StableMagnet
A BNB Chain stableswap protocol that rug-pulled ~$27M in June 2021 by deploying a linked library different from its verified source code, letting operators drain the protocol and approved user wallets. A white-hat traced the team to Manchester, UK; arrests followed and most funds were returned.
Also known as: StableMagnet
Summary
StableMagnet was a BNB Chain stableswap protocol that rug-pulled about $27 million on June 23, 2021. The operators hid a backdoor by deploying a linked library that differed from the verified source code — block explorers verified the main contract but not the linked library — which let them drain the protocol and the wallets of users who had approved it. [1][2]
Recovery
An anonymous white-hat traced the team via GitHub and social-media data to Manchester, United Kingdom, and coordinated with police. Arrests followed, about $9 million was seized from a USB device, and remaining members cooperated and returned most of the stolen funds. [2][3]
Bracketed numbers refer to the numbered sources listed below.
Sources (3)
- Explained: The StableMagnet Rugpull (June 2021) — Halborn
- Top 10 Rug Pulls — StableMagnet — Bankless
- Cyber vigilante hunts down DeFi scammers (StableMagnet) — Cointelegraph
See also
World Liberty Financial (WLFI) — Justin Sun token freezeProjectsWLFI, a DeFi project linked to Donald Trump and his family, blacklisted/froze the wallet of major investor Justin Sun in Sept 2025 — ~540–595M unlocked WLFI tokens (~$107M) plus ~2.4B locked. Sun sued, alleging an undisclosed admin 'blacklist backdoor'; WLFI denied it and threatened a countersuit. The dispute is ongoing.
Gala Games exploitTokensOn May 20, 2024 an attacker abused a privileged minter account on the GALA token contract to mint 5 billion GALA (≈$200M+ nominal) and dumped ~600M of them for ~$22M of ETH before Gala froze the address. Gala Games called it an internal access-control failure; the attacker later returned the ~$22M.
This page was last updated on Jun 15, 2026. View revision history.
