49 WETH isn’t much, but the exploit scheme is too classic—first take the owner, then inflate the balance, and finally cash out on Pancake, like a pipeline operation.

SlowMist states that the ONTR token contract has an onlyOwner vulnerability, allowing an attacker to gain ownership when owner is address(0), transfer ownership, and inflate balances to 1e30 units through operations like desertJasper, glenFlash, ashBud without increasing totalSupply, resulting in a loss of approximately 49.4801 WETH (about $98k). Then, they exchange on PancakePair for WETH, involving addresses such as 0xe806...b760.