Kokomo Finance Rug Pull

Reported loss $4.0M
Optimism
Drained Contracts

What happened

Kokomo Finance was rugpulled for 4,163,392 $USD. Project's social media was removed after an exit scam.

Kokomo Finance is a Lending and Borrowing Protocol running on a layer-2 Optimism chain. $KOKO token deployer conducted malicious actions and drained 4,163,392 $USD worth of assets from various pools. 3,967,779 $USD worth 141 $WBTC was drained after the implementation of the cBTC contract was changed and 7,000 $soWBTC was siphoned out to another EOA address and then swapped to $WTBC.

All the stolen funds this way were transferred through EOA addresses. The rest 195,613 $USD worth of $ETH was drained from KOKO/WETH UniSwap pool by the deployer-related address and almost all of the amount currently stay at the drainer's original address. Project-related social media accounts were removed shortly after an incident.

Scammer addresses:

Address 0x41be…310f

Address 0x5a2d…5716

Address 0x5c8d…7bff

KOKO pool drainer address:

Address 0xe06b…2f8e

Malicious transactions:

Tx 0xd751…f20b

Tx 0x728b…a67e

Protocol details

Classification Rugpull / Other
Protocol Type Lending
Affected asset / contract 0x7da25bc4cfaed3f29414c6779676e53b19a356f5
Implementation language Solidity
Protocol links @KokomoFinance

Security review history

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.