# ATM: LP tokens sent to pair burned for 1,603 WBNB

Victim mistakenly sent LP tokens to the Pancake pair; attacker burned them to redeem 1,603 WBNB and 99M ATM.

- Payout: Real-world hack
- Severity: high
- Program: ATM
- Credited: DeFiHackLabs
- Disclosed: 2026-06-22
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-06/ATM_LP_Burn_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260622-atm-lp-burn
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:recon vuln:business-logic

**Target:** PancakeSwap V2 pair (ATM/WBNB)
**Root cause:** Pancake V2 pair.burn() redeems any LP tokens held by the pair contract itself, so LP mistakenly transferred to the pair becomes burnable by anyone.
**Steps:**
1. Victim adds WBNB/ATM liquidity and receives LP tokens.
2. Victim transfers LP tokens to the pair address `0x9753...eba`.
3. Attacker calls `pair.burn(address(this))` on the pair, receiving ~1,603 WBNB and ~99M ATM.
4. Attacker returns ATM to pair and swaps out WBNB dust to `0xa447...06b`.
5. Attacker withdraws 1,571.9 WBNB to BNB and pays builder `0x1266...F20`.
6. Remaining WBNB forwarded to final receiver `0xfBa5...2D3`.
**How found:** Attacker likely monitored pair LP balances and spotted LP tokens sitting in the pair contract, then called burn() to redeem them.
**Exploitation:** No capital needed: attacker simply called burn() on the pair holding the victim's mistakenly transferred LP, redeemed underlying assets, paid builder bribe, and kept profit.
**Insight:** Monitor DEX pair contracts for LP token balances held by the pair itself; any such balance is burnable by anyone via pair.burn().