Incident Overview
The Squid game project has been rug pulled by its team by way of blacklisting users from selling the $SQUID token. Investors were collectively alleviated of approx. $ 5,7 million.
The Squid game project was inspired by the hit Netflix show and promised to be a play to earn game, hereby resembling the actions in the series. The hype surrounding the Netflix show combined with the increased interest in crypto due to the bull market incentivized big news outlets such as BBC and CNBC to write about the rapid surge in price of the new $SQUID token. Retailers around the world pushed the price from $0,01 to $2,861 in little over a week. CoinMarketCap published a warning concerning this project from the start as early investors reported that the sell of the token on pancake swap was not possible. A look at the smart contract revealed that all 3 contracts: SQUID, Marbles, and MasterChef were upgradable. Meaning the contract deployer would change the mechanisms of the project at will.
For example a new MasterChef made it possible for the 0x71 EOA to withdraw all tokens from the MasterChef contract at the following transaction:
https://bscscan.com/tx/0xf7c9d0e5…2cb6af
The Squid game project boasted two token. The $Marbels token was required in order to be eligible to sell $SQUID on the open market. $Marbles were not tradable on the market and could only be obtained by participating in the game with an entrance fee of $SQUID 456. Meaning at the all time high price of the SQUID token a withdrawal would have costed at least $1,3 million.
The contract deployer also blacklisted all users that did not hold Marble's token to prevent from selling SQUID in this transaction:
https://bscscan.com/tx/0x5b82e96f…555041
Involved EOA addresses:
https://bscscan.com/address/0x71d934aa…b0f728
https://bscscan.com/address/0x34400280…e7f0aa
https://bscscan.com/address/0x1f5eabba…125b31
https://bscscan.com/address/0x3228eea3…9bfb65
0x32 invoked the internal protocol's contract which worked as the interface of the PancakeSwap pair contract to sell SQUID tokens at multiple transactions under the "0x5c2a8729" method:
https://bscscan.com/address/0x3228eea3…9bfb65
Example of "0x5c2a8729" transaction:
https://bscscan.com/tx/0x98a07fde…3ae96a
The WBNB recipient was EOA, marked as SQUID Token Rug 2, which then deposited stolen funds into Tornado Cash Proxy:
https://bscscan.com/address/0x34400280…e7f0aa
2 unverified smart contracts were used to sell SQUID tokens:
https://bscscan.com/address/0x95eb532f…7d722f
https://bscscan.com/address/0x5b871670…2c9dcd
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Squid Game, these are the critical security checks that could have prevented this incident (November 2021).
- Verify all logic paths related to Rugpull are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSources & References
- 01
- 02
- 03
- 04
- 05
Learn to Prevent the Next Squid Game
The Squid Game hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.