An insider with admin lottery access exploited a predictable block-hash-based RNG by orchestrating multiple transactions in the same block with varied gas prices. This allowed manipulation of the random number generator to predict winning tickets and withdraw 59,765 CAKE (~$1.8M) from the lottery prize pool.

According to sources, since April 12, 2021, a person who has access to Binance Smart Chain account 0x35f16a46d3cf19010d28578a8b02dfa3cb4095a1 (PancakeSwap administrator account) has stolen 59,765 Cakes (approximately US$1,800,000) from the PancakeSwap lottery pool. After hackers exploited the vulnerability several times, PancakeSwap banned the account.