BreedTech Rug Pull

Reported loss $9.4M
Rugpull

What happened

BreedTech (CN) is a BNB Chain token deployed on 3 May 2022 at 0x60B10129…44512B. Its constructor credits the entire 32,000,000 CN supply to one hard-coded wallet, 0x7c1186d0…112E8e, and the contract has no mint function after deployment. The owner role can blacklist any address, keep PancakeSwap trading limited to a whitelist, and set buy, sell and liquidity-removal fees with no upper bound, so a fee above 100 makes every fee-paying trade revert.

CertiK's May 2022 report describes the event as a rug pull of about $9.4M on 28 May 2022, in which the 32 million CN were moved through several wallets and then sold. De.Fi's REKT database lists BreedTech as an exit scam/rug pull, with the price falling from $11.62 to $0.0098, and names 0x20bf1fa3…54b2bb as the owner's address.

How it happened

  1. The constructor sets _rOwned[ownerAddress] = _tTotal, giving all 32,000,000 CN to the hard-coded ownerAddress, creates the PancakeSwap pair, and excludes the owner and ownerAddress from fees.
  2. notOpen starts as true, and while it is set any transfer to or from a contract, including the pair, requires the sender or recipient to be on _buyList, which only the owner edits with setBuyList.
  3. _transfer requires !_jiaList[from] && !_jiaList[to], and the owner can add any holder to _jiaList with setJia, which blocks every transfer to or from that holder.
  4. setBuyFee, setSellFee and setRemoveFee accept any percentage. The holder's balance is debited in full and the recipient gets tAmount.sub(feeAmount), so a 100% fee delivers nothing and a fee above 100 reverts the trade. Despite the names, _buyFee is charged on sales to the pair and _sellFee on purchases.
  5. onlyOwner checks a _roles mapping, and setOwner can grant these powers to any number of addresses. renounceOwnership clears only the current _owner entry, so other granted addresses keep every setter.
  6. Because the whole supply sits in wallets exempt from fees, those wallets can sell into the pool at will. CertiK reports that the 32 million CN were routed through several wallets and sold, which drained the pool's value.

Protocol details

Classification Other
Protocol Type Exit Scam/Rugpull
Affected asset / contract CN

Evidence

Same attack technique

Browse all hacks →
BabyElon $53K lost AniMoon $6.3M lost Sport Move $160K lost Magic $47K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes