RCA: Accidental Deployment of "Hey" Tokens on Clanker

01 Nov, 2025

On October 31, 2025, two unintended "Hey" tokens were deployed on Clanker.world under the wallet yoginth.eth. These deployments caused public confusion and trading activity, as they appeared linked to the official Hey.xyz project.

After investigation, all test tokens were burned, and 6.3 ETH in liquidity provider fees were fully refunded to affected users.

Background

At my home office, I share a development computer with a co-worker who also contributes to Hey.xyz. While exploring the Clanker platform for testing, he accidentally connected to my yoginth.eth wallet instead of his test wallet and deployed two "Hey" tokens.

Since the deployments appeared publicly under my ENS name, users assumed they were official tokens from me or the Hey.xyz project. This led to trading and liquidity provision on the platform.

Impact

  • Two unauthorized tokens named "Hey" were deployed.
  • Test tokens were minted and distributed, creating additional confusion.
  • Users began adding liquidity and trading under the assumption of official backing.
  • Temporary reputational risk due to association with my ENS identity.

Immediate Actions Taken

Upon discovering the issue, I acted immediately:

  • Burned all unintended tokens by transferring them to the 0x0000 address.
  • Transferred all tokens to a backup wallet to prevent any potential asset loss.
  • Collected all contract fees to prevent misuse.
  • Conducted a full-day investigation into wallet activity and transaction history.
  • Confirmed that the deployments were accidental and not malicious.

Root Cause

The issue stemmed from human error during testing:

  • Shared workstation led to a wallet mix-up.
  • Clanker interface allowed quick deployment without ownership verification.
  • Lack of strict separation between production and testing environments.

Resolution

After verifying all details, a total of 6.3 ETH was refunded to all liquidity providers.

Refund transactions (Mainnet Chain)

All affected users have been fully reimbursed.

Reward Claim Transactions (Base Chain)

Below are all claim transactions collected on the Base chain.

The ETH values shown are actual claim amounts, and any difference was covered from Hey Pro’s revenue.

Preventive Measures

To prevent such incidents in the future:

  • Dedicated Wallets: Each contributor now uses separate wallets for testing and production.
  • Access Controls: Shared devices will no longer hold wallet access.
  • Deployment Verification: Every token deployment will pass through an internal verification checklist.
  • Awareness: All contributors have been reminded about ENS visibility and testing safeguards.

Closing Note

This incident was an unintentional mistake in a shared environment, not a malicious action. All affected parties have been fully refunded, and additional security measures are now in place.

Transparency and accountability remain top priorities, and this post serves as both documentation and a continued commitment to maintaining trust.