SQ staking (BNB Chain) hack — May 2026
Incident facts
| Date of incident | |
|---|---|
| Publicly disclosed | May 13, 2026 |
| Target type | Token contract |
| Loss | $346,137Price at time of incident |
| Method | Access control flawA hardcoded owner bypass in the verified SQ Staking contract let the attacker take ownership, set the staking period to zero, mint itself staking claims and redeem them for the contract's USDT |
| Chains | BNB Chain |
| Outcome | Unresolved |
What happened
SQ, a staking protocol on BNB Chain, lost 346,137 USDT on 12 May 2026, in a transaction at 10:11:11 UTC, as the security researcher Defi Nerd reported the next day.
According to Defi Nerd and a DeFiHackLabs reconstruction, the verified Staking contract contained a hardcoded owner bypass. The attacker sent an EIP-7702 transaction that ran helper code from its own address, used the bypass to take ownership, set the staking period to zero, minted itself 388,100 staking claims and redeemed them for the USDT the contract held.
This registry read the receipt: 346,137.03 USDT left the contract for the attacker's address. A hardcoded owner bypass points to a deliberate backdoor, but nobody has established who placed it, and no statement from the project has been found.
Sources
- Defi Nerd on XSecondary · retrieved 2026-10-06
- DeFiHackLabs exploit reconstructionSecondary · retrieved 2026-10-06
- BNB Chain transaction receipt, read by this registryOn-chain · retrieved 2026-10-06
Changes to this entry
- Recorded on 6 October 2026 in a backfill of 2026 incidents that this registry had missed, found through DeFiHackLabs' reproduction list. The amount was checked against the transaction receipt, read by this registry from a public node.
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "SQ staking (BNB Chain) hack — May 2026", iTokenly, accessed 2026-10-06, https://itokenly.com/hacks/sq-token-staking-bsc-may-2026https://itokenly.com/hacks/sq-token-staking-bsc-may-2026Permalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.