Hackers exploited the OCA deflationary logic to attack the USDC-OCA pool, profiting approximately $340,000.

According to BlockSec Phalcon monitoring, the USDC-OCA pool on the BSC chain was attacked, resulting in the withdrawal of approximately $422,000 worth of USDC. The attacker exploited the deflationary logic of OCA's `sellOCA()` function, simultaneously removing an equal amount of OCA from the liquidity pool during a transaction, artificially inflating the price. The attack was completed through three transactions: the first executed the attack, and the latter two were used to pay bribes. The attacker paid approximately 112 BNB to 48club-puissant-builder, ultimately profiting approximately $340,000. Another related transaction within the same block failed, suggesting that the attacker may have preemptively withdrawn the funds.