79thVault (BNB): operator key pulled ~$12.5M from the pool; ~$11M returned
07 Oct 2026: The 79AU token's operator role can move tokens out of its PancakeSwap pool. 5M) left.
The team first posted a system-upgrade notice, then said an attacker obtained an operator private key through weak account-permission management and that a white-hat settlement was in play.
On 09 Oct, on-chain terms asked for 15,000 BNB back and let the other side keep the rest as a bounty; 15,000 BNB returned. Hack versus insider is still open (firms disagree; Defimon notes bounty messages also came from the operator key).
Operator role revoked per Defimon. Remaining ~1,249 BNB appears kept under those terms. Research snapshot from PeckShield, Defimon, CertiK, GoPlus, SlowMist Hacked, and team posts.
369 take
One hot key that can yank pool inventory is the whole pool. Prefer multisig plus a delay on any role that can move LP or reward stock. Treat it as a misused privileged key with a negotiated return.
Outside-hack versus insider is still open. Recovery of most funds is good for holders; it does not prove the access path.
Sources