LULA token (BNB Chain) hack — July 2026

An attacker drained the PancakeSwap V2 LULA/USDT pool on BNB Chain at 16:08:29 UTC on 28 July 2026. This registry read the transaction: the attacker’s address received 578,295.91 USDT, and the pool’s USDT balance fell by 591,659.75. The headline is the attacker’s take, with the pool’s fall as the upper end. TenArmor flagged the attack first, and BlockSec Phalcon and CertiK published breakdowns on 29 July.

LULA’s recycle() function, callable by the token’s Rental contract, moved up to a third of the pair’s LULA straight out of the pair and then called sync(), so the reserves updated with no USDT leaving. According to the DeFiHackLabs reconstruction, the attacker first bought through a route that bypassed the token’s buy switch, then triggered Rental reward claims that each called recycle() and shrank the pair’s LULA reserve, and finally sold 4,999 LULA back for the pair’s USDT. CertiK reported that the attacker prepared about 12 days in advance and used a flash loan of about $237 million.

At 04:00 UTC on 29 July the LULA team sent the attacker an on-chain message offering not to pursue legal action if at least 25% of the funds, about $144,500, was returned within 36 hours, and threatening legal proceedings otherwise. This registry found no report of a return.