Tomatos Hack

TOTAL LOST $286K
Low Rugpull ethereum

What happened

The withdrawal of the user's funds was possible by the smart contract's unlimited malicious approval, which granted attacker to take DAI, TrueUSD, USDC-Tomatoes LP, USDC, USDT, and UNI from users' wallets. Users that deposited ETH during the pre-sale did not get project tokens. The project's social media is inaccessible.

Stolen funds were deposited into Tornado mixer:

  1. 0x96f3bae8…d53924
  2. 0xe908da08…c9dcee
  3. 0x56ddf87a…c8a880
  4. 0x3aa6c5c4…5692b4
  5. 0xcc8c4d38…d74156
  6. 0x1091bd2e…93f15a
  7. 0x7ec1bcac…fd3f7a
  8. 0xb0b725ca…6ac3ae

Example transactions of withdrawal from the fake contracts:

https://etherscan.io/tx/0x264e1a5a…8a11c6

https://etherscan.io/tx/0xb0b725ca…6ac3ae

https://etherscan.io/tx/0xcab4d6e0…99ddc3

https://etherscan.io/tx/0xcbf6858d…7d1d89

https://etherscan.io/tx/0x5399f79a…5b3b34

https://etherscan.io/tx/0x7d61c0b1…76ec74

https://etherscan.io/tx/0x7efa4390…9bf101

https://etherscan.io/tx/0x3e51d5f0…4addfc

Case & protocol details

Classification Exchange (DEX)
Protocol Type Exit Scam/Rugpull
Affected asset / contract TOMATOS
Official Website tomatos.finance/
Protocol Twitter/X @FinanceTomatos

Evidence & learning

Sources and on-chain records

Browse all hacks

Other incidents recorded with the same attack technique.

Pepe Trump $38K
NYC Memecoin $3.4M
OracleBNB $80K
Aqua $4.7M

Practice this exploit pattern safely

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes