-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0231
============================================================

Advisory-ID:  0xCERT-2026-0231
Severity:     Critical
Published:    2026-10-08T07:41:24.000Z
Updated:      2026-10-10T00:39:14.997Z
Chains:       BNB Chain
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0231

Title: 79th Vault (79AU) operator-key compromise drains about $12.5M from the 79AU/USDT pool on BNB Chain

Summary
- -------
On 7 Oct 2026 the 79th Vault operator key was used to move 2.01M 79AU out of the PancakeSwap 79AU/USDT pair and sell it, a loss of about $12.5M (16,249 BNB) per CertiK, Defimon and GoPlus. Do not interact with the attacker addresses listed; follow 79th Vault's official channels.

Details
- -------
Summary
On 7 October 2026 (about 07:25-08:19 UTC), the 79th Vault project (token 79AU, BNB Chain) lost about $12.5M. The 79AU token has an OPERATOR_ROLE-only function that moves 79AU out of the PancakeSwap 79AU/USDT pair to any address and then calls sync(). The operator hot wallet executed 7 such calls moving 2.01M 79AU to an attacker EOA, which sold them back into the pair (~95 swaps), draining the pair's USDT reserve from $15.2M to $3.9M, and cashed out 16,249 BNB (Defimon Alerts, GoPlus Security, CertiK Alert).

Affected
- - 79th Vault / 79AU token (BNB Chain), contract 0xc35ef0564751a27b468f791113c686c8eebaa9ca (source not verified on BscScan, per GoPlus)
- - PancakeSwap 79AU/USDT pair liquidity and 79AU holders
- - Fixed: OPERATOR_ROLE has since been revoked (Defimon, GoPlus); the project says emergency fixes and permission reviews have been applied

Impact
79th Vault states that the attacker obtained an operator's private key and used its privileges to withdraw tokens from the contract, then converted the proceeds to USDT and BNB. Defimon classifies it as a private key compromise and notes that 41 seconds after the cash-out the operator key sent its own 3.79 BNB to the same attacker address, so the attacker controls the key or it is insider activity; GoPlus likewise says a leaked key and insider activity both remain open. CertiK and GoPlus report that ~90% of the funds (about 14,394.92 BNB) were held at 0xa9537B40b02Af7Af8f1543aea3691992B2174F89 at the time of their analyses. The project says a white-hat settlement (10% bounty) was offered and discussions are ongoing.

Recommended actions
- - Do not send funds to, or accept funds from, the attacker addresses listed in this advisory
- - Exchanges and bridges: monitor and screen deposits from the listed attacker addresses
- - 79AU holders and LPs: follow 79th Vault's official channels only; ignore unofficial refund or claim links
- - Projects: avoid single-key privileged functions that can move pool balances; use multisig and timelocks for operator roles

Source & attribution
This 0xCERT advisory summarises alerts by CertiK Alert (https://x.com/CertiKAlert/status/2108114270559096916), Defimon Alerts (https://x.com/DefimonAlerts/status/2108100434942431441) and GoPlus Security (https://x.com/GoPlusSecurity/status/2108147742233284637), and the project's own statement (https://x.com/79thVault/status/2108244949963833685). Details may change; refer to the original sources for the authoritative record.

References
- ----------
- - https://x.com/DefimonAlerts/status/2108100434942431441
- - https://x.com/CertiKAlert/status/2108114270559096916
- - https://x.com/GoPlusSecurity/status/2108147742233284637
- - https://x.com/79thVault/status/2108244949963833685
- - https://hacked.slowmist.io/

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrPC9sJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmdHMLcfeGLeJce3e+MIPFzGRibeKXmLzP8DQvb+
bSmsxhYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAACZXQEAiPp1pnOCKfx2uuiu
uS5IZxyZ2vkTWjlRvCmEqYsbbIgA/2+F0vb0MRc7fzSmyIRVRjZHiNi4tucB
1NDDksUYxyEH
=siL/
-----END PGP SIGNATURE-----