MinterPro Rug Pull

Reported loss $34K
BNB Chain
Rugpull

What happened

Minter (MINT) is a BEP20 token whose verified source gives its owner an uncapped, unrestricted mint function. The constructor creates 50,000 tokens for the deployer, and mint(uint256 amount) is onlyOwner and credits any amount to the owner's own balance, so the owner can create new supply at any time and sell it into a liquidity pool against holders' deposits. renounceOwnership exists, but nothing forces its use, and the owner still reads as the deployer on 2026-09-30.

De.Fi's REKT database lists the incident as an exit scam / rug pull of about 33,821 USD on BNB Chain, dated 2021-01-09. It lists the deployer 0x7f659509…A3C981 as having added initial liquidity several times (example txs 0x54a8d82b…16bc8c and 0xc80a76fa…9aa0fe), called mint() several times to create tokens in its own wallet (example txs 0xc6e84ded…9f1685, 0xf893cc5b…ff93df and 0x5468bd8c…9af91f), sold the minted tokens several times (the listing points to the BscScan token-transfer list for the deployer address), and removed liquidity several times (example tx 0x35ce29dc…4ba660). The listing adds that the proceeds were bridged to Binance Chain through BSC: Token Hub in txs 0x65b0f544…71ecf4, 0x1dc038a8…4c86e3, 0x0d6dbde0…0a370a, 0xd88dcf0c…071d97, 0x4b9e5893…f0c76c, 0x83d2edfb…092d06, 0xf2e467f2…78e955, 0x7e25ad9d…a10de0, 0xb3676b60…f552fd, 0x2c578e10…bf3eca and 0x2255b828…a1f800. BscScan returned 403 for these transactions, so they were not opened.

How it happened

  1. The constructor gives the deployer the whole initial supply: _totalSupply = 50000 * (1e18); _balances[msg.sender] = _totalSupply;. The deployer also becomes the Ownable owner.
  2. The deployer can pair part of that supply with BNB in a liquidity pool, which gives buyers something to pay into. De.Fi's REKT database lists liquidity being added several times.
  3. The owner holds an uncapped mint: function mint(uint256 amount) public onlyOwner returns (bool) { _mint(_msgSender(), amount);, and _mint adds the amount to the caller with _balances[account] = _balances[account].add(amount);. Nothing limits the amount, the number of calls or the total supply, and the new tokens go to the owner's wallet.
  4. Newly minted tokens are ordinary balances, so the owner can sell them into the pool: every unit sold takes BNB paid in by earlier buyers and dilutes their share. De.Fi's REKT database lists three example mint() transactions followed by repeated sales of the minted tokens from the deployer.
  5. The listing also records liquidity being removed several times and the proceeds being bridged to Binance Chain through BSC: Token Hub in eleven listed transactions.

Protocol details

Classification Other
Protocol Type Exit Scam/Rugpull
Affected asset / contract MINT
Protocol links Website @minterProtocol

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.