SherLOCK Hack
What happened
SherLOCK token's liquidity was totally removed by the token owner. The scammer drained 938 $BNB from the PancakeSwap liquidity pool.
SherLOCK is BEP20 token, and can't be confused with the SherLOCK Security project on the Ethereum chain. The token was deployed on 5th September 2022, and users couldn't sell their $LOCK tokens after buying. On 21st September, the token deployer removed 938 $BNB from the PancakeSwap liquidity pool.
Consequently, 520 $BNB was transferred to Tornado Cash from the original address, and the remaining funds were transferred to another EOA address.
Scammer address:
https://bscscan.com/address/0x1ce21757…ac39bd
Liquidity Pool:
https://bscscan.com/address/0xd989d495…53db1d
Liquidity removal transaction:
https://bscscan.com/tx/0x96aa0df2…fe45da
Tornado Cash transfer transaction example:
https://bscscan.com/tx/0x4b3c3f00…bb4f54
Transfer to EOA address:
https://bscscan.com/tx/0xd388ad3c…8e33d4
Case & protocol details
Security review history
- Sherlock Report
Evidence & learning
Sources and on-chain records
- report Report twitter.com
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.