Swaprum, a decentralized exchange (DEX) on the Ethereum layer-2 network Arbitrum, has allegedly conducted an exit scam and drained $3 million in ether (ETH) tokens from the protocol. The platform offered high farming rewards and low swapping fees, with potential earnings of up to 100% annual percentage yield (APY).
Swaprum Rugpulls Users for $3M
On Friday, blockchain security firm Peckshield flagged the incident, revealing that around 1,628 ETH (worth approximately $3 million) was drained from Swaprum’s liquidity pools. The exit scam was executed in the late hours of Thursday and the team started by removing the liquidity provided for SAPR, the platform’s native token. They then sold the assets for ETH, transferred the funds from Arbitrum to Ethereum, and finally moved them to cryptocurrency mixer Tornado Cash.
A deeper analysis by blockchain security platform Beosin revealed that the deployer of the Swaprum smart contract added a backdoor function to steal liquidity pool tokens staked by users. The Swaprum team had upgraded the normal liquidity collateral reward contract to another containing backdoor functions, according to Beosin.
“The backdoor function add() will transfer LP tokens from the contract to the _devadd address. By querying the _devadd address, it will return the ‘Swaprum:Deployer’ address. The Swaprum: Deployer uses the stolen LP tokens in the previous step to remove liquidity,” the security platform stated.
SAPR Token Plunges 99%
As a result of the rugpull, SAPR lost almost all of its value. At writing time, the token was trading at $0.000022 with a 24-hour trading volume of $83, signifying a 99% decline from its previous price of $0.147 before the rugpull, according to data from CoinMarketCap. Swaprum’s social media accounts on Twitter, GitHub, and Telegram have been deleted, leaving only the platform’s website active at press time.
Swaprum’s rugpull is one of the largest exit scams on the Arbitrum network and overthrows that of DeFi protocol Hope Finance, which suffered a $2 million exploit in February allegedly deployed by a Nigerian hacker who created a fake router on the platform.
