LW Hack

Reported loss $49K
BNB Chain
Other

What happened

On May 12, 2023 (UTC), an attacker used a flash loan to drain about $48,000-$50,000 in USDT from LW, a BEP-20 token trading on PancakeSwap. The attack abused LW's automatic buyback: a wallet named marketAddr in the token's logic, holding about 173,272 USDT, was used to buy LW and push its price up, and the attacker could trigger those buybacks at will.

The attacker borrowed 1,000,000 USDT, bought LW, repeatedly forced the buyback wallet to buy LW at rising prices, then sold their LW back for USDT, repaid the loan and kept the difference. PeckShield, MetaTrust, Hexagate and others flagged the attack, and the LW price fell by roughly 69-80%. About 150 BNB of the proceeds was sent through Tornado Cash, and no funds were recovered.

Attacker: 0x4404de29913e0fd055190e680771a016777973e5

Attack contract: 0xa4fbc2c95ac4240277313bf3f810c54309dfcd6c

Attack transaction: 0xb846f3aeb9b3027fe138b23bbf41901c155bd6d4b24f08d6b83bd37a975e4e4a

How it happened

  1. The attacker flash-borrowed 1,000,000 USDT from a PancakeSwap pair and swapped it for LW.
  2. In a loop, the attack contract sent LW to the LW/USDT pool, called skim() to pull the excess back, and sent 1 wei of BNB to the LW token contract. That payment ran the contract's buyback, which spent 3,000 USDT from marketAddr to buy LW and push the price up.
  3. The loop repeated while marketAddr still held more than 3,000 USDT, so the buyback wallet kept buying LW at ever higher prices.
  4. The attacker swapped all their LW back to USDT at the inflated price, repaid the flash loan with its fee, and kept about $48,000-$50,000.
  5. The proceeds were converted and about 150 BNB was moved through Tornado Cash.

Protocol details

Classification Token / Oracle Manipulation
Protocol Type Exploit/Other
Affected asset / contract LW
Implementation language Solidity

Evidence

Understand the attack patterns

Compare incidents →
Oracle Manipulation & Price Manipulation

Same attack technique

Browse all hacks →
Ethereum Fire Token $24K lost BNB Chain Black Hole $1.3M lost BNB Chain DKP Token $79K lost BNB Chain BlackGold $18K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes