illegal Crypto Rug Pulls and Dirty Money

Crypto investigation company CipherTrace reports that Defi rug pulls and exit scams formed 99% of all crypto frauds in 2020 similar to the 2017 ICO craze.

Are Crypto rugs illegal? Crypto rugs are illegal and regulators would take action if they could trace the offenders within their country. The UK police recovered 22m of Ethereum in a USB token from the offenders behind the StableMagnet rug pull. Exchanges are also getting better in recovering and stopping rug pulls by using technology.

Is rug pull a crime?

Rug pulls or exit scams are illegal and there is a trend of regulators investigating rug pulls frauds 

• In the UK, Greater Manchester Police have detained a 23-year-old male and a 25-year-old female believed to be the perpetrators behind the StableMagnet rugpull. The specialist officers seized $22.25 million in Ethereum after receiving intelligence, which led them to discover USB sticks containing huge amounts of Ethereum. 

List of rug pulls

We compiled a list from various sources like CipherTrace 2020 Crypto Crime and Anti Money Laundering Report and other sources from companies dedicated to tracing such illegitimate funds like Ciphertrace, ChainAnalysis, and Cylynx.

• Squid coin collapsed from a high of just over $2,860 to effectively zero as cryptocurrency traders watched the token’s unknown creators clean out some $3.3 million in funds
• Lv.Finance
• Emerald Mine
• Yfdexf.Finance
• SharkTron - In November 2020, the Defi project SharkTron appeared to have conducted an exit scam with $10 million in user funds, closing its website and leaving users in the dark.
• Unicats - A back door in smart contracts allowed UniCat to keep control over users' tokens even after they were withdrawn from the pool. Around USD 200,000 worth of crypto has supposedly been stolen.
• Compounder.Finance
• Amplifi. money (unverified)
• Burn Vault Finance (unverified) - The newsletter says the team behind this protocol rug pulled. News.bitcoin.com also confirmed the community Telegram account is no longer active.
• Minions Farm (unverified)
• Unirocket (unverified)
• PlusToken netted $2.9 billion with its exit scam 64% of the 2019 major crime volume with its Ponzi scheme
• WoToken, a similar scheme operated by some of the same people as PlusToken, defraud investors out of $1.1 billion in its exit scam 58% of 2020's major crime volume
• TRUAMPL (TMPL) - a coin that mimics Ampleforth (AMPL) had its owner maliciously pull out the entire liquidity containing 154 ETH & 2,926,099 TMPL tokens.

Please let us know if you have other crypto rugs to report and complete the above listing.

What is a crypto rug pull?

Exit scams and rug pulls are used interchangeably where money was cheated from investors by an unexpected exit from the people involved tightly in the project such as developers.

• Initially, exit scams happened even in traditional finance (e.g. private companies) when promoters disappear with investors' money during or after an initial offering (e.g. Initial Coin Offering).
• Rug pulls are a form of exit scam whereby crypto developers abandon a project and run away with investors' funds by taking away buy support or Decentralised Exchange (DEX) liquidity pool from the market.

The TMPL was created and planned for a public sale on the Ethereum platform via an ERC20 token created on the Ethereum chain.

• Public sales are typically hyped up through marketing channels beforehand, in an attempt to attract potential investors to increase the worth of the token which aids in the development of the token.
• The owner of the Ethereum contract address 0x5d64a2b59328c1e387806ebefaebcf57a45a298e maliciously pulled out the entire liquidity containing 154 ETH & 2,926,099 TMPL tokens in 40 minutes after the public sale of TMPL. Many traders exchanged their valuable ETH for TMPL token at the market rate as they feared missing out on the future price appreciation

Source: cylynx.io

Based on Cylynx, about 27% of the TMPL rugged funds are still held in private addresses as of 21st May 2021.

Not all cases are traceable as the cheaters might outwit the regulators with obscuring tons of fictitious transactions (e.g. via mixers or tumbling) and can only be tracked when they attempt to convert the crypto to fiat. These are usually developers or IT savvy people who covered their tracks or even sell their tokens in P2P marketplaces that are unregulated. 

Source: cylynx.io

According to CoinGecko Defi had locked around $19.8 billion (23% of Ethereum's total market capitalization) which is a more than 1000% increase from $1.7 billion at the beginning of 2020. Defi-related hacks now make up more than 60% of the total hack and theft volume in 2021, a large increase from only 25% in 2020. 

How do you tell if crypto is a rug pull?

There is no easy way as these people could look legitimate but make plans to hide their agendas. Some ways to assess whether a crypto or NFT project is a rug pull warning are:-

• Projects focused on the short-term hype rather than a mission or purpose. While promoting a project is normal, speaking little of their missions or goals besides hyping up the prices or floors indicates the people might be going for a pump and dump schemes eventually.
• Little background information is available on the founders besides the "official" websites. It is easy to design an authentic and trustworthy website with (1) fabricated professional photos with Photoshop and photography skills, (2) fake relationships with celebrities and influencers. You can easily pay celebrity money to tout your name or wish you a happy birthday that creates fake trust. (3) Buying followers in social media
• You can also hire a private investigator to dig out information about the person much like how companies do background checks. If the person has criminal records or is blacklisted by United Nations or has been warned by financial institutions (e.g. Binance), that could mean you got to be wary about the compliance and integrity of the person or project.
• Smart contracts that are unverified by a third party provide zero assurance on whether developers or anyone can withdraw the liquidity without permission or consent

How do you stop a rug pull crypto

You cannot stop a rug pull yourself as you cannot stop transactions that you thought are legitimate. Unlike viruses, there is no "anti-virus" solution to detect and prevent transactions. Some rug pulls can take only 1 hour before the money is emptied.

Major exchanges like Binance and KuCoin are getting technology to detect and stop suspicious transactions.

• In 2020, a large $281 million hack of cryptocurrency exchange KuCoin happened and the exchange claimed to have already recovered 84% of the stolen funds. This is something almost unheard of in previous years. (ciphertrace.com)

• To stop a rug pul, KuCoin transferred the remainder of its hot wallets to new secure wallets and froze all customer deposits and withdrawals. Most of the stolen cryptocurrencies were ERC20 tokens, which can be easily laundered through Defi protocols. This case marks the first high-profile instance of a DEX, in this case, Uniswap, being used as a money mixer. Unlike centralized exchanges, a DEX can't freeze funds only specific projects can.  

Conclusion

In the long run, the incidents of rug pulling will hurt the belief that the panacea to the problem of financial exclusion is decentralization. The only way to maintain the public's interest in Defi is if influencers and community leaders help fix the problems. The effort could help prevent regulators from imposing rules that would curtail further growth of the space.