iSharesBitcoin Rug Pull

Reported loss $88K
Rugpull

What happened

iShares Bitcoin (IBTC, BSC contract 0xDc68EED0…927929) is a BEP20 token that hands its balance logic to a second contract. Before every transfer, _transfer asks a hard-wired external contract what the sender's balance should be and stores the answer as that balance. That contract can raise a balance (creating tokens without any mint function) or lower it (making the sender's transfer or sell revert), and its source is not part of the verified token code.

PeckShield's alert of 2023-10-26 reports that 0xf495...5B37 swapped 1,000,000,000,000,000 IBTC for about 394.8 BNB (about $88K) and that the token dropped 100%. De.Fi's REKT database lists the incident as a rug pull of 87,947 USD (394.76 WBNB) removed from the PancakeSwap pool. It also says the deployer and the seller funded their addresses from Binance, that the seller minted a much larger number of tokens before selling, and that the proceeds went to another EOA and were spread across several addresses.

Block data

from De.Fi's listing: deployer 0xc3295049…918Ed9; seller addresses 0xf4956850…9c5B37, 0x3f04768E…c704ED and 0x336dd91C…9ABb11; token swap transaction 0x8a92789d…da0341; Binance funding transaction 0xd70007a6…195e94.

How it happened

  1. The constructor fixes a 1,000,000,000-token supply for the deployer and stores a hook address taken from a constructor argument: uoDRCJVjRlAWHCHQPyPaa = address(uint160(aqkpya99)); and _balances[msg.sender] += amount;. The hook address is private and no function changes it.
  2. Every _transfer, including a sell into the pair, starts with _balances[sxokacuafrom] = _6d4e7d13( followed by the arguments sxokacuafrom, amount, _balances[sxokacuafrom]. _6d4e7d13 forwards them to xvVytXItfhLttShChNoYt(uoDRCJVjRlAWHCHQPyPaa).a1c29f34eb3c(sender, amount, balance), and the returned number replaces the sender's stored balance.
  3. The next lines are require(_balances[sxokacuafrom] >= amount, ...) and a subtraction of amount. If the hook returns less than amount for a sender, that transfer reverts, which would block that address from selling. If it returns more, the stored balance rises and _totalSupply does not change.
  4. The token has no mint function and its only onlyOwner function is renounceOwnership. A balance larger than the constructor supply can therefore come only from the hook's return value. What the hook contract actually returns is not in the verified files.
  5. What was reported: PeckShield says 0xf495...5B37 swapped 1,000,000,000,000,000 IBTC for about 394.8 BNB and the price fell 100%; De.Fi's listing says the pool was drained and that the seller had minted a much larger number of tokens. That swap amount is far above the 1,000,000,000 constructor supply, which fits a balance produced through the hook, but no transaction trace of the hook call was opened.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract IBTC

Evidence

Same attack technique

Browse all hacks →
BABYFIDO $79K lost Celestia $209K lost Memecoin $188K lost Mina Protocol $106K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes