PopcornSwap Hack

TOTAL LOST $2.2M
Medium Rugpull binance

What happened

The address behind the exit scam:

https://www.bscscan.com/address/0xFd6042Df…933c55

This address, marked as Phishing, got an unlimited allowance for transferring users' LP tokens from the Master Chef contract. The phishing address has withdrawn LP tokens onto his wallet by calling transferFrom() function into the Master Chef contract at:

https://www.bscscan.com/tx/0xe214c0f7…69cfb3

https://www.bscscan.com/tx/0x4bdb3728…cecbb5

https://www.bscscan.com/tx/0xe7f51685…225803

https://www.bscscan.com/tx/0x4f7685b0…4db465

https://www.bscscan.com/tx/0xaa277c44…c05394

The liquidity was removed multiple times by the Phishing address at:

https://www.bscscan.com/tx/0xa4593c08…d6634f

https://www.bscscan.com/tx/0x6659c115…c3b7e1

https://www.bscscan.com/tx/0x6c09b231…f62a87

https://www.bscscan.com/tx/0x9c218c10…c2df74

https://www.bscscan.com/tx/0x24f8004e…366ddd

Stolen funds are still holding on to the Phishing address.

Technical Root Cause

Unlimited allowance

Case & protocol details

Classification Exchange (DEX)
Protocol Type Exit Scam/Rugpull
Affected asset / contract POPCORN
Official Website popcornswap.com/
Protocol Twitter/X @SwapPopcorn

Evidence & learning

Sources and on-chain records

Practice this exploit pattern safely

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.