What happened
ArbTomb project was rugged by the $xToken deployer, resulting in the loss of 114,646 $USD worth of ETH.
On the day of its genesis launch, ArbTomb project experienced a rugpull on the Arbitrum layer-two chain. The attack affected ParbRewardPool contract which had $xToken as one of its assets. The attacker exploited their privilege over contracts by minting 1,000,000,000,000,000 $xTokens and transferring them into the pool since they were also deployers for this token's contract.
The exploit involved unverified source code for $xToken which allowed malicious actors to drain funds from the pool such as $WETH, $USDC, $ARB, and $SUSHI tokens. After gaining access to these funds the scammer swapped all stolen assets for 54.75 $ETH before bridging it onto Ethereum mainnet.
After that point, they used TornadoCash mixer service to move around some part (52 $ETH)of stolen funds before sending the rest (2.43$ ETH) directly to Binance hot wallet address.
Scammer address:
Stolen funds holder address:
Malicious transaction:
Bridging transaction:
Malicious contract:
Protocol details
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
