PancakeSwap OCA/USDC pool on BSC exploited for about $422K in flash loan attack

On February 14 2026, the PancakeSwap V2 OCA/USDC liquidity pool on BSC was drained in a flash loan-based exploit that removed nearly $500,000 in USDC in a single transaction. Reports indicate the attacker abused a flaw in the deflationary sellOCA() logic and repeatedly used the swapHelper function to manipulate pool reserves, ultimately securing around $422,000 and an estimated $340,000 in profit after paying builder bribes. The incident follows a December 2025 flash loan attack on the DMi/WBNB pair that extracted roughly 138.6 WBNB, or about $120,000, through reserve manipulation.