Two BV7X team wallets were compromised through phishing approvals on September 20, allowing an attacker to transfer approximately 6.18 million BV7X using Permit2 and an unlimited token allowance. One approval remained active for 27 days, enabling the attacker to steal another 149.06 million BV7X after liquidity was withdrawn into the affected wallet on October 17. The team subsequently deployed a replacement token contract and initiated a migration intended to exclude the stolen holdings