SOF token hack — February 2026

SOF, a token on BNB Chain sold with a mining scheme, lost 248,626 USDT from its PancakeSwap SOF/USDT pool on 14 February 2026, in a transaction at 08:45:28 UTC. CertiK published an analysis on 26 February that covered it together with an attack on the LAXO token eight days later, which used the same class of flaw.

According to CertiK, SOF's transfer logic burned the tokens being sold and synced the pool before the pool calculated how much USDT to pay. The attacker took flash loans worth more than $590m across several protocols and bought 991,223 SOF, leaving only 787 in the pool, then sold 875 SOF it had earned earlier as mining rewards. After the sell fee, exactly the 787 SOF left in the pool were burned, and the 875 SOF were exchanged for the pool's whole USDT balance.

This registry read the transaction's receipt: the pool lost 248,626.25 USDT and the attacker's address kept 225,936.44 USDT after repaying the loans. The pool's loss is recorded, with the attacker's net as the lower end. CertiK reported that about $213,600 of the proceeds was deposited at FixedFloat within half an hour and 20 BNB was sent to Tornado Cash.