ArchWay Fake Rug Pull

Reported loss $207K
Rugpull

What happened

ARCHWAY (ARCH, 9 decimals) at 0xE6Eff43c…38D572 is a fake BEP-20 token that copies the name of the Archway project. It was deployed on BNB Chain on 2023-06-25 by 0xD2010607…a8003E, which receives the entire 100,000,000-token supply in the constructor. CertiK Alert flagged it on 2023-06-30 as a large liquidity removal by the deployer, about 70,000 USD from the pool, and called the token a honeypot. De.Fi's REKT database lists the total loss as 207,371 USD.

The contract is a fee-on-transfer template whose owner can tune fees, switch trading off, block individual addresses from sending and cap sell size, while the owner and the fee wallets are exempt. Because liquidity is held by whoever supplied it, the pool itself could be emptied without any special function.

The listing's chain evidence, kept here: scammer address 0xd2010607…a8003e; liquidity removal transactions 0xc5d1ad9e…0d3e41 and 0xbb2aa808…b08784; a funds transfer in 0x730f5fc7…d5a4cd. The listing says the deployer ran several simultaneous transactions before draining the pool to raise trading volume and move the ARCH price, and that half of the funds went to another EOA while the rest stayed at the original address.

How it happened

  1. What the code allows: the constructor gives the deployer all supply (_rOwned[_msgSender()] = _rTotal;) and creates the PancakeSwap pair, and four fee wallets (marketingAddress, developmentAddress, charityAddress, vaultRewardAddress) are hard-coded to the deployer's own address 0xD2010607…a8003E.
  2. What the code allows: the owner is exempt from fees and limits (_isExcludedFromFee[owner()] = true; and the checks run only when from != owner() && to != owner()).
  3. What the code allows: ordinary holders pay fees that the owner can raise without a cap. Defaults are 1% tax, 1% vault and 10% liquidity on buys and 4% tax, 4% vault and 10% liquidity on sells, and function setSellFee(uint256 sellTaxFee, uint256 sellVaultFee, uint256 sellLiquidityFee) external onlyOwner sets them to any value. The holder is debited the full amount (_rOwned[sender] = _rOwned[sender].sub(rAmount);) and the fee total is subtracted from what the recipient gets (tAmount.sub(tFee).sub(tLiquidity).sub(tVault)), so a total of 100 or more leaves a seller with nothing or makes the transfer revert.
  4. What the code allows: the owner can block individual senders. addToAirdroplist(address account) marks an address, and _transfer begins with require(!_isAirdroplist[from], "BEP20: transfer from Airdrop-listed address");. The check is on from, so a listed holder cannot send or sell, while a listed pair would stop buys. setBots plus setABMode(true) do the same with require(bots[from] != true, ...).
  5. What the code allows: setTradingOpen(false) makes every transfer between non-exempt wallets revert with trading paused temporarily., and setSellMaxTxAmount / setBuyMaxTxAmount can set the per-transaction limit to a value too small to sell. Ownership is not renounced in the current state: an eth_call on 2026-09-30 returns the deployer as owner() (a state read, not proof about 2023).
  6. What was recorded: CertiK Alert reported on 2023-06-30 that the deployer removed about 70,000 USD from the liquidity pool and that the token is a honeypot; the De.Fi listing records two liquidity removal transactions and a loss of 207,371 USD. The code itself does not show which of the controls above, if any, were used on holders.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract ARCH
Protocol links Website @archwayHQ

Evidence

Same attack technique

Browse all hacks →
DubaiCEO $237K lost Boring Nakas $108K lost mCoin $144K lost Beamsplittr $61K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes