An attacker exploited SKP's transfer hook that called pair.sync() prematurely during token transfers, before the router completed the corresponding swap. This allowed the attacker to manipulate reserve ratios mid-transaction by calling sync() from inside the transfer flow. The attacker assembled $204M in capital from flash loan sources and nearly completely drained the SKP/USDT pair, extracting $212K.

On BSC, the SKP token suffered a token-side LP balance drain + sync attack. The attacker profited approximately $212.85k in a single transaction (162,854.21 USDT + 75.88 BNB). The root cause was a flaw in SKP token logic that allowed extra SKP tokens to be transferred out from the Pancake V2 SKP/USDT LP after a large buy, followed by calling sync() to write incorrect reserves, pushing the SKP reserve close to zero. The attacker used flash loans to amplify the attack.