Linda Yaccarino Rug Pull

Reported loss $375K
Rugpull

What happened

Linda Yaccarino (LINDA) is a BEP20 token on BNB Smart Chain (token contract 0x8883fa1d…382cfb) that traded on PancakeSwap. De.Fi's REKT database lists it as an exit scam / rug pull of 374,723 USD, and De.Fi's alert on X says about 380,000 USD was stolen in $LINDA tokens while only about 10,000 USD was initially added as liquidity. Per the De.Fi listing, the deployer manipulated the price and created false on-chain activity by repeatedly buying and selling the same amount to fake trading volume, and three transactions involving 600,000 USD pumped the price further. The deployer then withdrew 374,723 USD by selling all the acquired $LINDA, leaving holders with worthless tokens; the listing also says the scammer used a smart contract that allows anyone to create scam tokens.

The verified token code gives its owner several ways to trap other holders: a switch (changeAb) that blacklists every non-whitelisted wallet receiving tokens from the pair so it can no longer sell, owner-only blacklists, owner-only whitelist exemptions, and an unrestricted mint. The code does not show whether any of these was used in this incident.

Block data

per the De.Fi listing:

How it happened

What the code allows:

  1. initToken mints the whole supply to tokenOwner, makes that address owner, and creates the pair stored in LP. The contract has no transferOwnership or renounceOwnership, so the owner address is fixed.
  2. The owner can call changeAb(true). From then on, in transfer, if(msg.sender==LP&&ab&&!tokenWhitelist[_to]){ tokenGreylist[_to] = true; } puts every non-whitelisted wallet that receives tokens from the pair (that is, every buyer) on the greylist.
  3. A greylisted wallet cannot move its tokens: transfer requires require(tokenGreylist[msg.sender] == false) and transferFrom requires require(tokenGreylist[_from] == false). A router sell calls transferFrom with the holder as _from, so it reverts.
  4. Whitelisted addresses skip all of these checks (if(!tokenWhitelist[_from]&&!tokenWhitelist[_to])), and only the owner can whitelist, so the owner's wallets can still sell freely. The owner can also blacklist any address, including the router or the pair, with blackListAddress.
  5. mint(address account, uint256 amount) onlyOwner can create new supply for any address with no cap.
What happened

, per De.Fi's listing and alert:

  1. The deployer added about 10,000 USD of liquidity, repeated equal-size buys and sells to fake volume, and ran three transactions involving 600,000 USD to pump the price.
  2. The deployer then sold all its $LINDA and withdrew 374,723 USD, leaving holders with worthless tokens. The sources do not say whether changeAb, the greylist, or mint were used in this incident.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract LINDA

Evidence

Same attack technique

Browse all hacks →
Fintoch $31.7M lost Mother $734K lost DerpMan $88K lost Kickboxer Tate $33K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes