Briefing
A recently launched DeFi staking protocol, New Gold Protocol (NGP) on BNB Chain, suffered a critical exploit on September 18, 2025, resulting in the theft of approximately $1.9 million in Ethereum. The incident, occurring merely hours after the token’s launch, exploited a fundamental flaw in the protocol’s price oracle mechanism, which relied solely on a single Uniswap liquidity pool. This vulnerability enabled an attacker to execute a flash loan attack, artificially inflate the NGP token’s price, and subsequently drain significant assets, causing an 88% crash in the NGP token value.
Context
Prior to this incident, the DeFi landscape has consistently faced risks from protocols relying on insecure price oracles, particularly those deriving value from low-liquidity DEX pairs. The inherent immutability of smart contracts, once deployed, often renders fund recovery impossible, underscoring the critical need for robust pre-launch security measures. This exploit highlights a recurring vulnerability class where inadequate external data sourcing creates a significant attack surface for financial manipulation.
Analysis
The incident’s technical mechanics involved a sophisticated price oracle manipulation attack. The attacker first accumulated NGP tokens over several hours. Subsequently, a flash loan was utilized to execute massive USDT to NGP swaps on a single Uniswap liquidity pool, artificially inflating the NGP token’s perceived value. The protocol’s smart contract, designed to determine NGP’s price directly from these DEX pair reserves, was critically flawed in this reliance.
By routing flash-loan-driven swaps through the zero address, the attacker bypassed per-user buy limits and cooldowns, enabling the large-scale manipulation necessary to profit from their pre-acquired tokens. The stolen funds, approximately 443.8 ETH, were then converted to Binance-pegged ETH, bridged to Ethereum via the Across protocol, and subsequently deposited into Tornado Cash to obfuscate the transaction trail.
Parameters
- Protocol Targeted → New Gold Protocol (NGP)
- Blockchain → BNB Chain, Ethereum
- Vulnerability → Price Oracle Manipulation, Flash Loan Attack
- Financial Impact → ~$1.9 Million (443.8 ETH)
- Date of Exploit → September 18, 2025
- Attacker’s Method → Manipulated DEX pair reserves using flash loans and exploited zero address recipient logic
- Token Impact → NGP token price crashed 88%
Outlook
Immediate mitigation for similar protocols necessitates a multi-faceted approach to price oracle design, moving beyond sole reliance on single DEX pair reserves. Protocols must implement robust per-account and per-transaction limits, alongside strict whitelisting and control mechanisms for privileged recipients. This incident will likely reinforce the demand for aggressive pre-launch stress testing and independent security audits specifically designed to simulate flash-loan and oracle manipulation vectors. The rapid obfuscation of funds via mixers such as Tornado Cash underscores the ongoing challenge for forensic analysis and recovery efforts, potentially influencing future regulatory discussions on privacy tools.
