MetaMask Governance Hack
What happened
The contract deployer:
https://etherscan.io/address/0x0f629914…2cb417
Created 2 fake MetaMask tokens (MASK and META) and 1 Bored Ape Yacht Club (APE) token:
https://etherscan.io/tx/0x43fae6c2…476cc2
https://etherscan.io/tx/0x46194ca0…e072c3
https://etherscan.io/tx/0x9e9faba2…823674
Added initial liquidity at:
https://etherscan.io/tx/0x264e9142…811815
https://etherscan.io/tx/0x4a1faae1…e1b6d1
https://etherscan.io/tx/0x09b14538…48c8ab
https://etherscan.io/tx/0x4648a354…3fb3f3
https://etherscan.io/tx/0x6621b85c…39a19e
The liquidity was removed by the contract deployer:
https://etherscan.io/tx/0xb1317e04…3f51d4
https://etherscan.io/tx/0x32ba9db4…334076
https://etherscan.io/tx/0x66373054…3078f9
https://etherscan.io/tx/0x355a36ef…cb9c8f
Stolen funds were deposited into Tornado Cash mixer:
https://bloxy.info/txs/calls_from/0x0f629914…2cb417?signature_id=994162&smart_contract_address_bin=0x722122df…5b6967
The contract deployer possibly blocked token transfers:
https://honeypot.is/ethereum.html?address=0xd0898946…57B33f
https://honeypot.is/ethereum.html?address=0xbb5d5c01…8e5906
https://honeypot.is/ethereum.html?address=0xd696FB3C…ea3Df8
Case & protocol details
Evidence & learning
Sources and on-chain records
- report Report twitter.com
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.