SuperStep Hack

The SuperStep project was rugpulled by the team that worked on it. The team created a staking platform, offering a high annual income from staking. The project entailed a backdoor in the contract, allowing the creator address to withdraw all of the staked $BNB within the protocol.

SuperStep is a fitness DAPP empowered by Jog-to-Earn mechanism.

The scammers created contracts to attract investors to their project. In order to make the token valuable, they created a pair on PancakeSwap in this transaction:

https://bscscan.com/tx/0x83275f17…d69acc

Then they made an airdrop, which attracted even more investment in the project:

https://bscscan.com/txsInternal?a=0xc54b1292…8d54ea&p=92

When funds were deposited into the staking contract, scammers began to withdraw funds:

https://bscscan.com/address/0xaef547a5…444885#internaltx.

Funds were laundered via Tornado.cash.

As the time of this writing information on this case is scarce. More sources will be added if the case should develop.

Involved address:

Scammer address (A): https://bscscan.com/address/0xaef547a5…444885

Scammer address (B): https://bscscan.com/address/0x52c586c2…f2caac

Scammer address (C): https://bscscan.com/address/0xd2f7fd26…67e812

Liquidity pool creation transaction: https://bscscan.com/tx/0x83275f17…d69acc

Contracts interacted with:

Token address: https://bscscan.com/address/0x6f7a8827…b5b55f

Gem address: https://bscscan.com/address/0x594b5d76…f65633

Unverified contract addresses:

1. Address
2. Address