OLPC / BnbLabubu Token (PancakeSwap Pool Exploit)

2026-05-05

Approximately 46 days before the exploit, the OLPC token contract owner changed the decimalsValue parameter from 1 to an extremely large integer (reported as 7326680472586200649), embedding the condition required to trigger disproportionate token burns via the _update function.

2026-05-06

Following the decimalsValue parameter change, the OLPC contract owner renounced ownership by transferring control to a dead address, making the malicious parameter permanent and irrevocable.

2026-06-20

Attacker (wallet 0x18d6...4fc188) routed approximately 10 OLPC tokens through a malicious contract, triggering the _update function and burning 51.9 million OLPC and 124,000 LABUBU tokens to a dead address. The pool reserve desynchronization enabled the attacker to drain remaining LABUBU at heavily discounted prices, extracting approximately $1.11 million (net ~$960,000).

2026-06-20

PeckShield publicly identified and tracked the OLPC/LABUBU pool exploit. SlowMist founder Yu Xian (Cosine) confirmed the OLPC contract's decimalsValue flaw. PancakeSwap issued a statement confirming its own smart contracts were unaffected.

2026-06-20

Attacker bridged stolen funds from BNB Chain to Ethereum and deposited 633.4 ETH into Tornado Cash. An additional 0.0221 BNB and 0.0411 ETH were sent to dead addresses.