PancakeSwap Pool Hack Drains $1.1M, Smart Contracts Safe

PancakeSwap confirmed Friday that a hack targeting its OLPC/LABUBU liquidity pool resulted in roughly $1.1 million in losses – but the platform's core smart contracts remain untouched.

The decentralized exchange posted on X that it was aware of reports tied to the specific pool. An initial investigation found no vulnerabilities in PancakeSwap’s own contract code. The team said it is continuing to probe the incident and will share more details when available, urging users to rely only on official channels for updates.

On-chain security firm PeckShield first flagged the exploit. According to its analysis, the attacker drained the OLPC/LABUBU liquidity pool, then shifted the stolen funds to the Ethereum network. From there, the hacker deposited 633.4 Ether into Tornado Cash, a privacy mixer that obscures transaction trails.

The breach appears to be isolated to a single third-party pool, not a flaw in PancakeSwap’s broader infrastructure. That distinction matters for traders who stake liquidity across the platform. If the exploit had hit the base-layer contracts, a much wider set of positions could have been at risk.

Still, the incident adds fresh uncertainty around BNB Chain-based DeFi pools. OLPC and LABUBU are relatively niche tokens, and the $1.1 million figure – while modest by crypto-hack standards – is a real loss for the liquidity providers caught in the crossfire. The mixer move also indicates the attacker intends to cash out without leaving an easy trail.

For now, the watch item is PancakeSwap’s ongoing investigation. The team has not said whether it plans to compensate affected users or pursue any recovery actions. Traders should monitor the exchange’s official X account and blog for the final post-mortem. Until then, caution on small-pool positions is warranted.