Harvest Keeper, marketed as an AI-based DeFi platform, executed a coordinated rug pull barely one month after launch. The team drained the contract through a privileged getAmount function and conducted ice phishing attacks to steal additional user funds.

According to news, the Harvest_Keeper project maliciously transferred user funds, involving an amount of about 933,000 US dollars. Through the data on the chain, it was found that the attacker used the owner authority to transfer the USDT pledged by the user in the HarvestKeeper contract by calling the getAmount function, and then the attacker used the user's token authorization to the EOA account to transfer the user's funds through the EOA multiple times.