HYDRA Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

HYDRA (HYDRA) is a BNB Chain token deployed on 4 May 2021 at 0xed37d8e3…82fabf. The first transferFrom call from a non-zero address stores its recipient in a hidden variable called newun, and from then on every transfer or transferFrom to that address reverts with "please wait". If that first call is the router moving tokens into the PancakeSwap pair when liquidity is added, the pair becomes newun: buys from the pair still work, but any sale into the pair fails.

The owner can change newun at any time with transfernewun, and can withdraw any BNB held by the contract with clearCNDAO. De.Fi's REKT database lists HYDRA as an exit scam/honeypot, stating that the contract owner could disable transfers and so stop holders from selling.

How it happened

  1. The constructor credits the whole supply of 10,000,000,000,000 HYDRA to the deployer, who is also owner.
  2. In transferFrom, if from is not the zero address and newun is still unset, the contract sets newun = to instead of running any check. Adding liquidity through the PancakeSwap router moves tokens with transferFrom(owner, pair, amount), which would make the pair newun.
  3. Every later transferFrom and every transfer requires to != newun, so a router sale (transferFrom(holder, pair, amount)) or a direct transfer to the pair reverts with "please wait".
  4. A buy is the pair calling transfer to the buyer, whose address is not newun, so purchases keep going through.
  5. Only the owner can call transfernewun to point newun somewhere else and let sales through. Owned has no renounceOwnership, only a two-step transferOwnership/acceptOwnership, and an eth_call on 2026-09-30 still returned the deployer as owner.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract HYDRA

Evidence

Same attack technique

Browse all hacks →
BNB Chain NOZOMI COIN Loss not disclosed BNB Chain HellGate Loss not disclosed Ethereum SafeShib Loss not disclosed BNB Chain ChickenCoin Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes