Suspected BSC attack involving LULA token causes about $578,100 loss
Security firms said the LULA token on BNB Smart Chain was exploited in a PancakeSwap V2 reserve-manipulation attack using a privileged recycle() function, with losses estimated at about $578,000 to $578,100.
BNB
CAKE
Fact Check
Multiple independent authoritative security sources corroborate all key elements of the claim. The SlowMist Hacked database records the LULA (BSC) incident with a $578,100 loss and describes the recycle() privileged function abuse plus a flash loan manipulating PancakeSwap V2 reserves. BlockSec Phalcon's alert independently describes the same recycle()-driven reserve-manipulation attack for ~$578K on the PancakeSwap V2 pair. The Odaily newsflash and CryptoTimes article both confirm the ~$578K loss figure and the exploit mechanics. The estimated loss range of $578,000-$578,100 matches exactly.
Summary
The LULA token on BNB Smart Chain appears to have been exploited for about $578,000 to $578,100 in a reserve-manipulation attack on its PancakeSwap V2 pool, according to TenArmor, BlockSec Phalcon and CertiK. The firms said the attacker abused a privileged recycle() function in the token’s smart contract to pull liquidity from the pair, distort recorded reserves and extract value. CertiK added that the attacker had prepared helper contracts 12 days earlier and used a flash loan of around $237 million to maximize the exploit.
Terms & Concepts
- BNB Smart Chain (BSC): A blockchain network formerly known as Binance Smart Chain.
- flash loan: Unsecured borrowing that must be repaid within a single blockchain transaction.
- smart contract: Self-executing code running on a blockchain that governs token and protocol behavior.