Leaderboard
952All-time rank
C
CrowdRingCircle
Jul 16, 2026
$209K
Lost
$209K
Recovered
$0
Net loss
$209K
Unrecovered0% recovered
CrowdRingCircle's token contract allowed the pair's recorded reserves to desynchronize with actual balances by burning CRC directly from the pair address before calling sync(). An attacker exploited this to artificially inflate CRC's price and drain USDT from the PancakeSwap V2 CRC/USDT pool.
How the exploit worked
View reproducible PoCsell-destroy path burns CRC out of the pair on any non-exempt sell, collapsing the reserve so a follow-up swap drains the pool's USDT.
Lost: ~201.36K USDT
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Token & Share Accounting
- Technique
- Incorrect Share Accounting
- Attribution
- Unknown
- Chains
BSC
Event timeline
- Jul 16, 2026Exploit executed — $209K drained via incorrect share accounting
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)