{"investigation":{"slug":"meerkat-finance","entity_name":"Meerkat Finance","trust_score":0,"severity_base":0,"score_modifier":0,"confidence":0.93,"status":"under_investigation","content_type":"investigation","summary":"Meerkat Finance was a Binance Smart Chain yield-vault protocol that launched on March 3, 2021 and was drained of approximately $31.56 million in BUSD and BNB less than 24 hours later. On-chain evidence indicates the project's own deployer address executed the exploit, pointing to an intentional exit scam rather than an external hack. A developer identifying as 'Jamboo' subsequently claimed the drain was a 'trial' testing user greed, promised full refunds, and approximately 95% of funds were eventually recovered under heavy pressure from Binance and the BSC community.","sections":[{"content":"Meerkat Finance (ticker: MKAT) was a decentralized yield-farming vault protocol deployed on Binance Smart Chain (BSC). The project was a fork of Alpaca Finance, which itself was derived from Yearn Finance's vault architecture. MKAT launched on mainnet on March 3, 2021. The MKAT token contract address on BSC is 0xc65f62d372aa50e99b2a564ddb418a6bc84faa15. The project presented itself as a legitimate yield aggregator and rapidly attracted over $31 million in user deposits within its first day of operation.","heading":"Overview and Background","sources":[{"url":"https://bscscan.com/token/0xc65f62d372aa50e99b2a564ddb418a6bc84faa15","name":"bscscan.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/binance-smart-chain-copykat-project-loses-31-million-in-possible-rugpull","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://rekt.news/meerkat-finance-bsc-rekt","name":"rekt.news","type":"other","credibility":3}],"severity":"medium"},{"content":"On March 4, 2021, between 08:53 and 08:55 UTC — approximately 24 hours after launch — the Meerkat Finance deployer address executed a series of on-chain transactions that drained the protocol's vaults. The exploit proceeded in four steps over roughly 105 seconds. At 08:53:10 UTC, the WBNB Vault was upgraded to a malicious contract (0x9d3a4c3acee56dce2392fb75dd274a249aee7d57). At 08:53:31 UTC, the BUSD Vault was upgraded to a second malicious contract (0xb2603fc47331e3500eaf053bd7a971b57e613d36). At 08:54:31 UTC, 13,968,039 BUSD were transferred out of the BUSD Vault. At 08:54:55 UTC, 73,635 WBNB were transferred out of the WBNB Vault. Both vaults used OpenZeppelin's Transparent Proxy Upgrade pattern. The malicious upgrade introduced two new functions not present in the original implementations: a permissionless `init(address owner)` function with no access control, described by analysts as 'the ultimate backdoor into the Vaults,' and an unlabeled function `0x70fcb0a7` that transferred the entire token balance to a specified address. The new malicious contract implementations were approximately one-quarter the size of the legitimate prior versions. Crucially, the `upgradeTo()` calls were made by the Meerkat Finance Deployer address itself, not by any external party — a finding central to the rug-pull determination.","heading":"The Exploit: Technical Analysis","sources":[{"url":"https://rekt.news/meerkat-finance-bsc-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://hackmd.io/@mLAPku2WQZmso5oX4kzPOg/BkNlZv0zO","name":"hackmd.io","type":"other","credibility":3},{"url":"https://www.vidma.io/blog/meerkat-finance-anatomy-of-a-31-million-defi-rug-pull-on-binance-smart-chain","name":"vidma.io","type":"other","credibility":3},{"url":"https://beincrypto.com/defi-project-meerkat-suspected-of-31-million-rug-pull/","name":"beincrypto.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Multiple behavioral and on-chain indicators point to an intentional exit scam rather than an external hack. First, the on-chain deployer address — not an unknown external attacker — performed the vault upgrades. Unless the deployer's private key was independently compromised in the minutes following launch, this implicates the Meerkat team directly. Second, within hours of the exploit, the project's website was taken offline, its Twitter account was deleted, its GitHub repositories were removed, and its cached copies were erased from the Wayback Machine and Google Cache. Third, the project launched with no independent smart contract audit from a recognized firm. Fourth, Meerkat launched just one day before the exploit, suggesting the rapid fundraising phase was itself part of the scheme. CoinTelegraph and CoinDesk both noted the pattern was consistent with a planned exit scam rather than an opportunistic external exploit.","heading":"Exit Scam Indicators","sources":[{"url":"https://www.coindesk.com/policy/2021/03/04/defi-project-meerkat-raises-eyebrows-with-claimed-31m-hack-a-day-after-launch","name":"coindesk.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/binance-smart-chain-copykat-project-loses-31-million-in-possible-rugpull","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://rekt.news/meerkat-finance-bsc-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://beincrypto.com/defi-project-meerkat-suspected-of-31-million-rug-pull/","name":"beincrypto.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Approximately two days after the exploit, a developer identifying only as 'Jamboo' posted in a newly created Telegram channel called 'Meerkatrefunds.' Jamboo claimed the exploit was a 'trial' intended to test 'user greed and subjectivity,' and stated its purpose was to 'help users realize the potential danger in smart contracts and the subjectivity in the audit processes of audit companies.' Jamboo further stated the team had 'invited a third party (hacker) to attack the vulnerability through the verify proxy contract' and promised a full post-mortem report. To establish authenticity, Jamboo sent a small on-chain transaction from the Meerkat deployer address, confirming control of that wallet. The developer stated all victims would be refunded. Security analysts, community members, and reporters widely characterized the 'test' narrative as an implausible post-hoc justification designed to avoid legal liability or soften the perception of an intentional exit scam. Some observers speculated that Binance's identification of the perpetrators and threat of legal action may have compelled the refund rather than any genuine altruistic intent.","heading":"The 'Test' Claim and Developer Response","sources":[{"url":"https://cointelegraph.com/news/dev-says-31-million-meerkat-finance-exploit-was-a-test-will-return-funds","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://www.thedechained.com/meerkat-finance-exploit-was-a-trial-jamboo/","name":"thedechained.com","type":"other","credibility":3},{"url":"https://web3isgoinggreat.com/?id=2021-03-04-0","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://www.quadrigainitiative.com/casestudy/meerkatfinancerugpull.php","name":"quadrigainitiative.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Binance's security team became involved in the investigation shortly after the exploit. Binance stated it would freeze any recovered funds that moved through centralized exchange infrastructure, and suspended the Binance.org Bridge to prevent cross-chain movement of stolen assets. Binance coordinated with blockchain security firms PeckShield, SlowMist, and CertiK during the post-incident investigation. The exchange later described the Meerkat Finance case as the largest recovery of funds it had participated in up to that point. Under pressure from the BSC ecosystem and Binance's legal threat, a refund smart contract was deployed. Victims were required to interact directly with the new contract to claim their funds — a technically demanding process. Approximately 95% of user losses (~$30 million) were recovered, with ongoing distributions to remaining victims. Binance also indicated it had launched legal proceedings against the alleged perpetrators, though no public court filings or named individuals have been confirmed in available reporting.","heading":"Binance Involvement and Fund Recovery","sources":[{"url":"https://www.binance.com/en/blog/421499824684901829/How-Binance-Security-team-helped-recover-$30M-funds-from-Meerkat-Finance-Hack","name":"binance.com","type":"other","credibility":3},{"url":"https://www.cryptohopper.com/news/how-binance-security-team-helped-recover-30m-funds-from-meerkat-finance-hack-3026","name":"cryptohopper.com","type":"other","credibility":3},{"url":"https://coincodex.com/article/10890/how-binance-security-team-helped-recover-30m-funds-from-meerkat-finance-hack/","name":"coincodex.com","type":"other","credibility":3},{"url":"https://www.quadrigainitiative.com/casestudy/meerkatfinancerugpull.php","name":"quadrigainitiative.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The Meerkat Finance incident was at the time of its occurrence the largest single exploit or exit scam recorded on Binance Smart Chain. It highlighted systemic risks in the BSC ecosystem during early 2021, including the prevalence of unaudited protocol forks, the ease of deploying upgradeable proxy contracts with hidden backdoors, and the lack of due-diligence infrastructure for retail investors. The incident was widely cited in subsequent DeFi security literature as a canonical example of a 'malicious proxy upgrade' rug pull. It preceded a wave of similar BSC exit scams in 2021, including TurtleDex ($2.4 million) and others. Security researchers noted that unlike genuine hacks, rug pulls of this type require no external exploit skill — they rely entirely on the deployer's administrative privileges over upgradeable contracts. The case also demonstrated that Binance's involvement can create partial recovery outcomes in BSC-based fraud cases, in contrast to Ethereum-based incidents where on-chain fund recovery is typically impossible.","heading":"Significance and Industry Context","sources":[{"url":"https://u.today/largest-binance-smart-chain-fraud-meerkat-finance-mkat-rug-pulled-with-32-million-losses","name":"u.today","type":"other","credibility":3},{"url":"https://decrypt.co/62204/binance-smart-chain-hit-by-2-4-million-turtledex-exit-scam","name":"decrypt.co","type":"other","credibility":3},{"url":"https://www.merklescience.com/blog/diving-into-defi-aeu-crypto-crime-in-defi","name":"merklescience.com","type":"other","credibility":3},{"url":"https://rekt.news/meerkat-finance-bsc-rekt","name":"rekt.news","type":"other","credibility":3}],"severity":"medium"},{"content":"The Meerkat Finance team operated entirely anonymously. The sole identified party is 'Jamboo,' a pseudonym used in the post-exploit Telegram message. No team members were publicly named, no doxxing has been confirmed in available public reporting, and no criminal charges or court filings naming individuals have surfaced in publicly accessible records. The project had no known audit from a recognized firm prior to launch. ZachXBT, the pseudonymous blockchain investigator known for exposing DeFi fraud, flagged Meerkat Finance in their catalog of notable scams, though no detailed ZachXBT thread specifically on Meerkat Finance was located in available public sources. Binance stated it had initiated legal proceedings, but no public outcome of those proceedings has been reported. The lack of publicly identified perpetrators means the same individuals could theoretically operate new projects without being recognized.","heading":"Anonymity and Accountability Gaps","sources":[{"url":"https://cointelegraph.com/news/dev-says-31-million-meerkat-finance-exploit-was-a-test-will-return-funds","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/policy/2021/03/04/defi-project-meerkat-raises-eyebrows-with-claimed-31m-hack-a-day-after-launch","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.quadrigainitiative.com/casestudy/meerkatfinancerugpull.php","name":"quadrigainitiative.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021-03-03","event":"Meerkat Finance launches on Binance Smart Chain at approximately 19:00 UTC. The protocol attracts over $31 million in user deposits within 24 hours.","source":""},{"date":"2021-03-04","event":"At 08:53:10 UTC, the Meerkat Finance deployer upgrades the WBNB Vault to a malicious contract. At 08:53:31 UTC, the BUSD Vault is similarly upgraded. By 08:54:55 UTC, 13,968,039 BUSD and 73,635 WBNB (totaling approximately $31.56 million) are drained from both vaults.","source":""},{"date":"2021-03-04","event":"Meerkat Finance's website, Twitter account, and GitHub repositories are taken offline. Cached copies are removed from Wayback Machine and Google Cache. The Binance.org Bridge is suspended to prevent cross-chain movement of stolen funds.","source":""},{"date":"2021-03-04","event":"Binance announces it will freeze any stolen funds that reach its exchange. Binance engages PeckShield, SlowMist, and CertiK to assist in the investigation.","source":""},{"date":"2021-03-05","event":"A developer using the pseudonym 'Jamboo' posts in a new Telegram channel ('Meerkatrefunds') claiming the exploit was a 'trial' testing user greed. Jamboo confirms association with the project by sending a transaction from the deployer address and promises full refunds.","source":""},{"date":"2021-03-06","event":"A refund smart contract is deployed. Victims are required to interact with the contract directly to reclaim their funds.","source":""},{"date":"2021-03-07","event":"Approximately 95% of user funds (~$30 million) are reported as recovered, with ongoing distributions to remaining victims. Binance describes the outcome as the largest fund recovery it has participated in.","source":""}],"sources_used":[{"url":"https://bscscan.com/token/0xc65f62d372aa50e99b2a564ddb418a6bc84faa15","name":"bscscan.com","type":"other","archive_url":"http://web.archive.org/web/20260130232137/https://bscscan.com/token/0xc65f62d372aa50e99b2a564ddb418a6bc84faa15","credibility":3,"archive_timestamp":"2026-01-30T23:21:37+00:00"},{"url":"https://cointelegraph.com/news/binance-smart-chain-copykat-project-loses-31-million-in-possible-rugpull","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20260806195616/https://cointelegraph.com/news/binance-smart-chain-copykat-project-loses-31-million-in-possible-rugpull","credibility":3,"archive_timestamp":"2026-08-06T19:56:16+00:00"},{"url":"https://rekt.news/meerkat-finance-bsc-rekt","name":"rekt.news","type":"other","archive_url":"http://web.archive.org/web/20260415165242/https://rekt.news/meerkat-finance-bsc-rekt","credibility":3,"archive_timestamp":"2026-04-15T16:52:42+00:00"},{"url":"https://hackmd.io/@mLAPku2WQZmso5oX4kzPOg/BkNlZv0zO","name":"hackmd.io","type":"other","archive_url":"https://web.archive.org/web/20260829193353/https://hackmd.io/@mLAPku2WQZmso5oX4kzPOg/BkNlZv0zO","credibility":3,"archive_timestamp":"2026-08-29T19:33:53+00:00"},{"url":"https://www.vidma.io/blog/meerkat-finance-anatomy-of-a-31-million-defi-rug-pull-on-binance-smart-chain","name":"vidma.io","type":"other","archive_url":"http://web.archive.org/web/20260315232214/https://www.vidma.io/blog/meerkat-finance-anatomy-of-a-31-million-defi-rug-pull-on-binance-smart-chain","credibility":3,"archive_timestamp":"2026-03-15T23:22:14+00:00"},{"url":"https://beincrypto.com/defi-project-meerkat-suspected-of-31-million-rug-pull/","name":"beincrypto.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.coindesk.com/policy/2021/03/04/defi-project-meerkat-raises-eyebrows-with-claimed-31m-hack-a-day-after-launch","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20260218070730/https://www.coindesk.com/policy/2021/03/04/defi-project-meerkat-raises-eyebrows-with-claimed-31m-hack-a-day-after-launch","credibility":3,"archive_timestamp":"2026-02-18T07:07:30+00:00"},{"url":"https://cointelegraph.com/news/dev-says-31-million-meerkat-finance-exploit-was-a-test-will-return-funds","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20260806195617/https://cointelegraph.com/news/dev-says-31-million-meerkat-finance-exploit-was-a-test-will-return-funds","credibility":3,"archive_timestamp":"2026-08-06T19:56:17+00:00"},{"url":"https://www.thedechained.com/meerkat-finance-exploit-was-a-trial-jamboo/","name":"thedechained.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-job","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://web3isgoinggreat.com/?id=2021-03-04-0","name":"web3isgoinggreat.com","type":"other","archive_url":"https://web.archive.org/web/20260830091927/https://www.web3isgoinggreat.com/?id=2021-03-04-0","credibility":3,"archive_timestamp":"2026-08-30T09:19:27+00:00"},{"url":"https://www.quadrigainitiative.com/casestudy/meerkatfinancerugpull.php","name":"quadrigainitiative.com","type":"other","archive_url":"https://web.archive.org/web/20260830132720/https://www.quadrigainitiative.com/casestudy/meerkatfinancerugpull.php","credibility":3,"archive_timestamp":"2026-08-30T13:27:20+00:00"},{"url":"https://www.binance.com/en/blog/421499824684901829/How-Binance-Security-team-helped-recover-$30M-funds-from-Meerkat-Finance-Hack","name":"binance.com","type":"other","archive_url":"https://web.archive.org/web/20260830131606/https://www.binance.com/en/blog/421499824684901829/How-Binance-Security-team-helped-recover-$30M-funds-from-Meerkat-Finance-Hack","credibility":3,"archive_timestamp":"2026-08-30T13:16:06+00:00"},{"url":"https://www.cryptohopper.com/news/how-binance-security-team-helped-recover-30m-funds-from-meerkat-finance-hack-3026","name":"cryptohopper.com","type":"other","archive_url":"https://web.archive.org/web/20260829201641/https://www.cryptohopper.com/news/how-binance-security-team-helped-recover-30m-funds-from-meerkat-finance-hack-3026","credibility":3,"archive_timestamp":"2026-08-29T20:16:41+00:00"},{"url":"https://coincodex.com/article/10890/how-binance-security-team-helped-recover-30m-funds-from-meerkat-finance-hack/","name":"coincodex.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:gone","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://u.today/largest-binance-smart-chain-fraud-meerkat-finance-mkat-rug-pulled-with-32-million-losses","name":"u.today","type":"other","archive_url":"http://web.archive.org/web/20260215202245/https://u.today/largest-binance-smart-chain-fraud-meerkat-finance-mkat-rug-pulled-with-32-million-losses","credibility":3,"archive_timestamp":"2026-02-15T20:22:45+00:00"},{"url":"https://decrypt.co/62204/binance-smart-chain-hit-by-2-4-million-turtledex-exit-scam","name":"decrypt.co","type":"other","archive_url":"http://web.archive.org/web/20260315173638/https://decrypt.co/62204/binance-smart-chain-hit-by-2-4-million-turtledex-exit-scam","credibility":3,"archive_timestamp":"2026-03-15T17:36:38+00:00"},{"url":"https://www.merklescience.com/blog/diving-into-defi-aeu-crypto-crime-in-defi","name":"merklescience.com","type":"other","archive_url":"http://web.archive.org/web/20260610213256/https://www.merklescience.com/blog/diving-into-defi-aeu-crypto-crime-in-defi","credibility":3,"archive_timestamp":"2026-06-10T21:32:56+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:58.805974+00:00","updated_at":"2026-11-02T00:23:14.973+00:00"},"source_quality":{"total":17,"tier1":1,"tier2":6,"tier3":0,"unrated":10},"follower_count":null,"content_updated_at":"2026-11-02T00:23:15.958Z","last_fact_checked_at":"2026-11-02T00:23:15.211Z","fact_check_next_allowed_at":"2026-11-09T00:23:15.211Z","update_next_allowed_at":null}