Leaderboard
976All-time rank
L
LAXO
Feb 22, 2026
$190K
Lost
$190K
Recovered
$0
Net loss
$190K
Unrecovered0% recovered
LAXO token's flawed burn mechanism allowed an attacker to execute a burn-before-sync exploit via flash loans. By burning LAXO directly from the PancakeSwap pool without triggering a reserve sync, the attacker artificially collapsed pool reserves and extracted 487k USDT through manipulated swaps.
How the exploit worked
View reproducible PoCIncorrect Burn Logic.
Lost: ~137,000 US$
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Token & Share Accounting
- Technique
- Incorrect Share Accounting
- Attribution
- Unknown
- Chains
BSC
Event timeline
- Feb 22, 2026Exploit executed — $190K drained via incorrect share accounting
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)