79th Vault hack: 15,000 BNB went back, and the 1,249 BNB the attacker kept went into Tornado Cash

79th Vault said on 8 October that its token, 79AU, was attacked the day before through a weakness in account permission management: the attacker obtained the operator’s private key. GoPlus described the mechanics. The operator address, 0x019bD8ED017D11AF0eB24d28DCdd0f9930c85cA3, held a role that could move 79AU from any holder. Between 07:25 and 08:19 UTC on 7 October it made seven transfers, about 2.01 million 79AU out of the PancakeSwap pool, to 0xc3E90f78A918594a605d584887b2775F4b80A099. That wallet sold the tokens for USDT and then for BNB. PeckShield put the loss at 16,249 BNB, about $12.51 million, and later reported that 15,000 BNB had been returned.

Below is what happened to every BNB, read by us on 13 October 2026.

At 10:10 UTC on 7 October the selling wallet sent everything, 16,249.12 BNB, to 0x629B368c6BF1a9f190e38f21235033FEcE8A6231. Ten minutes later that wallet set 1,302 BNB aside on 0x1e2A669EC4E54E3960588B35ECa6a075F31216A3. In the afternoon it sent about 555 BNB in 27 payments of 10 to 50 BNB to addresses that had never been used before, and at 14:58 UTC it moved the rest, 14,394.92 BNB, to 0xa9537B40b02Af7Af8f1543aea3691992B2174F89.

The side wallet did the same on a smaller scale: 90 BNB in eight payments to fresh addresses the same morning.

On 9 October at 08:46 UTC the side wallet sent 912 BNB back to the holding wallet. That brought it to 15,306.9 BNB. Eight minutes later, at 08:54 UTC, the holding wallet sent exactly 15,000 BNB to 0x2BFcF0475e7B40cd68E91A7178Cf5E43262EB7b2.

The top-up is the detail that matters. The attacker did not return what happened to be left. They moved money back from a second wallet to reach a round number, which is what paying an agreed amount looks like. 79th Vault had publicly offered a settlement; we have not seen its terms, and the chain shows only the amounts.

The receiving wallet has since moved about 10,500 BNB through PancakeSwap and a swap aggregator. 4,000 BNB were still on it on 13 October.

The difference is 1,249.12 BNB, about $960,000 at the price of the day. It left in three ways.

Tornado Cash on BNB Chain, about 606 BNB. On 9 October, five hours after the return, the holding wallet paid 296.6 BNB into Tornado Cash in 41 deposits. On 10 October the side wallet paid in 309.8 BNB in 47 deposits. Both wallets are now empty.

One-time deposit addresses, about 645 BNB. The 35 fresh addresses were not wallets the attacker kept. Nineteen of them, with 475 BNB, are deposit addresses of a cross-chain swap service: each received BNB, the service’s contract swapped it to USDC in the next transaction and sent the USDC to the Relay bridge. Twelve more, with 130 BNB, were swept into one collector wallet of a service we have not identified. Three payments of 10 BNB went through one extra wallet each into three KuCoin deposit addresses, and one more reached the swap service the same way.

10 BNB sit untouched on 0x789012DCb83FC8460a8B01400656936B9233B935 since 8 October.

We followed one 15 BNB deposit all the way. On BNB Chain it became 11,427 USDC. The Relay bridge delivered 11,404 USDC on Ethereum to another one-time address, where the same service swapped it for ether and paid out 4.45 ETH.

The ether arrived on 0x4Cde5b334DB25c5817534f6664B25d9346810076. That wallet received four such payouts within four minutes on 7 October, 16.32 ETH in total. On 10 October, between 02:05 and 02:15 UTC, it paid 16.1 ETH into Tornado Cash on Ethereum in 17 deposits.

So for the part we could follow, both roads end in the same mixer. We could not resolve where the rest of the swap-service deposits were delivered: the service uses a new address for every deposit on both chains, and the bridge’s public records were not available to us for all of them.

Within minutes of each large transfer, strangers sent these wallets worthless tokens with amounts copied from the real transfers (15,000, 16,249.12) and zero-value transactions from addresses that begin and end with the same characters as the real counterparties. This is address poisoning, aimed at whoever copies an address from the history next. A token list or a transaction list for these wallets shows “15,000” going out four times. Only one of those is BNB.

We marked 10 addresses in our database as the attacker’s: the selling wallet, the three wallets that held the BNB, the wallet with the parked 10 BNB, four pass-through wallets and the Ethereum wallet. None of them was marked before. We did not mark the operator address, which belongs to the project and was used with a stolen key, the wallet that received the return, the deposit addresses of the swap service or of KuCoin, the bridge, or Tornado Cash.

KuCoin can identify who opened the three deposit addresses. To check an address yourself, use the address check.

It does not say who the attacker is, or whether the attacker was an outsider. It does not say that 79th Vault, KuCoin, Relay, the swap service or PancakeSwap did anything unlawful. The attack mechanics and the first addresses are GoPlus’s and PeckShield’s; the return was first reported by PeckShield. The accounting of the 16,249.12 BNB, the top-up before the return and the path of what was kept are ours, read on 13 October 2026.