On August 18-19, 2021, Pinecone Finance's staking pool was exploited when an attacker bypassed the frontend and directly invoked the smart contract to deposit more PCT tokens than their account balance. Due to failed balance verification, the attacker withdrew more tokens than deposited, extracting approximately $200K before the PCT token price collapsed 61%.

Pinecone launched the pledge pool of protocol token PCT at 09:00 UTC on August 18, 2021, and was attacked at 11:41:19 AM UTC. When the Pinecone PCT pledge pool went online, the front-end was processed to limit illegal operations, but the hacker bypassed the front-end page during the attack and directly called the smart contract through the ordinary account, depositing PCT tokens greater than the amount of the account balance, and the PCT pool was wrong. Records the number of user deposits. When withdrawing, you can extract more PCT tokens. After discovering that the currency price had plunged, the project party immediately terminated the call of the smart contract. The current loss of the number of PCTs: about 3.53 million.