Boy X Highspeed Incident Analysis

BXH suffered a cross-chain rugpull in September 2022 when an attacker used a privileged emergency function (InCaseTokensGetStuck()) in staking contracts on BSC, Avalanche, and HECO to drain funds, bridge ~1,865 ETH to Ethereum (≈$2.43M), and launder proceeds via Tornado Cash; the contracts were unaudited and the project has issued a statement and set up a Telegram channel.