Chainalysis said Hexagate detected an attack on the LpdFi protocol yesterday, with losses estimated at about $700,000. According to the monitoring details provided, the attacker used a flash loan of roughly $44 million and manipulated the price of the LPD token on a decentralized exchange, pushing it up by 71x. The inflated price was then used to fake a deposit worth around $140 million inside the protocol, even though the tokens involved were valued at only about $2 million. One second later, just after crossing the protocol’s daily interest settlement boundary, the attacker collected a full day of interest on that exaggerated position. The move then triggered the liquidation of the protocol’s entire liquidity pool and released the stolen funds. After repaying all loans, the attacker walked away with an estimated profit of about $700,000. The funds were then moved through Relay and TornadoCash.

LpdFi on BNB Chain was exploited in a flash-loan attack that drained roughly $690,000, according to monitoring from Defimon Alerts. The tracker said the flaw came from LpdFi’s Lpd.price() function, which pulled the LPD price directly from spot reserves in the PancakeSwap LPD/USDC pair without using a time-weighted average price or other manipulation safeguards. By borrowing USDC through a flash loan, the attacker was able to skew the pair’s reserves and make the order’s uAmount represent “interest” worth far more than the value of the LPD collateral behind it. Defimon said the attacker then used claimInterest(), which called removeLp(), to pay out that inflated interest by burning the protocol’s own PancakeSwap LP position, extracting USDC and forwarding 99% of it to the caller. The entire LpdFi LP stack, about 1.68 million LP, was removed, and around 693,000 USDC was paid to the attacker in a single transaction.