{"investigation":{"slug":"swaprum","entity_name":"Swaprum","trust_score":2,"severity_base":null,"score_modifier":0,"confidence":0.93,"status":"published","content_type":"investigation","summary":"Swaprum was an Arbitrum-based decentralized exchange (DEX) that launched in early 2023 and operated briefly before its anonymous development team executed a deliberate exit scam on May 18, 2023. The team exploited a backdoor function embedded in an upgraded smart contract to drain approximately 1,628 ETH (roughly $3 million) from user liquidity pools, then laundered the proceeds through Tornado Cash and deleted all official communication channels. No funds have been recovered and no arrests have been publicly reported.","sections":[{"content":"On or around May 18, 2023, the anonymous team behind Swaprum executed a deliberate rug pull against users of their Arbitrum-based DEX. According to blockchain security firm PeckShield, approximately 1,628 ETH — valued at roughly $3 million at the time — was drained from Swaprum's liquidity pools. The deployer address identified on-chain is 0xaaf8b44376f4ef3eD477eeEB3553b7623FEF5E1c. The native SAPR token contract address is 0x2aE25460c44d578E6f41aB900a7A5425b6492C16 on Arbitrum One. The incident was described as one of the largest exit scams recorded on the Arbitrum network at the time, surpassing the $2 million Hope Finance exploit of February 2023.","heading":"Exit Scam and Fund Theft","sources":[{"url":"https://cointelegraph.com/news/alleged-swaprum-rug-pull-swipes-three-million-in-customer-funds","name":"PeckShield alert — Swaprum rug pull reported by CoinTelegraph","type":"news_article","credibility":2},{"url":"https://www.theblock.co/post/231539/swaprum-dex-exit-scam-arbitrum","name":"The Block — Swaprum DEX team disappears with $3 million in apparent exit scam","type":"news_article","credibility":2},{"url":"https://arbiscan.io/token/0x2aE25460c44d578E6f41aB900a7A5425b6492C16","name":"SAPR Token on Arbiscan","type":"on_chain","credibility":1},{"url":"https://coingape.com/crypto-news-swaprun-dex-arbitrum-rugpulls-sapr-token-crash/","name":"CryptoGape — Breaking: Swaprum DEX on Arbitrum rug pulls $3M","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Security firm Beosin and independent analysis by QuillAudits established that the Swaprum team pre-planted a backdoor in the protocol. After the initial smart contract audit was conducted, the team upgraded the reward (MasterChef) contract to a malicious version containing at least two backdoor functions. First, the add() function allowed the deployer to transfer LP tokens staked by users directly to their own wallet. Second, the getToken() function minted 200,000,000 SAPR tokens into the deployer's wallet, which were then used to drain the SAPR/WETH liquidity pool. Separately, the attacker used the stolen LP tokens to remove liquidity from the USDT/WETH and USDT/USDC pools. Key transaction hashes documented by QuillAudits include: malicious contract upgrade (0x11a84164726c57dd7c3c0f610ed65cfa5f062009b3d51bcacc31e52c50908a9c), SAPR minting (0x821b2e98bb5ab19b6b35e5abaceca3d263a17b07039bc169823d7cf27460168e), liquidity removal (0xcb64a40d652ff8bfac2e08aa6425ace9c19f0eeb4a6e32f0c425f9f9ea747edf), and Tornado Cash transfer (0xfffb4bbabeafc906800ec790c8c9cd9c6b6e11532f6a9e210dc091f29909bafd). The SAPR token price collapsed from approximately $0.147 to $0.000022 — a decline of over 99%.","heading":"Technical Attack Mechanism","sources":[{"url":"https://quillaudits.medium.com/decoding-swaprum-finance-3-million-rug-pull-quillaudits-2c6f9527b589","name":"QuillAudits — Decoding Swaprum Finance $3 Million Rug Pull","type":"research","credibility":2},{"url":"https://www.halborn.com/blog/post/explained-the-swaprum-rug-pull-may-2023","name":"Halborn — Explained: The Swaprum Rug Pull (May 2023)","type":"research","credibility":2},{"url":"https://cryptopotato.com/swaprum-dex-drained-in-3m-crypto-rugpull/","name":"CryptoPotato — Swaprum DEX Drained in $3M Crypto Rugpull","type":"news_article","credibility":2}],"severity":"critical"},{"content":"After draining the liquidity pools, the alleged perpetrators bridged the stolen ETH from the Arbitrum network to Ethereum mainnet using multiple cross-chain bridges including Multichain, AcrossProtocol, and CelerNetwork. PeckShield confirmed that approximately 1,620 ETH of the stolen 1,628 ETH was subsequently routed through Tornado Cash, the sanctioned Ethereum mixing service, in an effort to obscure the transaction trail. This near-total laundering through Tornado Cash significantly reduced the prospects for on-chain fund tracing and recovery.","heading":"Tornado Cash Laundering","sources":[{"url":"https://ambcrypto.com/arbitrum-spirals-as-customers-lose-3-million-in-a-rug-pull-scam-what-next/","name":"PeckShield alert cited by AMBCrypto — Arbitrum spirals as customers lose $3 million in a rug pull scam","type":"news_article","credibility":2},{"url":"https://dailyhodl.com/2023/05/20/arbitrum-dex-burns-investors-with-3000000-rug-pull-scam-according-to-blockchain-security-firm/","name":"Daily Hodl — Arbitrum DEX Burns Investors With $3,000,000 Rug Pull Scam","type":"news_article","credibility":2},{"url":"https://quillaudits.medium.com/decoding-swaprum-finance-3-million-rug-pull-quillaudits-2c6f9527b589","name":"QuillAudits — Tornado Cash transaction hash documentation","type":"research","credibility":2}],"severity":"critical"},{"content":"CertiK conducted and published a smart contract audit of Swaprum on May 5, 2023 — approximately 13 days before the exit scam was executed. The audit identified 18 total findings: 0 critical, 4 major (all related to centralization/privilege), 0 medium, 7 minor, and 7 informational. None of the 18 findings were fully resolved by the Swaprum team; 15 were merely acknowledged and 3 were partially addressed. CertiK's audit specifically flagged the protocol's heavy centralization as a major risk, meaning the development team held privileged control over key contract functions. However, the backdoor that enabled the rug pull was introduced through a post-audit contract upgrade, meaning the malicious code was not present in the version CertiK reviewed. CertiK subsequently stated that its audit is not a guarantee of project safety and that the backdoor was added after the audit was completed. Critics including Mikko Ohtamaa, co-founder of TradingStrategy.ai, noted that CertiK's centralization risk flag did not materially affect the project's public audit score, arguing that audit certifications are being misused to build false trust with investors. The incident added to growing criticism of audit firms for enabling exit scam teams to market audit badges without meaningful security guarantees.","heading":"CertiK Audit and Centralization Warnings","sources":[{"url":"https://skynet.certik.com/projects/swaprum","name":"CertiK Skynet — Swaprum Project Insight","type":"research","credibility":2},{"url":"https://decrypt.co/140744/certik-taking-heat-as-another-project-it-audited-swaprum-gets-rugged","name":"Decrypt — Another CertiK Audited Project Rugs as $3M Disappears From Arbitrum DeFi Exchange","type":"news_article","credibility":2},{"url":"https://www.dlnews.com/articles/defi/defi-protocol-swaprum-in-3m-rug-pull-was-certik-audited/","name":"DL News — DeFi protocol in $3m scam was 'Certik audited'","type":"news_article","credibility":2},{"url":"https://finance.yahoo.com/news/another-certik-certified-project-rugs-183430383.html","name":"Yahoo Finance — Another CertiK Certified Project Rugs","type":"news_article","credibility":2}],"severity":"high"},{"content":"Immediately following the execution of the exit scam, the Swaprum team deleted their official Twitter/X account, Telegram group, and GitHub repository. At the time of initial reporting, the Swaprum website remained accessible, though the project was functionally defunct. No team members have been publicly identified, no post-incident communications were issued, and no compensation or recovery mechanism has been announced. The SAPR token retains effectively zero value. The anonymous nature of the founding team and the rapid deletion of all communication channels are consistent with a deliberate pre-planned exit strategy.","heading":"Social Media Deletion and Project Abandonment","sources":[{"url":"https://u.today/arbitrum-project-swaprum-suffers-rug-pull-tokens-value-falls-to-zero","name":"U.Today — Arbitrum Project Swaprum Suffers Rug Pull, Token's Value Falls to Zero","type":"news_article","credibility":2},{"url":"https://becausebitcoin.com/post/swaprum-dex-team-vanishes-in-apparent-usd3-million-exit-scam-on-arbitrum-network","name":"BecauseBitcoin — Swaprum DEX Team Vanishes in Apparent $3 Million Exit Scam","type":"news_article","credibility":2}],"severity":"high"},{"content":"As of the available reporting through mid-2023, no law enforcement agency has publicly announced an investigation, arrest, or prosecution related to the Swaprum exit scam. No regulatory action by the SEC, CFTC, or any comparable body has been reported. The near-complete laundering of funds through Tornado Cash and the entirely anonymous team structure have made attribution difficult. No civil suits or asset recovery proceedings have been publicly identified.","heading":"Regulatory and Legal Status","sources":[{"url":"https://coingape.com/crypto-news-swaprun-dex-arbitrum-rugpulls-sapr-token-crash/","name":"CoinGape — Breaking: Swaprum DEX on Arbitrum Rug Pulls $3M","type":"news_article","credibility":2}],"severity":"medium"}],"timeline":[{"date":"2023-05","event":"CertiK begins smart contract audit of Swaprum at the team's request.","source":"","date_original":"2023-05-01"},{"date":"2023-05-05","event":"CertiK publishes its audit of Swaprum, flagging 4 major findings related to centralization/privilege. Zero findings are fully resolved by the team.","source":""},{"date":"2023-05-18","event":"Swaprum deployer (0xaaf8b44376f4ef3eD477eeEB3553b7623FEF5E1c) upgrades the MasterChef reward contract to a malicious version containing add() and getToken() backdoor functions, executes the exit scam, and drains approximately 1,628 ETH (~$3 million) from user liquidity pools.","source":""},{"date":"2023-05-18","event":"Stolen ETH is bridged from Arbitrum to Ethereum mainnet via Multichain, AcrossProtocol, and CelerNetwork, then approximately 1,620 ETH is routed through Tornado Cash.","source":""},{"date":"2023-05-18","event":"SAPR token price collapses from approximately $0.147 to $0.000022, a decline of over 99%.","source":""},{"date":"2023-05-19","event":"PeckShield publicly alerts the community to the Swaprum rug pull via Twitter.","source":""},{"date":"2023-05-19","event":"Swaprum team deletes its Twitter/X account, Telegram group, and GitHub repository. The website remains accessible temporarily.","source":""},{"date":"2023-05-20","event":"Multiple major outlets including The Block, CoinTelegraph, Decrypt, and CryptoPotato publish full coverage of the incident. CertiK issues a statement clarifying the backdoor was introduced post-audit.","source":""}],"sources_used":[{"url":"https://cointelegraph.com/news/alleged-swaprum-rug-pull-swipes-three-million-in-customer-funds","name":"CoinTelegraph — $3M worth of customer funds swiped via alleged Swaprum DEX rug pull","type":"news_article","archive_url":"http://web.archive.org/web/20250827183337/https://cointelegraph.com/news/alleged-swaprum-rug-pull-swipes-three-million-in-customer-funds","credibility":2,"archive_timestamp":"2025-08-27T18:33:37+00:00"},{"url":"https://www.theblock.co/post/231539/swaprum-dex-exit-scam-arbitrum","name":"The Block — Swaprum DEX team disappears with $3 million in apparent exit scam on Arbitrum network","type":"news_article","archive_url":"http://web.archive.org/web/20250809022926/https://www.theblock.co/post/231539/swaprum-dex-exit-scam-arbitrum","credibility":2,"archive_timestamp":"2025-08-09T02:29:26+00:00"},{"url":"https://decrypt.co/140744/certik-taking-heat-as-another-project-it-audited-swaprum-gets-rugged","name":"Decrypt — Another CertiK Audited Project Rugs as $3M Disappears From Arbitrum DeFi Exchange","type":"news_article","archive_url":"http://web.archive.org/web/20260516104710/https://decrypt.co/140744/certik-taking-heat-as-another-project-it-audited-swaprum-gets-rugged","credibility":2,"archive_timestamp":"2026-05-16T10:47:10+00:00"},{"url":"https://www.dlnews.com/articles/defi/defi-protocol-swaprum-in-3m-rug-pull-was-certik-audited/","name":"DL News — DeFi protocol in $3m scam was 'Certik audited'","type":"news_article","archive_url":"http://web.archive.org/web/20260617144459/https://www.dlnews.com/articles/defi/defi-protocol-swaprum-in-3m-rug-pull-was-certik-audited/","credibility":2,"archive_timestamp":"2026-06-17T14:44:59+00:00"},{"url":"https://quillaudits.medium.com/decoding-swaprum-finance-3-million-rug-pull-quillaudits-2c6f9527b589","name":"QuillAudits — Decoding Swaprum Finance $3 Million Rug Pull","type":"research","archive_url":"https://web.archive.org/web/20260724210717/https://quillaudits.medium.com/decoding-swaprum-finance-3-million-rug-pull-quillaudits-2c6f9527b589","credibility":2,"archive_timestamp":"2026-07-24T21:07:17+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-swaprum-rug-pull-may-2023","name":"Halborn — Explained: The Swaprum Rug Pull (May 2023)","type":"research","archive_url":"http://web.archive.org/web/20260513004512/https://www.halborn.com/blog/post/explained-the-swaprum-rug-pull-may-2023","credibility":2,"archive_timestamp":"2026-05-13T00:45:12+00:00"},{"url":"https://skynet.certik.com/projects/swaprum","name":"CertiK Skynet — Swaprum Project Insight","type":"research","archive_url":"http://web.archive.org/web/20260422145056/https://skynet.certik.com/projects/swaprum","credibility":2,"archive_timestamp":"2026-04-22T14:50:56+00:00"},{"url":"https://cryptopotato.com/swaprum-dex-drained-in-3m-crypto-rugpull/","name":"CryptoPotato — Swaprum DEX Drained in $3M Crypto Rugpull","type":"news_article","archive_url":"http://web.archive.org/web/20260606045701/https://cryptopotato.com/swaprum-dex-drained-in-3m-crypto-rugpull/","credibility":2,"archive_timestamp":"2026-06-06T04:57:01+00:00"},{"url":"https://coingape.com/crypto-news-swaprun-dex-arbitrum-rugpulls-sapr-token-crash/","name":"CoinGape — Breaking: Swaprum DEX on Arbitrum Rug Pulls $3M","type":"news_article","archive_url":"https://web.archive.org/web/20260724210017/https://coingape.com/crypto-news-swaprun-dex-arbitrum-rugpulls-sapr-token-crash/","credibility":2,"archive_timestamp":"2026-07-24T21:00:17+00:00"},{"url":"https://ambcrypto.com/arbitrum-spirals-as-customers-lose-3-million-in-a-rug-pull-scam-what-next/","name":"AMBCrypto — Arbitrum spirals as customers lose $3 million in a rug pull scam","type":"news_article","archive_url":"http://web.archive.org/web/20250911211838/https://ambcrypto.com/arbitrum-spirals-as-customers-lose-3-million-in-a-rug-pull-scam-what-next/","credibility":2,"archive_timestamp":"2025-09-11T21:18:38+00:00"},{"url":"https://dailyhodl.com/2023/05/20/arbitrum-dex-burns-investors-with-3000000-rug-pull-scam-according-to-blockchain-security-firm/","name":"Daily Hodl — Arbitrum DEX Burns Investors With $3,000,000 Rug Pull Scam","type":"news_article","archive_url":"http://web.archive.org/web/20251115083551/https://dailyhodl.com/2023/05/20/arbitrum-dex-burns-investors-with-3000000-rug-pull-scam-according-to-blockchain-security-firm/","credibility":2,"archive_timestamp":"2025-11-15T08:35:51+00:00"},{"url":"https://u.today/arbitrum-project-swaprum-suffers-rug-pull-tokens-value-falls-to-zero","name":"U.Today — Arbitrum Project Swaprum Suffers Rug Pull, Token's Value Falls to Zero","type":"news_article","archive_url":"http://web.archive.org/web/20251117102046/https://u.today/arbitrum-project-swaprum-suffers-rug-pull-tokens-value-falls-to-zero","credibility":2,"archive_timestamp":"2025-11-17T10:20:46+00:00"},{"url":"https://finance.yahoo.com/news/another-certik-certified-project-rugs-183430383.html","name":"Yahoo Finance — Another CertiK Certified Project Rugs","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://arbiscan.io/token/0x2aE25460c44d578E6f41aB900a7A5425b6492C16","name":"Arbiscan — SAPR Token Contract","type":"on_chain","archive_url":"http://web.archive.org/web/20260724163212/https://arbiscan.io/token/0x2aE25460c44d578E6f41aB900a7A5425b6492C16","credibility":1,"archive_timestamp":"2026-07-24T16:32:12+00:00"},{"url":"https://invezz.com/news/2023/05/20/just-in-sapr-tokens-worthless-following-3m-rug-pull-by-swaprum-developers/","name":"Invezz — SAPR tokens worthless following $3M rug pull by Swaprum developers","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:42.206256+00:00","updated_at":"2026-08-29T01:34:48.511+00:00"}}