Hex Trust Token Rug Pull

Reported loss $200K
Rugpull

What happened

Hex Trust Token (HXT) is a BEP-20 token on BNB Chain whose owner holds functions that can empty its PancakeSwap pool without selling. The owner-only drainLP mints HXT into the pool, swaps a chosen share of the paired asset out to the owner, then burns HXT from the pool so both reserves shrink by the same fraction and the price does not move. The owner can also mint unlimited HXT with mint, and can mint or burn the pool's own HXT balance with rebaseLP to push the price.

Every transfer also calls an external warden contract whose code is not part of the verified source. CertiK reported that about 670 BNB (roughly $200,000) moved from the deployer to Tornado Cash in the days before 2023-03-02.

How it happened

  1. The constructor mints 100,000,000 HXT to the deployer and stores a warden address and a router address; the deployer is the Ownable owner, and the on-chain owner read on 2026-09-30 is still the deployer.
  2. drainLP(token, k) is onlyOwner. It mints a large amount of HXT straight into the pair, calls pair.swap to send reserveB * k / 10000 of the paired asset to the caller, then burns the minted HXT plus reserveA * k / 10000 from the pair and calls sync. Both reserves end at (1 - k/10000) of their old size, so liquidity leaves the pool while the quoted price stays flat and the caller never holds LP tokens.
  3. drainLP always withdraws the pair's token1. The contract address begins 0x0003, so HXT sorts as token0 against a normal paired asset such as WBNB, which makes the paired asset the side that is paid out.
  4. rebaseLP(token, k) is also onlyOwner: it burns or mints HXT held by the pair to reach k / 10000 of its current balance, then calls sync, letting the owner move the pool price in either direction.
  5. mint(amount) lets the owner create any amount of HXT for itself.
  6. _beforeTokenTransfer calls _warden.registerTransfer(from, to, amount) on every transfer, mint and burn. That contract's code is not in the verified source, so whether it could block holder transfers is not established.
  7. CertiK's Skynet alert of 2023-03-02 reported that 670 BNB (about $200,000) had been sent from the deployer to Tornado Cash over the previous few days.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract HXT

Evidence

Same attack technique

Browse all hacks →
Block Chain Games $40K lost STILTON MUSK $232K lost JNB Token $106K lost MOON Token $42K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes