Avoid your next
big mistake

Arthur Hayes is the co-founder and former CEO of BitMEX, one of the world's largest cryptocurrency derivatives exchanges, who pleaded guilty in 2022 to a Bank Secrecy Act violation and received two years' probation and a $10 million fine, before being granted a full presidential pardon by Donald Trump in March 2025. He now operates as CIO of Maelstrom, his family office and investment fund, which manages a venture portfolio of over 30 crypto projects alongside a $250 million private equity vehicle targeting crypto infrastructure firms. In June 2026, on-chain investigator ZachXBT alleged that Hayes used his large public following as exit liquidity by promoting tokens — including HYPE, ZEC, NEAR, and WLD — and then exiting those positions within days; Hayes denied the characterization but the controversy attracted sustained industry scrutiny.

Detailed analysis of Monad\

MOTHER (ticker: MOTHER) is a Solana-based memecoin launched on May 28, 2024 by Australian rapper Iggy Azalea (legal name Amethyst Amelia Kelly). The token peaked at a market capitalization of approximately $136–200 million in mid-June 2024 before declining roughly 99.5% to approximately $1.3 million by May 2026. On May 5, 2026, plaintiff Kenneth Kolbrak filed a federal class action against Azalea in the U.S. District Court for the Southern District of New York, alleging she misled consumers about the token's real-world utility through promises regarding an online casino (MOTHERLAND), a telecommunications integration (Unreal Mobile), and a luxury marketplace (DreamVault) that allegedly were not delivered as represented; all claims in that suit are allegations and remain unadjudicated.

PlusToken was a cryptocurrency Ponzi scheme that defrauded an estimated 3 million investors of between $2 billion and $3 billion in digital assets.

Flooring Protocol (fp.io) is an Ethereum-based NFT fractionalization platform that converts non-fungible tokens into fungible micro-tokens (μTokens and fpTokens) pegged to collection floor prices. The protocol launched in October 2023, was exploited twice — once in December 2023 (~$1.6M stolen) and again in June 2026 (~$570K in NFTs rescued by a Yuga Labs white-hat team — and entered formal sunset mode in September 2025 after liquidity and organizational failures. At the time of the June 2026 incident, the protocol was effectively defunct with a TVL of approximately $9.51.

Comprehensive guide to offshore crypto exchanges lacking proper regulatory oversight

Bottled water contains significantly more micro- and nanoplastics than previously thought. Each time you screw a plastic bottle cap on and off, it generates 553 microplastic par…

PiggyBank Protocol is a Solana-based DeFi yield platform offering delta-neutral funding-rate arbitrage vaults across USDC, JitoSOL, and tokenized stock (xStocks) assets. On or around June 6, 2026 the protocol disclosed that a mid-cap basis trade involving locked LAB tokens had failed, producing NAV declines of approximately 15%, 12%, and 9% across its three active vaults. On-chain investigator ZachXBT publicly alleged that the protocol had exposed depositor funds to a token he characterized as a scam with over 95% insider-controlled supply, raising serious risk-management and disclosure concerns that remain unresolved as of the investigation date.

Deribit is a crypto options and futures exchange founded in 2016 in the Netherlands by John and Marius Jansen, historically operated through a Panama-registered entity and now licensed under Dubai's VARA framework as Deribit FZE. The exchange suffered a $28 million hot wallet compromise on November 1, 2022, covering the loss entirely from its own balance sheet. Coinbase completed the acquisition of Deribit for approximately $2.9 billion on August 14, 2025, making it a subsidiary of a publicly traded, NASDAQ-listed U.S. company.

Unicoin, Inc. is a New York City-based cryptocurrency company that launched the Unicoin token in February 2022, promoting it as an asset-backed, dividend-paying digital asset tied to the Unicorn Hunters investment television series. On May 20, 2025, the U.S. Securities and Exchange Commission filed a civil fraud complaint against the company and three senior executives in the Southern District of New York, alleging they defrauded more than 5,000 investors through false claims that the token was backed by billions of dollars of real estate and pre-IPO equity interests when those assets were worth a fraction of the stated values. The case remains pending as of mid-2026, with Unicoin having filed a motion to dismiss in August 2025.

Tenderize V2 is a DeFi liquid staking protocol launched on January 29, 2024, enabling users to mint validator-specific liquid staked tokens (tTokens) for assets including MATIC, LPT, and GRT across Ethereum, Arbitrum, and Sei Network. The protocol suffered a protocol logic exploit on April 7, 2025, resulting in a loss of approximately $10,850 via a proxy upgrade skim technique on Ethereum; the incident was relatively small in dollar terms but raised concerns about smart contract integrity. ZachXBT has flagged this entity, and while the protocol holds multiple security audits including a Hacken audit scoring 9.8/10 and a Halborn audit, its current TVL of approximately $495,000 reflects limited adoption relative to the broader liquid staking market.

Alephium is a Swiss-founded Proof-of-Work Layer-1 blockchain launched November 8, 2021, featuring sharded smart contracts and the Proof-of-Less-Work consensus mechanism. On May 29-30, 2026, its TokenBridge was exploited for approximately $815,000 in approximately seven minutes via an off-chain backend vulnerability that allowed forged guardian messages to authorize unauthorized transfers and the minting of 13.76 million unbacked wrapped ALPH tokens. The team took the bridge offline, burned the unauthorized tokens, and committed to full user compensation.

On February 4, 2021, an attacker exploited Yearn Finance's v1 yDAI vault using a multi-protocol flash loan to manipulate exchange rates in Curve Finance's 3pool, causing approximately $11 million in vault losses while the attacker personally profited roughly $2.8 million. Yearn Finance's security team contained the exploit within eleven minutes, preserving $24 million of the vault's $35 million under management. Yearn subsequently reimbursed affected depositors by minting 9.7 million DAI against YFI collateral in a MakerDAO vault, with the intent to repay the debt from ongoing protocol revenue.

XRP is a cryptocurrency native to the XRP Ledger (XRPL), a public blockchain co-designed in 2011–2012 by Jed McCaleb, David Schwartz, and Arthur Britto. Ripple Labs, Inc. is the San Francisco-based company that co-developed the ledger and has historically used XRP sales to finance operations, accumulating approximately 80 billion of the fixed 100 billion token supply at launch. A landmark U.S. Securities and Exchange Commission lawsuit filed in December 2020 — alleging over $1.3 billion in unregistered securities offerings — concluded in August 2025 when both parties dropped their appeals, cementing a $125 million civil penalty and a permanent injunction against further unregistered institutional XRP sales in the U.S.

Superteam is a community-run talent network and grant accelerator operating as the contributor layer of the Solana ecosystem, founded by Tanmay Bhat and Akshay BD and active across 23+ global chapters. The organization has been flagged for investigation by ZachXBT, though no published, verifiable ZachXBT post or report specifically naming Superteam as a fraudulent entity was located during this investigation; the exact nature and basis of that flag remains unconfirmed. Separately, Superteam Earn — the organization's public freelance bounty and job platform — operates within a segment of the Solana ecosystem that regulators, Google Cloud threat intelligence, and on-chain investigators have identified as systematically targeted by DPRK-linked IT workers using false identities.

Fantom is a layer-1 blockchain founded in 2018 by Dr. Ahn Byung-Ik and technically led by Andre Cronje, operating the Opera mainnet using a DAG-based Lachesis consensus mechanism. In 2024 the project rebranded to Sonic Labs and launched a new high-throughput chain (Sonic) with a native S token replacing FTM at a 1:1 ratio. The project has experienced significant controversies including a $122 million loss from the Multichain bridge hack in 2023, a founder-level plagiarism finding in South Korean courts, SEC scrutiny of key leadership, allegations of a stablecoin liquidation scheme, and a 70%+ token price collapse in 2025.

Scallop Lend is a DeFi lending and borrowing protocol deployed on the Sui blockchain, and the first DeFi project to receive an official grant from the Sui Foundation. On April 26, 2026, the protocol suffered a flash-loan exploit that drained approximately 150,000 SUI (roughly $142,000) from a deprecated rewards contract that had remained callable on-chain for approximately 17 months despite no longer being in active use. The protocol covered 100% of user losses from treasury reserves and resumed operations within two hours, though the incident raised questions about legacy contract hygiene and the completeness of prior audits by OtterSec, MoveBit, and Zellic.

Gondi V3 is a decentralized, non-custodial NFT lending and borrowing protocol on Ethereum developed by Florida Street, which launched in July 2023 and raised a $5.35 million seed round from Hack.vc, Dragonfly Capital, and Pantera Capital. On March 9, 2026, the protocol suffered a smart contract exploit in its newly deployed Purchase Bundler component, resulting in the theft of approximately 78 NFTs valued at roughly $230,000 from users who had granted approvals to the vulnerable contract. The team disabled the affected feature, pledged full restitution using protocol fees, and engaged security firm Blockaid for a post-incident review; platform operations for other functions resumed the following day.

Polygon (formerly MATIC) is a Layer-2/sidechain scaling solution for Ethereum that completed its MATIC-to-POL token migration in September 2024. The SEC named MATIC as an alleged unregistered security in the June 2023 Binance lawsuit. Two major vulnerabilities were caught by Immunefi bounty hunters ($850M and $24B at risk respectively). Three of four co-founders departed within 24 months. Three rounds of layoffs occurred between 2023-2026. zkEVM was deprecated in June 2025 citing $1M annual operating loss.

Bitrefill is a Stockholm-based cryptocurrency e-commerce platform founded in 2014 that allows users to purchase digital gift cards, eSIMs, and mobile top-ups using Bitcoin and other cryptocurrencies across more than 100 countries. On March 1, 2026, Bitrefill suffered a significant cyberattack attributed to the North Korea-linked Lazarus Group (Bluenoroff subunit), in which attackers compromised an employee laptop, escalated access via legacy credentials, drained hot wallets, and exposed approximately 18,500 customer purchase records. Bitrefill stated it would cover all financial losses from operational capital and characterized this as the platform's first major security incident in over a decade of operation.

Fusion by IPOR is a modular on-chain vault infrastructure product developed by IPOR Labs AG (Zug, Switzerland), designed to automate DeFi yield strategies across multiple chains without requiring Solidity expertise. On January 6, 2026, a legacy Fusion Optimizer Vault on Arbitrum was exploited for $336,000 USDC via a combination of missing fuse validation in the instantWithdraw method and an EIP-7702 delegation vulnerability on an administrator account. The IPOR DAO committed to fully compensating all affected depositors from treasury reserves, and the incident was flagged by blockchain investigator ZachXBT.

Tinyman is an automated market maker (AMM) and decentralized exchange (DEX) built on the Algorand blockchain, launched on mainnet in October 2021. On January 1, 2022, attackers exploited a logic flaw in the protocol's pool-token burn function to drain approximately $3 million in wrapped Bitcoin and Ethereum assets across 43 pools. Tinyman subsequently patched the contracts, launched a compensation program covering all affected liquidity providers, and released a fully re-audited v2.0 protocol in early 2023.

edgeX is a decentralized perpetual futures exchange incubated by Amber Group and launched on mainnet in August 2024, with its native EDGE token generating at Token Generation Event on March 31, 2026. On June 2, 2026, the EDGE token crashed approximately 77% in under 60 seconds, erasing over $220 million in market value; edgeX attributed the event to an unidentified external party, while on-chain investigator ZachXBT alleged that a small group of insiders controlled the majority of the 1 billion token supply through a thin-float structure. A self-commissioned investigation found no team misconduct, a conclusion ZachXBT publicly derided as self-serving, and the project subsequently faced scrutiny for declining to disclose market-maker agreements or insider token allocations.

Epicentral Labs is an early-stage decentralized autonomous organization (DAO) and LLC incorporated in the US and Canada, building a decentralized options trading platform called OPX on the Solana blockchain. The project is led by a pseudonymous founder known as TheLazySol and governed by holders of its native LABS token, which carries a micro-cap market capitalization of approximately $177,000-$185,000 as of mid-2026. No fraud allegations, regulatory actions, or known exploits have been identified; primary risks relate to the project's pre-mainnet status, lack of a public smart contract audit, small community size, and significant token concentration concerns.

Adam Iza, also known as Ahmed Faiq and self-styled 'The Godfather,' is a 25-year-old California cryptocurrency entrepreneur who operated the trading platform Zort and pleaded guilty to multiple federal felonies across two jurisdictions. He admitted to a $37 million fraud against Meta Platforms, wire fraud, tax evasion, conspiracy to violate civil rights through an LASD deputy bribery scheme, and—in a separate Connecticut federal case—conspiracy to interfere with commerce by robbery in connection with a plot to kidnap a couple whose son had stolen $245 million in Bitcoin. Federal prosecutors are seeking a minimum of 14 years; sentencing in the Connecticut case is scheduled for August 12, 2026.

Nathan Fuller, a resident of Cypress, Texas, operated Privvy Investments LLC and its assumed business name Gateway Digital Investments as a fraudulent cryptocurrency investment scheme from at least October 2022 through mid-2024. Fuller raised approximately $12.3 million from roughly 150 investors by falsely claiming proprietary AI-powered trading bots would execute high-frequency crypto arbitrage and generate guaranteed returns of 40-100% within 21-45 days. The SEC filed a civil complaint against Fuller on May 28, 2026 in the U.S. District Court for the Southern District of Texas (Litigation Release No. 26558); Fuller had previously admitted in a September 2025 bankruptcy proceeding that Privvy Investments was a Ponzi scheme.

Shunda Park was a large-scale cryptocurrency investment fraud compound operated in Min Let Pan, Myanmar (Burma), active from at least January 2025 until its seizure by the Karen National Liberation Army (KNU/KNLA) in November 2025. The compound ran pig-butchering scams targeting victims across 30 or more countries, using trafficked workers held under threat of violence. In April 2026, the U.S. Department of Justice charged two Chinese nationals — Huang Xingshan and Jiang Wen Jie — with wire fraud conspiracy for managing the compound, as part of a coordinated international enforcement action that resulted in 276 arrests, the dismantling of nine scam centers, and the restraint of over $701 million in cryptocurrency.

Dango (ticker: DNG) is a DeFi-native Layer-1 blockchain and perpetual futures exchange that raised $3.6 million in seed funding in November 2024 from Hack VC, Lemniscap, and Delphi Labs. On April 13, 2026, the protocol suffered a logic flaw exploit in its insurance fund donation contract, resulting in $1.9 million USDC being drained; approximately $410,010 was bridged to Ethereum before bridge rate limits halted further outflows. The attacker was identified as a white hat who returned all funds in exchange for a bug bounty, leaving user positions and trading functions unaffected.

Curve LlamaLend (also referred to as the crvUSD lending markets) is a decentralized, permissionless isolated lending protocol built by Curve Finance that allows users to borrow crvUSD against crypto collateral using the LLAMMA soft-liquidation mechanism. The protocol has experienced multiple distinct incidents since launch: a $10 million bad-debt event in June 2024 tied to the founder's oversized leveraged positions, an oracle-manipulation attack on the sDOLA market in March 2026 resulting in approximately $240,000 in borrower losses, an October 2025 market crash that left the CRV-long vault approximately $700,000 underbacked, and a May 2026 third-party exploit (Stake DAO) that forced the sunsetting of an associated Arbitrum LlamaLend market. The protocol's core contracts have not been directly compromised by a code-level hack, but recurring bad-debt events, oracle design flaws in permissionlessly created markets, and governance concentration risks have drawn sustained scrutiny including a flag from on-chain investigator ZachXBT.

TesseraDAO is a BNB Chain project whose governance token TSR was the subject of a severe exploit on June 1, 2026, in which an attacker minted 99 million unauthorized TSR tokens and dumped them for approximately $2.5 million USDT, causing a 99% price collapse within hours. Stolen proceeds were bridged to Ethereum and laundered via Tornado Cash, with 1,285.5 ETH confirmed passed through the mixer. Security analysts noted that minting privileges were controlled exclusively by deployer-related addresses, raising questions about whether the incident constituted an external hack or an insider compromise.

DxSale is a decentralized token launchpad and liquidity-locking platform launched in August 2020, originally on Ethereum and later expanded to BNB Chain and other EVM networks. On May 28, 2026, a hidden backdoor in legacy BNB Chain liquidity locker contracts was exploited to drain approximately $7.3 million from more than 1,400 LP positions locked as far back as 2021. On-chain analysis identified a 269-day pre-exploit ownership transfer chain passing through approximately 80 wallets, with indicators strongly suggesting insider involvement by a current or former team member.

Linea is a zkEVM Layer 2 rollup built by Consensys that launched on Ethereum mainnet in July–August 2023 and uses a proprietary zk-SNARK proving library called gnark. The network is classified as Stage 0 by L2BEAT, operates a single centralized sequencer with no permissionless fallback, and demonstrated this centralization risk in June 2024 when it unilaterally halted block production during the Velocore DEX hack. The LINEA token launched in September 2025 and suffered a 93% price collapse within hours amid a delayed community airdrop contract, sequencer outage, and allegations of treasury wallet selling pressure.

Bitpin (legal name: Nooyan Bitpin, also known as Sana Ayman Mubadala) is an Iranian cryptocurrency exchange founded in 2020 and headquartered in the Anzali Free Zone, Gilan, Iran. On June 2, 2026, the U.S. Treasury's Office of Foreign Assets Control (OFAC) designated Bitpin on the Specially Designated Nationals (SDN) list under Executive Orders 13224 and 13902, citing IRGC-linked transactions, sanctions evasion, and investors with alleged ties to circumventing U.S. restrictions. Bitpin accounted for approximately 10% of Iranian digital asset inflows in 2025 and processed an estimated USD 821 million in volume that year, making it Iran's third-largest exchange by that metric among the four simultaneously designated platforms.

Silo Finance V1 is a non-custodial isolated lending protocol launched on Ethereum mainnet in August 2022, enabling permissionless markets for long-tail crypto assets by confining risk to individual lending pools (Silos). The protocol experienced two security incidents in 2023: a critical interest rate manipulation vulnerability discovered by a white-hat researcher (no user funds lost) and a white-hat drain of approximately $45,000 in SILO incentive tokens due to a separate contract flaw. The deployed production version of V1 diverges from the audited codebase, a risk the team has publicly acknowledged but not fully remediated through re-audit.

Ramzinex (legal name: Mubadala Ramzinex; also registered as Ramzineh Electronic Commerce Innovation Company) is an Iranian cryptocurrency exchange founded in 2018 and headquartered in Tehran. On June 2, 2026, the U.S. Treasury's Office of Foreign Assets Control (OFAC) designated Ramzinex under Executive Order 13902, citing facilitation of transactions linked to the Islamic Revolutionary Guard Corps (IRGC), a government-backed Iranian financial institution, and sanctions evasion. The designation was part of the Trump administration's broader 'Economic Fury' campaign, which simultaneously sanctioned three other major Iranian exchanges: Nobitex, Wallex, and Bitpin.

Superfortune AI is an AI-powered InfoFi platform on BNB Chain, incubated by Manta Labs, that combines Chinese metaphysical traditions with crypto market analytics. Its native token GUA launched on November 27, 2025. On May 27, 2026, approximately 14.98 million GUA tokens intended for an airdrop distribution were redirected to a lookalike attacker-controlled address, resulting in losses of approximately $15.18 million and a roughly 76% token price crash within 24 hours. The root cause remains disputed: the team attributed the incident to a compromised signer private key, while the absence of prior on-chain interaction between the attacker and project wallets has raised unresolved questions about the multisig workflow.

DIMO (Decentralized Infrastructure for Mobility Operations) is a Web3 vehicle data protocol built on Polygon and later migrating to Base, developed by Digital Infrastructure Inc. The protocol allows drivers to connect their vehicles, stream data, and earn $DIMO tokens in exchange. In November 2025, a sophisticated attacker compromised a developer key and withdrew approximately 30 million DIMO tokens (3% of total supply) from a Wormhole bridge contract, causing a price drop of over 57% in 30 days and triggering a CertiK security alert. The project has legitimate venture backing and a publicly identified founding team, but the security incident, centralized key management failure, and ongoing token unlock pressure are material risk factors.

Rathnakishore Giri, also known as 'Ravi' Giri, is a 31-year-old Ohio investment manager convicted of wire fraud for orchestrating a Bitcoin-derivatives Ponzi scheme that raised over $10 million from at least 150 investors between 2019 and 2022. Operating through two entities — NBD Eidetic Capital, LLC and SR Private Equity, LLC — he falsely promised guaranteed, risk-free returns while using new investor funds to repay earlier ones and diverting proceeds to fund a lavish personal lifestyle. On May 18, 2026, he was sentenced to nine years in federal prison after an aggravating factor emerged: following his October 2024 guilty plea, and while on pretrial release, he continued soliciting new cryptocurrency investors, causing additional harm and prompting an amended plea agreement.

Midnight (NIGHT) is a privacy-focused Cardano sidechain developed by Input Output (IO), the company behind Cardano, first unveiled in late 2023. Charles Hoskinson called it 'six years of intellectual and practical effort.' The 'Glacier Drop' airdrop distributed 100% of the 24B token supply to 37M users across 8 blockchains with zero VC allocation — 50%+ to ADA holders. NIGHT launched December 8, 2025 but immediately crashed 60%+ from $0.11 to $0.02 as the massive free distribution flooded exchanges. Over 4.5B airdropped tokens remain in 'thawing' through December 2026 (25% unlocks every 90 days), creating persistent selling pressure. Mainnet is not yet live, meaning token utility is largely theoretical.

Uniblock is a Canadian Web3 infrastructure company founded in 2022 that provides a unified, multi-chain API aggregation platform for blockchain developers, connecting over 300 blockchains and 55 data providers through a single interface with patented auto-routing technology. The company is venture-backed with C$7.5 million in total funding from institutional investors including SBI Ven Capital, AllianceDAO, NGC Ventures, Alchemy, and MoonPay. No regulatory actions, fraud allegations, or significant security incidents have been identified; risk factors are principally commercial and operational rather than conduct-related.

Maestro is a Telegram-based crypto trading bot developed by Gearlay Technologies Inc. (Canada) that enables sniping, copy-trading, and wallet management across 14 blockchains. On October 24, 2023, a critical access-control vulnerability in its MaestroRouter2 smart contract was exploited, draining approximately 280 ETH (~$500,000) from 106 user accounts; the team subsequently refunded all affected users with 610 ETH (~$1.1 million) sourced from its own revenue. The platform operates a partial-custody model in which user private keys are encrypted and stored on Maestro servers, representing a persistent systemic risk.

Curve Finance is a major decentralized exchange (DEX) on Ethereum optimized for stablecoin and pegged-asset trading, operating since January 2020. On July 30, 2023, a latent vulnerability in the Vyper smart-contract compiler (versions 0.2.15, 0.2.16, and 0.3.0) was exploited across multiple Curve liquidity pools, draining approximately $70 million and triggering a near-systemic crisis when the resulting CRV price drop threatened to cascade-liquidate founder Michael Egorov's heavily collateralized on-chain loans. Roughly 73% of stolen funds were ultimately recovered or returned, and in December 2023 the Curve DAO voted to disburse approximately $49 million in compensation to affected liquidity providers.

