Meerkat Finance
A BNB Chain yield-vault protocol that lost ~$31M (≈14M BUSD and ~73,600 BNB) one day after launch in March 2021. The deployer used the proxy upgradeTo() function to swap the vault logic for malicious contracts with a permissionless 'backdoor' and drained the vaults. Widely classified as a rug pull.
Also known as: Meerkat Finance
Summary
Meerkat Finance was a BNB Chain yield-vault protocol that lost about $31 million (≈13.96 million BUSD and ~73,600 BNB) on March 4, 2021, one day after launch. The deployer used the proxy upgradeTo() function to replace the vaults' logic with malicious contracts containing a permissionless initialization "backdoor," then drained the vaults. [1][2]
Aftermath
A developer later claimed the episode had been a "test [of] user greed" and promised refunds, but the team's online accounts disappeared. The incident is widely classified as a rug pull (or exit scam). [2][3]
Bracketed numbers refer to the numbered sources listed below.
Sources (3)
- Meerkat Finance — REKT — rekt.news
- Meerkat DeFi team briefly rug-pulls $31 million before returning funds — Web3 is Going Great
- Meerkat Finance: Anatomy of a $31 Million DeFi Rug Pull — Vidma
See also
World Liberty Financial (WLFI) — Justin Sun token freezeProjectsWLFI, a DeFi project linked to Donald Trump and his family, blacklisted/froze the wallet of major investor Justin Sun in Sept 2025 — ~540–595M unlocked WLFI tokens (~$107M) plus ~2.4B locked. Sun sued, alleging an undisclosed admin 'blacklist backdoor'; WLFI denied it and threatened a countersuit. The dispute is ongoing.
Gala Games exploitTokensOn May 20, 2024 an attacker abused a privileged minter account on the GALA token contract to mint 5 billion GALA (≈$200M+ nominal) and dumped ~600M of them for ~$22M of ETH before Gala froze the address. Gala Games called it an internal access-control failure; the attacker later returned the ~$22M.
This page was last updated on Jun 15, 2026. View revision history.
