{"investigation":{"slug":"skp-skippy-token","entity_name":"SKP / Skippy Token","trust_score":4,"severity_base":null,"score_modifier":0,"confidence":0.72,"status":"published","content_type":"investigation","summary":"SKP (SKIPPY) is a BEP-20 token on BNB Smart Chain deployed in October 2021 and originally presented as a utility token for an Australian e-commerce and travel business. On May 27, 2026, blockchain security firm TenArmor detected an active exploit draining approximately $212,000 from SKP-linked liquidity pools across PancakeSwap, Venus, and Lista DAO on BNB Chain, with the attacker exiting with approximately 162,854 BSC-USD and 74.877 BNB. As of the date of this investigation, the root cause of the exploit is unconfirmed, no official post-mortem or team response has been issued, and the token exhibits extreme supply concentration and no active trading volume.","sections":[{"content":"On May 27, 2026, blockchain security firm TenArmor published an alert stating: 'Our system has detected a suspicious attack involving #SKP on #BSC, resulting in an approximately loss of $212K.' The exploit drained funds from SKP-linked liquidity pools across at least four interconnected BNB Chain DeFi protocols: PancakeSwap, Venus, Lista DAO, and SKP's own liquidity pools. The attacker exited with approximately 162,854 BSC-USD and 74.877 BNB, for a total estimated loss to liquidity providers of approximately $212,000. The primary confirmed exploit transaction hash is 0xbc01ea37bd2ff8f6aa6afcfbe0406114ff27a01e9aa56102bfa4ad8a0c2f25ee. As of the time of this investigation, no official post-mortem has been issued by the SKP project team and the precise root cause has not been confirmed by independent researchers.","heading":"Exploit Overview","sources":[{"url":"https://www.cryptotimes.io/2026/05/27/skp-liquidity-exploit-drains-212k-across-bnb-chain-defi-protocols/","name":"SKP Liquidity Exploit Drains $212K Across BNB Chain DeFi Protocols — Crypto Times","type":"news_article","credibility":2},{"url":"https://bscscan.com/tx/0xbc01ea37bd2ff8f6aa6afcfbe0406114ff27a01e9aa56102bfa4ad8a0c2f25ee","name":"BscScan — Exploit Transaction 0xbc01ea37bd2ff8f6aa6afcfbe0406114ff27a01e9aa56102bfa4ad8a0c2f25ee","type":"on_chain","credibility":1}],"severity":"critical"},{"content":"While the root cause has not been officially confirmed, preliminary analysis suggests the attack exploited pricing inefficiencies between SKP liquidity pools and associated lending markets on BNB Chain. The alleged mechanism involves a flaw in SKP token logic that may have allowed excess SKP tokens to be transferred out of the PancakeSwap V2 SKP/USDT liquidity pool following a large buy order, after which the attacker called the sync() function to overwrite the pool's internal reserve state and push the SKP reserve balance close to zero. This class of vulnerability — combining flash loans with AMM reserve manipulation via sync() — has been documented in prior BNB Chain exploits including the December 2025 DMi/Moolah drain. The attacker allegedly cycled BSC-USD, BTCB, and SKP through multiple lending and swap protocols in rapid succession before consolidating proceeds. The involvement of Venus and Lista DAO indicates the attacker used these platforms as intermediary liquidity sources or collateral routes, creating residual risk for liquidity providers on those platforms, though neither Venus nor Lista DAO is alleged to be the primary vulnerable contract. The root cause characterization described here should be treated as alleged pending an official post-mortem.","heading":"Alleged Attack Mechanism","sources":[{"url":"https://www.cryptotimes.io/2026/05/27/skp-liquidity-exploit-drains-212k-across-bnb-chain-defi-protocols/","name":"SKP Liquidity Exploit Drains $212K Across BNB Chain DeFi Protocols — Crypto Times","type":"news_article","credibility":2},{"url":"https://medium.com/@zhenyazhdarkin/flash-loan-attack-uncovered-pancakeswap-lp-exploit-and-the-dmi-moolah-drain-explained-bb487f66f26e","name":"Flash Loan Attack Uncovered: PancakeSwap LP Exploit and the DMi/Moolah Drain Explained — CoinsBench/Medium","type":"research","credibility":3}],"severity":"critical"},{"content":"SKP (SKIPPY) is a BEP-20 token deployed on BNB Smart Chain at contract address 0x6F6E2DA8DB407B17d06FB4530fd1e42824fA881C. The contract was deployed on October 27, 2021, by deployer address 0x06d71a011c9db92acfd3a410860763499ec74fc4. The token has a fixed total supply of 400,000,000 SKP with 9 decimal places. The underlying smart contract is named 'CoinToken' and was compiled with Solidity v0.8.4 with optimization enabled (200 runs). Source code is verified on BscScan but no independent security audit has been submitted. As of the date of this investigation, the token has only 41 unique on-chain holders, with the top holder controlling approximately 60.05% of supply (240.2 million SKP), the second holder approximately 16.13% (64.5 million SKP), the deployer retaining approximately 10% (40 million SKP), and the top four addresses collectively controlling approximately 96% of total supply — a concentration level associated with elevated rug-pull and price manipulation risk. The token shows a price of approximately $0.00 with zero 24-hour trading volume. The contract implements reflection/reward mechanisms, auto-liquidity features, and a fee/tax system with owner-based access controls. These characteristics are common in token designs susceptible to fee-manipulation or reserve-distortion attacks.","heading":"Token Profile and On-Chain Characteristics","sources":[{"url":"https://bscscan.com/token/0x6F6E2DA8DB407B17d06FB4530fd1e42824fA881C","name":"SKIPPY (SKP) Token Tracker — BscScan","type":"on_chain","credibility":1},{"url":"https://thebittimes.com/token-SKP-BSC-0x6F6E2DA8DB407B17d06FB4530fd1e42824fA881C.html","name":"SKIPPY (SKP) Price and Market Stats — TheBitTimes","type":"other","credibility":3}],"severity":"high"},{"content":"According to ICO listing records, Skippy Token (SKP) was presented as a utility token for an Australian-based e-commerce and lifestyle business allegedly operating as UNIQUE GROUP AUSTRALIA PTY LTD (reportedly incorporated August 10, 2010). Stated use cases included a travel and accommodation platform (Skippy Go), online fashion retail (Skippy Apparels), a cryptocurrency marketplace (Skippy Coin Market), and a multi-currency crypto wallet (Skippy Multi Wallet). An ICO ran from January 10 to January 23, 2022, with a stated fundraising goal of $5,000,000 USD. No funding raised figure was disclosed publicly. The project website was listed as skippytoken.io. Team members listed on ICO aggregators include Fred Kher (CEO/Founder), Zak Aziz (CTO), Wade Kherk (Co-founder and R&D Manager), Sam Annavi (Project Engineering Manager), and Zia Rahman (Projects Technical Manager). All team members are listed as unverified by ICOholder. No independent LinkedIn profiles or prior project histories have been confirmed for any named team member through available sources. Tokenomics allocated 5% to founding team, 30% to private/pre-sale/ICO, 20% to liquidity supply, and 7.5% to public sale on PancakeSwap.","heading":"Project Background and Team","sources":[{"url":"https://icoholder.com/en/skippy-token-1008470","name":"SKIPPY TOKEN (ST) ICO Rating, Reviews and Details — ICOholder","type":"other","credibility":3},{"url":"https://www.icohotlist.com/ico/skippy-token/","name":"Skippy Token — ICO Hot List","type":"other","credibility":3}],"severity":"high"},{"content":"As of May 27, 2026 — the date TenArmor detected and publicly disclosed the exploit — no statement, post-mortem, or acknowledgment had been issued by the SKP project team through any verified channel. The protocol has not announced any pause of functionality, reimbursement plan, or root cause analysis. The absence of response following a $212,000 loss is a material risk factor for any remaining token holders or liquidity providers with active exposure to SKP pools.","heading":"Absence of Team Response","sources":[{"url":"https://www.cryptotimes.io/2026/05/27/skp-liquidity-exploit-drains-212k-across-bnb-chain-defi-protocols/","name":"SKP Liquidity Exploit Drains $212K Across BNB Chain DeFi Protocols — Crypto Times","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Venus Protocol is BNB Chain's largest DeFi lending protocol by total value locked (approximately $1.47 billion as of 2026), and Lista DAO is a liquid staking and CDP protocol with approximately $1.1 billion TVL, backed by Binance Lab (YZi Labs). Both protocols were identified by TenArmor as routes used in the SKP exploit. The precise nature of their involvement — whether as flash loan providers, collateral platforms, or routing intermediaries — has not been officially confirmed. Liquidity providers on Venus or Lista DAO who had indirect exposure to SKP-denominated positions may have sustained losses. Venus Protocol experienced a separate $3.7 million supply cap manipulation exploit in March 2026; that incident is distinct from the SKP exploit but illustrates the protocol's ongoing exposure to complex multi-protocol attack vectors on BNB Chain.","heading":"Third-Party Protocol Exposure: Venus and Lista DAO","sources":[{"url":"https://www.cryptotimes.io/2026/05/27/skp-liquidity-exploit-drains-212k-across-bnb-chain-defi-protocols/","name":"SKP Liquidity Exploit Drains $212K Across BNB Chain DeFi Protocols — Crypto Times","type":"news_article","credibility":2},{"url":"https://en.cryptonomist.ch/2026/03/16/venus-protocol-hack-bnb/","name":"Venus Protocol hack triggers $3.7 million loss after THE token manipulation on BNB Chain — Cryptonomist","type":"news_article","credibility":2},{"url":"https://www.halborn.com/blog/post/explained-the-venus-protocol-hack-march-2026","name":"Explained: The Venus Protocol Hack (March 2026) — Halborn","type":"research","credibility":2},{"url":"https://www.nansen.ai/post/what-is-lista-dao","name":"What Is Lista DAO? Guide to LISTA Token and lisUSD — Nansen","type":"other","credibility":2}],"severity":"medium"},{"content":"Multiple compounding risk factors are present for SKP/Skippy Token: (1) an active confirmed exploit draining approximately $212,000 as of May 27, 2026, with root cause still unknown; (2) no independent security audit of the SKP smart contract on record; (3) extreme supply concentration with approximately 96% of tokens held by four addresses; (4) near-zero token price and trading volume prior to the exploit, indicating minimal liquidity depth and limited real usage; (5) all project team members are listed as unverified on third-party ICO aggregators; (6) no team response following the exploit; (7) the smart contract includes owner-controlled access and fee mechanisms that introduce centralization risk; (8) the project has been deployed for over four years (since October 2021) with only 41 holders, suggesting negligible organic adoption. Taken together, these factors indicate an extremely high risk profile for any user interacting with this token or its associated liquidity pools.","heading":"Risk Indicators Summary","sources":[{"url":"https://bscscan.com/token/0x6F6E2DA8DB407B17d06FB4530fd1e42824fA881C","name":"SKIPPY (SKP) Token Tracker — BscScan","type":"on_chain","credibility":1},{"url":"https://www.cryptotimes.io/2026/05/27/skp-liquidity-exploit-drains-212k-across-bnb-chain-defi-protocols/","name":"SKP Liquidity Exploit Drains $212K Across BNB Chain DeFi Protocols — Crypto Times","type":"news_article","credibility":2}],"severity":"critical"}],"timeline":[{"date":"2021-10-27","event":"SKP (SKIPPY) BEP-20 token contract deployed on BNB Smart Chain at 0x6F6E2DA8DB407B17d06FB4530fd1e42824fA881C by deployer 0x06d71a011c9db92acfd3a410860763499ec74fc4.","source":"BscScan Token Tracker","source_url":"https://bscscan.com/token/0x6F6E2DA8DB407B17d06FB4530fd1e42824fA881C"},{"date":"2022-01-10","event":"Skippy Token ICO commenced on PancakeSwap with a stated fundraising goal of $5,000,000 USD; token priced at 0.0000041 ETH.","source":"ICOholder — SKIPPY TOKEN (ST)","source_url":"https://icoholder.com/en/skippy-token-1008470"},{"date":"2022-01-23","event":"Skippy Token ICO concluded after 13 days. No public fundraising total was disclosed.","source":"ICOholder — SKIPPY TOKEN (ST)","source_url":"https://icoholder.com/en/skippy-token-1008470"},{"date":"2026-05-27","event":"TenArmor blockchain security firm detected an active exploit draining approximately $212,000 from SKP-linked liquidity pools across PancakeSwap, Venus, and Lista DAO on BNB Chain. Primary transaction hash: 0xbc01ea37bd2ff8f6aa6afcfbe0406114ff27a01e9aa56102bfa4ad8a0c2f25ee. Attacker exited with approximately 162,854 BSC-USD and 74.877 BNB. Root cause unconfirmed; no team response issued as of the date of this report.","source":"Crypto Times — SKP Liquidity Exploit Drains $212K Across BNB Chain DeFi Protocols","source_url":"https://www.cryptotimes.io/2026/05/27/skp-liquidity-exploit-drains-212k-across-bnb-chain-defi-protocols/"}],"sources_used":[{"url":"https://www.cryptotimes.io/2026/05/27/skp-liquidity-exploit-drains-212k-across-bnb-chain-defi-protocols/","name":"SKP Liquidity Exploit Drains $212K Across BNB Chain DeFi Protocols — Crypto Times","type":"news_article","archive_url":"https://web.archive.org/web/20260725055730/https://www.cryptotimes.io/2026/05/27/skp-liquidity-exploit-drains-212k-across-bnb-chain-defi-protocols/","credibility":2,"archive_timestamp":"2026-07-25T05:57:30+00:00"},{"url":"https://bscscan.com/token/0x6F6E2DA8DB407B17d06FB4530fd1e42824fA881C","name":"SKIPPY (SKP) Token Tracker — BscScan","type":"on_chain","archive_url":"https://web.archive.org/web/20260725043016/https://bscscan.com/token/0x6F6E2DA8DB407B17d06FB4530fd1e42824fA881C#transactions","credibility":1,"archive_timestamp":"2026-07-25T04:30:16+00:00"},{"url":"https://bscscan.com/tx/0xbc01ea37bd2ff8f6aa6afcfbe0406114ff27a01e9aa56102bfa4ad8a0c2f25ee","name":"BscScan — Exploit Transaction 0xbc01ea37bd2ff8f6aa6afcfbe0406114ff27a01e9aa56102bfa4ad8a0c2f25ee","type":"on_chain","archive_url":"https://web.archive.org/web/20260725043036/https://bscscan.com/tx/0xbc01ea37bd2ff8f6aa6afcfbe0406114ff27a01e9aa56102bfa4ad8a0c2f25ee","credibility":1,"archive_timestamp":"2026-07-25T04:30:36+00:00"},{"url":"https://thebittimes.com/token-SKP-BSC-0x6F6E2DA8DB407B17d06FB4530fd1e42824fA881C.html","name":"SKIPPY (SKP) Price and Market Stats — TheBitTimes","type":"other","archive_url":"http://web.archive.org/web/20260725051452/https://thebittimes.com/token-SKP-BSC-0x6F6E2DA8DB407B17d06FB4530fd1e42824fA881C.html","credibility":3,"archive_timestamp":"2026-07-25T05:14:52+00:00"},{"url":"https://icoholder.com/en/skippy-token-1008470","name":"SKIPPY TOKEN (ST) ICO Rating, Reviews and Details — ICOholder","type":"other","archive_url":"http://web.archive.org/web/20260725192807/https://icoholder.com/en/skippy-token-1008470","credibility":3,"archive_timestamp":"2026-07-25T19:28:07+00:00"},{"url":"https://www.icohotlist.com/ico/skippy-token/","name":"Skippy Token — ICO Hot List","type":"other","archive_url":"https://web.archive.org/web/20260725060329/https://www.icohotlist.com/ico/skippy-token/","credibility":3,"archive_timestamp":"2026-07-25T06:03:29+00:00"},{"url":"https://en.cryptonomist.ch/2026/03/16/venus-protocol-hack-bnb/","name":"Venus Protocol hack triggers $3.7 million loss after THE token manipulation on BNB Chain — Cryptonomist","type":"news_article","archive_url":"http://web.archive.org/web/20260725092148/https://en.cryptonomist.ch/2026/03/16/venus-protocol-hack-bnb/","credibility":2,"archive_timestamp":"2026-07-25T09:21:48+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-venus-protocol-hack-march-2026","name":"Explained: The Venus Protocol Hack (March 2026) — Halborn","type":"research","archive_url":"http://web.archive.org/web/20260528032633/https://www.halborn.com/blog/post/explained-the-venus-protocol-hack-march-2026","credibility":2,"archive_timestamp":"2026-05-28T03:26:33+00:00"},{"url":"https://www.nansen.ai/post/what-is-lista-dao","name":"What Is Lista DAO? Guide to LISTA Token and lisUSD — Nansen","type":"other","archive_url":"http://web.archive.org/web/20260514023840/https://nansen.ai/post/what-is-lista-dao","credibility":2,"archive_timestamp":"2026-05-14T02:38:40+00:00"},{"url":"https://medium.com/@zhenyazhdarkin/flash-loan-attack-uncovered-pancakeswap-lp-exploit-and-the-dmi-moolah-drain-explained-bb487f66f26e","name":"Flash Loan Attack Uncovered: PancakeSwap LP Exploit and the DMi/Moolah Drain Explained — CoinsBench/Medium","type":"research","archive_url":"https://web.archive.org/web/20260726034528/https://coinsbench.com/flash-loan-attack-uncovered-pancakeswap-lp-exploit-and-the-dmi-moolah-drain-explained-bb487f66f26e?gi=20d8c2e37cea","credibility":3,"archive_timestamp":"2026-07-26T03:45:28+00:00"},{"url":"https://www.cryptotimes.io/2026/04/01/lml-staking-protocol-exploited-for-950k-on-bsc-token-crashes-99-6/","name":"LML Staking Protocol Exploited for $950K on BSC, Token Crashes 99.6% — Crypto Times","type":"news_article","archive_url":"https://web.archive.org/web/20260725055435/https://www.cryptotimes.io/2026/04/01/lml-staking-protocol-exploited-for-950k-on-bsc-token-crashes-99-6/","credibility":2,"archive_timestamp":"2026-07-25T05:54:35+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-05-28T03:57:19.020634+00:00","updated_at":"2026-07-26T04:03:52.823941+00:00"}}