New Gold Protocol Loses $2M in Hack, NGP Token Drops 88%

New Gold Protocol, a DeFi staking project, suffered a significant loss of approximately 443.8 Ethereum valued at $2 million due to an exploit on September 18. This incident led to the crash of its native NGP token by 88% within an hour.

The exploit was identified by blockchain security firms such as PeckShield and Blockaid.
Blockaid's analysis revealed a vulnerability in the protocol’s smart contract related to price oracle manipulation.

Flash Loan Attack Details

The attack exploited a critical flaw where the protocol determined NGP token’s price based on a single Uniswap liquidity pool.
The attacker used a flash loan to manipulate the pool's reserves, making the NGP token appear nearly worthless.
This allowed bypassing purchase limits and acquiring a large number of NGP tokens at low prices.
The attacker reversed the trade, repaid the flash loan, and profited 443.8 ETH, later obscuring funds via Tornado Cash mixer.

The incident raises concerns about transparency and trading volume issues with NGP and highlights increasing crypto hacks. It also fuels discussions on developer liability that many crypto firms urge lawmakers to address.