Eth Contingency Rug Pull

Reported loss $25.0M
Rugpull

What happened

EthContingency sold its Contingency Token (CTY) in an Ethereum ICO in early 2017 through a crowdsale contract modified from FirstBlood's. According to ZachXBT, it raised 21,144 ETH when ETH traded at about $17, and the team disappeared weeks after the sale while keeping most of the funds. Between 2021 and 2022 the team moved more than $25 million worth of ETH to Tornado Cash, and in February 2024 it still held more than 4,600 ETH (about $13.5 million) in dormant wallets. The contract gave contributors no protection: the founder address could withdraw any amount of the raised ETH at any time, with no escrow, milestone or refund path.

Dormant wallets listed by ZachXBT in February 2024:

How it happened

  1. During the crowdsale window, the payable fallback calls buyRecipient, which credits CTY to the buyer and keeps the ETH in the contract; the direct forward to the founder is commented out.
  2. founderWithdraw(uint amount) lets the founder address send itself any amount of the contract's ETH, at any time, with no cap, time lock or condition on the project's delivery.
  3. The contract has no refund function, so contributors have no on-chain way to recover ETH, and ordinary holders cannot even move CTY until about two months after the sale ends because of transferLockup.
  4. founderWithdraw is the only code path that sends ETH out of the contract, and Etherscan now shows a balance of about 0.31 ETH, so the contributed ETH can only have left through that function, to whichever address was founder at the time.
  5. According to ZachXBT, the team vanished weeks after the ICO, later moved more than $25 million worth of ETH to Tornado Cash in 2021-2022, and still held 4,600+ ETH in February 2024.

Protocol details

Classification Other
Protocol Type Exit Scam/Rugpull
Affected asset / contract CTY
Protocol links @EthContingency

Evidence

Same attack technique

Browse all hacks →
Ethereum Unidark $30K lost Ethereum Vegetables Finance $3K lost Ethereum Hatch DAO Loss not disclosed Ethereum LV Finance $334K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes