Security

AIDC Token Exploit Drains ~$120,900 From BNB Chain Liquidity Pool

Blockchain security firm SlowMist has confirmed that the AIDC token on BNB Smart Chain was exploited after a flaw in its smart contract burn logic exposed a liquidity pool. The incident resulted in the drainage of approximately 220.12 WBNB, valued at roughly $120,900.

According to SlowMist’s technical breakdown, the vulnerability originated in the _sellTransfer() function of the AIDCToken contract. The code accumulated a 30% burn requirement without properly deducting those tokens from the seller’s balance.

When a subsequent non-pair transfer was triggered, the contract incorrectly routed the burn command toward the liquidity pool address instead of the seller’s wallet. The contract then automatically executed a sync() call, which forcibly reduced the recorded AIDC token reserves within the pair.

That reserve distortion allowed the attacker to manipulate pricing before repeatedly withdrawing WBNB. On-chain tracking data reviewed by security firm TenArmor indicated the attacker moved the extracted funds through more than 180 automated transfers across intermediate wallets before consolidating the assets. Available reporting emphasized that the flaw was isolated to the AIDC token contract itself and did not compromise PancakeSwap’s core infrastructure or router logic.

The AIDC team has acknowledged the incident and signaled that patch work is in progress. Available sources do not yet show a published mitigation plan, audit verification or official timeline for pool recovery. The exact scope of broader user exposure and whether additional contract upgrades will be required remain pending formal confirmation from the protocol.