News

369 Guard

Global security awareness — not only PulseChain.

Permalink for this incident. Same content as the News feed — use Share to post it.

All newsAbout

Cross-chain security awareness in plain English. Not an audit. Not financial advice. We never publish drain recipes or exploit steps. News items are research snapshots from public reporting — not always a full 369 deep-dive.

highBNB Chaindefi

LpdFi (BSC): ~$690k via flash + spot DEX price

2 Aug 2026: Defimon flagged ~$690k (~693.5k USDC) drained from LpdFi / LOOPSDAO on BNB Chain in one transaction. The protocol priced LPD from live PancakeSwap LPD/USDC reserves with no time-weighted or manipulation guard. An attacker warped that pool in the same transaction, made interest accounting look far larger than the collateral, then was paid by burning the protocol’s own LP position and withdrawing USDC. Confirmed firm alert + BscScan success tx — textbook flash-loan + spot-oracle pattern, not a rumor thread.

369 take: If a protocol reads price from a live DEX pool and pays from shared LP or stables in the same window, flash loans can print fake value. Prefer time-weighted or multi-source prices, hard deviation bands, and claim caps — treat spot reserves as untrusted. Pulse lesson: same Allbridge-shaped gun on any PulseX / UniV2-style quote used for mint, interest, or redeem.