Locked liquidity did not stop this $14 million crypto pool drain

AI refinement failed — excerpt only

The AI model was rate-limited when this draft was created. The text below is a raw excerpt of the source article; rewrite it before publishing.

The PancakeSwap pool for 79AU, 79thVault’s token, lost $14.35 million in USDT on Oct. 7 through two selling wallets, according to a Bitquery investigation published Oct. 8.

Bitquery found that 79% of the pool’s liquidity-provider receipts had been burned. But a permission inside 79AU let tokens leave the pool without payment. Those tokens were then sold back for USDT, bypassing the need to redeem a liquidity receipt.

PancakeSwap’s V2 documentation describes LP tokens as receipts representing a provider’s share of a pool. They are separate from the two assets traders exchange inside it.

The exchange’s liquidity guide describes ordinary redemption: a provider selects a share to remove and receives both paired tokens. Sending receipts to an inaccessible address prevents their redemption. It does not disable swaps, since trading exchanges the underlying assets without cashing in a liquidity position.

In PancakeSwap’s archived pair contract, separate operations handle LP redemption, swaps and updating recorded reserves to match token balances. The swap operation checks token input without consuming LP receipts. The reserve-update operation reads balances from the underlying token contracts. Burning LP receipts does not rewrite those contracts’ balance rules or revoke a privileged address’s token permissions.

At 12:53 UTC on Oct. 8, Bitquery identified two pull-authorized addresses: the deployer and a newly authorized wallet. Read-only simulations from either allowed removal of about 95% of the pool’s remaining 79AU. The read-only tests moved no funds.