LAXO token hack — February 2026

LAXO, a token on BNB Chain, lost about $190,500 from its PancakeSwap LAXO/USDT pool on 22 February 2026, in four transactions by three addresses between 15:32 and 15:46 UTC. CertiK analysed it together with the SOF exploit of 14 February, which used the same class of flaw.

According to CertiK, when LAXO was sent to the pool the token contract took a sell fee, burned the rest of the transferred amount and synced the pool before the pool worked out the USDT owed. The first attacker borrowed 350,000 USDT, bought about 43.2m LAXO, routed them back to itself through an add-and-remove-liquidity step that avoided the fee, then sold into the pool: 41.1m LAXO were burned, the pool's LAXO fell from about 54m to 13m, and the sale was priced against the depleted reserve. Two other addresses repeated the attack within 13 minutes.

By CertiK's count the attackers kept 190,540 USDT: 137,320 and 45,061 USDT from the first attacker's two transactions, 6,974 USDT for the second and 1,185 USDT for the third. This registry read the first transaction: the pool paid out a net 263,903.60 USDT, of which 137,320.18 went to the attacker's contract and 126,408.42 was sold out of the pool by the token's own fee mechanism and sent to two fee wallets. The attackers' 190,540 USDT is recorded, with the pool's net outflow across the four transactions, about 354,336 USDT, as the upper end.