Fact-check findings
What an automated fact-checker found when it re-read Little Boy Plus - BSC DeFi Logic Exploit against the sources the page cites. Only the most recent review is shown.
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
unverifiable
3 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #5[unverifiable][awaiting moderator]in section: Financial Impact
“The drained funds were subsequently transferred to Tornado Cash, a mixer protocol, making on-chain tracing and potential recovery substantially more difficult.”
reviewerDrained funds were sent to Tornado CashOnly Crypto Times (blocked) would carry this; DARKNAVY and PANews do not mention it. - #7[unverifiable][awaiting moderator]in section: Protocol Overview
“Its tokenomics centered on a fixed supply of 21 million LBP tokens, drawing a conceptual parallel to Bitcoin's scarcity model.”
reviewerMarketing: fixed 21 million supply, no team, no pre-mine, no admin keysNo-team and no-admin-keys marketing is corroborated by the snippet. The 21M supply and Bitcoin comparison could not be read. - #9[unverifiable][awaiting moderator]in section: Vulnerability Classification
“No audit report for the LBPHashrate contract was referenced in any post-incident coverage.”
reviewerNo audit report was referenced in post-incident coverageA negative claim about all coverage; none of the readable sources mention an audit either way.
partially supported
1 claimThe cited evidence supports part of the claim but not all of it.
- #6[partially supported][awaiting moderator]in section: Post-Incident Response
“As of the date of reporting (June 18, 2026), the Little Boy Plus project had issued no public statement regarding the exploit, and no recovery efforts or compensation plans were announced.”
reviewerProject issued no statement / no recovery announcedDated to June 18 so correctly hedged, but the summary's 'as of publication' is now months old. No later coverage found.
confirmed
5 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in section: Financial Impact
“The total loss from the exploit was approximately 377,642 USDT, equivalent to roughly 610.56 WBNB at the time of the attack.”
reviewerAttacker drained about 377,642 USDT (about 610.56 WBNB)Figures match DARKNAVY and PANews. - #2[confirmed][no action needed]in section: Exploit: Logic Flaw in LBPHashrate Contract
“According to SlowMist's analysis, the _update function could be triggered via a zero-value transferFrom call, bypassing OpenZeppelin's standard allowance authorization check.”
reviewerZero-value transferFrom bypass triggers _update -> _harvest -> LBP.mintReward to the pairSupported by PANews. The specific call transferFrom(pair, DEAD, 0) was not in the fetched text, so that detail is not independently confirmed. - #3[confirmed][no action needed]in section: Reserve Manipulation via Flash Loan
“The attacker obtained a flash loan of approximately 7,772,960.68 USDT from the Moolah protocol and withdrew an additional approximately 34,088,143.96 USDT from PancakeSwap's Infinity Vault using the lock/take mechanism.”
reviewerFlash loan of about 7,772,960.68 USDT from Moolah and about 34,088,143.96 USDT from Infinity Vault; about 10.737M hLBP and about 207,166.985 LBP mintedMatches DARKNAVY. Note DARKNAVY describes the reserves as post-mint pair state; the page's 'instantaneous reserves' wording is a fair paraphrase. - #4[confirmed][no action needed]in section: Attacker Identifiers
“The exploit transaction hash is 0x55856d9fda4c5be5193561c7d775e823c3d6e499da44aab9da963daf61c50b0c, confirmed in block 104727184 on BNB Chain.”
reviewerAttacker addresses, tx hash and blockAddresses and hash match DARKNAVY. The 'helper EOA deployed the contract' framing is the page's reading of the EOA role. - #8[confirmed][no action needed]in the timeline
“2026-06-17”
reviewerTimeline: exploit on 2026-06-17 in block 104727184Date matches.