Dictum Exchange Hack

TOTAL LOST $2.1M
Medium Rugpull

What happened

Dictum Exchange has rugged pulled. On the 31st of Dec 2022, just after airdropping its $DIC token, the project shut down all of its social networks and performed hard rug from unverified proxy liquidity pool contracts.

The protocol built on the Arbitrum network Dictum Exchange performed hard rug from its LPs.

Most of the contracts of the protocol are built using a proxy upgradeability pattern. In this case, it allows deploying new implementations with any malicious logic. Currently, the source code of all LPs is not verified and includes malicious logic in the burn() function.

This function was called on each LP contract to drain a huge share of liquidity from them.

Currently, all stolen funds are bridged to the Ethereum Mainnet as ETH and stored in the account: 0xaF8f284e…16e21d

Scammer addreses:

https://arbiscan.io/address/0xaf8f284e…16e21d

https://etherscan.io/address/0xaF8f284e…16e21d

Liquidity draining TXs:

https://arbiscan.io/tx/0xbe0e8d83…e17112

https://arbiscan.io/tx/0xe7275b59…02b307

https://arbiscan.io/tx/0xe197f911…4c187f

https://arbiscan.io/tx/0x874e189e…667f66

https://arbiscan.io/tx/0xf3b30990…33540a

https://arbiscan.io/tx/0x4812d74f…51c7bc

https://arbiscan.io/tx/0x67ac2279…0723b1

https://arbiscan.io/tx/0xb0f0bc34…e8effc

https://arbiscan.io/tx/0x48805ffa…123876

Case & protocol details

Classification Exchange (DEX)
Protocol Type Exit Scam/Rugpull
Affected asset / contract DTOKEN
Official Website dictum.exchange/
Protocol Twitter/X @DictumExchange

Evidence & learning

Sources and on-chain records

Practice this exploit pattern safely

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.