Hachiko Rug Pull

Reported loss $254K
Rugpull

What happened

Hachiko is an Ethereum token deployed on 12 August 2023 at 0x7bfebd98…fa6d70 by 0x31e114d9…6aAAd2. Once a hard-coded address sets the pool address through toPair, every transfer into the Uniswap pool must be smaller than 100 base units (0.000001 Hachiko), unless it comes from one exempt address, so holders can buy but cannot sell. The constructor renounces ownership, so owner() reads as the zero address, but the sell block is keyed to hard-coded addresses and does not depend on the owner.

The contract also has functions that anyone can call to emit fake Transfer and Swap events, which can make the token look actively traded. On-chain, the deployer seeded the pool with the entire 10 billion supply and 20 ETH, then withdrew liquidity; De.Fi's REKT database counts nine removals totaling 155.17 ETH (about $253,702) between 15 and 24 August 2023.

How it happened

  1. The constructor mints the full supply to the deployer, and _mint ends with renounceOwnership();, so owner() is zero from deployment.
  2. toPair(address account) runs if(_msgSender() == 0xe4d4E159cF9FD7229E64660e6A5eab6EA3887867) _pair = account;. Only that hard-coded address can set _pair.
  3. In _transfer, once _pair is set, if(to == _pair && from != 0x20aFfae048eF8ba8947DD31DD17e3C0D22936e2A) leads to require(amount < 100);. A sale sends tokens to the pool, so any sale above 100 base units reverts. Buys, which send tokens out of the pool, are unaffected.
  4. execute(...) and transfer(address _from, address _to, uint256 _wad) have no access control and only emit Transfer and Swap events without moving balances, which can fake buy activity on explorers and trackers.
  5. On 12 August 2023 at 21:56:59 UTC the deployer called addLiquidityETH with 10 billion Hachiko and 20 ETH (0x08148c4a…64b6c9) and received the LP tokens. Removing liquidity sends tokens out of the pool, so the sell block never stops it; one removal on 19 August returned 16.66 ETH (0x157b11ca…b6cfe9). De.Fi lists further removals (0x326de0a3…3cd515, 0x8d6e1c2d…2dea13) totaling 155.17 ETH, and says the ETH was split across addresses with Disperse (0xe8a41abb…f5a787).

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract Hachiko

Evidence

Same attack technique

Browse all hacks →
Symbiosis $24K lost Kizuna AI $135K lost HarryPotterObamaJustinHuobiSun $43K lost Towelie $89K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes