A Well-Designed "Self-Detonation": Analysis of the PGNLZ Attack Incident
On January 27, 2026, an attacker executed a well-orchestrated exploit against the PGNLZ token on BNB Smart Chain, resulting in approximately $100k in losses. The attacker initiated a flash loan of 1,059 BTCB from Moolah Protocol, used it as collateral on Venus Protocol to borrow 30 million USDT, and then exchanged 23,337,952 USDT for 982,506 PGNLZ on PancakeSwap. These PGNLZ tokens were intentionally burned (sent to a dead address), drastically reducing the liquidity pool supply.
This manipulation caused the price of PGNLZ to surge from approximately $0.10 to over $5,528 per token. The attacker then invoked a fee-on-transfer function, triggering a built-in burn mechanism (_executeBurnFromLP) that further depleted the pool, leaving only a minuscule amount of PGNLZ and artificially inflating the price to an extreme 40 billion times its original value.
Finally, the attacker drained the liquidity pool, repaid the flash loan, and netted a significant profit. The root cause was identified as a flawed deflationary economic model with insufficient validation during fee processing and LP burns, allowing price manipulation. The incident underscores the importance of rigorous economic model design and multi-audit practices before contract deployment.
marsbit01/28 12:14
