What happened
Animoon (ANI) is an Ethereum NFT collection of up to 9,999 tokens sold at 0.2 ETH each from the contract 0x988a3e98…349ba2, deployed on 7 January 2022 by 0x81d3ec77…17fe3b. The contract holds no escrow or roadmap conditions: the owner can call withdraw() at any time, and it sends 68% of the mint ETH to the owner, 30% to 0x7c60e482…feb6eb and 2% to 0x2098145e…5605c7, the three addresses the live record names as scammer addresses A, B and C. Two withdraw() calls on 16 and 18 January 2022 moved about 1,671 ETH out of the contract, 1,669 ETH of it in the second call. The collection used recolored Pokémon artwork, was promoted by Jake Paul and promised a play-to-earn game, holder trips and monthly payouts for 15 legendary cards; by early June 2022 the team had deleted its website and Twitter account and closed its Discord chat, and reports put the loss at about $6.3M.
De.Fi's listing adds that the funds were then sent to a Binance hot wallet, citing transactions 0x12a6eb67…533422, 0x9aecb0b6…ea6dad and 0x4e31f03f…b2b9b2.
How it happened
- Buyers minted ANI through
buyorpresale, each requiringmsg.value >= tokenPrice * _countwithtokenPrice = 0.2 ether; the ETH stayed in the NFT contract. - Nothing in the contract ties that ETH to delivery of the game or any roadmap item.
withdraw()is guarded only byonlyOwnerand pays out the whole balance to three hard-coded shares: 68% toowner(), 30% to 0x7C60E482…FEB6EB and 2% to 0x2098145E…5605C7. - The owner 0x81d3EC77…17Fe3b called
withdraw()on 16 January 2022 (tx 0x9fc895ed…fa0149, 2.2 ETH) and on 18 January 2022 (tx 0x043ca640…670a75), which sent about 1,135.2 ETH, 500.8 ETH and 33.4 ETH to the three addresses. - The team later stopped posting, changed the promised legendary-card payouts to a share of future game income, then deleted the website and Twitter account and disabled the Discord chat, leaving holders with NFTs and no product.
Protocol details
Evidence
- report Report cryptotimes.io
- report Report breadcrumbs.app
- transaction Animoon contract creation transaction etherscan.io
- transaction Etherscan transaction 0x043ca640...0a75 (withdraw, 18 Jan 2022) etherscan.io
- transaction Etherscan transaction 0x9fc895ed...0149 (withdraw, 16 Jan 2022) etherscan.io
- transaction etherscan.io transaction 0x12a6…3422 etherscan.io
- transaction etherscan.io transaction 0x4e31…b9b2 etherscan.io
- transaction etherscan.io transaction 0x9aec…6dad etherscan.io
- address Animoon verified contract code on Etherscan etherscan.io
- address etherscan.io address 0x2098…05c7 etherscan.io
- address etherscan.io address 0x7c60…b6eb etherscan.io
- address etherscan.io address 0x81d3…fe3b etherscan.io
- analysis Explained: The Animoon Rug Pull (June 2022) halborn.com
- analysis Animoon rug pulls for $6.3 million web3isgoinggreat.com
- analysis Web Archive web.archive.org
- analysis Sourcify exact match for 0x988a3e9834f1a4977e6f727e18ea167089349ba2 on Ethereum repo.sourcify.dev
- analysis De.Fi REKT database listing for AniMoon (ANI) de.fi
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
