mCoin Rug Pull

Reported loss $144K
Rugpull

What happened

mCoin (MCOIN) is a BNB Chain token with a 500,000,000 supply minted to the deployer. On 27 June 2023 CertiK flagged an exit scam: EOA 0xed65cd98…bbb161 removed about $145K in WBNB from the token's liquidity pool and sent it to another EOA. De.Fi's REKT database gives the removal as 609.44 BNB, 143,841 USD, in liquidity removal transaction 0x8ebcbfb3…476f68, and says the funds were later deposited to Binance in transaction 0xad22a253…63c014.

The token code also gives the owner a confiscation switch: emergencyFreezeAndSlash moves the entire balance of any non-whitelisted, non-contract wallet to the owner and then blocks that wallet from every further transfer. Nothing in the code limits when the owner may use it, and whitelisting cannot be undone.

How it happened

  1. The constructor mints 500,000,000 MCOIN to the deployer, whitelists the deployer, and pauses trading until the owner calls launch(), a one-time unpause.
  2. emergencyFreezeAndSlash(address target) is onlyOwner. It requires only that target is not a contract and not whitelisted, then runs _transfer(target, msg.sender, balanceOf(target)) and sets isFreezed[target] = true.
  3. _beforeTokenTransfer reverts with "Walled is freezed for malicious activity" whenever the sender or recipient is frozen, so a slashed holder cannot send or receive MCOIN again. No function clears isFreezed.
  4. The token code does not hold or control the pool's liquidity; whoever holds the LP tokens can remove it. CertiK reported that EOA 0xed65cd98…bbb161 removed about $145K in WBNB from the LP on 27 June 2023 and moved it to another EOA. De.Fi's listing gives the removal transaction as 0x8ebcbfb3…476f68 (609.44 BNB) and the later Binance deposit as 0xad22a253…63c014.
  5. No source opened here shows emergencyFreezeAndSlash being called; step 2 describes what the code allows.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract MCOIN
Protocol links Website @mcoinofficials

Evidence

Same attack technique

Browse all hacks →
Boring Nakas $108K lost ArchWay Fake $207K lost Beamsplittr $61K lost TWEETY-MEGA-FUMO $484K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes