CertiK: After researching 40 runaway projects, these 7 points are worth warning.

Original Title: "CertiK: After Researching 40 Runaway Projects, These 7 Points Are Worth Warning"

Original Source: CertiK

Exit scam, also known as "project running away" in our industry. It is commonly referred to as "rug pull" and is a type of criminal fraud in the Web 3.0 field.

The common practice of Rug Pull is to create a seemingly legitimate DeFi project, and then create false trading volume and user numbers to enhance the project's reputation and attract more investors. After reaching a certain scale, the fraudster or team will suddenly withdraw a large amount of funds from the project and close it, ultimately causing the tokens held by investors to lose value.

Although there is a large amount of statistical information presenting the prevalence and impact of exiting scams over the years, there is little research on their characteristics and data on the perpetrators. Such research can improve anti-money laundering (AML) efforts, promote consumer protection, and maintain the integrity of the entire Web 3.0 market. 

By studying the entire cycle of exit scams from start to finish, we can better analyze the structure of these scams and understand the potential risk factors and commonalities that lead to their existence. By identifying these signals and indicators, we can adopt wiser security methods and strategies to more effectively protect the Web 3.0 world.

CertiK conducted research on 40 Rug Pull projects to better understand the commonalities and differences that led to their eventual removal of liquidity. By identifying project characteristics and conducting qualitative and quantitative analysis, we obtained the following results.

Concept Definition

In this study, we define "Rug Pull" as a project with a criminal plan and purpose that actively deceives investors through marketing and hype, and then has its funds taken away by one or more team members.

In this study, we only conducted research on Hard Rug Pull, which refers to a project team suddenly withdrawing funds from the project after receiving a large amount of investment from its community. Soft Rug Pull is a more subtle way for founders to achieve fraudulent goals. Founders do not sell off all the tokens they hold at once, but slowly sell them while maintaining the illusion that they are still investing in and supporting the project.

Methodology

This article randomly selected 40 samples of Hard Rug Pulls that occurred between 2020 and 2023 for study. The collected samples have a large variance in the total amount stolen, ranging from approximately $3,000 to $12 million.

Crime Analysis

Hard Rug Pull is inevitably accompanied by internal problems within the project team. It is not difficult to understand that if the team is responsible and there are no signs of running away, the event will be considered a hacking incident.

In our research on Rug Pull, we have classified exit scams into four categories: project team exit scams, malicious developer sabotage, project owner fraud, and unknown individual or team fraud. The definition and conclusions of each category will be further explained below:

This study emphasizes the importance of conducting background checks when evaluating new projects and their associated risks. As most Rug Pulls are caused by project teams, it is crucial to consider the team's motives and their background records before investing in a project.

Before the final rug pull scam occurred, the average time for Rug Pull activities was 93 days. If developers intentionally remain anonymous or completely unknown in newly deployed projects, and do not make commitments to transparency or decentralization, we need to be cautious.

In order to combat such scams, reduce risks, and help users make informed decisions, CertiK has developed the KYC Badge Program. The program focuses on verifying and reviewing the teams behind projects, and only awards badges to teams that agree to undergo thorough background checks. CertiK KYC helps distinguish verified, transparent, and responsible teams from other projects.

Case Study: Team Scam

CertiK investigators interviewed the project leader of an anonymous project (referred to as "the project" hereafter). During the conversation with the project leader, we discovered several noteworthy points, including the applicant's hesitation and difficulty in recalling the names of other team members. They also claimed to have limited knowledge of the project and its structure.

In addition, the project leader and team members have no experience in Web 3.0 and cannot provide any explanation for the project's purpose. They claim that the project aims to donate to a specific charity, but they have not developed any plans to support the charity and cannot name any specific charitable organizations. The charity statement seems to be just a marketing strategy to attract investors, or even a bait.

Three months after the initial conversation, the project ran away. Our on-chain analysis shows that the project team is fully responsible for the Rug Pull incident.

Project: Malicious Developer Scam

Unlike the participants of the overall project team, the person responsible for the scam in the project is an anonymous developer who stole all of the project funds. The conversation between CertiK and the project leader took place just a few days before the Rug Pull.

Except for the developers, all other members involved in the project have public connections to it. As the project manager became more familiar with the team, the names and identities of all team members were disclosed, but even the project manager himself had no knowledge of the developers.

The developer is completely anonymous and uses a fake name, and has never participated in any voice or video communication between teams, nor has he revealed any personal information. Because the developer claims to have extensive experience in Web3.0 and has spoken about previous projects, the person in charge believed the anonymous developer's words: most developers in project teams are anonymous, which is not a risk or problem.

CertiK investigators noted that there were no other risk factors for the project beyond the anonymous developer. However, the risk of the anonymous developer was crucial because they had many permissions for the smart contract, which greatly increased the risk of Rug Pull. A few days after the conversation with the founder, the anonymous developer Rug Pulled the project.

