Uncovering the Swaprum rug pull and how $3 million in customer funds ‘disappeared’

On May 19, blockchain security firm PeckShield revealed that nearly 1,628 ETH, worth $3 million, were drained from Swaprum's liquidity pools. It was later revealed that investors might have fallen victim to a rug pull.

To provide context, a rug pull, or exit scam, is a type of fraud in which a development team suddenly abandons a project and disappears with investor funds.  Such scams are driven by projects promising too-good-to-be-true yields and lucrative rewards to attract people.

In the Swaprum incident, the development team allegedly drained the project’s liquidity that had been issued against APR, the exchange's native coin. Following that, the team sold the APR for ETH, which resulted in a significant drop in the price of APR.

The Swaprum team then allegedly transferred the funds to Ethereum and used a mixer service called Tornado Cash to mask its activity. Consequently, investors unaware of the scam ended up with remaining worthless coins.

Once the liquidity pools were drained, most online footprints of Swaprum disappeared overnight. This included the project’s social media handles such as Twitter, Telegram, and GitHub. However, the website is still operational at the time of writing.

Further investigation by the blockchain security platform Beosin revealed that the deployer of the Swaprum smart contract had added a backdoor function that enabled the theft of users' staked tokens in the liquidity pool. Beosin explained that the team had updated the normal liquidity collateral reward contract to the one containing a covert backdoor function.

What is even more concerning is that Swaprum had declared a positive vulnerability check from auditing firm Certik before the alleged rug pull incident occurred. This, however, raises issues about whether the certification was forged or if Certik overlooked the DEX's contract flaw.

A similar scam occurred in November 2021, when an unknown developer launched a crypto token inspired by the popular Netflix show, 'Squid Games.' The show features people risking their lives to win a deadly game to overcome personal debts.

Monetizing the wild hype of the show, the developers released Squid tokens, which began trading on the PancakeSwap platform on October 26. The developers eventually abandoned the project and stole $3.3 million in customer funds, rendering the remaining SQUID tokens worthless.

Projects at risk of a potential rug pull can be easily spotted if investors look past FOMO (fear of missing out). For instance, the lack of a whitepaper, or fully shadowed developers without any information on their identities, are some major red flags.

Additionally, massive social media marketing campaigns can be a warning sign, especially if the project does not have any substantial product to show for it.

Sudden and reoccurring price swings or trading volumes may also suggest manipulators at work. To prevent rug pulls, it is important to assess the team and make sure that the project you invest in is open about how they work.