Binance Smart Chain Hit By $2.4 Million TurtleDex Exit Scam

TurtleDex, a decentralized finance (DeFi) file storage project on the Binance Smart Chain (BSC), is believed to have pulled a rugpull exit scam yesterday when more than $2.4 million in funds were drained from trading pools on major BSC DeFi exchanges Ape Swap and Pancake Swap. 

TurtleDex launched on March 15, advertising itself as a DeFi storage platform to help users store data and files securely online. Its pre-sale that day raised 9000 BNB tokens, or about $2.4 million, in just two hours. 

Yesterday, TurtleDex drained the liquidity pools on Ape Swap and Pancake Swap, converted their pot to ETH and then sent the funds to Binance wallets, according to Etherscan. 

TurtleDex’s entire online presence has vanished; its website is offline and the Telegram group’s admin’s accounts have been deleted, along with its Twitter account. 

The rugpull as it unfolded

The alleged heist was first flagged up by Twitter user @DefiStalker, who, at 9.30 AM UTC yesterday, wrote that “Liquidty [sic] on both @ape_swap & @PancakeSwap has been removed 10hrs ago and swapped to $ETH, split to 9 wallets, all sent to @binance. 

Jetfuel.Finance, a yield farming platform that partnered with TurtleDex, expressed its shock and dismay at the rug pull, tweeting, “We are just as shocked as everyone to see this unfold” before confirming both on Twitter, and in a Medium post that Jetfuel “will soon be delisted” from its platform. 

Jetfuel also took the initiative to start two Telegram groups in the hopes of recovering lost funds. One of them is called “Turtledex RUG” and the other is “ApeSwap - TTDX Recovery.”

Binance keeps schtum

All eyes are on Binance to mitigate the damage to investors’ pockets. So far there has been no word, but a tweet from company head CZ earlier this week clarified that “We actually help with a few rug pulls recently too.” Binance did not respond to Decrypt's request for comment.

It’s happened before on the Binance Smart Chain. Earlier this month $31 million was siphoned out of DeFi project Meerkat Finance’s vaults in what was ostensibly an attack by hackers, though many investors believe it was a rugpull, after Meerkat Finance’s website and social media platforms blacked out. 

Meerkat’s developers then returned the funds. In a newly created Telegram group called ‘Meerkatrefunds’ a Meerkat developer identifying themselves as “Jamboo” said the whole thing was a ‘test,’ though how much of a ‘test’ it was remains open to speculation. The Binance Smart Chain is a semi-closed ecosystem, which means that  Binance commands the various entry and exit points to the Smart Chain. This ensures that it’s very hard to take funds off the Smart Chain without passing under the surveillance of Binance’s central control. It could very well be the case that Binance stepped in.

This month has brought bitter tidings to DeFi fans. On March 9, hackers took $3.8 million worth of crypto from DeFi platform Dodo after discovering a bug that let them create counterfeit tokens and use them in tandem with flash loans (smart contracts that offer loans in a single transaction) to collect real tokens. 

These attacks prove that the growing DeFi space is still risky business for investors. 

Before TurtleDex’s rugpull, one concerned investor asked the company: “Why do turtles not rugpull?” 

It replied: “Because hands are too short”

That aged fast, didn’t it?