AISurf Rug Pull

Reported loss $112K
Rugpull

What happened

AISurf (AISC) is a BEP20 token on BNB Chain whose verified contract 0x564A4f36…79E8c2 stores no balances of its own. balanceOf and every transfer are delegated to a separate Accounting contract whose address the owner sets with setAccountingAddress, and that contract's code is not part of the verified source. De.Fi's REKT database lists the incident as a rug pull on 23 November 2023: the deployer 0x7e820e04…360382 removed liquidity worth 237,074 USD from the PancakeSwap pool, for a listed loss of 112,050 USD (474.02 WBNB), which was moved to another EOA and then split across several addresses.

PeckShield's alert instead describes the deployer swapping an amount of AISC far above the contract's 1,000,000-token supply for 1,002.93 (about $237K). Liquidity adding transaction: 0x7c68f884…691870; liquidity removal transaction: 0x59aa7dde…635235.

How it happened

  1. The constructor sets the supply and stores no balances: _totalSupply = 1000000 * 10 ** 9; emit Transfer(address(0), msg.sender, _totalSupply);. Balances are read from a separate contract: return Accounting(accounting).balanceOf(who);.
  2. Every transfer is handed to that external contract, with the Transfer event emitted first: emit Transfer(msg.sender, to, amount); return Accounting(accounting).doTransfer(msg.sender, msg.sender, to, amount);. transferFrom does the same after reducing the allowance.
  3. Only the owner chooses that contract: function setAccountingAddress(address accountingAddress) public { require(msg.sender == owner); accounting = accountingAddress; }. Whoever controls the chosen contract controls what every holder and the pair sees as their balance and whether any transfer succeeds, and the verified source does not show that logic. renounceOwnership exists, and a latest-block read on 2026-09-30 returned the zero address as owner; when it was renounced, and what the accounting contract does, is not established here.
  4. What was reported: PeckShield's alert says the deployer address swapped 100,100,100,100,100,100,100.1001 AISC for 1,002.93 (about $237K), a quantity far above the 1,000,000 AISC the contract reports as total supply. De.Fi lists the loss as a liquidity removal with 474.02 WBNB (112,050 USD) sent to another EOA and then distributed. The two accounts of the mechanism differ, and no transaction was opened to settle it.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract AISC

Evidence

Same attack technique

Browse all hacks →
Changpeng Zhao $454K lost Jewels $64K lost PAPABEAR $121K lost RepubliK $121K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes