CCC token exploit on BSC drains $117K

Security firm TenArmorAlert reported that the CCC token on Binance Smart Chain (BSC) was targeted in an exploit that resulted in an estimated loss of $117,000. The attacker used the contract’s sell() function to burn CCC tokens directly from the liquidity‑provider (LP) pair, triggering abnormal price movement.

How the attack unfolded

The monitoring system flagged suspicious activity on August 28. The alert identified a transaction beginning with 0x89d805064 that invoked the sell() function, causing a burn of CCC tokens held in the LP pool. By removing tokens from the pool, the attacker altered the token balances used for trading, which led to a sharp price deviation.

Impact and response

The estimated financial impact of the exploit is roughly $117,000. TenArmorAlert has not released a detailed post‑mortem, nor have they disclosed a fund‑recovery plan or any compensation for liquidity providers. Information about whether the CCC team has paused the contract or changed its permissions was not available at the time of reporting.

Context within BSC security incidents

Similar contract‑level attacks have affected other BSC projects this year, including:

• Swan Treasury – $625,000 loss via a compromised off‑chain signer.
• Balance Coin – $915,000 loss after minting unbacked tokens.
• Token of Power – $1.58 million loss from a Balancer pool governance takeover.
• DxSale – $7.3 million loss through a hidden backdoor.

These incidents illustrate a pattern of exploits that manipulate token contract functions to affect liquidity pools.

Technical parallels

The CCC exploit resembles the 2023 SafeMoon incident, where a public burn function allowed tokens from other addresses to be destroyed, impacting the liquidity pool. TenArmorAlert has not confirmed whether the CCC sell() function contained a similar permission flaw.