Meerkat Finance hack — March 2021

Meerkat Finance was a yield-vault protocol on BNB Smart Chain that had launched roughly a day earlier. On 4 March 2021 its vaults were emptied of 73,653 BNB and about 13.96 million BUSD, worth roughly $31 million at the time.

The drain was executed by re-pointing the project's upgradeable vault proxies at a new implementation contract and then calling it to move the deposits out. CoinDesk reported that on-chain data pointed to the original Meerkat deployer's account being used to alter the contract, and noted that unless the project's private key had been compromised this suggested the drain was carried out by Meerkat itself. A later technical write-up by Vidma Security describes the deployer calling upgradeTo() twice and taking ownership of two vaults through a permissionless initialization process, while also noting a post-mortem that pointed to a compromised private key. Meerkat's website and Twitter account went offline the same day.

The project told users on Telegram that its vaults had been compromised by an outside attacker. Two days later an account identifying itself as the developer 'Jamboo' said the team had invited a third party to attack the vulnerability, described the episode as a test of user greed, and promised a full report and a refund. Jamboo authenticated the claim by sending a transaction from the Meerkat deployer contract. No report was published.

The incident is commonly described as a rug pull rather than an external hack, but that characterisation rests on on-chain inference and the developer's own ambiguous statement. No charges, conviction or formal government attribution has been reported. Because BNB Smart Chain's main on- and off-ramps run through Binance, the exchange said its joint security team was monitoring the situation and would freeze any stolen funds that reached it. Whether users were ultimately made whole is unsettled: several secondary accounts state that Binance-assisted recovery returned roughly $30 million, but this could not be confirmed from a primary or tier-1 source and none of the sources cited here addresses the outcome.