KimJongMoon Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

KimJongMoon (KIMJ) is a BNB Smart Chain token whose verified code contains a transfer block that the owner controls. The first transferFrom call made while newun is empty stores its recipient in newun; after that, every transfer or transferFrom whose recipient is newun reverts with the message "please wait". If newun holds the liquidity pair address, sells through that pair fail while buys, which move tokens out of the pair, are not touched by the check.

Only the owner can change newun, through transfernewun. De.Fi's REKT database lists the token as an Exit Scam/Honeypot, saying the contract owner could disable the transfer function, which restricted users in selling their tokens. The source header advertises 10% fees and holder-milestone burns, but the code contains no fee, reflection or burn logic.

How it happened

  1. The constructor sets symbol = "KIMJ", name = "KimJongMoon" and assigns the whole _totalSupply of 10000000000000000000000 raw units (10 trillion tokens at 9 decimals) to owner.
  2. In transferFrom, the line if(from != address(0) && newun == address(0)) newun = to; runs on the first call while newun is unset. It records the recipient of that call, whoever it is, and applies no check on that call.
  3. From then on the else branch runs: else require(to != newun, "please wait");. transfer has the same check, require(to != newun, "please wait");, so no caller, including the owner, can send tokens to newun.
  4. A swap that sells tokens pulls them with transferFrom(holder, pair, amount). If the pair is the address stored in newun, that call reverts and the holder's balance is not debited. The code does not show which address newun holds, so this is the case the pattern is built for rather than something the source proves.
  5. The owner can call transfernewun(_newun) at any time. Setting it to address(0) re-arms capture by the next transferFrom; pointing it at an address nobody uses lifts the block. Nothing in the source forces either.
  6. De.Fi's REKT database lists the token as an Exit Scam/Honeypot. The source contains no function that mints, blacklists or withdraws liquidity; clearCNDAO only sends the contract's own native-coin balance to the owner.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract KIMJ

Evidence

Same attack technique

Browse all hacks →
Ethereum TrustPad Loss not disclosed Ethereum The Doge Space X Loss not disclosed BNB Chain SPACE GEM Loss not disclosed BNB Chain ACID RAIN Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes