Security Firms Warn of Potential DeFi Exit Scam After $2.5M in 'Locked' Cryptos Moved

Two blockchain security firms have warned that the creators of a DeFi contract on the EOS network may have fled with users' funds.

AccessTimeIconSep 9, 2020 at 9:48 a.m. UTC
Updated Sep 14, 2021 at 9:53 a.m. UTC

Two blockchain security firms have warned that the creators of a decentralized finance (DeFi) contract on the EOS network may have fled in what appears to be an exit scam.

China-based auditing firm SlowMist said on Wednesday that a liquidity mining DeFi project on EOS called Emerald Mine (EMD) has moved user tokens that were supposedly locked in smart contract to an account labeled "sji111111111" since early Wednesday China time.

SlowMist warned users not to send additional funds to the smart contract for liquidity mining because some of the funds have already been transferred to exchange platforms.

PeckShield, another China-based blockchain security startup, published a similar notice on WeChat soon after, saying the funds on the move include users' locked-up assets, which include some 787,000 USDT, 490,000 EOS and others – worth nearly $2.5 million in total.

After the publication of this article, crypto exchange Changenow reached out to CoinDesk and said it managed to stop the sale of 135,020 EOS from the alleged scam and has stored the funds in its cold storage.

“Anyone who has suffered from the exit scam can turn to their local police, and if they contact us our compliance team will check the legitimacy of the request and then a return procedure will be executed,” the firm said.

Both SlowMist and PeckShield said users participating in DeFi liquidity mining should be aware of EOS contracts that have no multi-signature (multisig) feature, meaning whoever is behind the contract can move assets even if they are supposed to be locked up.

The EMD project's website has since become inaccessible.

PeckShield said USDT tokens that are part of the apparently absconded funds are being sold via decentralized exchanges like DeFibox.

It's not yet clear who's behind the project, but the event has sparked users to send small transactions to the sji111111111 account on Wednesday with angry messages demanding the alleged scammer return their funds.

So-called liquidity mining has drawn wide interest over recent weeks, with some of the Ethereum-based tokens in such projects seeing heavy speculation on both decentralized and centralized exchanges.

Screenshot of messages users sent to the project
Screenshot of messages users sent to the project

UPDATE (Sept. 9, 2020, 14:35 UTC): This article has been updated with comments from Changenow.


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.

Read more about