{"investigation":{"slug":"sudorare","entity_name":"SudoRare","trust_score":2,"severity_base":null,"score_modifier":0,"confidence":0.92,"status":"published","content_type":"investigation","summary":"SudoRare was an anonymous NFT automated market maker (AMM) protocol launched on August 23, 2022, presented as a fork of SudoSwap and LooksRare. Approximately six hours after launch, the anonymous development team executed a premeditated rugpull via a backdoored smart contract, draining approximately 519 ETH (valued at $815,000–$852,000) from user deposits before deleting all online presence. Blockchain security firms PeckShield and CertiK traced a funding wallet to Kraken, but no public arrests or legal proceedings have been reported.","sections":[{"content":"SudoRare presented itself as a decentralized NFT exchange and automated market maker (AMM) that combined the liquidity pool mechanics of SudoSwap with the tokenomics model of LooksRare. The protocol launched on August 23, 2022, under the domain sudorare.xyz, and allowed users to deposit wETH, LOOKS, and XMON tokens into liquidity pools to earn yield denominated in the project's native SR token. The team explicitly stated it would remain 100% anonymous and would never disclose the identities of its members. Community observers flagged the project's anonymous team, high advertised yields, and suspicious social media follower counts as indicators of fraud prior to the rugpull.","heading":"Project Overview","sources":[{"url":"https://www.coindesk.com/tech/2022/08/23/looksrare-fork-sudorare-rugs-for-800k-despite-crypto-twitter-warnings","name":"coindesk.com","type":"other","credibility":3},{"url":"https://decrypt.co/108051/nft-project-sudorare-disappears-roughly-520-ethereum-user-funds","name":"decrypt.co","type":"other","credibility":3},{"url":"https://www.theblock.co/post/164970/nft-exchange-sudorare-suffers-800000-rug-pull-six-hours-after-launch","name":"theblock.co","type":"other","credibility":3}],"severity":"medium"},{"content":"CertiK's post-incident analysis confirmed that SudoRare's developers deployed an upgrade to the protocol's smart contract containing a backdoor function. This backdoor permitted a designated 'operator' address — controlled by the same entity that deployed the contract — to transfer all user-deposited tokens out of the protocol without user authorization. Six hours after launch, the operator called the backdoored GenesisV2Bootstrap function, draining 1,153,216 LOOKS tokens (approximately $314,000), 6.014 XMON tokens (approximately $210,000), and 200 WETH (approximately $320,000). The stolen assets were converted to ETH via Multicall transactions and WETH was unwrapped through a Withdraw function call. After executing the drain, the deployer called the Upgrade function to patch the backdoor — an action consistent with a deliberate attempt to obscure the exploit vector. The total value extracted is cited at approximately $815,000–$852,000 across different security sources, with variance attributable to ETH price fluctuations at the time of execution. 241 individual user deposits were affected.","heading":"Rugpull Execution and Technical Mechanism","sources":[{"url":"https://www.certik.com/resources/blog/3Udpk9kJW6rikLpgca3w3N-sudorare-incident-analysis","name":"certik.com","type":"other","credibility":3},{"url":"https://cryptobriefing.com/nft-exchange-sudorare-goes-dark-820000-rug-pull/","name":"cryptobriefing.com","type":"other","credibility":3},{"url":"https://cryptoslate.com/sudorare-developers-reap-815k-from-rug-pulling-project/","name":"cryptoslate.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the exploit, the stolen ETH was divided into three roughly equal portions of approximately 173 ETH each and distributed to three external wallets: 0x75c3b2...3981, 0x0498d1...8074, and 0xbFb784...7EAa. Blockchain security firm PeckShield traced a funding wallet used by the SudoRare deployer — specifically, EOA 0x814d — to a deposit originating from Kraken, a regulated U.S.-based centralized exchange. PeckShield stated publicly: 'The actor behind SudoRare rugpull seems a @krakenfx user.' Because Kraken is subject to U.S. Know Your Customer (KYC) requirements, investigators noted that the exchange would have identity documentation on the wallet's owner. Separately, CertiK identified that an address also involved in the Nomad Bridge exploit (EOA 0xfaFb...) had deposited 24 WETH into SudoRare but successfully withdrew before the exit scam was executed.","heading":"Fund Flow and On-Chain Tracing","sources":[{"url":"https://cryptobriefing.com/sudorare-pulled-the-rug-for-820000-how-will-kraken-respond/","name":"cryptobriefing.com","type":"other","credibility":3},{"url":"https://www.certik.com/resources/blog/3Udpk9kJW6rikLpgca3w3N-sudorare-incident-analysis","name":"certik.com","type":"other","credibility":3},{"url":"https://cryptobriefing.com/nft-exchange-sudorare-goes-dark-820000-rug-pull/","name":"cryptobriefing.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Multiple community members on Crypto Twitter issued warnings about SudoRare prior to the rugpull. Twitter user @2shabby noted that the team was anonymous, would not dox, and that 'the possibility of this being a scam is high.' User @0xStanec described the project as 'a 1,001% scam project that noobs will fall for.' Additional concerns raised included inflated or purchased social media follower counts, unusually high advertised yield rates, and the explicit refusal by the team to disclose any identifying information. CoinDesk reported that the project proceeded to attract over $800,000 in user deposits despite these publicly circulated warnings. The pattern — anonymous team, fork of established protocol, short staking period with high yields — is consistent with other contemporaneous rugpull schemes observed in the 2022 NFT market cycle.","heading":"Pre-Launch Warning Signs and Community Flags","sources":[{"url":"https://www.coindesk.com/tech/2022/08/23/looksrare-fork-sudorare-rugs-for-800k-despite-crypto-twitter-warnings","name":"coindesk.com","type":"other","credibility":3},{"url":"https://decrypt.co/108051/nft-project-sudorare-disappears-roughly-520-ethereum-user-funds","name":"decrypt.co","type":"other","credibility":3},{"url":"https://medium.com/coinmonks/sudorare-rugged-but-are-we-surprised-anymore-c984a73984f0","name":"medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Immediately following the fund extraction, the SudoRare team deleted the project's website (sudorare.xyz), Twitter account, and all other affiliated social media and communication channels. No public statement, post-mortem, or explanation was issued by the team. As of the available record through 2025, no law enforcement action, SEC filing, CFTC referral, DOJ indictment, or civil lawsuit has been publicly identified in connection with the SudoRare rugpull. Kraken has not publicly confirmed whether it cooperated with any investigation. The incident was widely cited in 2022 crypto security reporting as an example of the risks posed by anonymous development teams and upgradeable smart contracts without time-locks or multi-sig controls.","heading":"Platform Deletion and Aftermath","sources":[{"url":"https://cryptobriefing.com/sudorare-pulled-the-rug-for-820000-how-will-kraken-respond/","name":"cryptobriefing.com","type":"other","credibility":3},{"url":"https://news.bitdegree.org/sudorare-disappears-from-the-web-with-around-815k-stolen-by-developers","name":"news.bitdegree.org","type":"other","credibility":3},{"url":"https://cryptodaily.co.uk/2022/08/sudorare-rugpull-amounts-to-820-k-in-losses","name":"cryptodaily.co.uk","type":"other","credibility":3}],"severity":"medium"},{"content":"CertiK's incident analysis identified the central vulnerability as an upgradeable smart contract with no time-lock, no multi-signature requirement, and an unchecked operator permission model. This allowed the deployer to unilaterally modify the contract's behavior without any community governance vote, delay period, or external security check. The use of a proxy upgrade pattern is a recognized risk surface in DeFi and NFT protocol design: when not paired with appropriate decentralization controls, it provides deployers with the technical ability to insert arbitrary code and drain funds. The SudoRare incident contributed to growing industry discourse in 2022 about the need for mandatory time-locks on upgradeable contracts, multi-sig deployer requirements, and independent security audits before user funds are accepted. No audit by a recognized security firm was published prior to SudoRare's launch.","heading":"Security Analysis and Structural Risk Factors","sources":[{"url":"https://www.certik.com/resources/blog/3Udpk9kJW6rikLpgca3w3N-sudorare-incident-analysis","name":"certik.com","type":"other","credibility":3},{"url":"https://coindictate.com/sudorare-rugs-514-eth-six-hours-after-launch/","name":"coindictate.com","type":"other","credibility":3},{"url":"https://news.coincu.com/119529-nft-exchange-sudorare-experiences-rug-pull/","name":"news.coincu.com","type":"other","credibility":3}],"severity":"medium"},{"content":"AVOID.NET's intake record indicates that on-chain investigator ZachXBT flagged SudoRare as a fraudulent entity. ZachXBT is a pseudonymous blockchain investigator with a documented track record of identifying rug pulls, exit scams, and fund flow patterns across public blockchains. The SudoRare incident received broad coverage from crypto security researchers including PeckShield and CertiK, both of whom published on-chain evidence corroborating the rugpull narrative. The specific content and date of ZachXBT's flag have not been independently retrieved from a verifiable archived source in this investigation; however, the underlying facts of the rugpull are corroborated by multiple Tier 1 and Tier 2 sources.","heading":"ZachXBT and Investigator Flags","sources":[{"url":"https://cryptobriefing.com/nft-exchange-sudorare-goes-dark-820000-rug-pull/","name":"cryptobriefing.com","type":"other","credibility":3},{"url":"https://www.certik.com/resources/blog/3Udpk9kJW6rikLpgca3w3N-sudorare-incident-analysis","name":"certik.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2022-08-21","event":"Ethereum wallet 0x814d receives 0.596 ETH from Kraken (exchange), later linked to SudoRare deployer by PeckShield.","source":""},{"date":"2022-08-23","event":"SudoRare launches on sudorare.xyz, opening liquidity pools accepting wETH, LOOKS, and XMON token deposits.","source":""},{"date":"2022-08-23","event":"Community members on Crypto Twitter, including @2shabby and @0xStanec, publicly flag SudoRare as a likely scam citing team anonymity, inflated followers, and high yields.","source":""},{"date":"2022-08-23","event":"Approximately six hours after launch, the deployer calls a backdoored smart contract function to drain 1,153,216 LOOKS, 6.014 XMON, and 200 WETH from the protocol, affecting 241 depositors.","source":""},{"date":"2022-08-23","event":"Stolen assets are converted to ETH and distributed equally across three wallets: 0x75c3b2...3981, 0x0498d1...8074, and 0xbFb784...7EAa (~173 ETH each).","source":""},{"date":"2022-08-23","event":"SudoRare website (sudorare.xyz), Twitter account, and all social media channels are deleted.","source":""},{"date":"2022-08-23","event":"PeckShield publishes on-chain tracing showing the deployer's funding wallet (0x814d) was funded by Kraken, stating 'The actor behind SudoRare rugpull seems a @krakenfx user.'","source":""},{"date":"2022-08-23","event":"CertiK publishes incident analysis confirming the backdoored upgrade mechanism and detailing the full fund flow to three recipient addresses.","source":""},{"date":"2022-08-24","event":"Major crypto outlets including CoinDesk, The Block, Decrypt, and CryptoBriefing publish coverage of the rugpull. Total estimated losses reported at $815,000–$852,000.","source":""}],"sources_used":[{"url":"https://www.coindesk.com/tech/2022/08/23/looksrare-fork-sudorare-rugs-for-800k-despite-crypto-twitter-warnings","name":"coindesk.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://decrypt.co/108051/nft-project-sudorare-disappears-roughly-520-ethereum-user-funds","name":"decrypt.co","type":"other","archive_url":"http://web.archive.org/web/20260512221511/https://decrypt.co/108051/nft-project-sudorare-disappears-roughly-520-ethereum-user-funds","credibility":3,"archive_timestamp":"2026-05-12T22:15:11+00:00"},{"url":"https://www.theblock.co/post/164970/nft-exchange-sudorare-suffers-800000-rug-pull-six-hours-after-launch","name":"theblock.co","type":"other","archive_url":"http://web.archive.org/web/20260322055923/https://www.theblock.co/post/164970/nft-exchange-sudorare-suffers-800000-rug-pull-six-hours-after-launch","credibility":3,"archive_timestamp":"2026-03-22T05:59:23+00:00"},{"url":"https://www.certik.com/resources/blog/3Udpk9kJW6rikLpgca3w3N-sudorare-incident-analysis","name":"certik.com","type":"other","archive_url":"https://web.archive.org/web/20260830045412/https://www.certik.com/blog/3Udpk9kJW6rikLpgca3w3N-sudorare-incident-analysis","credibility":3,"archive_timestamp":"2026-08-30T04:54:12+00:00"},{"url":"https://cryptobriefing.com/nft-exchange-sudorare-goes-dark-820000-rug-pull/","name":"cryptobriefing.com","type":"other","archive_url":"http://web.archive.org/web/20260311034309/https://cryptobriefing.com/nft-exchange-sudorare-goes-dark-820000-rug-pull/","credibility":3,"archive_timestamp":"2026-03-11T03:43:09+00:00"},{"url":"https://cryptoslate.com/sudorare-developers-reap-815k-from-rug-pulling-project/","name":"cryptoslate.com","type":"other","archive_url":"http://web.archive.org/web/20260829132158/https://cryptoslate.com/sudorare-developers-reap-815k-from-rug-pulling-project/","credibility":3,"archive_timestamp":"2026-08-29T13:21:58+00:00"},{"url":"https://cryptobriefing.com/sudorare-pulled-the-rug-for-820000-how-will-kraken-respond/","name":"cryptobriefing.com","type":"other","archive_url":"http://web.archive.org/web/20251123083604/https://cryptobriefing.com/sudorare-pulled-the-rug-for-820000-how-will-kraken-respond/","credibility":3,"archive_timestamp":"2025-11-23T08:36:04+00:00"},{"url":"https://medium.com/coinmonks/sudorare-rugged-but-are-we-surprised-anymore-c984a73984f0","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://news.bitdegree.org/sudorare-disappears-from-the-web-with-around-815k-stolen-by-developers","name":"news.bitdegree.org","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://cryptodaily.co.uk/2022/08/sudorare-rugpull-amounts-to-820-k-in-losses","name":"cryptodaily.co.uk","type":"other","archive_url":"https://web.archive.org/web/20260829131537/https://cryptodaily.co.uk/2022/08/sudorare-rugpull-amounts-to-820-k-in-losses","credibility":3,"archive_timestamp":"2026-08-29T13:15:37+00:00"},{"url":"https://coindictate.com/sudorare-rugs-514-eth-six-hours-after-launch/","name":"coindictate.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://news.coincu.com/119529-nft-exchange-sudorare-experiences-rug-pull/","name":"news.coincu.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-job","archive_status":"unarchivable","archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:48.191686+00:00","updated_at":"2026-08-30T05:14:12.715374+00:00"}}