Digital Asset
Intelligence
Security Incident · BSC Ecosystem

BYToken Smart Contract Vulnerability: $87.40K Reported Loss

·Historical incident record

Incident Overview

The public triggerAutoBurn() maintenance function in BYToken contract on BSC was abused. The attacker took a Moolah flashloan (~422k WBNB), performed Pancake swaps, then called the unprivileged function. This burned ~67.8 quadrillion BY directly from the BY/WBNB pair and called pair.sync(), rewriting reserves to 1 BY + full WBNB. The extreme skew allowed massive BY sells to drain nearly all WBNB liquidity, netting the attacker ~146.60 BNB ($87,402).

Sources & References

Original incident referencehttps://x.com/TenArmorAlert/status/2062708160700322257 (opens in a new tab)

This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.

More Security Incidents

View All →
  1. Incident date
    Target

    ATM

    Attack methodSmart Contract Vulnerability
    Reported loss$ 243,500
  2. Incident date
    Attack methodBusiness Logic Vulnerability
    Reported loss$ 35,041
  3. Incident date
    Target

    ApeBond

    Attack methodSmart Contract Vulnerability
    Reported loss$ 3,421
  4. Incident date
    Target

    AROS

    Attack methodSmart Contract Vulnerability
    Reported loss$ 295,300
  5. Incident date
    Target

    YSDAO

    Attack methodReserve Manipulation Attack
    Reported loss$ 19,500