On June 17, 2026, Little Boy Plus was exploited for ~$377.6K USDT when a zero-value transferFrom call bypassed authorization checks in the custom transfer logic. This enabled the attacker to mint LBP tokens directly into the PancakeSwap pair, creating a reserve imbalance exploitable via swap.

On June 17, 2026, Little Boy Plus — a fully decentralized DeFi mining protocol on BSC claiming “no team, no admin keys” — was exploited. An attacker exploited a logic vulnerability in the LBPHashrate contract’s _update() function. By triggering it with a zero-value transferFrom call (bypassing OpenZeppelin authorization), the attacker unauthorizedly called _harvest and minted LBP tokens directly to the PancakeSwap LBP/USDT pair via mintReward. This inflated the pair’s balance without updating reserves, allowing the attacker to drain ~377,642 USDT (~$367k–$378k) through PancakePair.swap(). The funds were later sent to Tornado Cash.