Hack history / 2026 / Hack or exploit
LULA
Hack or exploit on Jul 28, 2026 · Improper Access Control
SOURCES AGREE ON DATE AND LOSS · 3 SOURCES
Lost
$578K
dollars at the time
Returned
none listed
as the sources state it
Rank
#1,103
among thefts by dollars lost
What happened
On July 29, 2026, LULA (BEP-20 token on BSC) suffered a ~$578K exploit via business logic flaw. Attacker exploited an accessible recycle() function in the Rental contract to transfer LULA directly from PancakeSwap V2 pair, then manipulated pair reserves via sync() call. Repeated recycle() calls drained LULA reserves to near-zero, allowing small swap for nearly all USDT.
Details
- Date
- Jul 28, 2026
- Kind
- Hack or exploit
- Method
- Improper Access Control
- How in
- Smart contract bug
- Target
- Token
- Chains
- BNB Chain
Reported by
Related incidents
SUPERFORTUNE AI 2026 · Hack or exploit · $15.2M
Crypto DAO 2026 · Hack or exploit · $8.2M
Coinsbuy 2026 · Hack or exploit · $7.9M
New Market Trading 2026 · Hack or exploit · $4M
MANTRA Chain 2026 · Hack or exploit · $3.6M
Crypto DAO 2026 · Hack or exploit · $8.2M
Coinsbuy 2026 · Hack or exploit · $7.9M
New Market Trading 2026 · Hack or exploit · $4M
MANTRA Chain 2026 · Hack or exploit · $3.6M
Cite this page
SwanBluechip, "LULA hack, Jul 28, 2026: $578K lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/ht243d4bd170/ (data as of 2026-10-31).