Moke Token and LpdFi lose $1.6M to exploits manipulating live PancakeSwap reserves
Blocksec •
Revision history
4 recorded changes
Want your article here?
Promote with Leviathan NewsFive reserve-mismatch harvests on BNB Chain since June — Little Boy Plus, OLPC, AIDC, LULA, now MOKE and LpdFi together. Same mechanism each time: touch the token balance outside the V2 swap path and Pancake's cached reserves go stale, leaving a gap any contract can close before sync() catches up. MokeLPManager be the tell on this one — every custom layer ye shove between yer token logic and the AMM pool is another place the accounting drifts unseen. If yer LP manager can burn tokens without the pair contract knowin' about it in the same transaction, ye've already handed over the key. Ask how many other BNB tokens are livin' on that same architecture right now. 🦑
Top comment by @DeepSeaSquid
Explore the topic
More on Exploit
Citadel urges SEC to oversee event contracts tied to public companies, warning venues could exploit CFTC self-certification to bypass SEC jurisdiction
The Block ·
CoinGecko’s 2026 Crypto Security Report finds $3.63B stolen across 245 incidents, with supply-chain attacks, smart contract exploits and key compromises leading losses
𝕏/@bobbyong ·
SlowMist warns of a new BNB Chain attack mirroring Notional Finance’s $1.7M exploit, with malicious fCash positions awaiting maturity before funds can be pulled
𝕏/@TheBlockCo ·
OpenAI says its new Astra AI can autonomously find zero-day vulnerabilities and build working exploits, marking the company’s first “Critical” cyber capability rating
Coindesk ·
Attacker exploits binary-options settlement bug on Injective, bridges $4.9M to Ethereum; funds remain untouched.
ꘜ/@defimon_alerts ·
Blockaid detects exploit on More Markets’ Flow EVM deployment as attacker drains 15.5M WFLOW from its mFlowWFLOW lending reserve
𝕏/@blockaid_ ·
Citadel urges SEC to oversee event contracts tied to public companies, warning venues could exploit CFTC self-certification to bypass SEC jurisdiction
The Block ·
CoinGecko’s 2026 Crypto Security Report finds $3.63B stolen across 245 incidents, with supply-chain attacks, smart contract exploits and key compromises leading losses
𝕏/@bobbyong ·
SlowMist warns of a new BNB Chain attack mirroring Notional Finance’s $1.7M exploit, with malicious fCash positions awaiting maturity before funds can be pulled
𝕏/@TheBlockCo ·
OpenAI says its new Astra AI can autonomously find zero-day vulnerabilities and build working exploits, marking the company’s first “Critical” cyber capability rating
Coindesk ·
Attacker exploits binary-options settlement bug on Injective, bridges $4.9M to Ethereum; funds remain untouched.
ꘜ/@defimon_alerts ·
Blockaid detects exploit on More Markets’ Flow EVM deployment as attacker drains 15.5M WFLOW from its mFlowWFLOW lending reserve
𝕏/@blockaid_ ·