Check Point Research unravels the Rug Pull: a million-dollar scam involving a fake token factory

By Oded Vanunu, Dikla Barda, Roman Zaikin

Highlights

• Blockchain Vigilance Exposes Million Heist: Our Threat Intel Blockchain System uncovered an ongoing rug pull event and identified the perpetrator behind this scheme

• The Scammer’s Tactics: Exploiting the Hype for Illegal Gains. The perpetrator lured unsuspecting victims into investing.

• Uncovering the Scam: A Step-by-Step Deception The scam occurred in several phases, including the creation of fake tokens, manipulation of liquidity pools, simulated trading activities, and extraction of funds.

• Check Point Researchers encourages investors to understand the details of this step-by-step process, which is critical to protecting themselves from falling victim to similar schemes.

background

In the dynamic cryptocurrency space, recent events have highlighted the ever-present threat of rug pulls – fraudulent maneuvers that leave investors empty-handed. Our Threat Intel Blockchain System, developed by Check Point, recently raised the alarm about a sophisticated scheme that managed to steal almost $1 million. Let’s dive into the details of this elaborate crypto scam and understand how it unfolded.

Check Point’s Threat Intel Blockchain System identified and alerted to the following address: 0x6b140e79db4d9bbd80e5b688f42d1fcf8ef97798

This address is involved in blacklisted activity. Our system has started monitoring activity associated with the wallet address:

This is the remaining balance of the scammer’s wallet (11/15/23). This address hosted 40 different robberies and almost $1 million was stolen!

The scammer’s tactic (0x6b140e79db4d9bbd80e5b688f42d1fcf8ef97798) is to create tokens based on the latest hype to trick victims into purchasing his tokens, for example with the token name GROK 2.0 (0xd4b726c5b5e6f63d16a2050ee3ac4a0f0f81 f1d4), possibly derived from a well-known AI system (X GROK), is intended to attract buyers.

The Anatomy of Fraud:

How did this elaborate fraud work and how did it manage to siphon off a significant sum? Here’s a breakdown:

1. Creating fake tokens: The scam started with the creation of fraudulent tokens, such as the GROK 2.0 token. The choice of names often reflected trending topics to attract unsuspecting buyers.
2. Add money to the liquidity pool: To create a façade of legitimacy, the scammer injected funds into the token pool, creating the illusion of a live and active token.
3. orchestrated Trading activities: The fraudster used a special function (0x521da65d) in the contract and executed simulated trades that made it appear as if real purchases and sales were taking place. However, it was just a ruse orchestrated by the fraudster.
4. Increase volume: Another feature (0xf029e7cf) came into play that enabled large-scale transactions between the WETH cryptocurrency and the GROK token. This artificial inflation created a feeling of high demand and value, enticing investors to join in.
5. Attract buyers: Users took advantage of the perceived attractiveness of the token and began buying in, unaware of the impending deception.
6. Take the money: Once the token had attracted enough investors, the scammer carried out the final step: withdrawing liquidity from the token pool, leaving token buyers empty-handed and depleted of funds.

Technical part

The scammer used two different smart contracts to trade and increase token volume. The first contract address he used is 0x2ef3216e95e2b7c8e378ae64534100e69598f955, which contained the simulated trading function (0x521da65d).

Function 0x521da65d

The function 0x521da65d is responsible for selling and buying the token for the fraudster, this function was executed 226 times for this token alone. The function’s behavior depends on the Boolean value varg7, which dictates its flow and results in two separate execution routes.

The first route (0x306b) is to switch from the cryptocurrency WETH to GROK 2.0 (buy).

As you can see in this picture:

And the 2nd route (0x2bac) represents the switch from GROK 2.0 to WETH (sell).

For the second smart contract, the fraudster used the address 0x4b2a0290e41623fbfeb5f6a0ea52dc261b65e29b, where he executed the function 0xf029e7cf to artificially increase the volume of the token.

Function 0xf029e7cf

This function receives five parameters:

Decoding the following data sent to this function reveals the following arguments:

Varg0 is the Uniswap router address that the scammer uses to exchange the tokens.

Varg1 is the WETH cryptocurrency address used for swapping for the GROK token.

Varg2 is the GROK 2.0 token address.

Varg3 is the amount of token to be exchanged.

Varg4 is the frequency at which this token should be exchanged.

Upon closer inspection of the function, we found that the scammer used the “swapExcatToekensSupportingFeeOnTransferTokens” function from the Uniswap router (varg0) to transfer from WETH (varg1) to GROK (varg2) nine times (varg4) and from GROK to WETH with one Total amount to exchange of $420,000 This increases the volume of the token and attracts traders and bots to buy.

The swaps loop can be seen in the following screenshot:

In the final phase of the scam, the scammer withdrew funds from the token’s liquidity pool after attracting a sufficient number of buyers and increasing the token’s price. This is evidenced by the fact that they removed liquidity from their fraudulent tokens 81 times.

Diploma:

As the crypto landscape continues to evolve, it is paramount for investors to remain vigilant and informed. The recent rug pull incident is a stark reminder of the need for increased awareness and due diligence. By understanding the tactics used by scammers, we can work together to create a safer crypto environment.

It is important to note that our commitment to protecting the crypto community goes beyond mere detection. Check Point researchers are actively monitoring domains associated with the identified fraudster’s wallet address and the like. The Threat Intel Blockchain System developed by Check Point continues to collect valuable information about emerging threats and this information will be shared in the coming future. With this collaboration, we aim to provide investors with the knowledge they need to confidently navigate the crypto space and protect themselves from potential pitfalls. For further information contact us at: [email protected]

Learn Crypto Trading, Yield Farms, Income strategies and more at CrytoAnswers
https://nov.link/cryptoanswers