Inertia Protocol (INRT) is a modular liquid restaking token (LRT) and lending protocol built on the Initia blockchain, launched to mainnet in April 2025. The protocol suffered a confirmed exploit in May 2025 in which approximately $152,000 was drained from five lending markets via a known ERC4626 share-price inflation attack; the protocol states its Insurance Fund restored affected user balances. Team composition, smart contract audit history, and investor backing are not publicly disclosed.

NiceHash is a Slovenian cryptocurrency mining marketplace founded in 2014 that allows users to buy and sell hashing power. In December 2017 the platform suffered one of the largest crypto exchange hacks of that year, with attackers stealing approximately 4,736 BTC (valued at roughly $64 million at the time) after compromising an employee's computer through a spear-phishing attack. The breach was subsequently attributed to North Korea's Lazarus Group, and NiceHash completed a full user repayment program in December 2020 after a three-year effort funded from operational revenue.

CATFI is a Solana-based memecoin launched in early 2025 via the Pump.fun launchpad. South Korean prosecutors charged five individuals, including a ringleader known online as 'Eth Father' (surname Park), with orchestrating a rug pull that inflated the token's price approximately 1,001-fold within 26 hours before draining liquidity and abandoning the project. This case represents South Korea's first criminal prosecution of a decentralized-exchange rug pull under the Virtual Asset User Protection Act.

SwissBorg is a Swiss-based crypto wealth management and exchange aggregator founded in 2017, holding MiCA authorization from France's AMF and VQF membership in Switzerland. In September 2025, the platform suffered a $41.5 million loss when its staking partner Kiln's API was compromised via a GitHub token theft and Kubernetes pod injection, resulting in the unauthorized transfer of 192,600 SOL from SwissBorg's SOL Earn program; the company subsequently pledged full reimbursement from treasury funds. While SwissBorg maintains legitimate regulatory standing and transparency measures including Proof of Liabilities, the third-party supply chain failure exposes material counterparty risk in its Earn product architecture.

Granary Finance was a decentralized, non-custodial lending and borrowing protocol forked from Aave V2, built by Byte Masons and an anonymous developer known as Fantom Menace, launching on Fantom in March 2022 before expanding to eight chains. The protocol raised over $5 million USDC via a community liquidity generation event in March 2023 and introduced the GRAIN governance token, but its TVL collapsed from a peak of approximately $60 million to under $200,000. By early 2025, the team announced the full withdrawal and discontinuation of Granary Finance across all chains, with GRAIN and OATH token holders migrated to the successor platform Cod3x (CDX). No regulatory actions, rug-pull allegations, or direct hacks of Granary contracts were documented; key risks include near-total value decline, deeply pseudonymous founding team, and protocol end-of-life.

Algorand is a Layer-1 blockchain founded in 2017 by Silvio Micali, a Turing Award-winning MIT cryptographer who co-invented zero-knowledge proofs and verifiable random functions. The protocol uses a Pure Proof-of-Stake consensus mechanism with genuine academic credibility, and has attracted institutional partnerships including FIFA and Visa-adjacent integrations. However, ALGO has been named as an alleged unregistered security in SEC complaints against both Bittrex and Binance, the Algorand Foundation conducted a highly criticized 2019 token auction that resulted in a mass refund event, the token trades approximately 96% below its 2021 all-time high, and the Foundation cut 25% of its workforce in 2025 while relocating from Singapore to the United States.

AKT is the native utility token of Akash Network, a decentralized cloud computing marketplace built on the Cosmos SDK and founded in 2015 by Greg Osuri and Adam Bozanich under Overclock Labs. The project operates as a legitimate, open-source DePIN (Decentralized Physical Infrastructure Network) with public governance, audited code, and institutional partnerships including an indirect connection to NVIDIA through the Brev.dev acquisition. No regulatory actions, fraud allegations, or major exploits have been identified, though a responsibly disclosed critical vulnerability was patched in May 2024 and a spam attack disrupted the network briefly in March 2025.

SuperRare is a curated Ethereum-based NFT art marketplace founded in 2018 by John Crain, Charles Crain, and Jonathan Perkins, operating as a high-end platform for 1-of-1 digital artworks with its own governance token RARE. On July 28, 2025, a critical access control vulnerability in the platform's RareStakingV1 staking contract was exploited, resulting in the theft of approximately 11.9 million RARE tokens worth roughly $731,000. SuperRare subsequently reimbursed the 61 affected wallets by August 5, 2025, and the RARE token recovered approximately 41% following the remediation announcement.

Goliath Ventures Inc. was an Orlando, Florida-based cryptocurrency investment firm that, according to U.S. federal prosecutors, operated a Ponzi scheme from January 2023 through January 2026, raising at least $328 million from more than 2,000 investors through false promises of guaranteed monthly returns via cryptocurrency liquidity pools. Its founder and CEO, Christopher Alexander Delgado, was arrested on February 24, 2026 on federal wire fraud and money laundering charges; the company subsequently filed for Chapter 11 bankruptcy and is the subject of multiple civil class-action lawsuits against Delgado, its banking institutions, and its outside law firm.

Gemini is a New York-based cryptocurrency exchange and custodian bank founded in 2015 by Cameron and Tyler Winklevoss, regulated under a NYDFS Limited Purpose Trust Charter. The exchange gained significant notoriety following the collapse of its Gemini Earn lending program in late 2022, which left approximately 340,000 users with roughly $900 million in frozen assets; subsequent SEC and NYDFS enforcement actions were resolved by early 2024 and 2026 respectively with full customer restitution. Gemini went public on the Nasdaq in September 2025 under the ticker GEMI, but its stock has since declined more than 80% amid deepening losses, executive departures, mass layoffs, and a contested post-IPO strategic pivot to prediction markets.

Yelo, known online as @yelotree, is a crypto key opinion leader (KOL) and former professional Fortnite esports player with approximately 180,000 Twitter followers who also operated a luxury car rental business in Miami. As of May 2026, Yelo faces federal criminal charges alleging he laundered funds stolen from cryptocurrency holders through that rental business, with a potential sentence of up to 30 years. Separately, Yelo participated in undisclosed paid promotion of the Sharpei memecoin on Solana in October 2024, which subsequently suffered a documented rug pull that erased 96% of its market value.

On June 1, 2026, Gnosis Pay's Zodiac Delay Module — a third-party smart contract add-on designed to impose mandatory waiting periods on outgoing Safe transactions — was exploited via a signature-verification flaw in the Delay Modifier v1.1.0 and Roles Modifier v2. Blockchain security firm CertiK estimated losses at approximately $265,000 affecting 41 Gnosis Safes, with stolen funds partially bridged to Hyperliquid and converted to Monero. Gnosis co-founder Martin Köppelmann publicly pledged full reimbursement for all affected users, card services were restored for over 99% of users by June 7, and Safe core contracts were confirmed unaffected.

In May 2026, independent security researcher Taylor Hornby discovered a critical soundness vulnerability in the Zcash Orchard shielded pool's zero-knowledge proof circuit that had existed since the pool's launch in May 2022. The flaw — an under-constrained elliptic-curve multiplication gadget in the halo2_gadgets crate — could theoretically have allowed unlimited undetectable counterfeit ZEC creation within the Orchard pool, though it could not inflate total ZEC supply due to the turnstile mechanism. The Zcash Open Development Lab coordinated an emergency two-phase response within 50 hours: a soft fork on June 2 disabling Orchard transactions, followed by the NU6.2 hard fork on June 3 deploying the corrected circuit. No exploitation has been confirmed, though the privacy properties of the Orchard pool make definitive confirmation impossible. ZEC fell approximately 38% on public disclosure on June 5, 2026.

RaveDAO is a Web3 entertainment protocol that markets itself as a community bridging electronic dance music culture with blockchain-based ticketing, governance, and event access. Its native token, RAVE, launched on Binance Alpha in December 2025 and experienced a ~10,800% price surge in April 2026 before collapsing approximately 95% within 48 hours amid substantial on-chain evidence of insider supply control and an alleged coordinated 'bait and liquidate' short-squeeze scheme. Binance, Bitget, and Gate.io opened formal investigations; on-chain investigator ZachXBT publicly accused the project's affiliated insiders of engineering the rally and named RAVE as part of a broader pattern of Bitget-enabled market-maker fraud.

Safe{Wallet}, operated by the Safe Ecosystem Foundation, is the dominant smart-contract multisig platform on Ethereum and EVM-compatible chains, securing approximately $35 billion in assets across 61 million accounts as of Q1 2026. In February 2025, a developer machine compromise by North Korea's Lazarus Group (TraderTraitor) allowed attackers to inject malicious JavaScript into the app.safe.global frontend, enabling the theft of approximately $1.5 billion in ETH from Bybit — the largest cryptocurrency heist in history. The Safe smart contracts themselves were not compromised; the attack was entirely at the infrastructure and frontend layer. Safe has since rebuilt its infrastructure and launched Safenet, a decentralized transaction-security network, as a structural response.

bc1qtkv6qcgq3qhqcdsk88wey50je0wk07s6erjrr9 is a native SegWit (Bech32) Bitcoin address with a small and fully spent transaction history confined to a two-day window in late May 2026. The address received approximately 0.0579 BTC (~5,793,506 satoshis) in a single inbound transaction and forwarded the entire balance outward within roughly 36 hours, exhibiting a classic pass-through or forwarding pattern. No scam reports, law enforcement actions, or regulatory designations were identified for this address at the time of investigation.

