What happened
Fintoch (DFintoch) was a BNB Chain investment platform that advertised a 1% daily return and claimed to be owned by Morgan Stanley, which denied any link; the "Bobby Lambert" shown as its CEO was identified as a paid actor. Its FintochSTO contract, which is also the FTH token, holds its own FTH and USDT and prices swaps from those two balances alone. Any holder can sell FTH to it for USDT through swapForUSDT, but only the owner can buy FTH from it, and the owner can send any token the contract holds to any address with recycleToken or burn the contract's FTH with poolBurn, which raises the USDT paid per FTH.
According to De.Fi, on 22 May 2023 a single swapForUSDT call exchanged 20,000 FTH for 31,666,317 USDT from the contract, and the funds were bridged to Ethereum and Tron through Multichain and SWFT. ZachXBT reported the 31.6 million USDT outflow and users being unable to withdraw.
How it happened
- The contract was deployed on 11 July 2022 by 0x8a0deffb…49aa63 (tx 0x3ef479ba…87fce6). The constructor gives the deployer the whole fixed supply of 100,000 FTH (
_totalSupply = 100000e18; _balances[msg.sender] = _totalSupply;); no mint function is active. - The contract acts as its own FTH/USDT pool.
swapForUSDTis open to anyone and paysamountFTHIn.mul(poolUSDTBal)divided bypoolFTHBal.add(amountFTHIn), using only the contract's own balances. The reverse direction,swapForFTH, is markedonlyOwner, so only the owner can buy FTH from the pool. - The owner can also move out any token the contract holds with
recycleToken(address tokenAddr, address destination, uint256 amount) external onlyOwner, and can shrink the pool's FTH balance withpoolBurn, which makes each FTH sold worth more USDT.renounceOwnershipis commented out, so these powers cannot be given up, only transferred. - According to De.Fi, on 22 May 2023 34,341 FTH moved from an address starting 0xfce4d to one starting 0xec1a (tx 0xee053bf3…f004d6). Then 20,000 FTH were sold through
swapForUSDTfor 31,666,317 USDT (tx 0xa5e64161…1c7ea2, 12:58 UTC per DN Institute). Under the contract's formula, a 20,000 FTH sale returns that much only if the contract held few FTH relative to its USDT at that moment; the sources reviewed do not show how the balances reached that state. - De.Fi reports that the USDT went to 0x398dcb3e…ebacf4 and was bridged through Multichain and SWFT. ZachXBT reported on 23 May that the funds had been bridged to multiple Tron and Ethereum addresses and that users could not withdraw.
Protocol details
Evidence
- report @zachxbt incident report twitter.com
- report ZachXBT post on the Fintoch exit twitter.com
- transaction BscScan swap transaction 0xa5e64161...c7ea2 bscscan.com
- transaction bscscan.com transaction 0x3ef4…fce6 bscscan.com
- transaction bscscan.com transaction 0xee05…04d6 bscscan.com
- address FintochSTO verified source code at 0x19a00e359990Ec7dAf6e9dD9A2Fb7664014bB5f7 bscscan.com
- analysis Project takes off with $31.6M in alleged exit scam cointelegraph.com
- analysis Web Archive archive.ph
- analysis Sourcify match for 0x19a00e359990Ec7dAf6e9dD9A2Fb7664014bB5f7 on BNB Chain repo.sourcify.dev
- analysis Fintoch DeFi Platform Executes $31.6 Million Rug Pull Scam dn.institute
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
