Wettok Market Rug Pull

Reported loss $190K
Rugpull

What happened

Wettok Market (WTO) is a BEP20 token traded on PancakeSwap. De.Fi's REKT database lists it as an exit scam / rug pull of 189,905 USD, made up of 164,996 USDT and 103 BNB, dated 2023-07-22. The contract gives its owner an uncapped mint function, so supply was never fixed: the owner can create new WTO at any time and sell it into the liquidity pool against the paired USDT and BNB.

According to the De.Fi listing, the deployer 0x7f076960…38e5ef minted 1 billion WTO to an address controlled by the scammer 0x56d35Ddf…420eAB (mint transaction 0x91a27109…1da6ae), drained the pool in several transactions (for example 0x87db5771…fab095), moved 100 BNB through Tornado Cash (transfer transaction 0x55458e67…018378), kept the remaining funds at the scammer address as of July 22, 2023, and then burnt the remaining 993 million WTO (transaction 0x701cffba…436116). De.Fi's alert post says its scanner flagged the root cause before the rug pull happened.

How it happened

  1. The constructor mints the initial supply to the deployer: treasuryWalletAddr = _msgSender(); initialSupply = 3000 * 10**6 * 10**18; mint(treasuryWalletAddr, initialSupply);.
  2. The contract keeps a permanent minting power for the owner: function mint(address _to, uint256 _amount) public onlyOwner { _mint(_to, _amount); }. No maximum supply or cap is enforced anywhere, so any holder of a WTO/USDT or WTO/BNB pool is exposed to dilution by new tokens.
  3. The owner also has function withdraw(address token, address addr, uint256 amount) external onlyOwner { IERC20(token).transfer(addr, amount); }, which can move any ERC20 balance held by the token contract itself to an address of the owner's choice, and burn(address _from, uint256 _amount) public onlyOwner, which destroys tokens from any account without that account's approval.
  4. Ownership has not been given up: the on-chain owner read at 2026-09-30 still returns 0x7f076960…38e5ef, the deployer (a current-state read, not historical). renounceOwnership exists but was not used.
  5. What happened, per the De.Fi listing: on 2023-07-22 about 1 billion WTO were minted to an address under the scammer's control and swapped through PancakeSwap for the pool's USDT and BNB. The listing counts 164,996 USDT and 103 BNB (189,905 USD) taken, with 100 BNB sent through Tornado Cash and the remaining WTO burnt.

Protocol details

Classification Token / Other
Protocol Type Exit Scam/Rugpull
Affected asset / contract WTO
Protocol links Website @wet_tok

Evidence

Same attack technique

Browse all hacks →
IEGT $1.1M lost AORcoin $52K lost Gandalf The Grey $266K lost Scooby Pepe $238K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes