Hack history / 2026 / Hack or exploit
XPlayer_Media
Hack or exploit on Jan 28, 2026 · Burn mechanism exploit — attacker called the privileged DynamicBurnPool() function to burn XPL directly from the PancakeSwap V2 liquidity pair, reducing reserves to near-zero, then drained USDT
ONE SOURCE · 1 SOURCE
Lost
$717K
dollars at the time
Returned
none listed
as the sources state it
Rank
#1,009
among thefts by dollars lost
What happened
No description from DefiLlama or SlowMist; see the sources below.
Details
- Date
- Jan 28, 2026
- Kind
- Hack or exploit
- Method
- Burn mechanism exploit — attacker called the privileged DynamicBurnPool() function to burn XPL directly from the PancakeSwap V2 liquidity pair, reducing reserves to near-zero, then drained USDT
- How in
- Other
- Target
- DeFi protocol
- Chains
- BNB Chain
- Audit (ack3)
- unaudited
How sure: 0 of 4 checks what the checks mean
- Witnessesone source so far
- Same storyneeds a second source
- Blockchain receiptno public attack transaction checked
- Official wordno official statement linked
Who says what
Figure used: $717K, the figure ack3 H1 2026 dataset (CC BY 4.0) gives. Each source's own figure is in dollars at the time.
Cite this page
SwanBluechip, "XPlayer_Media hack, Jan 28, 2026: $717K lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/hta12afba600/ (data as of 2026-11-01).