What happened
On September 18, 2025, New Gold Protocol's NGP token on BNB Chain lost an estimated $2 million in a flash-loan-assisted price-oracle manipulation. The token's getPrice logic used instantaneous NGP/USDT pool reserves, while transfer-fee and sync behavior could further distort those reserves and permit the liquidity pool to be drained.
How it happened
- The attacker took large USDT flash loans and manipulated the NGP/USDT pool's instantaneous reserves.
- It used the resulting getPrice value to bypass intended purchase limits.
- A whitelisted DEAD address bypassed additional buy-count and cooldown protections.
- The attacker triggered sell-side fee and sync behavior, sold at an inflated price, drained pool liquidity and repaid the loans.
Protocol details
Classification
Token / Oracle Manipulation
Protocol Type
Exploit/Flash Loan Attack
Affected asset / contract
NGP
Implementation language
Solidity
Protocol links
@newgoldprotocol
Evidence
- report @CertiKAlert incident report x.com
- report @PeckShieldAlert incident report x.com
- report Report blockchain.news
- analysis DeFiLlama defillama.com
- analysis NGP Token Hack Analysis blog.solidityscan.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
