An attacker drained an estimated $117,000 from the CCC token on BNB Smart Chain on Aug. 28 after manipulating the contract's sell() function to burn tokens held in its liquidity pool, according to blockchain security firm TenArmorAlert.
Key Takeaways
CCC suffered an estimated $117,000 exploit on BSC after an attacker targeted the token contract's sell() function
TenArmorAlert said the function burned CCC tokens from the LP pair, causing abnormal price movement
No post-mortem, fund recovery plan, or compensation proposal has been announced
The incident follows a string of BSC token exploits in recent months
Attacker Manipulated sell() Function to Burn LP Tokens
According to TenArmorAlert, its monitoring system detected suspicious activity involving CCC on BSC on Aug. 28 and traced the incident to the token contract's sell() function. The firm said the function was used to burn CCC tokens directly from the liquidity provider pair, which was followed by abnormal movement in the token's price. TenArmorAlert estimated losses from the attack at roughly $117,000 and identified an attack transaction beginning with 0x89d805064 in its security alert.
The available information does not identify how the attacker obtained the ability to trigger the affected function, whether access controls were bypassed, or whether another contract interaction was required before the tokens could be burned. This exploit follows other recent BNB Chain security incidents, including the Moonwell MAMO exploit that drained $8.7M from Base earlier this week.
BSC Token Exploits Pattern Continues in 2026
The CCC incident follows several attacks involving token contracts and liquidity infrastructure on BNB Chain this year. In July, Swan Treasury lost $625,000 after attackers obtained an off-chain signer key used by its ZhaiquanBuy contract. Balance Coin fell more than 99% after security firms linked two suspicious transactions to an estimated $915,000 attack involving 42DAO. The mechanics described by TenArmorAlert bear similarities to the SafeMoon exploit in March 2023, where an attacker exploited a public burn function to burn tokens belonging to other addresses. That vulnerability had been introduced through a project upgrade and was used against the protocol's liquidity pool. This pattern of attacks highlights the ongoing risks in DeFi, as seen with the Term Finance Meta Vaults attack earlier this month.
No Recovery Plan Announced
TenArmorAlert has not disclosed the full attack sequence or explained how the attacker was able to trigger the affected function. No detailed post-mortem, fund recovery plan, or compensation proposal had been announced at the time of the alert. The security firm did not name the decentralized exchange hosting the LP pair or provide a full breakdown of the assets removed. The CCC team has not publicly confirmed whether the affected contract has been paused or its permissions changed.
