The BNB Chain project 79thVault lost approximately $12.5 million after a privileged admin address was used without authorization, an incident affecting close to 10,000 holders and leaving a central question unanswered: was it a hack or an insider action?

Security firm GoPlus Security reviewed the case on-chain, tracing the movement of funds from the 79AU/USDT liquidity pair to the wallets where the proceeds now sit. Its analysis leaves two explanations open — a leaked operator key or insider activity. The project has not confirmed either, and its public statement mentioned only a system upgrade.

What the On-Chain Data Shows About the Operator Role

GoPlus Security outlined its findings in a post on X titled “Hack or insider? Security analysis of the $12.5M loss at 79thVault,” published on October 8, 2026. The firm said the 79AU contract has a function restricted to OPERATOR_ROLE. According to GoPlus, “centralized-control risk was high.”

Hack or insider? Security analysis of the $12.5M loss at 79thVault

BNB Chain project @79thVault lost about $12.5M after a privileged admin address was used without authorization. Close to 10,000 holders are affected. A leaked operator key and insider activity are both still… pic.twitter.com/eXIb3YwClW

— GoPlus Security (@GoPlusSecurity) October 8, 2026

On-chain calls show the restricted function can move 79AU from a chosen address to any recipient. In this incident, it pulled tokens from the 79AU/USDT pair and then called sync() to update the pair’s recorded reserves. GoPlus wrote that the “effect is backdoor-like.” The firm’s account of the function rests on observed on-chain calls; the contract’s source code remains unverified on BscScan, so there is no published code to compare against the observed behavior.

The OPERATOR_ROLE was held by address 0x019bD8ED017D11AF0eB24d28DCdd0f9930c85cA3. On the missing safeguards, GoPlus wrote: “No multisig. No timelock.” Multisig approval and timelocks are the standard safeguards for privileged contract roles — the first requires several key holders to approve a sensitive action, and the second delays execution long enough for users and monitoring services to react. Their absence left a single key with unilateral power over a function capable of moving 79AU from any address.

Between 07:25 and 08:19 UTC, that address executed seven privileged calls, all concentrated within roughly one hour. GoPlus listed a leaked operator key and an insider as the two possible sources behind the activity. The calls moved 2.01 million 79AU to 0xc3E90f78A918594a605d584887b2775F4b80A099, with individual transfers ranging from 10,000 to 500,000 tokens. The transfers coincided with a sharp rise in the 79AU price. The role was revoked after the incident.

Following the Funds

GoPlus traced the full path from the liquidity pair to the final wallets, reconstructing each step from on-chain records. The receiving address sold the 79AU into the pool and drained the USDT, then converted the proceeds into 16,249 BNB. Those funds were consolidated at 0x629B368c6BF1a9f190e38f21235033FEcE8A6231.

Several smaller transfers of 10 to 15 BNB each followed, and their purpose is unclear. Most of the funds now sit at 0xa9537B40b02Af7Af8f1543aea3691992B2174F89. That address holds 14,394.92 BNB, worth about $11.03 million, and GoPlus reported that no further movement has occurred yet — meaning the bulk of the proceeds remains stationary and traceable at a single address for now.

Why the Hack-or-Insider Question Remains Open

An on-chain bounty negotiation message adds another question: it was sent from the same privileged address used in the incident. According to GoPlus, using that address to communicate with an attacker “would be unusual.” The firm added that the message’s authenticity “is still in question.”

Meanwhile, the project’s own post on X described the event as a system upgrade — wording that GoPlus called “vague.” The project has not shared details on the suspected key compromise, the role-revocation transaction, or the loss breakdown. GoPlus said this limited disclosure “leaves open whether users have been given enough information.”

What remains unresolved is who used the privileged address and how its key was obtained. GoPlus’s findings establish the mechanics of the loss but stop short of attributing responsibility for the roughly $12.5 million in losses. From here, the markers to watch are observable on-chain: any movement of the 14,394.92 BNB held at 0xa9537B40b02Af7Af8f1543aea3691992B2174F89, verification of the 79AU contract’s source on BscScan, and whether the project discloses the details it has so far withheld.