The Illusion of Security: How a $14 Million Crypto Drain Bypassed "Locked" Liquidity

On October 7, a significant security breach struck the PancakeSwap liquidity pool for 79AU, the native token of 79thVault. Despite the project having "burned" a majority of its liquidity provider (LP) receipts—a move usually intended to signal a permanent lock on funds—attackers successfully drained $14.35 million in USDT. This incident highlights a sophisticated vulnerability where internal token permissions can effectively circumvent the standard safeguards of decentralized finance (DeFi).

The Mechanism of the Drain

The investigation by Bitquery revealed that while 79% of the pool’s LP receipts were burned to prevent redemption, a hidden permission within the 79AU token contract allowed for a different exploit. This specific permission enabled tokens to be removed from the pool without any associated payment. Once these tokens were extracted, they were sold back into the pool for USDT. By performing this "swap" rather than a "redemption," the attackers bypassed the need to hold or use the burned liquidity receipts, siphoning value directly from the underlying assets.

Technical Oversight and Contract Logic

The breach underscores a critical distinction in DeFi architecture: LP tokens are merely receipts representing a provider's share, separate from the actual assets being traded. PancakeSwap’s documentation confirms that while burning receipts prevents the removal of paired tokens through traditional means, it does not disable trading or rewrite the balance rules of the underlying token contracts. Because the 79AU contract maintained privileged address permissions, the attackers were able to manipulate the reserve-update operations, which read balances directly from the compromised token contract rather than the LP receipt ledger.

Residual Risks and Ongoing Exposure

Current data suggests that the threat to the 79AU pool has not entirely passed. A snapshot taken shortly after the drain identified two specific addresses—the original deployer and a newly authorized wallet—that still retain "pull-authorized" rights. Simulations indicate these addresses could potentially remove up to 95% of the remaining 79AU tokens. Furthermore, one wallet still holds the unburned 21% of LP receipts, granting it standard redemption rights and leaving the remaining liquidity in a precarious state.