79thVault $14.35M Exploit: Privileged Function Drained PancakeSwap Pool

In early October 2026 a PancakeSwap pool for the 79AU token lost $14.35 million in USDT after a project wallet used the OPERATOR_ROLE privileged function to move tokens out without buying them. Nine withdrawals to three addresses cut pool reserves from $15.2 million to $3.89 million, and the attacker consolidated about 14,395 BNB.

• 9 privileged withdrawals to 3 wallets caused a $14.35M loss
• Pool reserves fell from $15.2M to $3.89M in USDT
• OPERATOR_ROLE had no multisig or timelock protection
• Attacker holds ~14,395 BNB (~$11M) in one address