SlowMist says an attacker drained 111,097.596667856001191208 USDC, about $111,097.6, from a PancakeSwap DIP liquidity pool by abusing DIP’s `_transfer()` logic. The bug was a missing `return` in the router branch, causing transfers involving the PancakeSwap Router to execute twice; the attacker repeatedly called `skim(router)` and then `sync()` to crush reserves and skew the AMM price. SlowMist identified the attacker as `0x0d4024cd27538350a911d9b7ee90811fa4875ba3`, the victim pair as `0xf7d8267d01d1104da2dd30828aa9c0e1647919ef`, and the vulnerable token as `0x6c60bf5db0670ae94489d3dde2c60f271625db50`.

TLDR by @Benthic