BNB Chain’s latest project, The New Gold Protocol (NGP), faced disaster within hours of its debut on September 18, 2025. Touted as a next-generation “DeFi 3.0” staking platform powered by AI, the project collapsed almost immediately after hackers exploited critical flaws in its design, draining nearly $2 million.
Aiming for “sustainable DeFi”
NGP was introduced as a bold attempt to address volatility and inefficiencies in decentralized finance. According to its whitepaper, the platform sought to establish clear pricing rules, promote fairness through AI optimization, and provide real yield instead of speculative incentives. Its native token was positioned as deflationary, relying on automated burns and transparent governance.
The project promoted itself as a solution for transparency and accountability in DeFi, but its security architecture proved fatally weak.
How the exploit unfolded
Just hours after launch, an attacker found a way to bypass NGP’s safeguards. According to blockchain security firm Hacken, the hacker executed a classic flash loan exploit, borrowing large sums of crypto across multiple accounts.
By manipulating NGP’s price oracle—which derived value from its liquidity pool—the attacker artificially inflated the token price. They then bypassed NGP’s buy and cooldown limits by routing transactions through a “dEaD” address.
Once the token’s price was manipulated upward, the attacker drained nearly all the BUSD liquidity, walking away with roughly $1.9 million. The stolen funds were quickly converted into ETH via BNB Chain and laundered through Tornado Cash.
Within hours, NGP’s token price collapsed 88%, leaving investors with heavy losses.
A familiar DeFi weakness
The incident adds to a long list of flash loan attacks that continue to plague decentralized finance. The most infamous example was the Euler Finance exploit in 2023, when nearly $197 million was stolen—though eventually returned by the attacker. Other high-profile cases include Cream Finance ($130M in 2021) and Cetus Protocol ($223M in 2025).
Despite repeated warnings from auditors and security firms, many new protocols still fail to implement adequate protections against oracle manipulation and flash loan abuse.
Silence from the team
So far, the NGP team has not issued an official response. Ironically, the project’s last tweet, posted just hours before the exploit, read: “stability meets growth.” For users and investors, that message now feels like a cruel reminder of what might have been.
The NGP hack highlights how overpromising and undersecuring remain recurring problems in the DeFi sector, where innovation often outpaces safety.
