0x2b5bf7d9d9dc1eec68f40c6b7a8f197e65f9731a

Bonfire Swap exploit (2026-09-15) — attacker addresses

• Scam type: Hack
• Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
• Reported: 2026-10-15
• Last updated: 2026-10-16

Bonfire Swap exploit on EVM, 2026-09-15. DeFiHackLabs summary: BonfireSwap - missing caller authorization lets anyone force-sell any approved holder's tokens. Loss as recorded by DeFiHackLabs: ~66 BNB (~$47-50K); 58.78 BNB reproduced from a 5-victim subset (~98.7% of tokens drained). Addresses below are copied verbatim from the DeFiHackLabs proof-of-concept header for this incident, where they are explicitly labeled (attacker = attacker EOA; attack contract = contract deployed/used by the attacker): - 0x2B5bF7D9D9Dc1EEc68f40C6B7a8f197e65f9731a — labeled "attacker" (EVM) -…

Other addresses in this report: 0x28e976ea7b83553d6d1d45ce81334156a2632127

Bonfire exploit (2026-09-15) — attacker addresses (Blackpaper BP-1274)

• Scam type: Hack
• Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
• Reported: 2026-10-15
• Last updated: 2026-10-16

Bonfire incident on 2026-09-15 (Improper Access Control). BonfireSwap's BSC router moved 5.421 trillion BONFIRE from 65 external holders and extracted 66.080052 BNB from its pair, reported at about $47,400. Source: Blackpaper BP-1274 (https://blackpaper.wiki/incident/BP-1274/), in-house verified. This report lists only the addresses Blackpaper places under its Attacker addresses section; no victim wallets are included: - 0x2b5bf7d9d9dc1eec68f40c6b7a8f197e65f9731a (BSC · Sender of the exploit transaction) Confidence: Medium — single incident database (Blackpaper, on-chain verified by them);…