Little Boy Plus (LBP) hack — June 2026
Incident facts
| Date of incident | |
|---|---|
| Publicly disclosed | June 17, 2026 |
| Target type | Token contract |
| Loss | $377,643Price at time of incident |
| Method | Oracle or price manipulationLBP's hashrate rewards were sized from the LBP/USDT pool's post-mint reserves, so the attacker inflated the reserves with flash-loaned USDT, minted outsized rewards and dumped them into the pool |
| Chains | BNB Chain |
| Outcome | Unresolved |
What happened
Little Boy Plus (LBP), a token on BNB Chain, lost 377,643 USDT from its LBP/USDT pool on 17 June 2026, in a transaction at 08:35:38 UTC. Defimon Alerts reported it that evening, estimating the loss at about $367,000.
According to Defimon, the attacker flash-borrowed 7.77m USDT from Moolah and took 34m USDT from PancakeSwap's Infinity vault, transferred 5.79m USDT into the LBP/USDT pair and minted liquidity. The LBP hashrate contract sized its rewards from the pair's reserves after that mint, so it issued about 10.7m hashrate units and roughly 141,000 LBP of rewards, which were dumped back into the pair.
This registry read the receipt: the pair lost 377,642.54 USDT, which the attacker swapped for 610.56 BNB; DeFiHackLabs records the same 610.56 BNB, after a 5 BNB payment to the block builder. The pool's loss is recorded. No statement from the project has been found.
Sources
- Defimon Alerts on XSecondary · retrieved 2026-10-06
- DeFiHackLabs exploit reconstructionSecondary · retrieved 2026-10-06
- BNB Chain transaction receipt, read by this registryOn-chain · retrieved 2026-10-06
Changes to this entry
- Recorded on 6 October 2026 in a backfill of 2026 incidents that this registry had missed, found through DeFiHackLabs' reproduction list. The amount was checked against the transaction receipt, read by this registry from a public node.
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "Little Boy Plus (LBP) hack — June 2026", iTokenly, accessed 2026-10-06, https://itokenly.com/hacks/little-boy-plus-lbp-june-2026https://itokenly.com/hacks/little-boy-plus-lbp-june-2026Permalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.