TSUKA Rug Pull

Reported loss $71K
Rugpull

What happened

TSUKA is a copycat BEP20 token (contract 0x4e8842F6…07F56C) and is not Dejitaru Tsuka, which uses the same name. The token contract holds no balances of its own: balanceOf and every transfer are forwarded to a separate accounting contract whose address the deployer chooses, and that contract's code is not part of the verified token source. That leaves the real transfer rules, and every holder's balance, outside what the token code shows.

De.Fi's REKT database lists the deployer 0xf9ddbfdb…a7e158 as adding liquidity on PancakeSwap with 55 WBNB and 500,000 TSUKA, then selling 100,100,100,100,100,000,000 TSUKA for 320 WBNB within an hour of trading starting, which dropped the price by more than 99%. The listed profit is 70,755 USD. The listed figure is far larger than the 1,000,000 TSUKA supply declared in the contract, which fits a token whose balances are not tracked in its own code. CertiK Alert flagged the more than 99% price drop on 2022-09-16.

Liquidity pool: 0x3f024015…1d77ec Drain transaction: 0x950446e1…d87f47

How it happened

  1. The constructor sets _totalSupply = 1000000 * 10 ** 9 and only emits Transfer(address(0), msg.sender, _totalSupply). It writes no balance anywhere, and owner = msg.sender makes the deployer the owner.
  2. balanceOf returns Accounting(accounting).balanceOf(who), and transfer / transferFrom end with Accounting(accounting).doTransfer(...). Whatever contract accounting points to decides every balance and whether any transfer succeeds.
  3. setAccountingAddress is guarded only by require(msg.sender == owner), so the deployer can choose, and until ownership is given up can swap, the contract that holds those rules. The source of that contract is not in the verified token file, so its sell or fee rules cannot be read here.
  4. transfer emits Transfer(msg.sender, to, amount) before it calls doTransfer, so a Transfer event does not by itself show that a balance moved.
  5. renounceOwnership sets owner = address(0). An eth_call on 2026-09-30 reads the owner as the zero address, so setAccountingAddress can no longer be called; when ownership was renounced is not shown by the sources.
  6. What happened, per De.Fi's REKT database: the deployer added 55 WBNB and 500,000 TSUKA of liquidity, then sold into the pool for 320 WBNB and the price fell by more than 99%.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract TSUKA

Evidence

Same attack technique

Browse all hacks →
SherLOCK $262K lost Hunter Doge $46K lost F*ck The Merge $110K lost Cornerchain $51K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes