Hepton token Rug Pull

Reported loss $73K
Rugpull

What happened

Hepton (HTE) is a BNB Chain token that used the Hepton name, deployed on 12 April 2023 at 0x9D77c78D…6D9de3 by 0x3Da39c75…baa5b3 and paired with USDT on PancakeSwap. Every buy, sale and wallet-to-wallet transfer by an ordinary holder calls an outside userchange contract, and the owner could swap that contract for any other with changeUserAmountOutIn; a replacement that reverts on addOutAmount would block every sale and transfer while buys still work. The code also contains changeCanSell and maxSellToken switches that nothing in the transfer path reads, and a fixed 5% burn on trades.

On 15 April 2023 CertiK reported that the deployer removed liquidity in 3 transactions, gaining about $55K, and that the token appeared to be a honeypot. De.Fi's REKT database lists the loss as about $73K, says the deployer also sold HTE and the price fell about 90%, and names liquidity removal tx 0x1f9c5ba1…cbe714.

How it happened

  1. The constructor creates the HTE/USDT PancakeSwap pair, mints 100,000,000 HTE to a tokenOwner argument, excludes that address, the deployer and the contract from fees, and deploys a simple UserAmountChange ledger as userchange.
  2. For a non-excluded holder, _transfer calls userchange.addInAmount(to, amount) on a buy, userchange.addOutAmount(from, amount) on a sale, and userchange.addOutAmount(from, amount) on a transfer between wallets. If that call reverts, the whole transfer reverts.
  3. changeUserAmountOutIn(IUserAmountChange _userchange) is onlyOwner and accepts any address, so the owner could replace the ledger with a contract whose addOutAmount reverts. Buys would still pass through addInAmount while every sale and wallet transfer failed. Only fee-excluded addresses, which the owner chooses with excludeFromFees, skip these calls.
  4. changeCanSell() and maxSellToken(address,uint256) store canSell and _maxSell, but _transfer never reads them. The only visible trade rule is super._transfer(from, _destroyAddress, amount.div(100).mul(5)), a 5% burn.
  5. Ownership now reads as 0x...dEaD, so the ledger can no longer be changed; whichever userchange contract was set last still runs on every trade.
  6. On 15 April 2023 the deployer removed liquidity in 3 transactions, gaining about $55K, and CertiK flagged the token as an apparent honeypot.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract HTE

Evidence

Same attack technique

Browse all hacks →
ANT Token $36K lost Move token $87K lost ChainGPT $82K lost Iwr token $34K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes