A PancakeSwap liquidity pool for OLPC/LABUBU tokens was drained for $1.1M after a malicious contract parameter, set 46 days earlier, caused massive token burns that desynchronized pool reserves.
On June 20, 2026, the OLPC/LABUBU trading pair on PancakeSwap V2 on BNB Chain was drained for 1,115,903 USDT. Approximately 46 days before the attack, the token owner changed the decimalsValue parameter from 1 to 7326680472586200649. Several days later, ownership was renounced, locking the parameter. The _update function burned tokens equal to value * decimalsValue. The attacker sent a small OLPC transfer, triggering burns of ~51.9M OLPC and 124K LABUBU to a dead address. This desynchronized cached reserves from actual balances. The attacker extracted LABUBU at distorted prices and exited with 1,115,903 USDT.
Attacker bridged USDT from BNB Chain to Ethereum and deposited 633.4 ETH into Tornado Cash. Small test transfers were made to a long-unused address. No recovery reported.
0xolpc-labubu-exploit-1