BYToken exploit analysis
BYToken's permissionless `triggerAutoBurn` collapsed the BY reserve to near-zero once the attacker met the trading threshold, letting a tiny BY swap drain the entire WBNB side. DeFiHackLabs reconstructs about 146.60 WBNB drained.
- Reported loss
- ~$87,402 (146.60 WBNB), per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-06-04: Permissionless Triggerautoburn Reserve Manipulation on BYToken”.
Analysis1 min read
BYToken's triggerAutoBurn is a permissionless function designed to keep the BY/WBNB Pancake pair's reserve in a healthy range once enough WBNB-side liquidity is added. The attacker cornered BY supply via router swaps, donated WBNB to trigger the trading threshold, and called triggerAutoBurn to crash BY's reserve to a near-zero, then sold a tiny BY amount to drain the entire WBNB side.
DeFiHackLabs reconstructs the sequence against the live BNB Chain state; loss about 146.60 WBNB (~$87,402).
What would have prevented it: an auto-burn that ignores off-pair transfers and a per-block trigger cooldown. The defence is in flow shape: an attacker should not be able to make auto-burn benefit themselves.
Other exploits
- AISOTHPresale exploit analysis 5 Jun 2026
- DTXT exploit analysis 5 Jun 2026
- ATM Token exploit analysis 4 Jun 2026
- The Kiss exploit analysis 2 Jun 2026
- AROS exploit analysis 30 May 2026
- Gravity Bridge exploit analysis $5.4M
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
