PeckShield said stolen assets were bridged to Ethereum and 633.4 ETH sent to Tornado Cash, while SlowMist’s Yu Xian linked the drain to an OLPC decimalsValue flaw set 46 days earlier.
The OLPC/LABUBU liquidity pool on PancakeSwap’s BNB Chain was drained of about $1.1 million, according to security researchers. PeckShield said the stolen assets were bridged to Ethereum and that 633.4 ETH was deposited into Tornado Cash, while the attacker also sent 0.0221 BNB and 0.0411 ETH to a deprecated address. SlowMist founder Yu Xian said the incident appeared to stem from an OLPC flaw involving an abnormally large decimalsValue of 7326680472586200649, set by the owner about 46 days earlier, which may have let attackers burn pair reserves and swap a small amount of OLPC for about 1.115 million USDT worth of LABUBU.