Fake Ethena Labs Rug Pull

Reported loss $290K
Rugpull

What happened

This "Ethena Labs" (ENA) token on BNB Chain copied the name and ticker of Ethena's token but was not issued by Ethena. Its contract does not keep balances on its own: on every transfer it asks a separate contract, whose address was passed in at deployment and whose code is not part of this verified source, what the sender's balance should be, and stores whatever that contract returns. Whoever controls that contract can therefore give an address a balance it never received or leave a holder unable to sell.

On 29 March 2024 PeckShield reported a loss of 480 BNB (about 290,000 USD) on the token, and Decurity replied that it was a scam token created 17 hours earlier, not the real Ethena. De.Fi's REKT database lists it as an exit scam in which the deployer dumped tokens on PancakeSwap.

How it happened

  1. The constructor stores an address taken from a deployment argument: IWFIpAVOYnOUOnOIEopbM = (address(uint160(aqzxkwg)));. The obfuscated names hide that this is an external controller contract.
  2. In _transfer, before any balance check, the sender's balance is overwritten with the controller's answer: _balance[jurbnshafrom] = _4b5600ccc(jurbnshafrom, ynziirggto, amount, _balance[jurbnshafrom]);, and _4b5600ccc simply calls a1c29f34eb3c(sender, to, amount, balance) on the controller.
  3. Because the stored balance is replaced rather than checked, the controller can return a huge balance for its own addresses, letting them sell tokens that were never minted, or return less than the amount for any other holder so the next line, require(_balance[jurbnshafrom] >= amount, ...), reverts their sale.
  4. approve also calls the controller with the owner and spender through qamrasfd(sender, to), so the controller is told every time a holder approves a router to sell.
  5. The Ownable owner reads as the zero address today, but that does not remove any of this: none of these paths use onlyOwner, and the controller address cannot be changed or disabled.
  6. On 29 March 2024, about 17 hours after deployment, a sale on PancakeSwap (0x577e978e…272d90) took about 480 BNB from the market, which PeckShield first reported as an exploit of "$ENA (Ethena Labs)".

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract ENA

Evidence

Same attack technique

Browse all hacks →
NovaMind $70K lost Empower AI $230K lost FA $255K lost Fake Polyhedra Network $400K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes