79thVault Hacker Returns 15,000 BNB, 92% of Stolen $12.5M Loot
Published October 10, 2026, 04:15 PKT. Details from 79thVault's confirmation on X, reported by Cryptopolitan via TradingKey; return figures from TokenPost. Background on the October 7 attack from CertiK, Defimon Alerts and our earlier reporting.
The hacker who drained $12.5 million from 79thVault's 79AU liquidity pool on October 7 has returned 15,000 BNB, roughly 92% of the stolen funds, the DeFi project confirmed on X. The 79thVault team linked an onchain transaction showing the recovered coins, Cryptopolitan reported, and said the BNB will be put back into the project's liquidity pool, with the resulting LP tokens permanently burned. The returned stash is worth about $11 million at current BNB prices.
The returned 15,000 BNB
TokenPost reported that a wallet designated by the 79thVault team received the 15,000 BNB transfer. An additional 30 BNB was deposited into a KuCoin address, while the status of the remaining funds, about 1,219 BNB, was not immediately clear. The returned amount compares with an estimated loss of roughly $12.5 million, TokenPost said. Recoveries of this scale are rare: stolen crypto almost never comes back once it leaves the attacker's wallet, TradingKey noted.
How the $12.5M drain happened
The attack began on October 7, when an operator wallet pulled 2.01 million 79AU tokens out of the project's PancakeSwap pool across seven transactions between 07:25 and 08:25 UTC, according to onchain data. The perpetrator then sold the tokens back into the pool through roughly 95 trades, draining the pool's USDT reserves from about $15.2 million to $3.9 million. The sale generated about 16,249 BNB, worth around $12.5 million, TradingKey reported. In its October 8 statement, 79thVault blamed "weaknesses in account permission management". Reports noted that the 79AU contract held an OPERATOR_ROLE function capable of moving tokens out of the pool and rewriting its reserves, and that the permission was revoked afterward. Security monitors including Defimon Alerts and GoPlus have characterized the incident as a suspected private-key compromise, possibly an insider action.
The 10% bounty that preceded the return
After the incident, 79thVault sent an onchain message to the attacker's address offering a 10% bounty in exchange for the remaining funds, EtherWorld reported. The return of 15,000 BNB, far above what the bounty offered, arrived without explanation from the attacker. Similar returns have happened twice in the past two weeks, TradingKey noted: the NEAR Intents attacker sent back the entire $3.8 million stolen about a day after general manager Alex Shevchenko posted the attacker's wallet addresses alongside a 48-hour ultimatum. Recoveries are far harder when state-linked actors are involved: Bitget CEO Gracy Chen has said she is "not very optimistic" about recovering the $388 million stolen from her exchange, pointing to the February 2025 Bybit hack, where only about 3.5% of roughly $1.5 billion was ever frozen.
This article is news reporting and is not investment advice.
Sources
- 79thVault confirmation on X, via Cryptopolitan/TradingKey, 79thVault claws back 92% of stolen BNB as Bitget doubts $388M return (Oct. 9, 2026), primary source
- TokenPost, 79thVault Hot Wallet Receives 15,000 BNB Worth About $11 Million (Oct. 9, 2026), secondary source
- EtherWorld, 79thVault Loses $12.5M in 79AU Hot Wallet Hack (Oct. 9, 2026), secondary source
MABOnChain Daily Brief
The key crypto and markets stories in one short, plain-language email. Free. Unsubscribe any time.
Prefer chat? Join us on Telegram
Keep reading
France Logs 90 Violent Crypto Attacks in Seven Months, Interior Ministry Data Shows
French authorities recorded 90 cases of kidnapping, abduction, extortion, threats and violent theft tied to cryptocurrency from January to mid-August 2026, figures the Interior Ministry provided to Cointelegraph, with 223 arrests and 126 imprisonments. Chainalysis says a major data breach likely fueled the surge, and more than 40% of French victims were relatives or acquaintances of crypto holders.
Ledger Investigates $86M Crypto Drain Tied to Southeast Asian Reseller CryptoBilis
Hardware wallet maker Ledger is investigating reports of fund losses from users in Southeast Asia who bought devices from authorized reseller CryptoBilis, which the company told to halt sales and shipments. Onchain investigators estimate suspected thefts of $72 million to more than $86 million across Bitcoin, Ethereum and Tron, while Ledger says its own security systems were not compromised.
79thVault Loses $12.5M as Compromised Operator Key Drains 79AU Liquidity Pool
79thVault lost about $12.5 million when an operator wallet pulled 2.01 million 79AU tokens out of its PancakeSwap liquidity pool across seven transactions on October 7 and sold them back into the pool, draining USDT reserves from $15.2 million to $3.9 million. Security monitors flagged a suspected private-key compromise, possibly an insider action, and the team offered a 10% onchain bounty.