StableMagnet Rug Pull

StableMagnet was a decentralized exchange on BNB Chain for swapping stablecoins. On 23 June 2021, its own developers pulled off a rug pull. The main contract matched the code the team had published, but it relied on a separate piece of code that was never verified on the block explorer and differed from what the team had shared. Block explorers did not check that linked code, so the backdoor was invisible to anyone reviewing the contract. The project's audit also only covered the published code, not what was actually deployed.

The backdoor let the developers empty StableMagnet's liquidity pools and then keep pulling tokens from wallets that had approved the exchange. The theft started at around $22M and grew to about $27M as more wallets were drained. In August 2021, Greater Manchester Police said it had tracked the people behind the scam to Manchester, arrested two people and seized around $22M in crypto from a USB stick and an online vault. Police said work had begun to return the funds, but only a small part has been confirmed as returned to victims.

The StableMagnet contract was never paused or repaired, so the backdoor was never removed. Many wallets still have live approvals to it, so any tokens in those wallets remain at risk. If you ever used StableMagnet, revoke all approvals to its Swap contract on BNB Chain. This case also shows that a verified contract on a block explorer is not proof of safety, because code linked to it may not have been checked at all.

Affected users remain at risk as long as they haven't revoked their approvals, so it is recommended to use the Revoke.cash Exploit Checker below to make sure that you're safe.