Red light warning! Do not touch!

Red light signal 1: Website registration

Among the 40 projects analyzed in this article, 37.5% (15) of them use Namecheap as their domain registrar. Namecheap is a domain privacy provider that allows domain registration without any personal information. These services may use privacy service information and randomly generated email addresses instead of real contact information related to the domain. Its practice of not requiring personal or identifying information to register a website may be attractive to future Rug Pull scammers.

It is worth noting that 4 out of 40 projects do not have clear website domain names or data related to website domain names. Projects registered through Namecheap and unknown projects together account for 45% of the entire sample.

In addition, all 4 Rug Pull incidents carried out by malicious developers did not use Namecheap, which further indicates that projects that were not malicious at the outset are unlikely to intentionally use privacy domains to try to conceal personal information.

Red Light Signal 2: Project Lifespan

When researching Rug Pull, another important variable to consider is the project's lifespan. In the context of this study, the project lifespan is defined as the number of days from the project start date to the Rug Pull (i.e. exit scam) date. The project start date is calculated using the social media creation date, on-chain wallet creation date, and website date (usually taking the average of available dates).

Through our research on these 40 projects, we have identified the launch dates of 36 of them. By collecting the start dates and Rug Pull times, we have calculated the average lifespan and median of these projects: the average lifespan of these projects is 92 days, and the median is 57 days.

Although the typical lifespan of most Rug Pull projects is only three months or even shorter, it should be noted that there are also outliers in the data. For example, there are four projects in the sample with a lifespan of about 300 days or more. While the data shows the trends and characteristics of Rug Pull, this data cannot be generalized.

Red Signal Three: Fraudulent Strategies

CertiK conducted a content analysis of the overall sample to identify common fraudulent marketing strategies that attract potential investors. Due to the average lifespan of Rug Pull projects being only 93 days, malicious projects will be more focused on "making their presence felt" after the project is established in order to obtain more funds before running away. CertiK found that projects often use multiple strategies in their project introductions.

Red Signal Four: Roadmap and Whitepaper

For the 31 projects that can log in to websites and collect project information data, CertiK found that most of them did not provide continuous Roadmap or white papers. Even in cases where there are Roadmaps or white papers, the quality may be poor (many grammatical errors, missing information), and fraudulent information is often used in these materials. Projects that are relatively mature with Roadmaps and white papers will focus on marketing materials that promote false legitimacy.

Among these 31 projects, only 7 have a Roadmap, and 4 have released a white paper. For those projects without a roadmap or white paper, most of them use a common statement: the roadmap or white paper will be released soon.

Red Signal 5: Suspicious Team Introduction

Another important variable in this study is the team introduction in the project, and whether the team is anonymous, semi-anonymous, or publicly identified. In the sample, we collected team introductions from 31 projects, but none of the teams were completely publicly identified.

Most projects are completely anonymous, accounting for 24 out of 31 projects (77.4%). The remaining 7 projects are considered semi-anonymous (22.6% of the sample) - there is no identifiable information other than the listed project team members. Photos and names used by other teams were identified as false materials after confirmation by our investigators.

In addition, we found that some Rug Pull incidents used artificially generated "team member" avatars, and their names and information data were also false.

利用犯罪特征分析、检测和预防

translates to

Utilizing Criminal Feature Analysis, Detection, and Prevention

CertiK identified and analyzed 7 important variables related to the characteristics and trends of Rug Pull projects. These variables share a lot in common, indicating that the modus operandi of Rug Pull is generally the same.

However, although there are many commonalities, Rug Pull projects are constantly updating their technology and strategies to adapt to the changing market environment and keep up with the times.

Here is a summary of the research results: The lifespan of most Rug Pull projects is short, and most of them are carried out by the project team as a whole. During the establishment process, most of them use domain name registrars that do not retain the personal information of registered users. Of course, some exceptional projects were also found in the research, so the above characteristics can be used as a reference, but cannot be used as an absolute standard for evaluation.

Scammers in the project will try to use as many strategies as possible to attract potential investors, so it is necessary to conduct due diligence before investing and refer to authoritative information provided by experts with Web 3.0 security expertise.

Using third-party security auditors for background checks can improve the efficiency and effectiveness of security measures. CertiK's KYC team is composed of investigative experts. In addition to thorough background checks and risk assessments, CertiK also has a unique Web 3.0 fraudster database and can help detect fraudulent behavior through qualitative and quantitative risk indicators.

Rug Pull is a persistent threat to the Web 3.0 ecosystem. Although we have identified some high-risk factors from 40 samples and our KYC will help high-quality projects stand out, these threats cannot be completely eliminated.

By raising security and transparency standards, CertiK hopes to provide credible proof for projects that truly have ideals, while also helping users make wise and correct decisions, avoiding more people becoming victims of Rug Pull.

Original article link

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia