New Gold Protocol (NGP), a decentralized finance (DeFi) platform operating on BNB Chain, was hit with a $2 million attack on Wednesday. The attack targeted the protocol’s liquidity pool, resulting in significant losses.
NGP Protocol on BNB Chain Loses $2 Million
Web3 security firm Blockaid explained that the attack was based on price oracle manipulation. The attacker targeted the getPrice function in the NGP smart contract. This function calculates the token price by directly referencing Uniswap V2 pool reserves. However, according to Blockaid, “the instant price from a single DEX pool is not secure because attackers can easily manipulate reserves with a flash loan.”
The attacker executed a large swap using a flash loan for a large amount of tokens. This increased the pool’s USDT reserves, decreased the NGP reserves, and caused the price oracle to report an artificially low value. This manipulation allowed the contract’s transaction limit to be exceeded, allowing the attacker to acquire a large amount of NGP tokens at a low price.
On-chain security firm PeckShield reported that the stolen funds were transferred through Tornado Cash. The NGP token price also plummeted by 88% following the attack.
This incident is the latest in a series of attacks targeting DeFi protocols. Last week, the Sui-based Nemo Protocol suffered a similar $2.6 million loss.
According to Chainalysis data, more than $2 billion was stolen from crypto services in the first half of 2025 alone. This figure is higher than the same period in previous years, indicating increasing security risks in the sector.
*This is not investment advice.