Incident Overview
On August 2, 2026, LOOPSDAO's LpdFi protocol on BNB Chain was exploited for approximately $690,000 in USDC (netting ~$573,000 in profit) through a combination of spot price oracle manipulation and a flaw in the protocol's discrete daily interest accrual logic.
The attack targeted Lpd.price(), which derived token valuations directly from the instantaneous reserves of a PancakeSwap LPD/USDC liquidity pair without TWAP, liquidity thresholds, or price deviation guards. The attacker temporarily inflated the LPD spot price by ~5,163x via temporary liquidity swaps and invoked buy(), allowing them to record a massive $140M nominal USDC interest-bearing principal for a minimal LPD deposit. After rebalancing the pool and stepping across the daily issue boundary in the subsequent block (just one second later), the attacker called claimInterest(), which accrued a full 0.5% interest period on the bloated principal and forced the protocol to burn 1.68 million of its own Cake-LP tokens (with zero slippage bounds) to pay out the unbacked USDC.
Attacker Address: 0x5d289266…193f33
Attack Executor Contract: 0x7f5ad0a9…9ef711
Victim / Vulnerable Contract: 0xce6a6e44…7f295e
Setup Transaction: 0xbb5b8573…1c3588
Claim Transaction: 0x70bbe0aa…3315d6
Incident Report
Protocol Information
Market Context at Time of Hack
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to LOOPSDAO, these are the critical security checks that could have prevented this incident (August 2026).
- Verify all logic paths related to Oracle Issue are guarded by proper access controls and input validation - see the Oracle Manipulation & Price Manipulation attack class for patterns
- Audit oracle price feeds for manipulation risks - ensure time-weighted average prices (TWAPs) or multi-source aggregators are used, not spot prices
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next LOOPSDAO
The LOOPSDAO hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.