Binance Faces Backlash as PopcornSwap Scam on BNB Chain Leaves Users Seeking Answers
Summary:
The PopcornSwap scam on the BNB Chain resulted in users losing $2 million. Binance initially stated that the funds were frozen but later retracted the statement. After nearly two years, Binance finally froze the scammer's wallet, which had grown to $10.8 million. Users are demanding more from Binance. This highlights the risks of using smart contracts and the ability of centralized entities to control user assets.
A rug pull scam on the BNB Chain has resulted in users losing $2 million (equivalent to $11 million in current BNB prices). Affected users have reached out to Binance for assistance, but the initial statement that the funds had been frozen was later retracted. After nearly two years, Binance finally took action to freeze the scammer's wallet, which had grown to $10.8 million. Binance had previously claimed that it could not freeze wallets outside exchange addresses due to BNB Chain's decentralized nature. Unsatisfied with the response, users are demanding more from Binance. This is the story of the PopcornSwap scam.
On January 28, 2021, decentralized exchange PopcornSwap on the BNB Chain executed an exit scam, stealing over $2 million from liquidity providers by exploiting a little-known function in the exchange's smart contract. Users turned to Binance, the creator of BNB Chain, hoping that the scammer's address would be frozen. Over time, the value of BNB held in the scammer's account grew to over $10 million as users wondered if the funds had been frozen.
Investigations have revealed that contrary to popular belief, Binance can freeze private wallet addresses on the BNB Chain with the consent of all validators. However, Binance only froze the attacker's address nearly two years after the scam took place. During this time, the scammer chose not to move the funds voluntarily.
In 2021, PopcornSwap emerged as one of the first decentralized exchanges on the newly launched BNB Smart Chain. Users eagerly deposited liquidity in the hopes of earning high returns from expected trading volumes. Unfortunately, instead of profits, they lost all the funds they had put in. PopcornSwap was a fork of Pancakeswap, which itself was a fork of Sushiswap on the Ethereum network. Sushiswap included a function that allowed developers to approve themselves as spenders for every liquidity provider token, allowing them to drain all the assets held by the protocol.
Between January 28, 2021, 1:26 p.m. and 5:53 p.m. UTC, the attacker drained $2 million worth of crypto from PopcornSwap by using the mentioned function and converting it all into BNB. This left the scammer with approximately 48,511 BNB, worth $2 million at that time and $10.8 million now. The stolen funds have remained untouched for over two years.
In the aftermath of the rug pull, victims created the PopcornRugPull Telegram group and urged each other to contact Binance and report the fraud, hoping that the scammer's address would be frozen before any cash-out attempts could be made. While some believed that Binance had the ability to freeze the scammer's private wallet address, others argued that a centralized exchange cannot do so.
On January 29, 2021, Binance responded to one of the victims, mistakenly stating that the scammer's wallet had been frozen and urging patience until the situation was resolved by authorities. However, by October 2022, the stolen funds remained untouched, and attempts to get a response from Binance's customer service were met with generic replies requesting users to contact the police. Blockchain data shows that the scammer's address had not been frozen before October 6, 2022, and Binance did not have possession of the stolen funds.
On October 6, 2022, a new proposal was made to freeze address 0xFd6042Df3D74ce9959922FeC559d7995F3933c55, the scammer's address, following an unrelated attack that exploited the BSC Token Hub bridge. The proposal, which included freezing both the bridge exploiter's and PopcornSwap scammer's addresses, was unanimously approved by BNB Chain validators. However, the proposal did not include transferring the frozen funds to another address, leading victims to think that Binance could have done more to address the incident.
Binance has confirmed that the proposal to freeze the scammer's address was made by them, but it required the consent of all validators to be implemented. They also clarified that the funds were never transferred to Binance, and they do not have control over them. Binance emphasized that BNB Chain is decentralized, and freezing wallets is not easily done. The investigation into the incident remains open, and Binance is ready to cooperate with law enforcement if needed.
The PopcornSwap scam serves as a cautionary tale of the risks involved in using smart contracts. If a contract contains a vulnerability that allows funds to be drained, victims face challenges in seeking reimbursement from validators after the attack. Additionally, this incident highlights that despite claims of decentralization, entities can still exercise control over user assets if they choose to do so.
Published At
9/7/2023 3:00:00 PM
Disclaimer: Algoine does not endorse any content or product on this page. Readers should conduct their own research before taking any actions related to the asset, company, or any information in this article and assume full responsibility for their decisions. This article should not be considered as investment advice. Our news is prepared with AI support.
Do you suspect this content may be misleading, incomplete, or inappropriate in any way, requiring modification or removal?
We appreciate your report.