PancakeSwap OLPC/LABUBI liquidity pool hack — June 2026

On 20 June 2026 the OLPC/LABUBI liquidity pool on PancakeSwap V2, on BNB Chain, was drained of roughly $1.1 million. OLPC's transfer logic treated transfers initiated by the pair contract itself as buy transactions and burned the transferred amount multiplied by a stored parameter, sending nothing to the recipient. Because PancakeSwap's skim() and sync() functions can be called by anyone, the attacker was able to force pair-originated transfers repeatedly, collapsing the OLPC side of the pool's reserves from about 51.93 million tokens to a fraction of a token. A far smaller quantity of LABUBI, about 124,000 tokens, was burned in the same sequence, leaving that side of the pool comparatively intact. The pool then priced LABUBI against almost no OLPC, and a small swap took the LABUBI reserve, which was routed through LABUBI/WBNB and WBNB/USDT and converted to USDT. Olympix, which analysed the transactions, put the take at 1,115,903.66 USDT in block 105326393 at 11:31 UTC after twenty skim() and twenty-one sync() calls, and identified the attacker. The Crypto Times, citing PeckShield, reported that the proceeds were bridged to Ethereum, converted into 633.4 ETH and deposited into Tornado Cash; it also put the attacker's net gain at about $960,000, against the roughly $1.12 million removed from the pool. Published figures otherwise cluster at about $1.1 million. DEXTools reported that the burn multiplier in the OLPC contract had been raised from 1 to 7,326,680,472,586,200,649 about 46 days before the drain, after which ownership was renounced, making the setting permanent. It described the configuration as looking premeditated. No party has been named and no charges have been brought, so this is recorded as an exploit of the token's transfer logic rather than an established insider act.