Security Firms Warn of Potential DeFi Exit Scam After $2.5M in 'Locked' Cryptos Moved

Two blockchain security firms have warned that the creators of a DeFi contract on the EOS network may have fled with users' funds.

AccessTimeIconSep 9, 2020 at 9:48 a.m. UTC
Updated Sep 14, 2021 at 9:53 a.m. UTC
Consensus 2023 Logo
Join the most important conversation in crypto and Web3 taking place in Austin, Texas, April 26-28.
Consensus 2023 Logo
Join the most important conversation in crypto and Web3 taking place in Austin, Texas, April 26-28.

Two blockchain security firms have warned that the creators of a decentralized finance (DeFi) contract on the EOS network may have fled in what appears to be an exit scam.

China-based auditing firm SlowMist said on Wednesday that a liquidity mining DeFi project on EOS called Emerald Mine (EMD) has moved user tokens that were supposedly locked in smart contract to an account labeled "sji111111111" since early Wednesday China time.

SlowMist warned users not to send additional funds to the smart contract for liquidity mining because some of the funds have already been transferred to exchange platforms.

PeckShield, another China-based blockchain security startup, published a similar notice on WeChat soon after, saying the funds on the move include users' locked-up assets, which include some 787,000 USDT, 490,000 EOS and others – worth nearly $2.5 million in total.

After the publication of this article, crypto exchange Changenow reached out to CoinDesk and said it managed to stop the sale of 135,020 EOS from the alleged scam and has stored the funds in its cold storage.

“Anyone who has suffered from the exit scam can turn to their local police, and if they contact us our compliance team will check the legitimacy of the request and then a return procedure will be executed,” the firm said.

Both SlowMist and PeckShield said users participating in DeFi liquidity mining should be aware of EOS contracts that have no multi-signature (multisig) feature, meaning whoever is behind the contract can move assets even if they are supposed to be locked up.

The EMD project's website has since become inaccessible.

PeckShield said USDT tokens that are part of the apparently absconded funds are being sold via decentralized exchanges like DeFibox.

It's not yet clear who's behind the project, but the event has sparked users to send small transactions to the sji111111111 account on Wednesday with angry messages demanding the alleged scammer return their funds.

So-called liquidity mining has drawn wide interest over recent weeks, with some of the Ethereum-based tokens in such projects seeing heavy speculation on both decentralized and centralized exchanges.

CoinDesk - Unknown

Screenshot of messages users sent to the project

UPDATE (Sept. 9, 2020, 14:35 UTC): This article has been updated with comments from Changenow.


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

The leader in news and information on cryptocurrency, digital assets and the future of money, CoinDesk is a media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. CoinDesk is an independent operating subsidiary of Digital Currency Group, which invests in cryptocurrencies and blockchain startups. As part of their compensation, certain CoinDesk employees, including editorial employees, may receive exposure to DCG equity in the form of stock appreciation rights, which vest over a multi-year period. CoinDesk journalists are not allowed to purchase stock outright in DCG.

Learn more about Consensus 2023, CoinDesk’s longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to to register and buy your pass now.

Read more about