LBP exploit analysis
LBPHashrate staged hashrate reward credit through Moolah and Pancake Vault flash liquidity, the attacker sold the inflated LBP balance against the WBNB-side pair, and the USDT was swapped to BNB for about 610.56 BNB.
- Reported loss
- 610.56 BNB, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-06-17: Lbp Balanceof Reward Accounting on LBP”.
Analysis1 min read
LBPHashrate credits rewards to the LBP/BNB pair via a flash arrangement between Moolah and Pancake Vault. The attacker used these flash sources to stage LBP LP credit, trigger reward accounting, and read the inflated LBP balance from LBP.balanceOf(). A swap against the WBNB-side pair pumped the price, sold the inflated LBP balance for USDT, swapped to WBNB, unwrapped to BNB, retained 5 BNB as a builder payment, and forwarded the rest.
The attacker at 0xb26dfe6b6180a30e2a2d9826867cc7e06631825a used the Moolah and Pancake Vault flash liquidity sources simultaneously to maintain LBP LP credit and ratchet hashrate reward accounting.
DeFiHackLabs reports a total loss of about 610.56 BNB. The drain is in 0x55856d9fda4c5be5193561c7d775e823c3d6e499da44aab9da963daf61c50b0c on BscScan. The vulnerable LBP contract is 0x88886f0fd371dff856291badced45922bc888888; the LBP contract is unverified on BscScan.
What would have prevented it: an LBPHashrate reward credit that pulls from the LP contract's actual balanceOf(), with the LP holder's actual underwrite, rather than from a held-credit accounting that can be staged through external flash sources.
Other exploits
- Aztec Connect second exploit analysis 18 Jun 2026
- JB exploit analysis 18 Jun 2026
- Aztec V1 exploit analysis 17 Jun 2026
- WHALE exploit analysis 17 Jun 2026
- DIP exploit analysis 16 Jun 2026
- Aztec Connect exploit analysis $2.1M
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
