PancakeSwap LP (2026) — Crypto Hack
ConfirmedA PancakeSwap liquidity provider signed a malicious EIP-7702 authorization, allowing ~$1.48M BSC-USD and ~$1.48M BUSD to be removed. The BUSD was swapped to ETH and ~$1.46M was deposited to Tornado Cash.
Summary
A PancakeSwap liquidity provider signed a malicious EIP-7702 authorization, allowing ~$1.48M BSC-USD and ~$1.48M BUSD to be removed. The BUSD was swapped to ETH and ~$1.46M was deposited to Tornado Cash.
How It Was Compromised — DeFi via Malicious EIP-7702 Authorization
On July 23, 2026, a PancakeSwap liquidity provider signed a malicious EIP-7702 authorization, granting an attacker control over their position. The attacker removed approximately $1.48M in BSC-USD and $1.48M in BUSD from the LP position. The BUSD was swapped to ETH, and approximately $1.46M was subsequently deposited into the Tornado Cash mixer.
Fund Flow & Laundering Analysis
The stolen BUSD was swapped to ETH and approximately $1.46M was deposited into the Tornado Cash mixer to obscure the trail.