Abandon Hope all ye who enter here.
$1.86M was stolen from Hope Finance on Monday.
The project, an Arbitrum-based Tomb-fork, published a tweet accusing a team member of rugging the project, along with KYC information.
FUCKING SCAMMER!!!! HE SCAMMED COMMUNITY FOR 2 MLN DOLLARS
The official comms didn’t mince their words, even as they advised users on how to use the emergencyWithdraw function to attempt to salvage funds:
Steps to withdraw your staked LP from the this fucking scam protocol
While the official story may be of a dev gone rogue, the tx preparing the rug was approved by all three accounts on the team’s multisig. And faked KYC is not hard to come by.
For users, the situation seems…
According to Certik’s analysis:
In preparation for the @hope_fin exit scam, a fake router was deployed in txn 0xf188.
In txn 0x1b47,
_swapExactTokenForTokensvariable was set to wallet address, 0x957D.
GenesisRewardPool.openTrade()is called to borrow USDC, GenesisRewardPool transfers WETH to TradingHelper to convert to USDC.
Instead of swapping, USDC was sent to 0x957D.
Rug puller prep address: 0xdfcb9a03fbe9f616ee6827cd1b753238d53c6145
Hope Finance Multisig: 0x8ebd0574d37d77bdda1a40cdf3289c9770309aa7
The USDC received was swapped to ETH, for a total of 1095 ETH, which was then bridged to Ethereum via Celer and finally deposited into Tornado Cash.
The project had two audits prior to launch, by Cognitos (the code passed despite auditors flagging two ‘major’ issues, neither of which related to the mechanism used to rug) and AuditRateTech (who appear to have deleted the audit report, although a KYC certificate still remains on their site).
It’s impossible to know whether the doxxed individual accused by the team is truly to blame.
According to Streetview, the address given in the ID is a vacant lot.
And with many other possible explanations: bought KYC or even framed by someone else from the project with access to official comms.
It’s possible that this case will end in whoever is responsible being brought to justice…
But don’t get your Hopes up.
REKT serves as a public platform for anonymous authors, we take no responsibility for the views or content hosted on REKT.
donate (ETH / ERC20): 0x3C5c2F4bCeC51a36494682f91Dbc6cA7c63B514C
REKT is not responsible or liable in any manner for any Content posted on our Website or in connection with our Services, whether posted or caused by ANON Author of our Website, or by REKT. Although we provide rules for Anon Author conduct and postings, we do not control and are not responsible for what Anon Author post, transmit or share on our Website or Services, and are not responsible for any offensive, inappropriate, obscene, unlawful or otherwise objectionable content you may encounter on our Website or Services. REKT is not responsible for the conduct, whether online or offline, of any user of our Website or Services.
you might also like...
Coinbase’s compliant and grown-up L2 is already a shitshow. BALD pulled the rug for $23M, and the deployer has some interesting connections... YOLO-mania is in full force while DeFi burns.
Kannagi Finance, a yield aggregator on zkSync pulled the rug on Saturday, dropping TVL from $2.1M to $0.17. The auditors may have highlighted 'centralised aspects' but, in this industry, who reads the fine print?
Yesterday, DeFiLabs rugged $1.6M from its users on BSC via a backdoor function in their staking contract. Random projects rugging on BSC is nothing new. The shitcoin casino claims another set of victims.