New Gold Protocol Suffers $2 Million Hack on Launch Day
The New Gold Protocol, an AI-controlled, self-described “DeFi 3.0” protocol, was hacked just hours after its launch on September 18, 2025. The hacker exploited two design flaws in the protocol, making off with nearly $2 million in cryptocurrency. This incident highlights the importance of robust security measures in DeFi protocols, even those with ambitious plans for sustainability and transparency.
What is the New Gold Protocol?
The New Gold Protocol is a staking protocol built on the BNB blockchain, designed to address the “lack of price stability” in many DeFi protocols. According to its whitepaper, the protocol aims to provide a transparent, automated environment maintained through smart contracts, with a native token that is deflationary due to token burns. The NGP team claimed that their AI-optimized approach would ensure transparency, fairness, and sustainability, but the hack has raised questions about the protocol’s security.
How was the New Gold Protocol Hacked?
The hack occurred shortly after the NGP token launch, with the attacker accumulating a large number of assets through flash loans from different accounts. Flash loans are a feature that allows for quick borrowing of cryptocurrency without collateral, often used for arbitrage trading or price manipulation. In this case, the hacker used oracle manipulation tactics, exploiting the protocol’s reliance on a liquidity pool to determine the NGP token price. By replacing BUSD with PancakePair for NGP, the attacker quickly pumped up the NGP price, then sold the tokens to drain the protocol’s funds.
Aftermath of the Hack
The stolen funds, worth approximately $1.9 million, were sent to Tornado Cash, a cryptocurrency mixing service, to conceal the attacker’s identity. The NGP price subsequently fell by 88%, leaving the protocol with a small amount of funds. The New Gold Protocol team has yet to comment on the incident, with their latest tweet, “Stability hits growth,” now seeming like a bitter irony. The hack has raised concerns about the security of DeFi protocols, particularly those that rely on complex smart contracts and AI optimization.
Other Notable Flash Loan Attacks
Flash loan attacks have become a common tactic used by hackers to exploit DeFi protocols. One of the largest flash loan attacks occurred in March 2023, when a hacker stole approximately $197 million from the Euler Finance protocol. Other notable examples include the Cream Finance hack ($130 million stolen in 2021) and the Polter hack ($12 million stolen in 2024). These incidents highlight the need for robust security measures and rigorous testing of DeFi protocols to prevent such attacks.
Source: https://crypto.news/bnb-chains-new-gold-protocol-hit-by-2m-launch-day-hack/
