Sunday, August 2, 2026

LOOPSDAO

Funds lost

$573K

Attack type

Oracle Issue

Network

BNB Chain

Category

Yield Aggregator

Summary

On August 2, 2026, LOOPSDAO's LpdFi protocol on BNB Chain was exploited for approximately $690,000 in USDC (netting ~$573,000 in profit) through a combination of spot price oracle manipulation and a flaw in the protocol's discrete daily interest accrual logic.

Details of the Exploit

The attack targeted Lpd.price(), which derived token valuations directly from the instantaneous reserves of a PancakeSwap LPD/USDC liquidity pair without TWAP, liquidity thresholds, or price deviation guards. The attacker temporarily inflated the LPD spot price by ~5,163x via temporary liquidity swaps and invoked buy(), allowing them to record a massive $140M nominal USDC interest-bearing principal for a minimal LPD deposit. After rebalancing the pool and stepping across the daily issue boundary in the subsequent block (just one second later), the attacker called claimInterest(), which accrued a full 0.5% interest period on the bloated principal and forced the protocol to burn 1.68 million of its own Cake-LP tokens (with zero slippage bounds) to pay out the unbacked USDC.

Source: De.Fi REKT Database. Data as of November 5, 2026.