GoPlus Security 🚦 (@GoPlusSecurity): 🥷 Hack or insider? Security analysis of the $12.5M loss at 79thVault

🥷 Hack or insider? Security analysis of the $12.5M loss at 79thVault BNB Chain project @79thVault lost about $12.5M after a privileged admin address was used without authorization. Close to 10,000 holders are affected. A leaked operator key and insider activity are both still open. 1. Root cause — privileged function + operator key compromise (or an insider) The 79AU contract has a function restricted to `OPERATOR_ROLE` (selector `0x2a2c5923`; source unverified on BscScan). On-chain calls show it can move $79AU from a chosen address — this time the 79AU/USDT pair — to any recipient, then call `sync()` to update the pair’s recorded reserves. Effect is backdoor-like. https://bscscan.com/address/0xc35ef0564751a27b468f791113c686c8eebaa9ca 2. Key leak, or insider? `OPERATOR_ROLE` was held by `0x019bD8ED017D11AF0eB24d28DCdd0f9930c85cA3`. No multisig. No timelock. In the incident window (UTC 07:25–08:19, almost an hour) that address executed 7 privileged calls and moved 2.01M $79AU (10K / 100K / 100K / 300K / 500K / 500K / 500K) to `0xc3E90f78A918594a605d584887b2775F4b80A099`. The transfers coincided with a sharp spike in the $79AU price. The role was revoked after the incident. 3. Fund flow The receiving address sold the $79AU into the pool and drained the USDT, then converted the proceeds to 16,249 BNB and consolidated them to `0x629B368c6BF1a9f190e38f21235033FEcE8A6231`. Aside from several smaller transfers of 10–15 BNB each, purpose still unclear, most of the funds now sit at `0xa9537B40b02Af7Af8f1543aea3691992B2174F89` — 14,394.92 BNB (~$11.03M). No further movement yet. 4. Points in question The contract is not open-sourced, and it contains a privileged function with backdoor-like effect. Centralized-control risk was high. The on-chain “bounty negotiation” message was sent from the same privileged address involved in the incident. Using that address to talk to an attacker would be unusual, and the message’s authenticity is still in question: https://bscscan.com/tx/0x09f02313958d5761671c53fdea48700d2128c41f633aa12a7cf00ebf9cba2344 The project’s X post only called it a vague “system upgrade.” No detailed note yet on the suspected key compromise, the role-revocation tx, or the loss breakdown. That limited disclosure leaves open whether users have been given enough information. https://x.com/79thVault/status/2108023747240411244