{"investigation":{"slug":"olpc-bnblabubu-token-pancakeswap-pool-exploit","entity_name":"OLPC / BnbLabubu Token (PancakeSwap Pool Exploit)","trust_score":0,"severity_base":null,"score_modifier":-12,"confidence":0.88,"status":"published","content_type":"investigation","summary":"On June 20, 2026, an attacker drained approximately $1.11 million from the OLPC/LABUBU liquidity pool on PancakeSwap V2 (BNB Chain) by exploiting a flaw in the OLPC token's _update function that burned pool reserves and desynchronized the pair's cached balances. About 46 days earlier, the OLPC contract owner had changed the decimalsValue parameter from 1 to an extremely large integer and then renounced ownership, a sequence security researchers and reporting outlets characterize as an alleged premeditated rug pull disguised as an external exploit. The proceeds were bridged to Ethereum and 633.4 ETH was deposited into Tornado Cash; no recovery or attribution has been announced.","sections":[{"content":"On June 20, 2026, a PancakeSwap V2 liquidity pool pairing the OLPC token with the LABUBU token on BNB Chain was exploited for approximately $1.11 million in USDT-equivalent assets. Security firm PeckShield was the first to publicly identify and track the attack. Analysts identified the attacker's primary wallet as 0x18d6...4fc188 and the target pool contract as 0xedb7...c9f365. The attack vector was a logic flaw in the OLPC token's _update function that caused a large burn of pool reserves, desynchronizing the pair's cached balances from its actual token holdings. PancakeSwap stated that its own smart contracts were unaffected and that the flaw lay entirely in the OLPC token contract. The LABUBU token involved appears to be a BNB Chain meme token distinct from the Labubu/Pop Mart collectible brand, which has no known association with the incident.","heading":"Incident Overview","sources":[{"url":"https://www.cryptotimes.io/2026/06/20/pancakeswap-labubu-pool-exploited-for-1-1m-what-went-wrong/","name":"PancakeSwap Labubu Pool Exploited for $1.1M: What Went Wrong - CryptoTimes","type":"news_article","credibility":2},{"url":"https://www.kucoin.com/news/flash/bnb-chain-olpc-labubu-pool-exploited-1-11m-stolen","name":"BNB Chain OLPC/LABUBU Pool Exploited, $1.11M Stolen - KuCoin News","type":"news_article","credibility":2},{"url":"https://en.bloomingbit.io/feed/news/114666","name":"PancakeSwap Says Smart Contracts Unaffected as OLPC/LABUBU Pool Hack Causes $1.1 Million Loss - Bloomingbit","type":"news_article","credibility":2},{"url":"https://cryptonews.net/news/security/33038552/","name":"PancakeSwap OLPC/LABUBU Pool Exploited for $1.1 Million; Funds Moved to Tornado Cash - CryptoNews.net","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Approximately 46 days before the June 20 exploit, the OLPC token contract owner (deployer) changed a parameter called decimalsValue, used in the contract's _update() function, from its standard value of 1 to an extremely large integer reported as 7326680472586200649. The parameter controls the multiplier applied to token burn amounts during pool balance updates: at 1, burns are proportional; at the manipulated value, a transfer routed through the contract triggers burns orders of magnitude larger than intended. After the change, the owner renounced ownership by transferring control to a dead address, making the modification permanent and irrevocable and giving the contract the appearance of being decentralized and immutable. Security researchers characterized the renunciation as an attempt to disguise the premeditation. The 46-day gap suggests the deployer may have waited for liquidity to accumulate in the pool before the attack. The vulnerability is alleged to have been intentionally embedded and designed to be triggered later.","heading":"Alleged Premeditation: the decimalsValue Parameter Change","sources":[{"url":"https://www.cryptotimes.io/2026/06/20/pancakeswap-labubu-pool-exploited-for-1-1m-what-went-wrong/","name":"PancakeSwap Labubu Pool Exploited for $1.1M: What Went Wrong - CryptoTimes","type":"news_article","credibility":2},{"url":"https://ambcrypto.com/bnblabubu-exploit-drains-1-1mln-after-olpc-reserve-mismatch-details/","name":"BnbLabubu exploit drains $1.1mln after OLPC reserve mismatch - AMBCrypto","type":"news_article","credibility":2},{"url":"https://fxdailyreport.com/pancakeswap-olpc-labubu-pool-suffers-1-1-million-exploit/","name":"PancakeSwap $OLPC/$LABUBU Pool Suffers $1.1 Million Exploit - FX Daily Report","type":"news_article","credibility":2},{"url":"https://cryptonews.net/news/security/33038552/","name":"PancakeSwap OLPC/LABUBU Pool Exploited for $1.1 Million; Funds Moved to Tornado Cash - CryptoNews.net","type":"news_article","credibility":2}],"severity":"critical"},{"content":"The attacker routed approximately 10 OLPC tokens through a purpose-built malicious contract, triggering the modified _update() function. Because of the inflated decimalsValue, this small transfer burned approximately 51.9 million OLPC and 124,000 LABUBU tokens, sent to an address reported as 0xed...f365 (described as a dead address). PancakeSwap V2's cached reserve values did not resynchronize after the balance collapse, so the pool's internal accounting still showed pre-burn reserves while its actual balances had collapsed. The mismatch produced severely distorted prices in the constant-product (AMM) formula, and the attacker used it to buy the remaining LABUBU in the pool far below market value. The drained LABUBU was routed through the LABUBU/WBNB and WBNB/USDT pools to yield approximately 1,115,903 USDT. Reports differ on the attacker's net gain: one account describes the 1,115,903 USDT as net proceeds, while another puts the net gain after costs at approximately $960,000. SlowMist founder Yu Xian (known as Cosine) publicly confirmed that the OLPC contract's decimalsValue function could, under certain conditions, burn far more tokens than the amount that triggered the operation.","heading":"Exploit Mechanism: Reserve Desynchronization","sources":[{"url":"https://www.cryptotimes.io/2026/06/20/pancakeswap-labubu-pool-exploited-for-1-1m-what-went-wrong/","name":"PancakeSwap Labubu Pool Exploited for $1.1M: What Went Wrong - CryptoTimes","type":"news_article","credibility":2},{"url":"https://ambcrypto.com/bnblabubu-exploit-drains-1-1mln-after-olpc-reserve-mismatch-details/","name":"BnbLabubu exploit drains $1.1mln after OLPC reserve mismatch - AMBCrypto","type":"news_article","credibility":2},{"url":"https://fxdailyreport.com/pancakeswap-olpc-labubu-pool-suffers-1-1-million-exploit/","name":"PancakeSwap $OLPC/$LABUBU Pool Suffers $1.1 Million Exploit - FX Daily Report","type":"news_article","credibility":2},{"url":"https://www.kucoin.com/news/flash/bnb-chain-olpc-labubu-pool-exploited-1-11m-stolen","name":"BNB Chain OLPC/LABUBU Pool Exploited, $1.11M Stolen - KuCoin News","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Security researchers and reporting outlets have characterized the incident as an alleged premeditated rug pull rather than an opportunistic exploit of a pre-existing bug. The indicators cited are: (1) the deployer set decimalsValue to an extreme value about 46 days before the exploit; (2) ownership was renounced after the change, creating a false appearance of an immutable contract; (3) the attacker used a purpose-built malicious contract to route the triggering transaction; and (4) the proceeds were immediately bridged and laundered through Tornado Cash, indicating advance preparation for evasion. The identities behind the OLPC project and the attacker wallet (0x18d6...4fc188) are not publicly known; no team has claimed the OLPC project and no individual or organization has been formally attributed as the exploiter. It is alleged but unconfirmed that the OLPC deployer and the attacker are the same actor or coordinated parties, given the precise alignment between the pre-planted parameter change and the exploit method; no regulatory or law enforcement body has confirmed this.","heading":"Rug Pull Classification and Attribution","sources":[{"url":"https://www.cryptotimes.io/2026/06/20/pancakeswap-labubu-pool-exploited-for-1-1m-what-went-wrong/","name":"PancakeSwap Labubu Pool Exploited for $1.1M: What Went Wrong - CryptoTimes","type":"news_article","credibility":2},{"url":"https://ambcrypto.com/bnblabubu-exploit-drains-1-1mln-after-olpc-reserve-mismatch-details/","name":"BnbLabubu exploit drains $1.1mln after OLPC reserve mismatch - AMBCrypto","type":"news_article","credibility":2},{"url":"https://en.bitcoinsistemi.com/watch-out-an-altcoin-liquidity-pool-on-pancakeswap-has-been-hacked/","name":"Watch Out: An Altcoin Liquidity Pool on PancakeSwap Has Been Hacked - Bitcoin Sistemi","type":"news_article","credibility":2},{"url":"https://cryptonews.net/news/security/33038552/","name":"PancakeSwap OLPC/LABUBU Pool Exploited for $1.1 Million; Funds Moved to Tornado Cash - CryptoNews.net","type":"news_article","credibility":2}],"severity":"critical"},{"content":"After the exploit, the attacker swept LABUBU through the LABUBU/WBNB and WBNB/USDT pools, extracted approximately 1,115,903 USDT and bridged the proceeds from BNB Chain to Ethereum, where 633.4 ETH was deposited into Tornado Cash, a mixing service used to obscure transaction trails. Small amounts, 0.0221 BNB and 0.0411 ETH, were also sent to dead addresses, a tactic sometimes used to add noise to on-chain tracing. The use of Tornado Cash is consistent with patterns seen in deliberate theft and exit scams and makes recovery or attribution to a named individual substantially harder. Tornado Cash has been subject to U.S. Treasury OFAC sanctions since August 2022, so its use by U.S. persons is prohibited; the attacker's jurisdiction is unknown. No recovery of funds had been announced as of reporting.","heading":"Fund Movement and Laundering via Tornado Cash","sources":[{"url":"https://bitcoinworld.co.in/pancakeswap-olpc-labubu-pool-hack-1-1-million/","name":"PancakeSwap OLPC/LABUBU Pool Exploited For $1.1 Million; Funds Moved To Tornado Cash - Bitcoin World","type":"news_article","credibility":2},{"url":"https://cryptonews.net/news/security/33038552/","name":"PancakeSwap OLPC/LABUBU Pool Exploited for $1.1 Million; Funds Moved to Tornado Cash - CryptoNews.net","type":"news_article","credibility":2},{"url":"https://fxdailyreport.com/pancakeswap-olpc-labubu-pool-suffers-1-1-million-exploit/","name":"PancakeSwap $OLPC/$LABUBU Pool Suffers $1.1 Million Exploit - FX Daily Report","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/06/20/pancakeswap-labubu-pool-exploited-for-1-1m-what-went-wrong/","name":"PancakeSwap Labubu Pool Exploited for $1.1M: What Went Wrong - CryptoTimes","type":"news_article","credibility":2},{"url":"https://en.bloomingbit.io/feed/news/114666","name":"PancakeSwap Says Smart Contracts Unaffected as OLPC/LABUBU Pool Hack Causes $1.1 Million Loss - Bloomingbit","type":"news_article","credibility":2}],"severity":"critical"},{"content":"PeckShield publicly identified and tracked the attack on June 20, 2026, classing it as a token contract vulnerability rather than an AMM protocol flaw. SlowMist founder Yu Xian (Cosine) confirmed the nature of the OLPC contract flaw. PancakeSwap issued a public statement: 'Our initial investigation has confirmed that there are no issues with PancakeSwap's smart contracts.' It said the vulnerability was confined to the OLPC token contract and did not affect other liquidity pools or user funds, described the OLPC/LABUBU pool as a smaller pool on the platform, and said it was continuing to investigate and would share further findings.","heading":"Security Researcher and PancakeSwap Response","sources":[{"url":"https://bitcoinworld.co.in/pancakeswap-smart-contracts-not-at-fault-hack/","name":"PancakeSwap Smart Contracts Not To Blame In $1.1M Pool Hack - BitcoinWorld","type":"news_article","credibility":2},{"url":"https://en.bloomingbit.io/feed/news/114666","name":"PancakeSwap Says Smart Contracts Unaffected as OLPC/LABUBU Pool Hack Causes $1.1 Million Loss - Bloomingbit","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/06/20/pancakeswap-labubu-pool-exploited-for-1-1m-what-went-wrong/","name":"PancakeSwap Labubu Pool Exploited for $1.1M: What Went Wrong - CryptoTimes","type":"news_article","credibility":2},{"url":"https://ambcrypto.com/bnblabubu-exploit-drains-1-1mln-after-olpc-reserve-mismatch-details/","name":"BnbLabubu exploit drains $1.1mln after OLPC reserve mismatch - AMBCrypto","type":"news_article","credibility":2}],"severity":"medium"},{"content":"The OLPC token was extremely volatile during and after the attack: it fell to $3.89 before spiking to $4,190 (a reported 6,839% increase) and then corrected rapidly. The pattern is consistent with the attack mechanics, as the large burn of OLPC from the pool sharply reduced supply and caused an artificial price spike before market participants recognized the exploit and sold. The LABUBU token was also affected as its pool was drained.","heading":"Market Impact and Token Price Volatility","sources":[{"url":"https://fxdailyreport.com/pancakeswap-olpc-labubu-pool-suffers-1-1-million-exploit/","name":"PancakeSwap $OLPC/$LABUBU Pool Suffers $1.1 Million Exploit - FX Daily Report","type":"news_article","credibility":2},{"url":"https://ambcrypto.com/bnblabubu-exploit-drains-1-1mln-after-olpc-reserve-mismatch-details/","name":"BnbLabubu exploit drains $1.1mln after OLPC reserve mismatch - AMBCrypto","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/06/20/pancakeswap-labubu-pool-exploited-for-1-1m-what-went-wrong/","name":"PancakeSwap Labubu Pool Exploited for $1.1M: What Went Wrong - CryptoTimes","type":"news_article","credibility":2}],"severity":"high"},{"content":"As of June 24, 2026, no regulatory body (SEC, CFTC, DOJ or an equivalent international authority) had publicly announced an investigation, charges or enforcement action related to the exploit, and no law enforcement referrals or on-chain bounty recovery efforts had been announced. No attacker has been publicly identified by name. The laundering of proceeds through Tornado Cash involves OFAC-sanctioned infrastructure, and fund recovery is considered unlikely.","heading":"Regulatory and Law Enforcement Status","sources":[{"url":"https://bitcoinworld.co.in/pancakeswap-olpc-labubu-pool-hack-1-1-million/","name":"PancakeSwap OLPC/LABUBU Pool Exploited For $1.1 Million; Funds Moved To Tornado Cash - Bitcoin World","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/06/20/pancakeswap-labubu-pool-exploited-for-1-1m-what-went-wrong/","name":"PancakeSwap Labubu Pool Exploited for $1.1M: What Went Wrong - CryptoTimes","type":"news_article","credibility":2}],"severity":"high"},{"content":"The exploit belongs to a documented category of DeFi attack in which deflationary or burn-on-transfer token mechanics create reserve desynchronization vulnerabilities in AMM pools. PancakeSwap V2 and similar constant-product market makers assume that pool balances change only through explicit swap or liquidity operations tracked by the contract; tokens whose burns fire during transfers can break this assumption and create exploitable pricing distortions. The incident underscores the risk of listing low-liquidity or algorithmically novel tokens in permissionless AMM pools without prior security audits. It occurred amid approximately $60.03 million in total crypto losses in June 2026, per DeFiLlama data cited in reporting, including a $32 million Humanity Protocol exploit and the drainage of 1,158 ETH from Aztec Network.","heading":"Broader DeFi Risk Context","sources":[{"url":"https://ambcrypto.com/bnblabubu-exploit-drains-1-1mln-after-olpc-reserve-mismatch-details/","name":"BnbLabubu exploit drains $1.1mln after OLPC reserve mismatch - AMBCrypto","type":"news_article","credibility":2},{"url":"https://fxdailyreport.com/pancakeswap-olpc-labubu-pool-suffers-1-1-million-exploit/","name":"PancakeSwap $OLPC/$LABUBU Pool Suffers $1.1 Million Exploit - FX Daily Report","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/06/20/pancakeswap-labubu-pool-exploited-for-1-1m-what-went-wrong/","name":"PancakeSwap Labubu Pool Exploited for $1.1M: What Went Wrong - CryptoTimes","type":"news_article","credibility":2}],"severity":"medium"}],"timeline":[{"date":"2026-05","event":"About 46 days before the exploit, the OLPC token contract owner changed the decimalsValue parameter from 1 to an extremely large integer (reported as 7326680472586200649), embedding the condition needed to trigger disproportionate token burns via the _update function.","source":"CryptoTimes / AMBCrypto","source_url":"https://www.cryptotimes.io/2026/06/20/pancakeswap-labubu-pool-exploited-for-1-1m-what-went-wrong/"},{"date":"2026-05","event":"After the decimalsValue change, the OLPC contract owner renounced ownership by transferring control to a dead address, making the parameter permanent and the contract appear decentralized and immutable.","source":"CryptoTimes / CryptoNews.net / AMBCrypto","source_url":"https://cryptonews.net/news/security/33038552/"},{"date":"2026-06","event":"On June 20, the attacker (wallet 0x18d6...4fc188) deployed a malicious contract and routed about 10 OLPC tokens through it, triggering the _update function and burning 51.9 million OLPC and 124,000 LABUBU tokens to a dead address, desynchronizing the pool's reserves.","source":"PeckShield / CryptoTimes / FX Daily Report / KuCoin News","source_url":"https://www.cryptotimes.io/2026/06/20/pancakeswap-labubu-pool-exploited-for-1-1m-what-went-wrong/"},{"date":"2026-06","event":"The attacker exploited the reserve mismatch to drain the remaining LABUBU at distorted prices, routing proceeds through LABUBU/WBNB and WBNB/USDT pools to yield approximately 1,115,903 USDT (about $1.11 million; net gain reported at ~$960,000).","source":"CryptoTimes / AMBCrypto","source_url":"https://www.cryptotimes.io/2026/06/20/pancakeswap-labubu-pool-exploited-for-1-1m-what-went-wrong/"},{"date":"2026-06","event":"PeckShield publicly identified and tracked the exploit; SlowMist founder Yu Xian (Cosine) confirmed the OLPC contract's decimalsValue flaw.","source":"AMBCrypto / FX Daily Report / BloomingBit","source_url":"https://ambcrypto.com/bnblabubu-exploit-drains-1-1mln-after-olpc-reserve-mismatch-details/"},{"date":"2026-06","event":"Stolen funds bridged from BNB Chain to Ethereum; the attacker deposited 633.4 ETH into Tornado Cash and sent 0.0221 BNB and 0.0411 ETH to dead addresses.","source":"CryptoNews.net / BitcoinWorld / FX Daily Report","source_url":"https://cryptonews.net/news/security/33038552/"},{"date":"2026-06","event":"PancakeSwap issued a statement confirming its smart contracts were not at fault and that only the OLPC/LABUBU pool was affected; said it was continuing to investigate.","source":"BloomingBit / BitcoinWorld","source_url":"https://en.bloomingbit.io/feed/news/114666"}],"sources_used":[{"url":"https://www.cryptotimes.io/2026/06/20/pancakeswap-labubu-pool-exploited-for-1-1m-what-went-wrong/","name":"PancakeSwap Labubu Pool Exploited for $1.1M: What Went Wrong - CryptoTimes","type":"news_article","archive_url":"https://web.archive.org/web/20260727011703/https://www.cryptotimes.io/2026/06/20/pancakeswap-labubu-pool-exploited-for-1-1m-what-went-wrong/","credibility":2,"archive_timestamp":"2026-07-27T01:17:03+00:00"},{"url":"https://ambcrypto.com/bnblabubu-exploit-drains-1-1mln-after-olpc-reserve-mismatch-details/","name":"BnbLabubu exploit drains $1.1mln after OLPC reserve mismatch - AMBCrypto","type":"news_article","archive_url":"http://web.archive.org/web/20260622060539/https://ambcrypto.com/bnblabubu-exploit-drains-1-1mln-after-olpc-reserve-mismatch-details/","credibility":2,"archive_timestamp":"2026-06-22T06:05:39+00:00"},{"url":"https://cryptonews.net/news/security/33038552/","name":"PancakeSwap OLPC/LABUBU Pool Exploited for $1.1 Million; Funds Moved to Tornado Cash - CryptoNews.net","type":"news_article","archive_url":"https://web.archive.org/web/20260727094906/https://cryptonews.net/news/security/33038552/","credibility":2,"archive_timestamp":"2026-07-27T09:49:06+00:00"},{"url":"https://fxdailyreport.com/pancakeswap-olpc-labubu-pool-suffers-1-1-million-exploit/","name":"PancakeSwap $OLPC/$LABUBU Pool Suffers $1.1 Million Exploit - FX Daily Report","type":"news_article","archive_url":"https://web.archive.org/web/20260727100354/https://fxdailyreport.com/pancakeswap-olpc-labubu-pool-suffers-1-1-million-exploit/","credibility":2,"archive_timestamp":"2026-07-27T10:03:54+00:00"},{"url":"https://www.kucoin.com/news/flash/bnb-chain-olpc-labubu-pool-exploited-1-11m-stolen","name":"BNB Chain OLPC/LABUBU Pool Exploited, $1.11M Stolen - KuCoin News","type":"news_article","archive_url":"https://web.archive.org/web/20260727173447/https://www.kucoin.com/news/flash/bnb-chain-olpc-labubu-pool-exploited-1-11m-stolen","credibility":2,"archive_timestamp":"2026-07-27T17:34:47+00:00"},{"url":"https://en.bloomingbit.io/feed/news/114666","name":"PancakeSwap Says Smart Contracts Unaffected as OLPC/LABUBU Pool Hack Causes $1.1 Million Loss - Bloomingbit","type":"news_article","archive_url":"https://web.archive.org/web/20260727095723/https://en.bloomingbit.io/feed/news/114666","credibility":2,"archive_timestamp":"2026-07-27T09:57:23+00:00"},{"url":"https://bitcoinworld.co.in/pancakeswap-olpc-labubu-pool-hack-1-1-million/","name":"PancakeSwap OLPC/LABUBU Pool Exploited For $1.1 Million; Funds Moved To Tornado Cash - Bitcoin World","type":"news_article","archive_url":"http://web.archive.org/web/20260727202405/https://bitcoinworld.co.in/pancakeswap-olpc-labubu-pool-hack-1-1-million/","credibility":2,"archive_timestamp":"2026-07-27T20:24:05+00:00"},{"url":"https://bitcoinworld.co.in/pancakeswap-smart-contracts-not-at-fault-hack/","name":"PancakeSwap Smart Contracts Not To Blame In $1.1M Pool Hack - BitcoinWorld","type":"news_article","archive_url":"https://web.archive.org/web/20260727045940/https://bitcoinworld.co.in/pancakeswap-smart-contracts-not-at-fault-hack/","credibility":2,"archive_timestamp":"2026-07-27T04:59:40+00:00"},{"url":"https://en.bitcoinsistemi.com/watch-out-an-altcoin-liquidity-pool-on-pancakeswap-has-been-hacked/","name":"Watch Out: An Altcoin Liquidity Pool on PancakeSwap Has Been Hacked - Bitcoin Sistemi","type":"news_article","archive_url":"https://web.archive.org/web/20260727170925/https://en.bitcoinsistemi.com/watch-out-an-altcoin-liquidity-pool-on-pancakeswap-has-been-hacked/","credibility":2,"archive_timestamp":"2026-07-27T17:09:25+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-merge-writer","created_at":"2026-06-25T23:22:52.459747+00:00","updated_at":"2026-11-01T23:08:12.544+00:00"},"source_quality":{"total":9,"tier1":0,"tier2":0,"tier3":0,"unrated":9},"follower_count":null,"content_updated_at":"2026-11-01T23:08:13.160Z","last_fact_checked_at":"2026-11-01T23:08:12.859Z","fact_check_next_allowed_at":null,"update_next_allowed_at":null}