StableMagnet Rug Pull

Reported loss $27.0M
BNB Chain
Drained Contracts and User Wallets

What happened

StableMagnet was a deliberate rug pull on BNB Chain on June 23, 2021. The operators drained roughly $27 million in stablecoins from protocol pools and wallets that had granted StableMagnet token approvals. Greater Manchester Police later recovered about $22.25 million in crypto assets.

Technical root cause

Linked-library bytecode was not independently verified, allowing a malicious library with administrator withdrawal and approval-drain logic to execute. The incident shows why source verification must include deployed library addresses and bytecode, not only the main contract source.

How it happened

  1. The deployed SwapUtils linked library did not match the audited source shown to users.
  2. The replacement library contained backdoor functions that withdrew pooled stablecoins.
  3. The same logic used existing ERC-20 approvals to pull tokens from user wallets.
  4. Law-enforcement seizure later recovered reported assets; that recovery is distinct from the amount initially drained.

Protocol details

Classification Rugpull / Other
Protocol Type Exit Scam/Rugpull
Affected asset / contract SMAG
Implementation language Solidity
Protocol links Website @stablemagnet

Funds Recovery

88.9%

Recovered

$24.0M

Net Loss

$2,997,000

Post-Incident Timeline

  • 2022-12-01

    On 1 December 2022, after a year after the incident, 24,000,000 $USD from the stolen assets were returned.

Evidence

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes