Briefing
The New Gold Protocol, an AI-driven DeFi 3.0 staking platform on BNB Chain, was exploited for approximately $1.9 million just hours after its launch on September 18, 2025. The attack leveraged a flash loan to manipulate the protocol’s internal pricing oracle, leading to the unauthorized minting and subsequent draining of BUSD tokens. This incident highlights severe vulnerabilities in the protocol’s design, resulting in an 88% plummet in the NGP token price and significant financial loss for early participants.
Context
Prior to this incident, the DeFi ecosystem has consistently faced a prevailing attack surface rooted in price oracle manipulation and flash loan vulnerabilities. Many protocols, especially those newly launched, often exhibit a lack of standardized mechanisms for behavior pricing, rendering them susceptible to economic exploits. The ability to borrow vast amounts of capital without collateral via flash loans provides threat actors with the means to execute sophisticated price manipulation attacks, a known class of vulnerability that has historically resulted in millions in losses across various platforms.
Analysis
The core system compromised was the New Gold Protocol’s internal token pricing mechanism, which determined the NGP token price by scanning its reserves in the DEX’s liquidity pool. The attacker initiated the exploit by accumulating a high volume of assets through flash loans across different accounts. This enabled them to execute a series of BUSD to NGP swaps on PancakePair, artificially inflating the NGP token’s price.
Crucially, the attacker bypassed the protocol’s integrated buying and cooldown limits by designating a “dEaD” address as the recipient, thereby circumventing intended security controls. This chain of cause and effect allowed the attacker to then sell the inflated NGP tokens, draining nearly all BUSD from the protocol’s liquidity pools, ultimately converting the stolen $1.9 million into BNB-based ETH and channeling it through Tornado Cash.
Parameters
- Protocol Targeted → New Gold Protocol
- Attack Vector → Flash Loan, Price Oracle Manipulation
- Financial Impact → ~$1.9 Million
- Blockchain → BNB Chain
- Vulnerability → Flawed Internal Pricing Oracle, Limit Bypass
- Funds Destination → Tornado Cash
Outlook
In the immediate aftermath, users should exercise extreme caution with nascent DeFi protocols, especially those making “DeFi 3.0” claims without transparent, verifiable security audits. This incident will likely establish new best practices emphasizing the critical need for robust, decentralized external price oracles and comprehensive pre-launch security audits that specifically address economic attack vectors. The contagion risk extends to similar protocols that rely on internal, easily manipulated pricing mechanisms, necessitating a systemic review of smart contract logic and a shift towards more resilient oracle solutions across the ecosystem.
Verdict
This incident underscores the critical necessity for comprehensive security audits and robust oracle mechanisms to safeguard nascent DeFi protocols against sophisticated economic exploits.
Signal Acquired from → crypto.news
