BNB Chain’s New Gold Protocol Suffers $2 Million Hack on Launch Day

Summary:
The New Gold Protocol, a novel DeFi 3.0 staking protocol built on the BNB blockchain, was tragically hacked just hours after its launch on September 18, 2025. Utilizing two design flaws, the hacker managed to steal $2 million, highlighting vulnerabilities in blockchain protocols and the importance of robust security measures.

Key Takeaways

Launch and Hack: The New Gold Protocol launched on September 18, 2025, and was hacked within hours, resulting in a loss of approximately $2 million.
Design Flaws: The protocol was compromised due to two significant design vulnerabilities that the hacker exploited.
Flash Loans: The attacker utilized flash loans, allowing them to quickly accumulate assets and manipulate token prices before executing the hack.
Price Manipulation: By manipulating the NGP token price on PancakePair, the hacker was able to bypass both the buying limit and the cooldown limit set by the protocol.
Impact on NGP: Following the hack, the NGP token price crashed by 88%, indicating severe repercussions for the project's credibility and future.

BNB Chain’s New Gold Protocol hit by $2m launch-day hack - 1

Understanding the New Gold Protocol

The New Gold Protocol is a staking mechanism initiated on the BNB blockchain aimed at addressing the deficiencies in decentralized finance (DeFi), specifically the "lack of pricing rules." The project's whitepaper explained that many DeFi protocols suffer from a lack of standardized pricing mechanisms, leading to volatility and disarray in the market.

Positioned as a “next-generation DeFi 3.0,” the New Gold Protocol sought to outshine its competitors by offering intrinsic earnings and improved governance models. The team behind NGP aimed to foster transparency, fairness, and sustainability through innovative AI optimization.

With an objective to create an inclusive staking platform, The New Gold Protocol was designed to operate within a transparent, automated environment governed by smart contracts. It promoted its native token as deflationary via token burns and offered genuine yield distributions instead of speculative, inflationary rewards. However, it seems that the promise of transparency was ultimately insufficient to prevent the hack.

Details of the Hack

The malicious attack occurred soon after the NGP token was officially launched. In an effort to mitigate price-inflation attacks, the amount of NGP tokens available for purchase was limited, but the hacker ingeniously circumvented this restriction.

According to investigations by Hacken, a blockchain security firm, the hacker executed flash loans to amass a significant quantity of assets just six hours before the attack. Flash loans, a feature prevalent in DeFi platforms, enable quick borrowing of cryptocurrencies without collateral. This method can be used for various purposes including arbitrage trading and exploiting vulnerabilities within a protocol.

Utilizing an oracle-manipulation strategy, the hacker was able to influence the NGP token price by leveraging the liquidity pool reserves. By trading BUSD for NGP on PancakePair, the hacker swiftly inflated the price of NGP.

The New Gold Protocol implemented two critical limits: a purchase cap and a cooldown period for buyers. Both mechanisms were defeated as the hacker employed the “dEaD” address, allowing them to drain almost all BUSD tokens from the protocol through the sale of NGP. Ultimately, the attacker retrieved $1.9 million in cryptocurrencies and instantly converted the assets into BNB-based ETH.

Hacken reported that the next step involved depositing the stolen assets into Tornado Cash, using Ethereum bridged with Across. This move further manipulated the NGP price upward while leaving the protocol severely depleted. Following the theft, the value of NGP fell by 88%.

Despite its ambitious goals to innovate within the DeFi space and create a sustainable product, the New Gold Protocol’s neglect of security protocols led to catastrophic consequences. The company has not yet responded to the incident, and their last social media post promoting "stability meets growth" now feels ironic.

The Rise of Flash Loan Attacks

Since their introduction, flash loans have become a favored method for cybercriminals aiming to launch attacks on protocols. One of the most substantial incidents happened in March 2023 when around $197 million worth of Wrapped Bitcoin, Wrapped Ethereum, and other assets were siphoned from the Euler Finance protocol, exploiting a flaw in the platform’s calculation methods. Interestingly, the hacker later opted to return the stolen funds and issued an apology.

Additional high-profile flash loan exploits include the Cream Finance hack in 2021, which resulted in $130 million stolen, and a $12 million theft from Polter in 2024. In 2025, a flash loan formed part of a scheme to pilfer $223 million in cryptocurrencies from the Cetus protocol built on Sui.

These incidents serve as a cautionary tale, underscoring the critical need for robust security measures and code audits in the rapidly evolving world of decentralized finance.