79thVault Operator Key Compromise
An attacker used the 79thVault operator's leaked key to drain a 79AU PancakeSwap pool for ~$12.5M on BNB Chain; most funds were later returned.
Vuln-watch · relayed from a public source; see Source & attribution below
Summary
An attacker used the 79thVault operator's leaked key to drain a 79AU PancakeSwap pool for ~$12.5M on BNB Chain; most funds were later returned.
Incident
- Victim: 79thVault (79AU)
- Date (UTC): 2026-10-07
- Estimated loss: $12.5M
- Chain(s): BNB Chain
- Attack type: private key compromise
- Funds status: partially-recovered
Recommended actions
- If you use 79thVault (79AU), move funds to a fresh wallet with a new seed phrase once the vendor confirms the root cause
- Update the wallet software only from official sources
- Beware of follow-on phishing: ignore unofficial "refund", "recovery", or "claim" links and DMs; use the project's verified channels only
Source & attribution
Full analysis on Blockchain Breaches, 0xCERT's incident archive: https://www.blockchainbreaches.com/en/breaches/79thvault-2026. Primary sources: https://www.kucoin.com/news/flash/79thvault-hot-wallet-suspected-private-key-leak-causes-12-5m-loss ; https://www.kucoin.com/news/flash/79thvault-hacker-returns-15-000-bnb-worth-11-1m ; https://www.tokenpost.com/news/technology/28660 ; https://blockfence.io/79thvault-loses-12-5-million-as-privileged-wallet-drains-bnb-chain-liquidity-pool/.
References
- https://www.blockchainbreaches.com/en/breaches/79thvault-2026
- https://www.kucoin.com/news/flash/79thvault-hot-wallet-suspected-private-key-leak-causes-12-5m-loss
- https://www.kucoin.com/news/flash/79thvault-hacker-returns-15-000-bnb-worth-11-1m
- https://www.tokenpost.com/news/technology/28660
- https://blockfence.io/79thvault-loses-12-5-million-as-privileged-wallet-drains-bnb-chain-liquidity-pool/
Indicators of compromise
All IOC feeds →- address0x629b368c6bf1a9f190e38f21235033fece8a623179thVault attacker consolidation address, 16,249 BNB of proceeds (GoPlus Security analysis) · BNB Chain
- address0xa9537b40b02af7af8f1543aea3691992b2174f89Address holding ~14,394.92 BNB of 79thVault exploit proceeds (GoPlus Security analysis) · BNB Chain
- address0xc3e90f78a918594a605d584887b2775f4b80a09979thVault attacker: received 2.01M 79AU via seven privileged OPERATOR_ROLE calls (GoPlus Security analysis) · BNB Chain
OpenPGP-signed. The signed text of this advisory verifies against the 0xCERT key CCC7 D9EC 9415 723D.
Published 2026-10-07 · last updated 2026-10-20
curl -s https://www.0xcert.com/pgp.asc | gpg --import && curl -s https://www.0xcert.com/advisory/0xCERT-2026-0257/signed.txt | gpg --verify