What happened
On May 28, 2021, BurgerSwap — a BSC-based AMM — was drained of ~$7.2M in a flash-loan attack that abused a fake-token pair to manipulate reserves and re-enter the swap logic fourteen times in one transaction. ChainHint traces the attacker's address as the proceeds were swapped out through 1inch, the largest of the three endpoints this trace holds.
How the funds moved
Fake-token Flash Loan
The attacker created a worthless token, paired it against BURGER, and used a flash loan to swap through the fake pair — exploiting a missing reserve check to re-enter the swap path 14 times in a single transaction.
Reserve Drain
Each re-entry drained real assets (BNB, BUSD, WBTC, BURGER) from BurgerSwap's pools against the worthless collateral. Roughly $7.2M left the AMM in minutes.
1inch Exit
Proceeds were routed out through 1inch aggregation — the largest of the three endpoints this trace holds, on both the historical and the current valuation.
Where the funds went
Read from the transfers in ChainHint's trace, not from press reports
ChainHint's trace of the BurgerSwap hack follows 96 transfers across 4 addresses and 1 hop, between May 27, 2021 and Jul 5, 2021. The first hop out of the attacker's address moved USDT ($2.07M), WBNB ($1.79M), BNB ($74.8K).
Visualized attack path
4 addresses · 96 transfers · Traced with ChainHint
Key findings
Attacker Address
Trace Shape
Historical Context
Investigate your own incident
ChainHint traced the BurgerSwap hack in minutes.
Use the same tool for your case.