Orbit Swap Rug Pull

Reported loss $36K
BNB Chain
Rugpull

What happened

OrbitSwap (ORBIT) is a BEP20 token on BNB Chain (contract 0xc993e816…297af6). Its supply starts at zero and can only be created by the owner through an uncapped mint, and owner() still returned the deployer address 0xdd313329…1c77bf when read on 2026-09-30. De.Fi's REKT database lists the project as an exit scam/rugpull of 36,441 USD on 2021-02-08 and records four deployer actions: minting tokens to its own wallet (transaction 0x26313743…59d30d), adding the initial liquidity (0xe57802a3…b4ba9c), selling tokens across multiple transactions (token transfers of 0xdd313329…1c77bf on BscScan), and removing liquidity (0x32b63293…f1d229). A BSC rug-tracking post dated 2021-02-10 also names Orbitswap among that week's rugs.

The token has no transfer restrictions, so holders can sell; the exposure comes from the owner's ability to mint without limit and from liquidity pulled out of the pool by whoever holds the LP tokens, which the contract itself neither holds nor locks.

How it happened

What the code allows:

  1. Orbitswap is deployed with no initial supply: the BEP20('OrbitSwap', 'ORBIT') constructor only sets the name, symbol and decimals, so every token in existence has to be created by mint.
  2. Both mint entry points are owner-only and have no cap: function mint(uint256 amount) public onlyOwner returns (bool) mints to the caller, and function mint(address _to, uint256 _amount) public onlyOwner mints to any address. The owner can therefore create new tokens at will and sell them into the pool, diluting every other holder.
  3. The transfer path is the plain _transfer with a balance check and no blacklist, fee or trading switch, so the harm does not come from blocked sells. The contract holds no liquidity and has no lock, so pool funds are controlled by whoever holds the LP tokens.

What was reported:

  1. De.Fi's REKT database lists the deployer minting tokens to its wallet, adding the initial liquidity, selling in multiple transactions and then removing the liquidity, with a loss of 36,441 USD. These transactions were not opened for this record, so the order, sizes and the share of the loss from minted versus purchased tokens are not independently verified.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract ORBIT
Protocol links Website

Evidence

Same attack technique

Browse all hacks →
BNB Chain Astronaut NFT $187K lost Ethereum Tranquility Defi $13K lost Ethereum Aphrodite Protocol $97K lost Ethereum Binary Protocol $4K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes