Min Token Multi-Level Marketing Referral Logic Bug Exploited

Notice: This page is a freshly imported case study from an original repository. While the original content had a similar format, some sections may not have been fully completed. Please help fill in any empty sections or any missing information you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Min Token

Min Token appears to use a multi-level marketing (MLM) mechanism, where users earn rewards when others they refer purchase the token—initially 50% of the purchase amount, with further rewards for additional referral levels. This design is exploitable and was in fact abused via a flash loan attack involving an 8-level intro chain, resulting in a profit of over $21,000 for the attacker. The token lacks transparency, with no known operator, website, or social media presence, and was previously linked to an airdrop with LibreGold/LibreCoin. Despite the exploit, there’s no sign the issue was addressed, and it's unclear if the project is still active.

About Min Token

Min Token appears to feature "an MLM mechanism."

"When A "introduces" B (A->B) to buy $MIN, A can get 50% amount of what B buys."

About Libre Coin/Libre Chain/Libre Gold

"Libre dual-currency linkage will definitely create miracles. The number of dividend nodes is about to be sold out. Grab it and earn it."

"Libre dual currency linkage airdrop activity has begun! $ Libre+min eco cooperation token 100 times set sail. Join us and challenge the miracle!"

The Reality

"And this can be an intro-chain where A->B->C, when C buys x, A and B both get 50% x. (maybe the dev wants it to be B gets 50% while A gets 25%? but still exploitable)"

It is unclear who owns or operates the Min Token network.

They appear to have had an airdrop partnership with LibreGold/LibreCoin, however there doesn't appear to be a website or social media associated with the project.

What Happened

"Min Token (MIN) is suspected to have been attacked on BSC, resulting in a loss of approximately $21,400."

Key Event Timeline - Min Token Multi-Level Marketing Referral Logic Bug Exploited

Date	Event	Description
December 16th, 2024 11:17:56 PM MST	Min Token Contract Created	The Min Token smart contract is first created.
January 15th, 2025 3:23:00 AM MST	LibreChain Airdrop Tweet	There appears to be a partnership between the Min Token and the LibreChain/LibreGold/LibreCoin team, where Min Tokens were airdropped to participants who provided their wallet address. It appears that 10,000 Min Token were airdropped per address.
March 27th, 2025 7:31:45 PM MDT	Exploit Transaction Draining	One of the exploit transactions which are draining the Min Token smart contract. This appears to get the exploiter 21,421.446310962716549294 BUSD.
March 27th, 2025 8:34:00 PM MDT	SlowMist Posting Tweet	SlowMist reports they have "detected potential suspicious activity related to $MIN."

Technical Details

SlowMist: "Exploited the burnPairToken function"

"Funny token design with an MLM mechanism. When A "introduces" B (A->B) to buy $MIN, A can get 50% amount of what B buys.

And this can be an intro-chain where A->B->C, when C buys x, A and B both get 50% x. (maybe the dev wants it to be B gets 50% while A gets 25%? but still exploitable)

The attacker builds an intro chain of 8 and swapped BUSD for $MIN, got much more $MIN and swapped back to profit.

The hacker borrowed BUSD flashloan from 4 pools."

Total Amount Lost

"resulting in a loss of approximately $21,400."

From the blockchain, this may be 21,421.446310962716549294 BSC-USD.

The total amount lost has been estimated at $21,000 USD.

Immediate Reactions

The Min Token appears to have continued operating, and there is no indication that the exploit was even noticed.

Ultimate Outcome

The Min Token appears to have continued operating, and there is no indication that the exploit was even noticed.

Total Amount Recovered

The total amount recovered is unknown.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

It's unknown if Min Token is still actively being promoted. Very little information appears to be available about the token project.

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.