On August 2, 2026, LpdFi (LOOPSDAO's lending product on BNB Chain) was drained of ~$690K when an attacker flash-borrowed USDC and manipulated the PancakeSwap LPD/USDC pair price via donate-and-sync. The inflated price was used to compute interest owed, which the protocol paid by burning its own LP position and forwarding 99% of the USDC proceeds to the attacker.

LOOPSDAO’s LpdFi protocol on BSC was exploited. The attacker used a flash loan to manipulate the spot price of the thin PancakeSwap LPD/USDC pair (no TWAP or deviation guard), opened a massively inflated interest-bearing position with minimal LPD, and claimed interest right across the daily settlement boundary. This triggered the protocol to burn its own Cake-LP and pay out the inflated amount, draining approximately $690,000.