EthBread Token Rug Pull

Reported loss $787K
Rugpull

What happened

EthBread (ETB) was a BNB Chain token deployed on 16 February 2023, with its whole 10 million supply minted to the deployer, 0x9f73c549…903070. On 25 June 2023 CertiK flagged a large liquidity removal: address 0x28dd1a9c…ada196 removed about $312,000 of BSC-USD from the ETB liquidity pool and sent it to 0x7772ffa0…2999a4. De.Fi's REKT database says ETB was spread across several addresses on 16 February and that addresses linked to the deployer together removed about $786,574 from the ETB/USDT pool on PancakeSwap, one of them $135,291.

De.Fi lists 0x77f5a5c2…b28a93, 0xe4ce32ea…478d5a, 0xba9ca72f…936c41 and 0x28dd1a9c…ada196 as scammer addresses, and 0x92c58163…0e8E08 and 0x7772ffa0…2999a4 as the addresses holding the funds. The token code also gives the owner a trading switch. While stage is not 1, any transfer to or from an address the owner has marked 2, such as the pool, reverts with "Swap Disabled" unless the other side is marked 1.

Marking the pool this way would let only owner-approved addresses buy or sell. No transaction showing the owner setting these flags was opened, so it is not known whether the switch was used.

How it happened

  1. The constructor mints the full supply to the deployer: _mint(_msgSender(), total_). De.Fi reports the ETB was then spread across several addresses on 16 February 2023.
  2. The owner can mark any address with setExtConfig(account_, state_) and switch all checks off or on with changeStage(_stage).
  3. While stage != 1, _beforeTokenTransfer runs require(s1 == 1 || s2 == 1, "Swap Disabled") for any transfer touching an address marked 2, so marking the pool 2 limits trading to addresses marked 1.
  4. On 25 June 2023 address 0x28dd1a9c…ada196 removed about $312,000 of BSC-USD from the ETB pool and passed it to 0x7772ffa0…2999a4 (CertiK).
  5. De.Fi lists three liquidity-removal transactions, 0xdeef572d…d40da8, 0x4a2612b8…fc336e and 0xe6974fc0…9c06f0, and totals the removals by deployer-linked addresses at about $786,574 from the ETB/USDT pool.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract ETB

Evidence

Same attack technique

Browse all hacks →
Beamsplittr $61K lost TWEETY-MEGA-FUMO $484K lost Greatest Of All Time (GOAT) $43K lost GUIDO The Mechanics $63K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes