Rug Pull attacks in 2023

The BALD memecoin developer pulled liquidity from Coinbase's Base testnet, netting $5.9M in dev profit and $23M in investor losses while denying any rug pull.

A hidden deployer-only withdrawFunds function in DeFiLabs' BNB Chain staking contract drained $1.6M in user deposits before the project vanished completely.

Kannagi Finance, a zkSync Era yield farm, rug-pulled $2.1M after its closed-source upgradeable staking contract was swapped to a malicious implementation.

$3M rug-pulled from Swaprum on Arbitrum, an Arbiswap fork whose audited contracts hid an upgradeable proxy with a backdoor add() function.

Merlin DEX on zkSync lost $1.82M hours after launch when a back-doored owner role let insiders pull liquidity. CertiK's audit flagged the centralization risk.

Kokomo Finance, an Optimism Compound fork, rug-pulled $4M by pausing cBTC, pointing rewards at a malicious implementation, draining WBTC and deleting socials.

Hope Finance lost $1.86M at its Arbitrum launch after the deployed contract differed from the audited one; funds went straight to Tornado Cash.