Heist, Hacks & Tornado Cash: How $2M Evaporated From NGP Protocol

by

So, the NGP protocol on BNB Chain just got hit with a flash loan heist worth $2 million. Yup, someone managed to swipe the stash and then played a game of crypto hide-and-seek using Tornado Cash. Spoiler alert: the token price took a nosedive and alarms screamed louder than your mum when you forgot to call her.

In arguably the fastest magic trick of 2025, a cool $2 million vanished from the NGP protocol on the BNB Chain. And where did the stolen loot go? Oh, just casually washed through Tornado Cash, raising all sorts of eyebrows among crypto aficionados – because nothing says “clean money” like sneaky mixers, right? 🕵️‍♀️🚿

Source – X (because who needs actual names when there’s mystery)

The eagle-eyed Blockaid spotted this digital heist quicker than you can say “rug pull” and promptly sent the community into full panic mode.

Source – X (again, secret squirrel style)

Result? NGP tokens took a dive worthy of an Olympic gymnast. Hackers swapped the stolen goodies for Ethereum, then passed the pile over to the Ethereum network – probably sipping champagne in a private jet somewhere while the rest of us watched the soap opera unfold.

A Glimpse Inside the Flash Loan Fiasco & Oracle Orchestra

Here’s the tea: The whole stunt hinged on a laughably fragile price oracle. The “getPrice” function? Yeah, it basically eyeballs just one Uniswap V2 pool – which in crypto-world-speak is like relying on your unreliable mate to tell you the weather.

That “spot price feed” was about as secure as a paper umbrella in a hurricane and totally ripe for manipulation – all within a single atomic transaction no less. Hackers borrowed a monster flash loan, twirled token swaps like a DJ at Coachella, pumped USDT reserves, and deflated NGP faster than your hopes for a quiet weekend.

Source – X (the usual suspects)

This smoke and mirrors distorted the getPrice() so the token looked dirt cheap – a discount binge nobody wanted except our friendly hackers.

Then, in a move that screams “plot twist”, they side-stepped the maxBuyAmountInUsdt limit, scooped up mountains of NGP, did a quick swap shuffle back, and cashed out their criminal cash to repay the loan. Genius level: hacker. Morals: questionable.

Source – X (because mystery is the spice of hacking life)

And if you’re wondering about transparency, the entire exploit is out there for all to see on BSCScan – so you can track who lost what and who took it. Spoiler: Data is public, shame is not.

Oh, and the hacker’s wallet? Fueled by Tornado Cash – the crypto equivalent of a magician’s disappearing act – making it a royal pain to follow the money trail. Use of Tornado Cash means this laundering job was no amateur hour. High stakes, high complexity, and a whole lot of “where did it all go?”

Read More

2025-09-19 11:09