According to the Beosin EagleEye security risk monitoring, early warning and blocking platform monitoring of Beosin, Rug Pull occurred in the Hope Finance project. The Beosin security team analyzed and found that the attacker (0xdfcb) used the multi-signature wallet (0x1fc2) to execute a transaction that modified the router address of the TradingHelper contract, so that when the GenesisRewardPool contract uses the openTrade function for lending, it does not call the SwapWETH function of the TradingHelper contract for swap. The Swap operation will be performed through the original SushiSwap router, but the transferred tokens will be directly sent to the attacker (0x957d) to make a profit. The attackers withdrew a total of approximately $1.8 million in two attempts. Beosin Trace traced and found that the attacker has transferred funds into the cross-chain contract to the Ethereum chain, and finally the funds have entered Tornado Cash. Beosin reminds users not to perform mortgage operations in the 0x1FC2..E56c contract, and recommends canceling all authorizations related to the project party.