Tiny token, $1.1M oopsie: BNB Chain's Labubu pool learns deflation is a feature, not a bug 🧸

An attacker siphoned approximately $1.11 million from the OLPC/LABUBU liquidity pool on PancakeSwap V2 on BNB Chain on June 20 by exploiting a flaw in how the pool's constant-product market maker interacted with OLPC's deflationary mechanism. The pair's cached reserves remained unchanged while its actual token balances collapsed after a small transfer from the attacker's contract, which triggered the burn of roughly 51.9 million OLPC and 124,000 LABUBU tokens to a dead address. The resulting reserve mismatch produced severe pricing distortion, allowing the attacker to purchase and drain the remaining LABUBU at heavily discounted prices.

Preliminary analysis indicates the exploit stemmed from a long-standing modification to the OLPC contract. About 46 days before the attack, the token owner changed the decimalsValue parameter from 1 to an unusually high figure, enabling excessive token burns through the _update() function. The timing has drawn attention: weeks before ownership of the contract was renounced, decimalsValue had already been set to that elevated level, raising questions about whether the vulnerability was embedded long before it was exploited. It remained unclear at the time of writing whether the flaw had been intentionally introduced.

The stolen funds have not been reported as moving to other chains, passing through Tornado Cash, or being distributed across multiple wallets. With this incident included, the total value of hacks recorded in June to date has reached $60.03 million, according to DeFiLlama data. Separately, Humanity Protocol [H] suffered an exploit that caused losses of about $32 million, and Aztec Network experienced another notable exploit resulting in the drainage of 1,158 Ethereum [ETH], 150,000 DAI, and 0.4696 renBTC. UXLink, which was targeted in September 2025, recently saw its attacker transfer approximately $8.1 million in Ethereum into Tornado Cash.