Honeypot Queen

Modus operandi

Deploys high-APY "farms" whose contracts contain a honeypot: deposits succeed, but a hidden modifier blocks withdrawals for everyone except whitelisted owner addresses. Migrates the farm under a new name every few weeks.

Evidence collected

• 1Withdraw function gated by an owner-only allowlist modifier.
• 2Same bytecode redeployed across 9 "different" farms.
• 3Front-end hosted on bulletproof hosting, rotated frequently.
• 4$2.1M recovered from an exchange deposit address.

Crime timeline

1. 2022First farm

   900% APY. Deposits flow in fast.

2. 2023Serial redeploys−$46,000,000

   New name, same trap, every 3–6 weeks.

3. 2024-04Exchange slip-up+$2,100,000 recovered

   Cash-out via a KYC exchange; $2.1M frozen.

4. 2024-05Geolocated

   Login metadata narrows region to Bangkok.