LAXO Token exploit analysis
LAXO Token's `_burn(_from, _value)` accepted a caller-supplied `_from`, and the attacker under-reported it to keep surplus tokens after the burn. DeFiHackLabs reconstructs the on-chain drain.
- Reported loss
- ~137,000 US$, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-02-22: Incorrect Burn Logic on LAXO Token”.
Analysis1 min read
LAXO Token's burn path accepted a _value from the caller and deducted it from the user's recorded balance, but the burn returned a _from balance that the caller could under-report. The attacker burned totalSupply, kept the surplus tokens, and walked the unbacked tokens out.
DeFiHackLabs reconstructs the sequence against the live BNB Chain state; total loss is captured in the PoC.
What would have prevented it: a burn path that pins _from to msg.sender rather than accepting a caller-supplied _from.
Other exploits
- Venus THE exploit analysis 15 Mar 2026
- AlkemiEarn exploit analysis 10 Mar 2026
- Curve LlamaLend exploit analysis 2 Mar 2026
- XDKRecycle exploit analysis 16 Feb 2026
- Moonwell February 2026 exploit analysis 15 Feb 2026
- Makina exploit analysis 20 Jan 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
