JohnLennonC0IN Rug Pull

Reported loss $11K
Rugpull

What happened

JohnLennonC0IN (BEATLES) is a 9-decimal BEP-20 token on BNB Chain at 0x22d871B5…09bE4a, deployed on 2024-01-18 by 0xBAb318f9…b11B9F. Its constructor mints the whole 50,000,000 supply directly to three hard-coded addresses: 35,000,000 to the liquidityPool address 0xeFBf0b01…961bcC, which also becomes the owner, 5,000,000 to the marketing address 0x861091bE…aa7c4C and 10,000,000 to the raffle address 0x4639026A…833EC8. The deployer receives no tokens.

A CertiK Skynet alert dated 2024-01-23 reports an exit scam: EOAs 0x861 and 0x463 received large amounts of tokens from the initial mint and sold them for about $54.9k, and the website was deleted. De.Fi's REKT database lists a loss of about $11.3k from the PancakeSwap pool and says the insiders used disperse.app to fund several addresses that bought and sold tokens, which affected the price, that the deployer and the other addresses were funded from the same address, and that the proceeds moved to another EOA and then to several addresses. It lists the liquidity add (tx 0x22642d3d…1ceb35), the liquidity removals (txs 0xee3bdbc1…8c357a and 0x54348d4e…bef544) and the transactions where the tokens were received (txs 0x83f76891…64f472, 0x6307aca8…a95b7c and 0x2b3bb025…91d6e6).

How it happened

  1. The constructor mints the entire supply to three fixed addresses and hands ownership to the first of them: transferOwnership(liquidityPool); _mint(liquidityPool, 35000000 * 10 ** decimals()); _mint(marketing, 5000000 * 10 ** decimals()); _mint(raffle, 10000000 * 10 ** decimals());. The deployer is not one of the recipients.
  2. Those same addresses also collect the trading fees. On a buy, the pankaceSwap pair address as sender pays 2% to marketing and 1% to raffle; on a sell, 2% goes to marketing and 1% to dev. The fee code is uint _feeMarketing = calculate(amount, 200); on buys and _transfer(owner, marketing, _feeRaffle); _transfer(owner, dev, _feeDev); on sells, and a holder who sells is debited the fees plus the net amount.
  3. The code does not block selling by holders: it has no blacklist, pause or trading switch, and the owner-only functions are setPankaceSwapAddress, addAddressToTaxFreeList and removeAddressToTaxFreeList. owner() read as the zero address on 2026-09-30, so those functions cannot be called now; when or how ownership left the first address is not established here.
  4. What happened, per CertiK: the holders of the minted tokens at 0x861 and 0x463 sold a large amount into the pool for about $54.9k and the website was deleted. De.Fi's REKT database lists two liquidity removals and funding of several buyer/seller addresses through disperse.app.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract BEATLES

Evidence

Same attack technique

Browse all hacks →
Ore $243K lost Not Found $200K lost LongNoseDog $310K lost Xai $581K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes