CommEX Hack
What happened
CMX (fake token) rugpulled with liquidity removal, stealing 134,077 $USD worth 635.86 WBNB.
CMX, a BEP20 token trading on PancakeSwap, faced a significant exitscam on Oct 6, 2023. The deployer removed liquidity from the LP pool and transferred the stolen funds to another EOA address. These funds were further distributed among multiple addresses, part still remained deployer wallet as BSC-USD, and a portion was sent to a Bybit deposit through the scammer's address.
The fraudulent CMX token was promoted in Russian-language Telegram groups. Before the final withdrawal, the token creator withdrew liquidity five times, utilizing these funds to buy back CMX tokens. This strategy artificially inflated the token's price, deceiving investors into thinking the project was thriving.
Deployer Address:
https://bscscan.com/address/0x67F09504…57b888
Scammer Addresses:
https://bscscan.com/address/0x041b8ED1…9F1bA4
https://bscscan.com/address/0xc6ae76C4…EE98d5
Liquidity Removal Transaction:
https://bscscan.com/tx/0x56a8cc91…4dcbe2
Bybit Deposit Transaction:
https://bscscan.com/tx/0x51c7f193…f265fe
Case & protocol details
Evidence & learning
Sources and on-chain records
- report Report twitter.com
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.