{"investigation":{"slug":"rocketswap-base","entity_name":"RocketSwap Base","trust_score":22,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"RocketSwap is a decentralized exchange (DEX) launched on the Coinbase Base Layer 2 network in mid-2023 that suffered a $865,000 private key compromise exploit just days after Base's public launch, making it one of the first major exploits on the network. The attack, confirmed by security firms PeckShield and Certik as a private key compromise, was compounded by a separate $69,000 social engineering loss one week prior, and the hacker subsequently laundered stolen funds through Tornado Cash, Binance, OKX, and a self-created memecoin called LoveRCKT. The project has been flagged by ZachXBT and community analysts, with some alleging that pre-exploit proxy contract modifications and the team's decision to silence communications point to possible insider involvement, though this has not been conclusively proven.","sections":[{"content":"On August 14, 2023, RocketSwap Labs — then the second-largest DEX on the Base network by total value locked — suffered a critical exploit resulting in the theft of approximately 471 ETH, valued at approximately $865,000 to $870,000 at the time of the incident. On-chain security firm PeckShield detected and reported the attack, finding that the hacker drained the protocol's yield farming contracts of RCKT governance tokens and Wrapped Ethereum (WETH) before bridging the assets from Base to Ethereum via the Stargate bridge. Certik's security team later classified the incident as a 'Private Key Compromise,' confirming that the root cause was not a smart contract logic flaw but rather the improper storage of private keys on an internet-connected cloud server. The team publicly acknowledged the critical operational failure: 'The team needed to use offline signatures when deploying the launchpad and put the private keys on the server.' The proxy contract architecture used for the farm contract exacerbated the damage by granting 'multiple high-risk permissions' to the compromised key, allowing the attacker to transfer the entire balance of the farming pools.","heading":"Exploit Overview: $865,000 Private Key Compromise","sources":[{"url":"https://decrypt.co/152519/meme-coin-base-dex-rocketswap-hit-866k-exploit","name":"decrypt.co","type":"other","credibility":3},{"url":"https://www.theblock.co/post/245599/hacker-creates-memecoin-after-stealing-870000-from-rocketswap-on-base","name":"theblock.co","type":"other","credibility":3},{"url":"https://bitcoinist.com/base-defi-project-suffer-865k-exploit-emergency/","name":"bitcoinist.com","type":"other","credibility":3},{"url":"https://cryptonews.net/news/security/27714842/","name":"cryptonews.net","type":"other","credibility":3},{"url":"https://beincrypto.com/rocketswap-exploit-speculation-rug-pull/","name":"beincrypto.com","type":"other","credibility":3}],"severity":"medium"},{"content":"One week before the primary exploit, on approximately August 8, 2023, community members discovered deleted posts from RocketSwap revealing a separate security failure. Scammers posing as KuCoin exchange team members allegedly contacted the RocketSwap team, claiming they wished to list the RCKT token and requesting that the team send native tokens for liquidity market-making purposes. The RocketSwap team allegedly transferred approximately $69,000 worth of native RCKT tokens to these malicious actors. The team's initial attempt to conceal this incident by deleting posts was noted by community observers and contributed to the suspicion of insider involvement or gross negligence in the lead-up to the larger exploit. The proximity of this social engineering incident to the private key compromise raised questions — not yet conclusively answered — about whether the two events were coordinated.","heading":"Pre-Exploit Incident: $69,000 KuCoin Impersonation Scam","sources":[{"url":"https://beincrypto.com/rocketswap-exploit-speculation-rug-pull/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://crypto.news/rocketswap-unveils-response-strategy-after-865-hack/","name":"crypto.news","type":"other","credibility":3},{"url":"https://www.ccn.com/news/base-projects-hit-by-hackers-rocketswap-plan/","name":"ccn.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the theft, the exploiter executed a multi-step laundering operation that attracted significant on-chain attention. The attacker bridged 471 ETH from Base to Ethereum via the Stargate bridge, then created a new ERC-20 memecoin named 'LoveRCKT,' minting 90 trillion tokens. The exploiter supplied 400 ETH and the full LoveRCKT supply as liquidity to Uniswap, briefly generating speculative interest: LoveRCKT's price tripled within one day before crashing more than 90% as the exploiter exited positions. PeckShieldAlert subsequently tracked the remaining funds through multiple laundering channels: approximately 169 ETH was routed through Tornado Cash, approximately 86 ETH was bridged to Arbitrum and Binance Smart Chain, over 347 BNB and 34 ETH were deposited to Binance, approximately 9,000 USDT was transferred to OKX, and smaller amounts were exchanged for TIP tokens and sent to MEXC. This multi-venue dispersal strategy, spanning Layer 1, Layer 2, decentralized, and centralized exchanges, is characteristic of sophisticated threat actors seeking to obscure transaction trails.","heading":"Post-Exploit Fund Flow and LoveRCKT Memecoin","sources":[{"url":"https://cryptonews.net/news/security/27714842/","name":"cryptonews.net","type":"other","credibility":3},{"url":"https://decrypt.co/152519/meme-coin-base-dex-rocketswap-hit-866k-exploit","name":"decrypt.co","type":"other","credibility":3},{"url":"https://www.theblock.co/post/245599/hacker-creates-memecoin-after-stealing-870000-from-rocketswap-on-base","name":"theblock.co","type":"other","credibility":3},{"url":"https://insidebitcoins.com/news/rocketswap-hacker-uses-870000-stolen-ethereum-to-create-meme-coin-loverckt","name":"insidebitcoins.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the exploit, community analysts raised allegations that the incident may have been a premeditated rug pull rather than an external hack, though these allegations remain unproven. Key points of suspicion included: proxy contract modifications detected on-chain in the hours immediately preceding the exploit; the team's decision to disable comments on X (formerly Twitter) and shut down their Telegram channel immediately after the attack, which observers described as 'the worst hack reaction I have ever seen'; the pre-exploit deletion of posts relating to the $69,000 KuCoin impersonation loss; and the general pattern of insider-facilitated exploits that characterized Base's early launch period, including the contemporaneous BALD rug pull in which developers intentionally withdrew $25.6 million in liquidity. At least one on-chain analyst described the incident as 'likely a pre-meditated planned rug.' The RocketSwap team disputed these characterizations, attributing the exploit entirely to an external brute-force attacker. Certik's classification as a 'Private Key Compromise' is consistent with both an external attack and an insider-assisted scenario. No law enforcement or regulatory body has issued findings on this question.","heading":"Rug Pull Allegations and Community Suspicion","sources":[{"url":"https://beincrypto.com/rocketswap-exploit-speculation-rug-pull/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://bitcoinist.com/base-defi-project-suffer-865k-exploit-emergency/","name":"bitcoinist.com","type":"other","credibility":3},{"url":"https://decrypt.co/152519/meme-coin-base-dex-rocketswap-hit-866k-exploit","name":"decrypt.co","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/?id=rocketswap-exploited-after-key-compromise","name":"web3isgoinggreat.com","type":"other","credibility":3}],"severity":"medium"},{"content":"RocketSwap's security posture exhibited several critical failures documented in the public record. First, the team stored private keys on an internet-connected cloud server, a practice widely recognized as a fundamental operational security failure in the cryptocurrency industry — private keys for high-value smart contract permissions should be stored exclusively in hardware security modules (HSMs) or offline cold storage. Second, the use of a proxy contract architecture for the farming contract concentrated broad permissions — including the ability to transfer all farm assets — under a single key, violating the principle of least privilege. Third, the team's response to the pre-exploit KuCoin impersonation scam, which involved sending $69,000 in tokens to alleged scammers and then deleting the evidence, demonstrates a pattern of inadequate operational security awareness. No independent smart contract audit report for the original farm contract has been surfaced in public sources. Following the exploit, RocketSwap announced plans to redeploy a new farm contract using an open-source model, drop the proxy contract architecture, and relinquish RCKT minting rights.","heading":"Security Posture and Operational Failures","sources":[{"url":"https://bitcoinist.com/base-defi-project-serve-865k-exploit-emergency/","name":"bitcoinist.com","type":"other","credibility":3},{"url":"https://crypto.news/rocketswap-unveils-response-strategy-after-865-hack/","name":"crypto.news","type":"other","credibility":3},{"url":"https://beincrypto.com/rocketswap-exploit-speculation-rug-pull/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://basescan.org/token/0x6653dD4B92a0e5Bf8ae570A98906d9D6fD2eEc09","name":"basescan.org","type":"other","credibility":3}],"severity":"medium"},{"content":"RocketSwap's exploit occurred within a broader pattern of security incidents that characterized the early launch period of the Base network in summer 2023. On August 1, 2023, LeetSwap — then Base's largest DEX — halted trading after losing approximately 340 ETH ($600,000) to an attacker who exploited an exposed smart contract function to manipulate token prices and drain liquidity pools. Earlier, the BALD token project on Base gained notoriety when developers intentionally withdrew $25.6 million in liquidity in a textbook rug pull. Community members described this period as 'Base on-chain summer became Base hard rug summer.' RocketSwap's incident thus occurred in an environment of elevated risk and nascent security infrastructure. Coinbase, operator of the Base network, subsequently announced development of a monitoring tool called 'Pessimism' in direct response to the cluster of exploits. RocketSwap was flagged by ZachXBT, the pseudonymous on-chain investigator, as part of his coverage of the Base network's early security problems.","heading":"Broader Context: Base Network Security in Summer 2023","sources":[{"url":"https://cointelegraph.com/news/leetswap-dex-halts-trading-amid-exploit-fears","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://www.ccn.com/news/following-rocketsap-hack-coinbase-launches-monitoring-tool-pessimism/","name":"ccn.com","type":"other","credibility":3},{"url":"https://beincrypto.com/rocketswap-exploit-speculation-rug-pull/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://decrypt.co/152519/meme-coin-base-dex-rocketswap-hit-866k-exploit","name":"decrypt.co","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the exploit, RocketSwap Labs published an emergency response plan on August 15, 2023. The plan outlined the following commitments: (1) redeploy a new farm contract by replacing the proxy contract model with an open-source, directly deployed contract; (2) accelerate the RCKT production reduction schedule by 0.075 per block; (3) relinquish minting rights for RCKT tokens while retaining limited authority to allocate new low-risk pools; and (4) publicly appeal to the exploiter to return stolen assets. The team also suspended the farming feature while leaving all other protocol functions operational. The recovery plan did not include direct reimbursement of exploited users from team funds, instead proposing a future token airdrop as compensation. This response was widely criticized by community members as inadequate given the scale of the loss. The decision to silence community channels — disabling comments on X and shutting the Telegram group immediately after the exploit — further eroded user trust and fueled rug pull speculation.","heading":"Team Response and Recovery Plan","sources":[{"url":"https://crypto.news/rocketswap-unveils-response-strategy-after-865-hack/","name":"crypto.news","type":"other","credibility":3},{"url":"https://bitcoinist.com/base-defi-project-suffer-865k-exploit-emergency/","name":"bitcoinist.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/base-dex-rocketswap-announces-emergency-plan-after-exploit","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://beincrypto.com/rocketswap-exploit-speculation-rug-pull/","name":"beincrypto.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2023-08-08","event":"RocketSwap team allegedly transfers approximately $69,000 in native RCKT tokens to scammers impersonating KuCoin exchange representatives; team deletes posts about the incident.","source":""},{"date":"2023-08-14","event":"Exploiter executes brute-force attack on RocketSwap's cloud server, extracts private keys, and drains approximately 471 ETH ($865,000) from the protocol's yield farming contracts via a compromised proxy contract.","source":""},{"date":"2023-08-14","event":"PeckShieldAlert detects and reports the exploit on-chain; confirms 471 ETH bridged from Base to Ethereum via Stargate bridge.","source":""},{"date":"2023-08-14","event":"RocketSwap team disables comments on X (Twitter) and shuts down Telegram channel; community alleges pre-exploit proxy contract modifications observed on-chain.","source":""},{"date":"2023-08-14","event":"Exploiter creates LoveRCKT memecoin, mints 90 trillion tokens, and supplies 400 ETH plus full LoveRCKT supply as liquidity to Uniswap. LoveRCKT price temporarily triples before collapsing over 90%.","source":""},{"date":"2023-08-15","event":"RocketSwap Labs publishes emergency recovery plan: new open-source farm contract, accelerated RCKT production reduction, relinquishment of minting rights, and public appeal to exploiter to return funds.","source":""},{"date":"2023-08-15","event":"Certik classifies the incident as a 'Private Key Compromise.' ZachXBT flags RocketSwap as part of broader coverage of Base network security incidents.","source":""},{"date":"2023-08-15","event":"PeckShieldAlert tracks post-exploit laundering: approximately 169 ETH routed through Tornado Cash; approximately 86 ETH bridged to Arbitrum and BNB Chain; 347+ BNB and 34 ETH deposited to Binance; approximately 9,000 USDT sent to OKX.","source":""},{"date":"2023-08-16","event":"Coinbase announces development of 'Pessimism,' a blockchain monitoring tool, in direct response to the cluster of Base network exploits including RocketSwap and LeetSwap.","source":""}],"sources_used":[{"url":"https://decrypt.co/152519/meme-coin-base-dex-rocketswap-hit-866k-exploit","name":"decrypt.co","type":"other","archive_url":"http://web.archive.org/web/20260518215849/https://decrypt.co/152519/meme-coin-base-dex-rocketswap-hit-866k-exploit","credibility":3,"archive_timestamp":"2026-05-18T21:58:49+00:00"},{"url":"https://www.theblock.co/post/245599/hacker-creates-memecoin-after-stealing-870000-from-rocketswap-on-base","name":"theblock.co","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://bitcoinist.com/base-defi-project-suffer-865k-exploit-emergency/","name":"bitcoinist.com","type":"other","archive_url":"http://web.archive.org/web/20260411042614/https://bitcoinist.com/base-defi-project-suffer-865k-exploit-emergency/","credibility":3,"archive_timestamp":"2026-04-11T04:26:14+00:00"},{"url":"https://cryptonews.net/news/security/27714842/","name":"cryptonews.net","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://beincrypto.com/rocketswap-exploit-speculation-rug-pull/","name":"beincrypto.com","type":"other","archive_url":"http://web.archive.org/web/20250831143955/https://beincrypto.com/rocketswap-exploit-speculation-rug-pull//","credibility":3,"archive_timestamp":"2025-08-31T14:39:55+00:00"},{"url":"https://crypto.news/rocketswap-unveils-response-strategy-after-865-hack/","name":"crypto.news","type":"other","archive_url":"http://web.archive.org/web/20250906001834/https://crypto.news/rocketswap-unveils-response-strategy-after-865-hack/","credibility":3,"archive_timestamp":"2025-09-06T00:18:34+00:00"},{"url":"https://www.ccn.com/news/base-projects-hit-by-hackers-rocketswap-plan/","name":"ccn.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://insidebitcoins.com/news/rocketswap-hacker-uses-870000-stolen-ethereum-to-create-meme-coin-loverckt","name":"insidebitcoins.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.web3isgoinggreat.com/?id=rocketswap-exploited-after-key-compromise","name":"web3isgoinggreat.com","type":"other","archive_url":"http://web.archive.org/web/20260521074129/https://www.web3isgoinggreat.com/?id=rocketswap-exploited-after-key-compromise","credibility":3,"archive_timestamp":"2026-05-21T07:41:29+00:00"},{"url":"https://bitcoinist.com/base-defi-project-serve-865k-exploit-emergency/","name":"bitcoinist.com","type":"other","archive_url":"https://web.archive.org/web/20260830035917/https://bitcoinist.com/","credibility":3,"archive_timestamp":"2026-08-30T03:59:17+00:00"},{"url":"https://basescan.org/token/0x6653dD4B92a0e5Bf8ae570A98906d9D6fD2eEc09","name":"basescan.org","type":"other","archive_url":"https://web.archive.org/web/20260830035513/https://basescan.org/token/0x6653dD4B92a0e5Bf8ae570A98906d9D6fD2eEc09","credibility":3,"archive_timestamp":"2026-08-30T03:55:13+00:00"},{"url":"https://cointelegraph.com/news/leetswap-dex-halts-trading-amid-exploit-fears","name":"cointelegraph.com","type":"other","archive_url":"https://web.archive.org/web/20260829131119/https://cointelegraph.com/news/leetswap-dex-halts-trading-amid-exploit-fears","credibility":3,"archive_timestamp":"2026-08-29T13:11:19+00:00"},{"url":"https://www.ccn.com/news/following-rocketsap-hack-coinbase-launches-monitoring-tool-pessimism/","name":"ccn.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cointelegraph.com/news/base-dex-rocketswap-announces-emergency-plan-after-exploit","name":"cointelegraph.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:38.940752+00:00","updated_at":"2026-08-30T05:14:10.182548+00:00"}}