MTI Finance Rug Pull

Reported loss $32K
Ethereum
Rugpull

What happened

MTI Finance's MTI token on Ethereum (0x86d3F38e…78C346) was deployed from TokenMint's mintable ERC-20 template. Any address holding the minter role can call mint with no supply cap, and the deployer holds that role from construction. On 18 November 2020 the deployer called mint and created 10,000,000 MTI in its own wallet (transaction 0x48d8abe1…511d7e).

According to De.Fi's REKT database, the deployer then sold the minted tokens. On 19 November 2020 the deployer sent 66.2 ETH to 0x7E644890…208B81 (transaction 0xafdc7249…7d38d9), and that wallet deposited 66.2 ETH to a KuCoin address about an hour later (transaction 0x5b4798e8…b7906d). De.Fi lists the case as an exit scam with $32,065 lost.

How it happened

  1. The constructor gives the deployer the minter role: constructor () internal { _addMinter(msg.sender); }.
  2. mint(address account, uint256 amount) public onlyMinter calls _mint, which adds amount to total supply and to the chosen balance. Nothing caps the supply.
  3. On 18 November 2020 the deployer called mint and received 10,000,000 new MTI (transaction 0x48d8abe1…511d7e). New supply created this way dilutes every existing holder.
  4. De.Fi's REKT database says the deployer then sold the minted tokens. The pool data behind that statement was not opened.
  5. On 19 November 2020 the deployer sent 66.2 ETH to 0x7E644890…208B81, which forwarded 66.2 ETH to a KuCoin deposit address.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract MTI
Protocol links Website @finance_mti

Evidence

Same attack technique

Browse all hacks →
Ethereum Rotex $5K lost Ethereum Rubick Finance $21K lost Ethereum K3psav.Finance $3K lost Ethereum x20 finance $3K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes