The AIDC token on BNB Smart Chain lost about $121,000 after an attacker exploited a flaw in its burn mechanism and drained WBNB from its PancakeSwap liquidity pool.
Blockchain security firm SlowMist reported that the attacker extracted 220.12 WBNB, worth about $120,929 at the time of the incident. The affected pool was the PancakeSwap V2 AIDC/WBNB pair.
The vulnerability was found in the token’s _sellTransfer() function. Instead of deducting the 30% burn amount from the seller, the contract recorded the amount for later processing. A subsequent transfer could then trigger the burn against the liquidity pool’s AIDC balance.
🚨SlowMist TI Alert🚨
AIDC token on BSC has been exploited.
💸 Loss: 220.12 WBNB (~$120929.35)
🔍 Root Cause: AIDCToken’s `_sellTransfer()` accumulates a 30% burn amount without deducting it from the seller. Subsequently, any non-Pair transfer triggers… pic.twitter.com/EnutUjxcBY
— SlowMist (@SlowMist_Team) June 29, 2026
The burn mechanism became the attack path
The flaw created an unusual mismatch between the token’s accounting and the actual balances held by the pool.
Each affected sale recorded a 30% burn liability but did not remove those tokens from the seller’s balance. When the accumulated burn was later executed, the contract instead removed AIDC from the PancakeSwap pair.
The contract then called sync(), forcing the automated market maker to update its reserves. Because the AIDC balance fell while the WBNB reserve remained intact, the pool’s pricing relationship became distorted. The attacker could repeat the process and eventually swap AIDC for much of the pool’s WBNB.
The attack shows why custom tokenomics can create risks that are easy to miss during ordinary testing. The underlying BNB Smart Chain and PancakeSwap infrastructure was not itself compromised. The weakness was in the AIDC token contract’s logic.
Custom token features need extra scrutiny
Burn taxes and other automated token mechanisms are common in smaller DeFi projects, but they add extra accounting paths to otherwise standard token transfers.
In AIDC’s case, the burn was not simply a transfer from one wallet to a dead address. It was accumulated and executed later, with the liquidity pool becoming the unintended source of the tokens.
That distinction mattered because an AMM relies on accurate reserves to determine prices. Changing one reserve without a corresponding economic transaction can create an artificial price imbalance.
The incident is similar in one respect to other DeFi exploits covered by DeFi Planet, including the Curve Finance incident: the loss came from weaknesses in application-level logic rather than a failure of the underlying blockchain.
The lesson goes beyond AIDC
Security reviews need to test how token functions interact with external protocols, not just whether each function works independently.
For tokens with transfer taxes, burns, liquidity controls or automatic reserve updates, developers need to examine what happens when those functions interact with AMMs and routers. A mechanism that appears harmless during a normal transfer can have a very different effect when it changes an exchange’s reserves.
The AIDC incident also shows why a single audit should not be treated as proof that a contract is safe. Independent reviews, adversarial testing and monitoring after launch can help identify logic problems that conventional testing misses.
SlowMist published the vulnerable contract, affected liquidity pool and attacker information as part of its alert. Those details give other developers a useful case for testing whether similar burn-accounting patterns exist in their own contracts.
Enjoyed this? Bookmark DeFi Planet, explore related topics, and follow us on Twitter, LinkedIn, Facebook, Instagram, Threads, and CoinMarketCap Community for seamless access to high-quality industry insights
Take control of your crypto portfolio with DEFI PLANET PRO, DeFi Planet’s suite of analytics tools.
