79thVault Loses $12.5M in BNB to Compromised Operator Key

Operator Wallet Moves 2.01 Million 79AU in an Hour

79thVault, a vault protocol deployed on BNB Chain, lost an estimated $12.5 million on October 7 in an incident that security monitoring classifies as a private key compromise. The BNB price stood near $768 when the stolen tokens were converted, and the finding was made public on October 8 by the on-chain monitoring account Defimon Alerts, which published its incident breakdown on X. The post describes the mechanism precisely: the 79AU token contract carries a function callable only by addresses holding the OPERATOR_ROLE, a privileged administrative position. That function can move any quantity of 79AU straight out of the PancakeSwap 79AU pair to any address, then call sync() to refresh the pool's recorded reserves. Under normal operations, the team's hot wallet, whose address begins 0x019bd8ed, used this route only for small internal movements, shifting tokens from the pair into a rewards pool.

On October 7, between roughly 15:00 and 16:00 Taiwan time, equal to 07:00 to 08:00 UTC, that wallet's behavior changed. It split 2.01 million 79AU across seven transfers, sized at 10,000, 100,000, 100,000, 300,000, 500,000, 500,000 and 500,000 tokens, all drawn from the pair at an address beginning 0x02d50b93 and delivered to an attacker address beginning 0xc3e90f78. Our own on-chain review confirms the sequence: the first transaction in the set was broadcast at 07:25 UTC and ran from the operator wallet to the 79AU contract. Defimon's working assessment, still provisional, is that the attacker either controls the operational private key or is an insider, a determination based on the wallet's post-drain behavior. The $12.5 million figure remains an estimate derived from the BNB conversion, not an audited loss total.

Same Key, Revoked Role, 10% Bounty Offer

An automated market maker pair sets its price from the ratio of the two tokens it holds rather than from an order book, so pulling one side out mechanically inflates the quoted price of what remains. The attacker appears to have understood that design: after receiving the 2.01 million 79AU, address 0xc3e90f78 sold the tokens back into the same pair across roughly 95 transactions, extracting USDT on each pass. On-chain data shows the pair's USDT reserves fell from about $15.2 million to $3.9 million, a decline of roughly $11.3 million that left approximately a quarter of the original buffer in place. The extracted stablecoins were then converted into 16,249 BNB, valued near $12.5 million at the prevailing price, and forwarded to an address beginning 0x629b368c. That dollar weight also reflects where the asset trades, after BNB's climb toward $800 on an 11% September rally.

Two subsequent on-chain details sharpen the picture. Forty-one seconds after the BNB left, the operator private key itself sent 3.79 BNB to the same destination address, and a separate transfer of 500,000 79AU landed at another address beginning 0xf219d073. On-chain records further show the OPERATOR_ROLE privilege has since been revoked, closing the function that made the drain possible. A message posted on-chain in the project team's name offered the attacker a 10% bounty if the remaining 90% came back, and monitoring notes that this message, like the 3.79 BNB transfer, was signed with the same operational key. The drain also lands on a chain expanding its on-chain finance stack, one that has seen BNB Chain top $1 billion in tokenized stocks and ETFs. Vault products that automate execution, from yield aggregators to copy trading services, commonly rely on exactly this kind of concentrated operator privilege.

In our reading, the exploit needed no contract bug: the OPERATOR_ROLE function performed precisely as written, which shifts the failure from code to key management. A single hot wallet holding sweeping transfer rights is a custody pattern inherited from traditional finance treasuries rather than from DAO-style multisignature controls with timelocks, and it remains the weakest link on otherwise hardened chains. The bounty message cuts two ways, a genuine negotiation if the team still holds the key or a laundering step if the attacker does, and the shared signature evidence points to the latter. As of publication the $12.5 million estimate rests on a single on-chain reading at roughly $768 per BNB. What has not yet been counted includes the 500,000 79AU parked at 0xf219d073 and any proceeds the attacker has moved since.