BV7X Incident and Response

In short

On 20 September two team wallets signed approvals on a phishing page, and a rented drainer kit used them the same afternoon to take 6,177,401.32 BV7X. One of those approvals stayed live. On 17 October, minutes after the migrate.fun liquidity lock ended and its BV7X landed in the deployer wallet, the kit used it to take a further 149,058,039.72. In all 155,235,441.04 BV7X left team wallets, 15.5% of supply. Holders’ wallets and the protocol’s contracts were never in the path.

The old token cannot take coins back, so bv7x is re-issuing it. On 26 October a new BV7X contract was created with 1,000,000,000 tokens, and the 149,048,039.72 still sitting in the phishing wallet were burned from it in one transaction, leaving a supply of 850,951,960.28.

A snapshot of every holder, staker and liquidity provider is taken at a time that is not announced in advance, and its block is published once it is taken. Every old BV7X held at that block is replaced one for one and sent straight to the wallet that held it. The new BV7X/WETH pool then opens at the average price of old BV7X across the whole incident, from the first phished signature on 20 September to the snapshot, and that figure is published with its method when the pool opens.

New $BV7X on Robinhood Chain · chain id 46630x5996c0a5B9c6a6A05387979E8854f33D5FB9C603Blockscout ↗

What happened

On 20 September an approval drainer took 6,177,401.32 BV7X from two wallets operated by the bv7x team. On 17 October it used an approval left standing from that day to take a further 149,058,039.72 BV7X from one of them. The total is 155,235,441.04 BV7X, 15.5% of supply. Every coin came out of those two team wallets: the staking pool, the agents and the app were never exposed. Of the coins taken, 149,048,039.72 still sit in one wallet on the old token, after a single 10,000 sale on 17 October, and that is the amount burned from the new one.

What is not known

It is not known how the 20 September signatures were given: an AI assistant adding liquidity in the browser, or a fake Uniswap site. The unlimited approval was a ticking time bomb, live for 27 days, that went off when liquidity was withdrawn into that wallet.

The receipts

Every hash below opens on the chain’s explorer. The old token contract is 0x459476869aF797Eb9061B41fA04dE46A60FBeDBD. Wallet A is 0x3f2f705ca38e395a80596dddf3613fcfe900c0f2. Wallet B, the token deployer, is 0xd8B71d23e1a8da9867497C0E757A1143B94C3e1e. The attacker’s Safe is 0xcdda64628c51d47064ab4803d3a4f195e881e7ef, a 1-of-2 with owners 0x3ef438c34ce51a697a24247fe033c4562c94f0fd and 0xca9006c164b99a3e7d9e8ed34912ec86a6a4f25b.

UTC · block	What happened	Transaction
09-20 15:59:14 68,064,347	Wallet A makes a real Uniswap trade and approves Permit2 for BV7X.	`0x4e9a02b8a8d0f57ce88ed4554a8321387ff503d89eb07a159660d44166978a0c`
09-20 16:30:58 68,083,356	The attacker broadcasts a Permit2 permit signed by wallet A, spender the Safe, unlimited and with no expiry, and pulls 2,923,452.97 BV7X in the same transaction.	`0x019629dd552d1dd33de2acaafd77b7fc1ae19ae3a7a3ffb08cd2822f827efec2`
09-20 16:32:24 68,084,210	Wallet B confirms `approve(Safe, unlimited)` on the token.	`0x3b56d364dd0b12418939bb76cf8ee66f32a15baf06e837053b3c84cb9cf166c3`
09-20 16:32:27 68,084,237	3,253,948.35 BV7X pulled from wallet B: 650,789.67 to the kit’s fee wallet `0xff227fef31c6e6d48ecd5eab60b4e2bf32fc060d` and 2,603,158.68 to an affiliate `0xde05b7b741caec42b78e25a9913da7c332847b97`.	`0x42571f4fea4c82f4cb3b86bcef368c4603ad2f395dd0fda52b7d2bc176636cb5`
10-17 09:38:50 90,827,081	The migrate.fun liquidity lock has ended, and the team reduces the BV7X/WETH position into wallet B.	`0xf9c2b22c05a1cd505a33aade16e9f598678d769d8c02238222a6458164ab6052`
10-17 09:54:33 90,836,234	On the approval of 20 September, still live, the Safe pulls 149,058,039.72 BV7X from wallet B.	`0xed771efacfc65604dd4bfedb4d49ede05741f044e323be86b56bbd58a39d1e93`
10-17 09:5x 90,836,776	The Safe forwards the 149,058,039.72 to `0xca4cbcd4f8fb08d2ef6f3fbbd77a75f1144d92bb`, the phishing wallet.	`0x37067f29e01d77fc7fa747cf85f343dcf526dad85e752ca01b927c0113255c6c`
10-17 10:08:50 90,844,647	10,000 BV7X sold from it through a router. The remaining 149,048,039.72 have not moved since.	`0x22caa0090091783652f971773daee7831c345db03494fc89ea9ff657a9e4dcb1`
10-20 13:40:48 93,492,478	Wallet B’s approval to the Safe set to zero.	`0xadccd4babc80c254baf1e7bd63b921f5c2e6a37232642b53840dd473cf3e2b1a`
10-20 13:42:03 93,493,227	Wallet B’s approval to Permit2 set to zero.	`0x3a446089ece345a8068be4e01c5601e7b3a83c8bb62f8629f3d9ca599c8b56f8`
10-20 17:27:54 93,623,367	Wallet A’s Permit2 grant to the Safe set to zero.	`0x3459a3c60551caebb699c235fe90a930dca245ecba331698abdcb22f289ea41b`
10-20 17:28:02 93,623,448	Wallet A’s approval to Permit2 set to zero.	`0xb7e0145caae5d3211bdc24c21ed8d939974ba428c8a5d7e8dc755ae73f8abdeb`

