What happened
The project was holding a presale event at:
https://app.bounce.finance/fixed-swap/5048
304 ETH were raised in total.
1. The contract deployer transferred tokens to the external wallet at:
https://etherscan.io/tx/0x08779ce4…a805ec
2. The token recipient added initial and further liquidity at:
https://etherscan.io/tx/0xcff977ee…816858
https://etherscan.io/tx/0xb97cfbb3…1074bf
3. Only 18.23 / 304 ETH was used to add liquidity. In addition, the token was listed on the Hotbit exchange:
https://hotbit.zendesk.com/hc/en-us/articles/360060184974-Hotbit-will-launch-CUBIC-Cubic-Finance-on-January-15th-2021
4. The token recipient from step 2 transferred part of tokens to the other external wallet at:
https://etherscan.io/tx/0x84c16aa1…4ac41c
5. This external wallet deposited received tokens directly to the Hotbit exchange so further actions can't be tracked. Stolen funds were calculated based on the raised funds from the presale event minus added liquidity amount.
Case & protocol details
Evidence & learning
Sources and on-chain records
- report Report twitter.com
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.