79thVault: A $12.5M Drain Through Its Own Master Key, Then 92% Came Back

At 07:25 UTC on Wednesday 7 October 2026, a wallet that belonged to the people running 79thVault started taking money out of 79thVault. Within the hour it had made seven withdrawals, and the project's main trading pool, which had held about $15.2 million in digital dollars that morning, was soon down to about $3.9 million.

The proceeds were swapped into 16,249 BNB, the native coin of BNB Chain, worth about $12.5 million at roughly $768 a coin. Two days later, on 9 October, PeckShield, a blockchain security firm, reported that 15,000 BNB (about $11 million) had been sent back to a wallet chosen by the 79thVault team. That is about 92 per cent of the haul. Around 1,249 BNB, close to $960,000 at the day's price, is still out, including 30 BNB that went to the KuCoin exchange before the return.

The money came back. The question of who took it did not.

What 79thVault is

79thVault, also written 79th Vault, is a small decentralised finance project on BNB Chain, the blockchain run alongside the Binance exchange. Decentralised finance, or DeFi, means financial services run by smart contracts, code that moves money by itself without a bank or broker in the middle. Its token is 79AU. "Au" is the chemical symbol for gold and 79 is gold's atomic number, and the project's own material describes a system "chiefly anchored by gold reserves". IQ.wiki, a crypto encyclopedia, repeats that claim but gives no figure for the reserves, no custodian and no audit. 79AU is not a gold-backed token in the way a gold exchange-traded fund is backed by bars in a vault. It is the project's governance and reward token, used for staking, rewards and an automatic buyback scheme meant to support its price.

The project says it was founded in 2026. It is not to be confused with AU79, a separate gold-themed token on the Solana blockchain. GoPlus Security, a crypto safety firm, put the number of affected 79AU holders at close to 10,000.

The till and the master key

Most 79AU trading happened in a liquidity pool on PancakeSwap, the largest trading app on BNB Chain. A liquidity pool is a shop's till that holds two things: in this case 79AU tokens and USDT, a stablecoin that works as a digital dollar. Anyone can trade against the till. Buyers put dollars in and take tokens out; sellers do the reverse. There is no order book. The price is simply the ratio of what is in the till, so if the stock of tokens shrinks while the dollars stay put, each token is suddenly worth more dollars.

The 79AU contract carried a special permission called OPERATOR_ROLE, which works like a staff master key. According to analyses by GoPlus Security, Defimon Alerts and The Crypto Times, a function reserved for that role could move any amount of 79AU from a set address, including the PancakeSwap pool, to any recipient. It then called sync(), a standard command that tells the pool to recount what is in the till and reset its prices to match. The contract's source code was not verified on BscScan, the public BNB Chain explorer, so outsiders could not easily read what the key could do. GoPlus summed up the controls in four words: "No multisig. No timelock." A multisig would have needed several people to approve a move, like a cheque needing two signatures. A timelock would have forced a waiting period before any change, giving holders time to see it coming.

How the hour went

©CMZ chart. Data: TokenPost, The Crypto Times

The operator address, beginning 0x019bD8ED, made seven calls in a row between 07:25 and about 08:20 UTC. Each one lifted between 10,000 and 500,000 79AU straight out of the pool and sent them to an address beginning 0xc3E90f78, about 2.01 million tokens in all. No one paid for them. Because the till now held far fewer tokens against the same pile of dollars, the 79AU price jumped. The team later called this "a short-term abnormal price increase".

The receiving wallet then sold the same tokens back into the pool at the inflated price, in about 95 separate trades, and walked away with the dollars. In shop terms, someone with a staff key took stock off the shelf for free, told the till it had less stock so prices went up, then sold the stock back to the till at the new price and emptied the cash drawer. The dollars were swapped into 16,249 BNB and gathered at one address. Forty-one seconds after the main transfer, the operator wallet itself sent another 3.79 BNB to the same place.

That small payment is why Defimon Alerts classified the event as a "suspected private-key compromise or possible insider activity". CertiK, another security firm, flagged it as a suspected exploit through a privileged function. Bitquery, an on-chain data company, later counted nine privileged withdrawals across three recipient wallets, about 2.52 million 79AU in total, including a separate batch of 500,000 tokens that a second wallet sat on for about five hours before selling for roughly $1.75 million. On that count about $14.35 million in dollars left the pool and the sales produced about 17,881 BNB. The project has not said which set of figures is right.

The excuse, the offer and the return

©CMZ chart. Data: PeckShield, TokenPost, Crypto Economy

On 8 October 79thVault posted on X about a "system upgrade" and warned that "some front-end features and asset-related operations may be temporarily affected". It did not use the word hack. GoPlus called the wording vague. A fuller statement followed, reported by Odaily: the attack happened "due to account permission management vulnerabilities", the attacker had "obtained the operator's private key", emergency fixes and permission reviews were complete, the attacker's addresses had been identified, and the team had offered a white-hat settlement under its bug bounty framework. A white-hat settlement is a deal in which the taker returns most of the money, keeps a cut as a reward and is not pursued.

The offer itself arrived as an on-chain message proposing a 10 per cent bounty. Oddly, it was sent from the same operator address that had done the draining. GoPlus said using that address to talk to an attacker "would be unusual" and questioned whether the message was genuine. Reports compiled by CoinAlertNews said the holder of most of the BNB answered by asking to keep 25 per cent and for legal action to be dropped. The team said the attacker had responded and talks were ongoing.

On 9 October the team posted: "We have successfully recovered 15,000 BNB from the attacker involved in the recent exploit." PeckShield confirmed the transfer. Measured against 16,249 BNB, the attacker kept about 7.7 per cent, close to the 10 per cent first offered. Measured against Bitquery's 17,881 BNB, the return is about 84 per cent and the gap is nearer 2,900 BNB. No final settlement terms have been published, nobody has been named, and no police report has been mentioned.