TrustPad

Quick Summary

TPAD token was rugpulled by the deployer, removing liquidity worth 240,006 USD from PancakeSwap pool, causing a total loss of
56,329 USD.




Details of the Exploit

TPAD is a BEP20 token trading on PancakeSwap. On Nov 23, 2023, the deployer removed liquidity from the LP pool, amounting to
240,006 USD. The stolen funds were then transferred to another EOA address and subsequently distributed among multiple addresses.
The total funds lost in this exit scam are 56,329 USD, equivalent to 390.58 WBNB.




Block Data Reference

Deployer Address:

https://bscscan.com/address/0x2Ca8Ec9dd0AE45CB890bdc1a7d08c69D5bA3b4fd




Liquidity Adding Transaction:

https://bscscan.com/tx/0xcf321926d9f66c1e34afa2dde17ccee82e079fcd767b7fd5d3ebc377d26260cf




Liquidity Removal Transaction:

https://bscscan.com/tx/0x0ccb4b81b587a0d81e0575020d857449c67c3ab0aeed0d732e2c5c3c6dc32fa0

Quick Summary

TrustPad, a DeFi launchpad on Binance Smart Chain, was exploited, resulting in the loss of 615.19 BNB worth approximately 152,487
USD.




Details of the Exploit

TrustPad is a DeFi launchpad running on the Binance Smart Chain. On November 7, 2023, the project's vulnerable smart contracts
were exploited by an attacker. The vulnerability was in the staking mechanism, allowing the attacker to perform multiple deposit
and withdraw transactions to exploit and withdraw roughly 615.19 BNB. The stolen funds were then deposited into TornadoCash,
making it difficult to trace the attacker's identity. The exploit resulted in a loss of approximately 152,487 USD worth of BNB.




Block Data Reference

Attacker Address:

https://bscscan.com/address/0x1a7b15354e2F6564fcf6960c79542DE251cE0dC9




Malicious Transaction:

https://bscscan.com/tx/0x191a34e6c0780c3d1ab5c9bc04948e231d742b7d88e0e4f85568d57fcdc03182




Malicious Contract Address:

https://bscscan.com/address/0x1694d7fAbf3B28f11D65DEEb9f60810DAa26909a




TornadoCash Deposit Transaction:

https://bscscan.com/tx/0xfe5543cea4e6d2e85e97de054ab92e0e3433acb49b04f53157f0ea10c0734eee

The contract owner could disable the transfer function, which restricted users in selling their tokens.