What happened
On January 25, 2023 attackers took over Robinhood's Twitter account and posted the launch of a fake RBH token on BNB Chain, priced at $0.0005. Robinhood's Instagram and Facebook profiles posted the same unauthorized content. Robinhood said the posts were removed within minutes and that, based on its investigation, the source of the incident was a third-party vendor.
The scammer had funded a wallet with about $1,000 of BNB from a Binance hot wallet, minted 100 million RBH, and seeded a PancakeSwap pool with the tokens and 3.1 WBNB before the posts went out. According to on-chain figures shared by ZachXBT and reported by Decrypt, the scammers made off with about 26.95 BNB, around $8,200. SlowMist says about 25 people bought the token for a total of just under $8,000. CoinDesk counted $16,335 of WBNB swapped into the pool and 61 holder addresses at press time, a gross inflow figure that includes the scammer's own liquidity and trading.
This was a social media account compromise used for a token scam, not a flaw in any smart contract.
How it happened
- The scammer's wallet received about $1,000 of BNB from a Binance hot wallet and made test transactions creating BEP-20 tokens and PancakeSwap pools.
- The scammer minted 100 million RBH and added them with 3.1 WBNB as liquidity in a PancakeSwap pool.
- Using access to Robinhood's social accounts, reportedly gained through a third-party vendor, the attackers posted the RBH launch to Robinhood's followers.
- Buyers swapped BNB into the pool for RBH before the posts were deleted, and the scammers left with about 26.95 BNB.
Protocol details
Evidence
- analysis DeFiLlama defillama.com
- analysis Robinhood's Twitter Account Promotes Scam Token on Binance's BNB Chain in Unauthorized Posts (CoinDesk, 2023-01-25) coindesk.com
- analysis Hackers Take Over Robinhood Twitter Account To Promote Scam (Decrypt, 2023-01-25) decrypt.co
- analysis SlowMist Hacked - entry 2023-01-26 Robinhood hacked.slowmist.io
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
