NFT Exchange SudoRare Rug Pull $800,000 Hours After Launch, Goes Offline

On Tuesday, NFT exchange SudoRare scammed users out of around $820,000 in various cryptocurrencies. Before he pulled the curtain and shut down the website and associated social media profiles, SudoRare had only been in operation for six hours.

SudoRare stole $820,000

Before deleting the project’s online presence on Tuesday, the creators of the non-fungible token (NFT) platform Sudorare released a total of $820,000 in customers’ cryptocurrencies.

Sudorare is part of LooksRare (LOOKS), another decentralized NFT marketplace that pays users to use its service, and SudoSwap, a decentralized NFT marketplace known for its NFT liquidity pools and lower gas prices. In the past year, both projects have become more well-known in the cryptocurrency community.

Users who staked LOOKs, XMON and WETH for Sudorare’s own tokens within a week gained access to a yield farm.

On-chain data indicates the incident occurred early Tuesday, just six hours after SudoRare went live. Created by an unidentified team as part of NFT marketplaces LooksRare and sudoswap, the exchange was designed to allow users to build liquidity pools for NFT collections and earn fees by staking the project’s native token SR. But shortly after going live, the team “pulled the curtain.” The website and Twitter account for the platform disappeared shortly after.

Rug pulls are decentralized finance (DeFi) scams where the developers work legitimately on a blockchain and then drain the liquidity pools from the project, thereby “pulling the rug” from investors and causing a dramatic decline in connected tokens.

Many warned that it could be a scam

Many in the Crypto Twitter community were skeptical, with 2shabby tweeting on Monday that SudoRare may be a scam, “Do not participate unless you want to take the risk of losing your money. This team is [anonymous]won’t dox [disclose their identities]and the possibility that this is a fraud is high.”

Another Twitter user 0xStanec had a high degree of suspicionand said, “This is like a 1001% scam noobs will fall for it.”

“Sudo weird is live but ppl are betting on an upgradable contract pointing to a fork of masterchef… Can’t see any reason to need an upgradable version of Masterchef as it really is battle tested already… stay safe as could be a scam,” one user goes by Adam pointed out on Twitter earlier today.

Data from chained forensics platform PeckShield reveals that the money has already been transferred to three separate wallets.

#PeckShieldAlert #rugpull Seems @SudoRare robust 519 $ETH (~$815k).
SudoRare has already deleted his social accounts/groups, sudorare[.]xyz is down
Steal funds that have already been transferred to 3 new addresses (173 $ETH/address):
0x75c3b2…3981
0x0498d1…8074
0xbFb784…7EAa pic.twitter.com/O5D7jThYvm

— PeckShieldAlert (@PeckShieldAlert) 23 August 2022

PeckShield and other observers assumed that the project’s founders were responsible for its demise. This is due to the fact that given how soon after the launch the hack happened, they were the only ones likely to have access to the liquidity in the pool.

BTC/USD trades at $21k. Source: TradingView

The company announced later that one of the crypto addresses belonged to a user who has an account with Kraken.

Kraken must perform mandatory identification checks on each of its customers in accordance with “Know Your Customer” regulations because it operates as a regulated US exchange. This means that at least one person connected to the attack may have been aware of the exchange.

Featured image from iStockPhotos, chart from TradingView.com