OLPC / BnbLabubu Token (PancakeSwap Pool Exploit)
Last changed 2026-11-01 · Fact-check review — Fact-check review (verdict: revise): the reviewer checked the page's claims against its sources; the judge moved the trust score from 2 to 0. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·2PEfYu…Q8BtSummary
On June 20, 2026, an attacker drained approximately $1.11 million from the OLPC/LABUBU liquidity pool on PancakeSwap V2 (BNB Chain) by exploiting a flaw in the OLPC token's _update function that burned pool reserves and desynchronized the pair's cached balances. About 46 days earlier, the OLPC contract owner had changed the decimalsValue parameter from 1 to an extremely large integer and then renounced ownership, a sequence security researchers and reporting outlets characterize as an alleged premeditated rug pull disguised as an external exploit. The proceeds were bridged to Ethereum and 633.4 ETH was deposited into Tornado Cash; no recovery or attribution has been announced.
Connected Entities
4 entities · 60 linked investigations- OLPC / BnbLabubu Token (PancakeSwap Pool Exploit)→mentioned with→Ethereum(70%)
- OLPC / BnbLabubu Token (PancakeSwap Pool Exploit)→mentioned with→Binance(70%)
- OLPC / BnbLabubu Token (PancakeSwap Pool Exploit)→mentioned with→OLPC Token / PancakeSwap OLPC-LABUBU Pool(80%)
- Binance→mentioned with→Ethereum(65%)
- OLPC Token / PancakeSwap OLPC-LABUBU Pool→mentioned with→Ethereum(80%)
- OLPC Token / PancakeSwap OLPC-LABUBU Pool→mentioned with→Binance(70%)
Timeline(7 events)
May 2026
About 46 days before the exploit, the OLPC token contract owner changed the decimalsValue parameter from 1 to an extremely large integer (reported as 7326680472586200649), embedding the condition needed to trigger disproportionate token burns via the _update function.
CryptoTimes / AMBCryptoMay 2026
After the decimalsValue change, the OLPC contract owner renounced ownership by transferring control to a dead address, making the parameter permanent and the contract appear decentralized and immutable.
CryptoTimes / CryptoNews.net / AMBCryptoJune 2026
On June 20, the attacker (wallet 0x18d6...4fc188) deployed a malicious contract and routed about 10 OLPC tokens through it, triggering the _update function and burning 51.9 million OLPC and 124,000 LABUBU tokens to a dead address, desynchronizing the pool's reserves.
PeckShield / CryptoTimes / FX Daily Report / KuCoin NewsJune 2026
The attacker exploited the reserve mismatch to drain the remaining LABUBU at distorted prices, routing proceeds through LABUBU/WBNB and WBNB/USDT pools to yield approximately 1,115,903 USDT (about $1.11 million; net gain reported at ~$960,000).
CryptoTimes / AMBCryptoJune 2026
PeckShield publicly identified and tracked the exploit; SlowMist founder Yu Xian (Cosine) confirmed the OLPC contract's decimalsValue flaw.
AMBCrypto / FX Daily Report / BloomingBitJune 2026
Stolen funds bridged from BNB Chain to Ethereum; the attacker deposited 633.4 ETH into Tornado Cash and sent 0.0221 BNB and 0.0411 ETH to dead addresses.
CryptoNews.net / BitcoinWorld / FX Daily ReportJune 2026
PancakeSwap issued a statement confirming its smart contracts were not at fault and that only the OLPC/LABUBU pool was affected; said it was continuing to investigate.
BloomingBit / BitcoinWorldDecision Log
- slot 464271312 · hash Exyz4Rqjq3NqcRTP55EsJq3ZDoBtKS8uxE5YwsjExcj3
- slot 464271306 · hash 9baaGK4CbbLxpRH9oP3PwgiZw8ZmjzyTBh8qNVopyTgQ
- slot 457981348 · hash EcreUdS5AZiUpb2WUrovvNGi42CjedUCAQzrqrF9LQcH
- slot 443505112 · hash GoFrgnwYCLtZde4SrygTEhQdkSqCGZAR9MuQUpHKa68g
- slot 443505087 · hash 6KajQkwEwDLTNsZwvzaxwZvcSjSjDRFbA5ayLdtzuixW
- slot 428903937 · hash CpmDnNNLotueFCoHRMTj95QhzgwtqmemvurHrTZ9Q7TC
This investigation is cryptographically anchored to the Solana blockchain (6 decisions). 9 of 9 cited source URLs have an Internet Archive snapshot.
model: claude-code-merge-writer
generated: 6/25/2026, 11:22:52 PM
last updated: 11/1/2026, 11:08:13 PM
4 viewsavoid.net — verified advice for a post-truth world