An attacker successfully stole approximately $1.11 million worth of assets on June 20th by exploiting a vulnerability in the OLPC/LABUBU liquidity pool on PancakeSwap V2 on the BNB Chain. According to reports from PeckShield and ExVul, the attack took advantage of a flaw in how the pool's constant-product market maker interacted with OLPC's deflationary mechanism. The exploit started when a small amount of about 10 OLPC tokens was pushed through a malicious contract, triggering a massive burn event of approximately 51.9 million OLPC and 124,000 LABUBU tokens from the pool to a dead address. This sudden burn caused the pool's internal records to no longer match the real token balances, creating a severe imbalance that allowed the attacker to extract LABUBU at very low cost using minimal OLPC input. Security firm SlowMist confirmed that the issue came from a serious imbalance in the OLPC/LABUBU pair, with the pool's internal logic depending on reserve calculations that were pushed out of sync.
The reserve mismatch created severe pricing distortion that allowed the attacker to buy and drain remaining LABUBU at heavily discounted prices. As confirmed by ExVul, the exploit was linked to a function in OLPC's contract where value could be burned based on a multiplier called decimalsValue. About 46 days before the attack, the OLPC contract owner changed this parameter from a normal value to an extremely large number: 7326680472586200649. This change significantly amplified how much OLPC could be burned during certain operations, and when the OLPC owner renounced ownership of the contract, sending control to a dead address, the parameter could no longer be reversed or corrected. The attacker then interacted with the system, triggering the inflated decimalsValue inside the pair's update function, causing an abnormal burn of OLPC tokens that directly distorted the pool's reserve balance. As a result, the OLPC/LABUBU pair became heavily imbalanced, with the pool still assuming normal reserves existed while the actual token amounts had been reduced sharply.
After stealing the funds, the attacker quickly moved across chains to hide their tracks. According to PeckShieldAlert, the funds were moved from BNB Chain to Ethereum, where approximately 633.4 ETH was sent into Tornado Cash, a platform often used to hide crypto transactions. Smaller amounts like 0.0221 BNB and 0.0411 ETH were also sent to a dead address, making the funds harder to trace. The attacker's wallet involved in the exploit was identified as 0x18d6...4fc188, while the main pool that was attacked had the address 0xedb7...c9f365. The stolen tokens were converted into approximately 1,115,903 USDT by draining the LABUBU side of the pool and moving through other trading pairs like LABUBU/WBNB and WBNB/USDT. Meanwhile, PancakeSwap reacted to the incident, stating that its initial investigation confirmed there are no issues with PancakeSwap's smart contracts, though they are still investigating and will share updates through official channels.
This exploit represents part of a concerning trend in June 2025, with total value of hacks reaching $60.03 million according to DeFiLlama data. As reported by AMBCrypto, other notable attacks included Humanity Protocol experiencing losses of about $32 million, Aztec Network draining 1,158 Ethereum, 150,000 DAI, and 0.4696 renBTC, and UXLink witnessing an attacker transfer approximately $8.1 million in Ethereum into Tornado Cash. Looking at the bigger picture, many of these attacks this year are not breaking blockchains themselves but taking advantage of mistakes in smart contract logic, token design, or how systems track balances. So far, these types of exploits have contributed to nearly $400 million in losses this year, including large cases like KelpDAO (around $292 million) and Drift Protocol ($295 million) attacks. On June 18, Aztec Network's Private Rollup Bridge was also hit for about $2.165 million, including ETH, DAI, and renBTC, while Axelar reported an exploit involving around $4.67 million in assets moved through a bridge into Secret Network.
