BCE token hack — March 2026

BCE, a deflationary token on BNB Chain, lost 800,009 USDT from its PancakeSwap BCE/USDT pool on 23 March 2026, in a transaction at 05:59:13 UTC. Defimon Alerts reported it the same day, estimating the pool's liquidity before the attack at $1.6m.

According to Defimon and a DeFiHackLabs reconstruction, BCE recorded a "scheduled destruction" amount whenever tokens were sold into the pool, and on the next ordinary transfer it burned that amount directly from the pool and synced the pool's reserves. The attacker funded itself with flash loans from the Moolah lending protocol and borrowings from Venus, built up a large scheduled destruction through two flash swaps, triggered the burn so that the pool was left with almost no BCE, and sold its remaining BCE for the pool's USDT.

This registry read the receipt. The pool lost 800,009.32 USDT; the attacker's address kept 680,007.93 USDT, and 120,001.40 USDT was converted into 189.8 BNB and paid out of the attack contract, a payment of about 15% of the gross profit that DeFiHackLabs also reproduces. The pool's loss is recorded, with the attacker's net as the lower end. No statement from the project has been found.