Hack history / 2026 / Hack or exploit
Bonfire
Hack or exploit on Sep 15, 2026 · Improper Access Control
IN REVIEWSOURCES DISAGREE ON DATE OR LOSS · 3 SOURCES
Lost
$47K
sources: $47 to $50K
Returned
none listed
as the sources state it
Rank
#1,942
among thefts by dollars lost
What happened
BonfireSwap’s public transfer path accepted a caller-supplied token owner address and passed it as the from address to BONFIRE’s transferFrom without verifying that the caller was that owner or otherwise authorized by the owner. Because BONFIRE saw BonfireSwap itself as msg.sender, existing victim-to-BonfireSwap allowances authorized the transfers. The attacker repeatedly selected wallets with standing approvals, transferred their BONFIRE into the BONFIRE/WBNB PancakeSwap pair, and used the router’s public skim path to collect the resulting excess before selling the harvested BONFIRE for BNB. No private key, admin privilege, flash loan, or PancakeSwap invariant failure was required
In review: sources disagree on the loss.
Details
- Date
- Sep 15, 2026
- Kind
- Hack or exploit
- Method
- Improper Access Control
- How in
- Smart contract bug
- Target
- DeFi protocol
- Chains
- BNB Chain, Ethereum
Reported by
Related incidents
SUPERFORTUNE AI 2026 · Hack or exploit · $15.2M
Crypto DAO 2026 · Hack or exploit · $8.2M
Coinsbuy 2026 · Hack or exploit · $7.9M
New Market Trading 2026 · Hack or exploit · $4M
MANTRA Chain 2026 · Hack or exploit · $3.6M
Crypto DAO 2026 · Hack or exploit · $8.2M
Coinsbuy 2026 · Hack or exploit · $7.9M
New Market Trading 2026 · Hack or exploit · $4M
MANTRA Chain 2026 · Hack or exploit · $3.6M
Cite this page
SwanBluechip, "Bonfire hack, Sep 15, 2026: $47K lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/hte545ddf11f/ (data as of 2026-10-31).