A decentralized exchange (DEX) built on Arbitrum (ARB) burned its investors and made off with $3 million worth of crypto, according to the blockchain security firm PeckShield.

Swaprum (SAPR) bills itself as “a next-generation decentralized exchange with a range of trading tools and potential earnings of up to 100 APY.”

-->

PeckShield notes, however, that the DEX appears to have executed a rug pull scam this week, laundering 1,620 Ethereum (ETH) to the crypto mixer Tornado Cash and shutting down its social media accounts.

ImageSource: PeckShield/Twitter

Meanwhile, blockchain security firm Beosin reveals that the deployer of the Swaprum smart contract added a backdoor function to loot liquidity pool tokens staked by users. According to Beosin, the deployer used the “add ( )” backdoor function to siphon crypto from the liquidity pool for their profit.

ImageSource: Beosin/Twitter

Rug pulls generally refer to events when developers promote a new cryptocurrency project to investors and sell affiliated tokens, then withdraw the funds raised during the token sales and disappear.

The total value locked (TVL) on Swaprum fell from $3.148 million on Thursday to just over $9,000 on Friday, according to the crypto tracker DeFi Llama.

The TVL of a blockchain represents the total capital held within its smart contracts. TVL is calculated by multiplying the amount of collateral locked into the network by the current value of the assets.