BFB's "Safety" Burns Its Own Bag 🥞

An attacker drained roughly 396.43 BNB (approximately $226,000) from a BFB token liquidity pool on BNB Chain by weaponizing the token's own price-defense mechanism, blockchain investigators reported. The exploit targeted a logical flaw in BFBToken's _priceDeflPool() function rather than the underlying PancakeSwap pool, leaving a trail of zero-value transferFrom() calls that triggered mass token burns and collapsed the pool's reserves.

Investigators traced the attack sequence across roughly 151 repeated iterations. In each cycle, a zero-value transferFrom() call between externally owned accounts (EOAs) activated _priceDeflPool(), causing the contract to burn 5% of the BFB tokens held in the PancakeSwap liquidity pool and immediately call sync() to update reserves. After the BFB reserve was nearly exhausted, the attacker swapped a small amount of BFB for nearly all the BNB in the pool. Initial gas fees were funded through Railgun, a privacy protocol that obscures transaction origins.

The stolen BFB was converted into BNB and remains parked at wallet 0x3BFA…6b0F, which investigators continue to monitor for outgoing transfers. Investigators identified the logical flaw in BFBToken's price-defense mechanism as the root cause. The technique combined liquidity pool draining, Automated Market Maker (AMM) reserve manipulation, flash loans, logic exploitation, zero-value transaction abuse, and repeated execution.

The incident adds to a record-setting first half of 2026 tracked by TRM Labs, which logged 207 security breaches, though total losses fell sharply to $972 million, less than half the $2.3 billion stolen during the same period in 2025. The BFB exploit came shortly after Polymarket's recent phishing incident, where attackers compromised the frontend and manipulated what users viewed and signed, and followed Summer.fi's post-mortem showing attackers spent about three months preparing the $6.04 million Lazy Summer Protocol exploit before execution.