A flaw in the buy limit system for the MT token on the BSC chain let a hacker make off with around $

BlockSec Flags $242K Exploit on BSC: Attacker Manipulated MT-WBNB Pool via Flawed Buyer Rules

Another day, another DeFi exploit. BlockSec spotted a suspicious transaction on BSC targeting the MT-WBNB liquidity pool, with losses estimated at $242,000. The issue? A broken buyer restriction mechanism.

Here's how it went down. Under deflationary mode, normal buys would revert. But routers and the trading pair itself were whitelisted. That gave the attacker a way in: swap and remove liquidity via the router to grab MT from the pool.

Then came the manipulation. The attacker sold MT to build up pendingBurnAmount, called distributeFees() to burn MT directly from the pair—artificially pumping the price—and swapped back to WBNB for profit. A referral rule that let the first 0.2 MT transfer bypass restrictions was the entry point.