PancakeSwap OLPC/LABUBU Pool Exploited for $1.1 Million; Funds Moved to Tornado Cash

Decentralized exchange PancakeSwap has suffered a security breach affecting its OLPC/LABUBU liquidity pool, with losses estimated at $1.1 million. The incident was first flagged by blockchain security firm PeckShield, which tracked the attacker’s movements on-chain.

How the Attack Unfolded

According to PeckShield’s analysis, the exploit targeted the OLPC/LABUBU pool on PancakeSwap, a popular automated market maker (AMM) built on the BNB Chain. The attacker swiftly bridged the stolen funds to Ethereum, a common tactic used to obscure the trail and access more liquid markets. Once on Ethereum, the hacker deposited 633.4 $ETH into Tornado Cash, a privacy mixer that complicates fund tracing.

Implications for DeFi Security

This incident adds to a growing list of exploits targeting decentralized finance protocols in 2025. While PancakeSwap itself has not confirmed the root cause, the attack underscores persistent vulnerabilities in liquidity pools, particularly those involving less established token pairs. The use of Tornado Cash, which has faced regulatory scrutiny globally, also highlights ongoing challenges in enforcing anti-money laundering measures within DeFi.

What This Means for Users

For liquidity providers and traders on PancakeSwap, the hack serves as a reminder of the risks inherent in DeFi. Users should exercise caution when participating in pools with low liquidity or newly listed tokens. The exploit may also prompt further security audits and protocol upgrades from PancakeSwap to prevent similar incidents.

Conclusion

The $1.1 million exploit of PancakeSwap’s OLPC/LABUBU pool is a significant security event in the DeFi space. While the attacker has moved funds through Ethereum and Tornado Cash, investigations are ongoing. This story continues to develop, and further details may emerge regarding the vulnerability and potential recovery efforts.

FAQs

Q1: What was the total loss from the PancakeSwap hack?
The loss is approximately $1.1 million, as reported by PeckShield.

Q2: Where did the attacker send the stolen funds?
The funds were bridged to Ethereum, and 633.4 $ETH was deposited into Tornado Cash, a privacy mixer.

Q3: Has PancakeSwap commented on the exploit?
As of this report, PancakeSwap has not issued an official statement regarding the root cause or recovery plans.