Privileged Token Permission Drained $14.35 Million From 79AU Pool

A token-level permission enabled the removal of $14.35 million in USDT from 79thVault’s 79AU pool on PancakeSwap on Oct. 7, despite most liquidity receipts being inaccessible.

Nine transfers removed about $2.52 million worth of 79AU from the pool without payment. Two wallets then sold the tokens back into the pool for USDT, with the first sales occurring between 3:25 a.m. and 4:19 a.m. ET (07:25–08:19 UTC).

USDT reserves fell from roughly $15.2 million before the drain to about $3.89 million after the first wallet sold the tokens. The revised $14.35 million loss includes both sellers; an earlier estimate of about $12.5 million excluded one of them.

Roughly one-fifth of the liquidity-provider receipts remained in a wallet, while the other 79% had been transferred to an inaccessible address. At 8:53 a.m. ET (12:53 UTC) on Oct. 8, read-only tests indicated that two wallets could still pull about 95% of the remaining 79AU. The tests moved no funds.

Liquidity-provider receipts normally represent a holder’s share of a pool and allow withdrawals of its underlying assets. Burning or locking those receipts can block ordinary redemption but does not necessarily revoke transfer permissions embedded in a token contract.