LW Token Price Manipulation Attack

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' section to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

LW Token Price Chart

Little is known about the LW token. It doesn't appear to have an official website and there is limited references on social media, however it traded on PancakeSwap and was listed on several sites. On May 11th, the price spiked and rapidly fell due to a flash loan exploit. Approximately $48k worth of BNB was removed and brought to TornadoCash.

This is a global/international case not involving a specific country.

About LW Token

"The Warden system based on data from 1.000.000+ SmartContract, this contract has 95% to be a RugPull or HoneyPot!"

"The LW token on BSC was attacked, with a loss of 48,415 USDT, and the price of LW token plummeted by 69%. The attackers have transferred about 150 BNB to Tornado Cash."

"According to news from PANews on May 12, according to Paidun’s early warning and monitoring, the LW token on BSC was attacked, with a loss of 48,415 USDT, and the price of LW token plummeted by 69%. The attacker has transferred about 150 BNB to Tornado Cash."

"#MetaTrustAlert Our #MetaScout detected that $LW on BSC was attacked by the flashloan with a loss of ~48.4k $USD." "$LW is exploited (w/ 48,415 $USDT) $LW has dropped -69%"

"We identified an exploit on $LW token, on the PancakeSwap pair of $LW - $BUSD that resulted in an accumulated theft of ~$48k. The exploiting contract, utilizing a flashswap on the contract to conduct the attack, deployed around *10 hours* before the attack happened"

"The LW token on #BSC was attacked, with a loss of 48,415 USDT, and the price of $LW token plummeted by 69%. The attackers have transferred about 150 #BNB to Tornado Cash."

"It is a price manipulation attack.

In this attack, the marketAddr account has 173,272 $USDT, which is used to buy back the $LW and increase the price of the $LW.

The attacker first swapped $USDT for the $LW

The attacker triggered the buy-backs of $LW and increased the price of $LW

Finally, the attacker swapped $LW for the $USDT"

"The $LW exploiter has already transferred ~150 $BNB into Tornado Cash."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

• Known history of when and how the service was started.
• What problems does the company or service claim to solve?
• What marketing materials were used by the firm or business?
• Audits performed, and excerpts that may have been included.
• Business registration documents shown (fake or legitimate).
• How were people recruited to participate?
• Public warnings and announcements prior to the event.

Don't Include:

• Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
• Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - LW Token Price Manipulation Attack

Date	Event	Description
May 11th, 2023 3:00:00 AM MDT	Added To DexKoala	The trading pair is added to DexKoala. There are reportedly 6 token holders at this time.
May 11th, 2023 10:29:00 AM MDT	LW Smart Contract Exploited	The exploit transaction occurs on the Binance Smart Chain. TBD need to explain it.
May 11th, 2023 8:10:15 PM MDT	First Exploit Transaction	The first exploit transaction occurs. TBD need to explain it.
May 11th, 2023 8:11:39 PM MDT	Second Exploit Transaction	The second exploit transaction occurs. TBD need to explain it.
May 11th, 2023 8:29:54 PM MDT	Funds Moving To TornadoCash	The first transaction starts moving the funds through TornadoCash.
May 11th, 2023 8:32:42 PM MDT	Funds Moving To TornadoCash	The final transaction moving the funds through TornadoCash.
May 11th, 2023 8:35:00 PM MDT	PeckShield Alert	PeckShield alerts and posts an announcement on Twitter about the exploit.
May 11th, 2023 8:42:00 PM MDT	TornadoCash Transfer Reported	PeckShield reports that the exploiter has already cashed their 150 BNB token through TornadoCash.
May 12th, 2023 12:15:00 AM MDT	MetaTrust Alert Tweet	MetaTrust posts an alert and analysis on Twitter about the exploit including a detailed technical analysis.
May 12th, 2023 9:52:00 AM MDT	Hexagate Analysis Tweet	Hexagate reported on the situation on Twitter, and notes that the smart contract used a flashswap and was deployed 10 hours before the attack happened.
May 12th, 2023 5:42:00 PM MDT	DeDotFiSecurity Analysis Tweet	DeDotFiSecurity posts an analysis of the exploit on Twitter, noting that roughly $48k was taken and the LW token experienced a drop in price of roughly 80%.
May 13th, 2023 10:59:00 AM MDT	TronWeekly Report	TronWeekly reports with a new tweet about the LW token attack.

Technical Details

This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

Exploiter BSC Wallet:

Transactions: (DeDotFiSecurity) (MetaTrust/Hexagate)

Transaction Stealing Funds $48,415 USDT (DeDotFiSecurity):

https://bscscan.com/tx/0xd0dd0c8aa71860ff2d7fe6f9763892d936e31fb8c1aef01ec5ffbc947dbedbeb

A couple of transactions (Hexagate,MetaTrust)

https://bscscan.com/tx/0xb846f3aeb9b3027fe138b23bbf41901c155bd6d4b24f08d6b83bd37a975e4e4a

https://bscscan.com/tx/0x96b34dc3a98cd4055a984132d7f3f4cc5a16b2525113b8ef83c55ac0ba2b3713

Exploiting Contract Address

https://bscscan.com/address/0xa4fbc2c95ac4240277313bf3f810c54309dfcd6c

https://bscscan.com/address/0xa4fbc2c95ac4240277313bf3f810c54309dfcd6c

[1]Exploit Transaction 2 - As Reported By Hexagate - BscScan

Transfer To TornadoCash - BSCScan

https://bscscan.com/address/0x4404de29913e0fd055190e680771a016777973e5

MetaTrust Technical Analysis

MetaTrust published a technical analysis on Twitter.

#MetaTrustAlert Our #MetaScout detected that $LW on BSC was attacked by the flashloan with a loss of ~48.4k $USD.

The price of $LW has dropped ~21.5%

It is a price manipulation attack.

In this attack, the marketAddr account has 173,272 $USDT, which is used to buy back the $LW and increase the price of the $LW.

The attacker first swapped $USDT for the $LW

The attacker triggered the buy-backs of $LW and increased the price of $LW

Finally, the attacker swapped $LW for the $USDT

Hexagate Technical Analysis

Hexagate published a brief technical analysis of the exploit.

We identified an exploit on $LW token, on the PancakeSwap pair of $LW - $BUSD that resulted in an accumulated theft of ~$48k. The exploiting contract, utilizing a flashswap on the contract to conduct the attack, deployed around *10 hours* before the attack happened

DeDotFiSecurity Technical Analysis

The DeDotFiSecurity team posted a technical analysis on Twitter on the day after the exploit.

$LW Token Exploit

~ $48k has been stolen due to the exploit on the $LW token, specifically on the PancakeSwap pair of $LW - $BUSD.

As a result of the exploit, the $LW token has experienced a significant drop of approximately -80%.

Transaction Link Stolen Amount: ~$48,415 USDT

The attacker deployed the exploiting contract around 10 hours before the attack occurred

The $LW exploiter has already transferred around 150 $BNB into @TornadoCash

Total Amount Lost

The total amount lost has been estimated at $48,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.