79thVault: operator role drained the 79AU/USDT pool

$12.5M (16,249 BNB), per Defimon; 16.249K BNB (~$12.51M), per PeckShield.

Root cause: Per Defimon: 'Private Key Compromise' of the operator hot wallet holding OPERATOR_ROLE, which can move any amount of 79AU out of the pair and call sync(). No project statement found.

Timeline, as sourced: Linked transfer 7 Oct 2026 07:25:23 UTC (on-chain); transfers 07:27 to 08:19 UTC (per Defimon); Defimon alert 8 Oct 07:41 UTC; PeckShield alert 8 Oct 09:53 UTC.

On 7 October 2026 the 79AU/USDT pool on PancakeSwap was emptied through the token's own operator function. According to Defimon (opens in a new tab), 79AU has an OPERATOR_ROLE-only function that moves any amount of 79AU out of the pair to any address and then calls sync(). The team's operator hot wallet, normally used for small transfers to a reward pool, sent seven transfers totalling 2.01M 79AU from the pair to the attacker, who sold them back into the pool in about 95 swaps; Defimon says the pool's USDT reserve fell from $15.2M to $3.9M and the attacker cashed out 16,249 BNB. The linked transfer (opens in a new tab) was sent from the operator address (on-chain). Defimon notes that 41 seconds after the cash-out the operator key sent its own BNB to the attacker's address, concluding that the attacker controls the key or is an insider, and that OPERATOR_ROLE has since been revoked. PeckShield (opens in a new tab) reports 10K 79AU drained and swapped for 16.249K BNB, about $12.51M, and a 30 BNB deposit to KuCoin. No statement from 79thVault was found.