Frosties Hack
What happened
On January 9, 2022, the people later charged by U.S. prosecutors in connection with Frosties allegedly abandoned the Ethereum NFT project within hours of its sellout, deactivated its website and social accounts, and moved its cryptocurrency proceeds into wallets under their control. The criminal complaint identifies approximately 356.56 ETH, then valued at about $1.1 million, transferred from the Frosties sale wallet to a wallet controlled by the smart-contract owner. Prosecutors alleged that the funds were then routed through additional wallets to obscure their origin.
This was an alleged rug pull: buyers were promised holder benefits, but the project was abandoned rather than those benefits being delivered.
How it happened
- Frosties marketed 8,888 utility NFTs with promised holder rewards, giveaways, metaverse-game access, and future mint passes.
- After the January 9 public sale sold out, the collection's owner exercised a conditional withdrawal function in the Frosties smart contract.
- Approximately 356.56 ETH in sale proceeds was transferred from the Frosties sale wallet to a wallet that the complaint attributes to the contract owner, while the project website and social accounts were deactivated.
- The complaint alleges that the proceeds were moved through additional wallets, including transfers designed to obscure their source; federal authorities later charged two alleged operators with wire-fraud and money-laundering conspiracies.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.