SherLOCK Hack

TOTAL LOST $262K
Low Rugpull

What happened

SherLOCK token's liquidity was totally removed by the token owner. The scammer drained 938 $BNB from the PancakeSwap liquidity pool.

SherLOCK is BEP20 token, and can't be confused with the SherLOCK Security project on the Ethereum chain. The token was deployed on 5th September 2022, and users couldn't sell their $LOCK tokens after buying. On 21st September, the token deployer removed 938 $BNB from the PancakeSwap liquidity pool.

Consequently, 520 $BNB was transferred to Tornado Cash from the original address, and the remaining funds were transferred to another EOA address.

Scammer address:

https://bscscan.com/address/0x1ce21757…ac39bd

Liquidity Pool:

https://bscscan.com/address/0xd989d495…53db1d

Liquidity removal transaction:

https://bscscan.com/tx/0x96aa0df2…fe45da

Tornado Cash transfer transaction example:

https://bscscan.com/tx/0x4b3c3f00…bb4f54

Transfer to EOA address:

https://bscscan.com/tx/0xd388ad3c…8e33d4

Case & protocol details

Classification Token
Protocol Type Insurance
Affected asset / contract LOCK
Official Website sherlock.xyz
Protocol Twitter/X @Sherlock_DeFi

Security review history

Evidence & learning

Sources and on-chain records

Practice this exploit pattern safely

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.