79th Vault

On October 7, 2026, the project team’s operational hot wallet, normally used only for small transfers to the reward pool, moved a total of about 2.01 million 79AU in seven transactions over roughly one hour (07:25 to 08:25 UTC), in amounts of 10,000, 100,000, 100,000, 300,000, 500,000, 500,000, and 500,000 tokens. The tokens were then sold back into the PancakeSwap trading pool through about 95 trades, yielding about 16,249 BNB, worth roughly $12.5 million at the time, while the pool’s USDT reserves fell from about $15.2 million to about $3.9 million.⁠[1][2][2]

Security firm GoPlus Security found that the 79AU contract contained a function callable only by a wallet holding the OPERATOR_ROLE permission, which could transfer tokens out of a chosen address and then synchronize the pool’s reserves. The role was assigned to the address that carried out seven privileged operations during the incident; no multisignature or time lock was used to manage the permission, and the contract’s source code was not verified on BscScan, making it hard for users to check the logic of the privileged function themselves. The operator permission was revoked after the attack.⁠[3][3][3]

The cause of the incident had not been determined: a private key leak could explain the operational wallet’s unusual activity, but researchers did not rule out insider access. GoPlus also noted that the on-chain message to the attacker mentioning “negotiations” was sent from the same privileged address used to drain the funds, and that the message did not prove the sender’s identity. The BNB obtained was consolidated into several addresses, one of which held about 14,395 BNB, and the attacker separately transferred 30 BNB to the KuCoin exchange. Through an on-chain message, the project offered a 10% reward if the funds were returned.⁠[3][3][3][3]

The project team announced a “system upgrade” on X, saying some front-end features and asset-related operations might be temporarily affected; an October 8 statement attributed the incident to weaknesses in account permission management.⁠[3][3][2]

On October 9, 2026, PeckShieldPeckShieldPeckShield is a blockchain security company that provides smart contract audits, exchange and wallet security audits, on-chain fund tracking, and anti-money-laundering data services. In 2018 it disclosed integer overflow vulnerabilities in ERC-20 contracts such as batchOverflow, and it regularly publishes statistics on crypto industry hack losses and security incident monitoring.Open the full entry monitoring showed that the attacker had returned 15,000 BNB, worth about $11 million (another report estimated about $11.5 million at the time of the return), to a wallet address designated by the project team, roughly 92% of the 16,249 BNB swapped out; the status of the remaining funds was still unclear.⁠[1][1][2][2]

The same day, the project team posted a recovery update on X confirming that it had recovered 15,000 BNB from the attacker and sharing the on-chain transaction of the returned funds. The team said the recovered assets would be added back to the liquidity pool and the resulting LP tokens permanently burned, so that those tokens could not circulate or be used to claim the corresponding liquidity.⁠[2][2][2]

According to the project’s whitepaper, 79th Vault is a treasury-backed decentralized finance protocol built natively within the CocoCat ecosystem, providing a stability and value-preservation layer for decentralized markets through permanent liquidity, a closed-loop token reflection mechanism, and a multi-pool architecture; CocoCat is described as a peer-to-peer Web3 runtime that does not rely on centralized servers and only provides the access and distribution layer for 79th Vault. The “79” in the name comes from the atomic number of gold, and the “AU” in the token symbol $79AU comes from Au, the chemical symbol for gold. The whitepaper says it only describes architecture and mechanisms and does not promise investment returns.⁠[4][4][4][4][4]

According to the whitepaper, $79AU has an original maximum supply of 210 million tokens and an initial issue price of 0.0238 USDT, with a final target of only 21,000 tokens remaining after burns. The initial allocation is 20% to the DEX pool, 40% to the reward pool used to distribute protocol rewards, and 20% to the Defense Pool, with another 20% set aside for a 1:1 exchange airdrop to the CocoCat community. Every 12 hours, the system tallies the $79AU sold on the DEX and routes 60% of the sold volume to the reward pool, 15% to the Operations Pool, and 5% to buying back and burning $CAT, with the first two released linearly over 10 days; the contract automatically applies a 3.25% slippage on every sale.⁠[4][4][4][4][4][4][4][4][4][4]

The project uses what it calls a “System-Level Four-Pool Isolation Model,” separating the Staking Pool, the DEX liquidity pool, the reward pool responsible for dynamic reward distribution, and the Defense Pool holding treasury reserves; when the price falls in a disorderly way by 10%, the Defense Pool uses reserves to buy back tokens, aiming for a rebound of about 5%. The whitepaper’s risk section lists market, liquidity, smart contract and integration, governance parameter, and operational risks around OTC and LP operations, and says these rules do not eliminate risk.⁠[5][5][5][4][4][4][4]

79th Vault: Official website: https://79vault.com/ (opens in a new window).⁠[6]