OLPC / BnbLabubu Token (PancakeSwap Pool Exploit)
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·2PEfYu…Q8BtSummary
On June 20, 2026, an attacker drained approximately $1.1 million from the OLPC/LABUBU liquidity pool on PancakeSwap V2 (BNB Chain) by exploiting a logic flaw in the OLPC token's _update function, which triggered a massive burn of pool reserves. Approximately 46 days prior to the attack, the OLPC token contract owner had maliciously altered the decimalsValue parameter to an abnormally large integer before renouncing ownership, a sequence that security researchers and analysts widely characterize as a premeditated rug pull disguised as an external exploit. Stolen funds — 633.4 ETH — were bridged to Ethereum and deposited into Tornado Cash.
Connected Entities
4 entities · 60 linked investigations- OLPC / BnbLabubu Token (PancakeSwap Pool Exploit)→mentioned with→Ethereum(70%)
- OLPC / BnbLabubu Token (PancakeSwap Pool Exploit)→mentioned with→Binance(70%)
- OLPC / BnbLabubu Token (PancakeSwap Pool Exploit)→mentioned with→OLPC Token / PancakeSwap OLPC-LABUBU Pool(80%)
- Binance→mentioned with→Ethereum(65%)
- OLPC Token / PancakeSwap OLPC-LABUBU Pool→mentioned with→Ethereum(80%)
- OLPC Token / PancakeSwap OLPC-LABUBU Pool→mentioned with→Binance(70%)
Timeline(5 events)
5 May 2026
Approximately 46 days before the exploit, the OLPC token contract owner changed the decimalsValue parameter from 1 to an extremely large integer (reported as 7326680472586200649), embedding the condition required to trigger disproportionate token burns via the _update function.
CryptoTimes / AMBCrypto6 May 2026
Following the decimalsValue parameter change, the OLPC contract owner renounced ownership by transferring control to a dead address, making the malicious parameter permanent and irrevocable.
CryptoTimes / CryptoNews.net20 June 2026
Attacker (wallet 0x18d6...4fc188) routed approximately 10 OLPC tokens through a malicious contract, triggering the _update function and burning 51.9 million OLPC and 124,000 LABUBU tokens to a dead address. The pool reserve desynchronization enabled the attacker to drain remaining LABUBU at heavily discounted prices, extracting approximately $1.11 million (net ~$960,000).
PeckShield / CryptoTimes / KuCoin News20 June 2026
PeckShield publicly identified and tracked the OLPC/LABUBU pool exploit. SlowMist founder Yu Xian (Cosine) confirmed the OLPC contract's decimalsValue flaw. PancakeSwap issued a statement confirming its own smart contracts were unaffected.
PancakeSwap (official statement) / AMBCrypto20 June 2026
Attacker bridged stolen funds from BNB Chain to Ethereum and deposited 633.4 ETH into Tornado Cash. An additional 0.0221 BNB and 0.0411 ETH were sent to dead addresses.
CryptoNews.net / FX Daily ReportDecision Log
- hash: GoFrgnwYCLtZde4SrygTEhQdkSqCGZAR9MuQUpHKa68g
- hash: 6KajQkwEwDLTNsZwvzaxwZvcSjSjDRFbA5ayLdtzuixW
- hash: CpmDnNNLotueFCoHRMTj95QhzgwtqmemvurHrTZ9Q7TC
This investigation is cryptographically anchored to the Solana blockchain (3 events). 7 of 7 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 6/25/2026, 11:22:52 PM
last updated: 8/8/2026, 1:09:12 AM
4 viewsavoid.net — verified advice for a post-truth world