Check it yourself. Filter the old token’s Transfer events from wallets A and B and its Approval events for the same two wallets: the twelve rows above are the complete set that touches the attacker. Read balanceOf of the phishing wallet. Open the Safe and its two owners, and the same 20/80 fee split and the same permit-then-pull sequence appear on other victims across the chain, several seconds after a real Uniswap trade. 57 team wallets on Robinhood Chain and Base have been checked for live grants to any attacker address, and none remain.

Why it worked

Two signatures were given on one page, 86 seconds apart, from two wallets held in the same browser wallet: an off-chain Permit2 signature for the wallet that already had a Permit2 approval, and an on-chain approve for the wallet that did not. That per-wallet choice, the fee split and the fingerprint shared with the other victims identify a rented drainer kit behind a fake trading or claim page. It was not a stolen key, because a key thief needs no signature and would have taken the 24 WETH that sat untouched on wallet B for a month. It was not the servers, which never approve spenders and never hold wallet A’s key.

What made it expensive was an unlimited approval left standing for 27 days, the deployer key living in a browser wallet, 149 million BV7X landing in that wallet in one transaction, and no alert on approvals or outflows.

What changes

The deployer key signs nothing on a website, and dapps get a separate wallet with small balances. Approvals are sized to the trade in hand, reviewed weekly and revoked when idle. Large inbound amounts land in a wallet with zero outstanding grants, checked before the transfer. A wallet watcher that alerts on every approval and outflow from team wallets has been built.

The re-issue

The old BV7X contract has no owner and no way to freeze or recover a balance. That is the right design for a token, and it is also why the contract cannot undo this. The remedy left is a new token that leaves the phished coins behind and gives everyone else exactly what they held.

The new contract and the burn, done on 26 October. The new BV7X was created at 17:14:16 UTC with 1,000,000,000 tokens in the Treasury wallet 0xc73fBD2Cc5615EEA263A7Bbb278cb4d0546f2090 (creation). At 17:30:37 UTC the 149,048,039.72 the phishing wallet holds were burned from it in one transaction, and totalSupply now reads 850,951,960.28. The new contract has no admin functions at all: once created, nobody can mint more, pause it or block an address.
The snapshot, at a time not announced in advance. Every address holding, staking or providing liquidity in old BV7X at the snapshot block is recorded, with liquidity positions credited to their owners and stakers credited with their stake and the BV7X they have earned. The time is kept private so that nobody, the phishing wallet included, can trade around it. The block and the full list, with the excluded addresses marked, are published once it is taken.
The exclusion. The phishing wallet 0xca4cbcd4f8fb08d2ef6f3fbbd77a75f1144d92bb, every wallet it has paid BV7X to and the wallets linked to it on chain receive nothing; that is thirteen addresses today. The exclusion lives in the published snapshot rather than in the token.
The address on X, then the airdrop. The new contract address is posted on X first. The airdrop follows from the Treasury wallet in a series of transactions, and every wallet in the snapshot receives exactly the amount of old BV7X it held, as new BV7X. Stakers receive their staked BV7X and their earned BV7X in their wallet and can stake again when the new staking pool opens. 3RDI rewards keep accruing in the old staking pool and stay claimable there.
The new pool and its opening price. After the airdrop the BV7X/WETH pool opens at the time-weighted average price of old BV7X in its BV7X/WETH pool, from the first phished signature on 20 September at 16:30:58 UTC to the snapshot block. The window covers the whole incident, so the opening price reflects where BV7X traded across it rather than one print on a thin book in its last days. The figure, the method and the pool address are published when the pool opens, and anyone can recompute the figure from the old pool’s swap events.
The old contract 0x459476869aF797Eb9061B41fA04dE46A60FBeDBD is retired from the app, the docs and the listings after the airdrop. Old BV7X bought after the snapshot carries nothing into the new token.

If you hold BV7X

There is nothing to do. Keep your BV7X where it is, in your wallet, staked or in a liquidity position, and the new tokens arrive at the same address after the snapshot. bv7x will never ask you to sign anything or connect a wallet to receive them, so treat any page that asks, including one that appears to come from bv7x, as a scam.

Every figure here is read from Robinhood Chain, chain id 4663, on 26 and 27 October 2026. The snapshot block, the opening price and the new pool address are added to this post when they exist. Nothing here is advice.