MANTRA is a Cosmos SDK-based Layer 1 blockchain focused on real-world asset (RWA) tokenization, co-founded by John Patrick Mullin. Its native OM token collapsed approximately 90% in roughly one hour on April 13, 2025, falling from around $6.30 to under $0.50 and wiping out an estimated $5–6 billion in market capitalization. The causes remain disputed: the project team attributed the crash to reckless forced liquidations by centralized exchanges, while on-chain analysts, OKX, and critics alleged coordinated insider selling, supply manipulation, and artificially inflated liquidity metrics.

Zondacrypto, formerly known as BitBay and Zonda, was once described as Poland's largest cryptocurrency exchange, serving over 1.3 million users across Central and Eastern Europe. Beginning in December 2025, the platform experienced a severe withdrawal freeze that escalated into a full collapse by April 2026, with Polish prosecutors estimating losses of at least 350 million zloty (approximately $96 million USD) affecting an estimated 30,000 or more users. The crisis has prompted criminal investigations in Poland, a partial operating license suspension by Estonian regulators, the resignation of the company's entire supervisory board, and the reported flight of CEO Przemyslaw Kral to Israel, where his dual citizenship complicates extradition.

LayerZero is a major omnichain interoperability protocol operated by LayerZero Labs, deployed across 130+ blockchains and processing over 200 million cross-chain messages as of early 2026. The protocol gained institutional backing from Citadel Securities, ARK Invest, Tether, and Sequoia Capital, and is the infrastructure behind USDT0, which processed over $70 billion in cross-chain USDT transfers. In April 2026, LayerZero's off-chain DVN infrastructure was compromised via a social engineering attack attributed to North Korea's Lazarus Group (TraderTraitor), enabling the $292 million KelpDAO rsETH bridge exploit — the largest DeFi hack of 2026 — and triggering a multi-billion-dollar client exodus to competing bridge providers.

ProBit Global was a South Korea-founded centralized cryptocurrency exchange that operated from 2018 until it permanently terminated all services by April 1, 2026. The shutdown followed an inability or unwillingness to obtain MiCA licensing for EU/EEA users and a stated broader regulatory and restructuring rationale for global operations. The wind-down included a controversial abandoned-funds clause under which assets not withdrawn by April 1, 2026 were deemed permanently lost, as well as a monthly administrative fee of up to 10% of balances during the grace period, raising significant consumer-protection concerns.

VeChain (VET) is an enterprise-focused Layer-1 blockchain founded by Sunny Lu (former CIO of Louis Vuitton China). Launched in 2015 as a subsidiary of Bitse, rebranded and mainnet launched in 2018. The VeChain Foundation's buyback wallet was hacked in December 2019 due to employee negligence, losing 1.1 billion VET (~$6.5M). The Foundation held 27.3% of total token supply as of September 2019. VeChain's official X account was compromised in January 2024 for a scam giveaway. The blockchain has built-in fund freezing capabilities. Enterprise partnerships include Walmart China, BMW, and UFC. VeChain was among the first to proactively comply with MiCAR regulations.

Bit.com was a cryptocurrency derivatives and spot exchange launched in August 2020 by Matrixport, a Singapore-based digital asset firm founded by Bitmain co-founder Jihan Wu. On December 27, 2025, the exchange announced a phased wind-down under the label 'business restructuring,' with spot trading ceasing January 31, 2026, a backup withdrawal-only station active through March 31, 2026, and post-deadline asset recovery requiring individual customer-service requests. No regulatory action, security breach, or insolvency has been publicly reported as the cause; the shutdown appears consistent with a broader strategic consolidation by Matrixport, which rebranded as 'BIT' on March 20, 2026.

Silo V2 is a non-custodial, permissionless isolated lending market protocol operating across Ethereum, Arbitrum, Base, Optimism, and Sonic. On June 25, 2025, an unreleased peripheral leverage contract was exploited for approximately $545,000 (224 ETH) belonging to SiloDAO test funds; the team confirmed that all core markets and user deposits were unaffected. The incident revealed inadequate input validation and absent formal verification on pre-release code that had been deployed to mainnet, and the attacker subsequently laundered the stolen ETH through Tornado Cash.

Virtual Assets LLC, doing business as Crypto Dispensers, is a Chicago-based cash-to-cryptocurrency exchange operator founded in 2017 by Firas Isa. In November 2025, Isa and the company were each charged with one count of federal money laundering conspiracy in the Northern District of Illinois, with prosecutors alleging at least $10 million in proceeds from wire fraud and narcotics offenses were processed through the platform between 2018 and 2025. Both defendants have pleaded not guilty; the case is pending in federal court before U.S. District Judge Elaine E. Bucklo.

Kok An (born Phu Kok An, 1954) is a Sino-Cambodian senator, businessman, and one of Cambodia's wealthiest individuals, whose flagship companies Crown Resorts and Anco Brothers were designated by the U.S. Treasury's Office of Foreign Assets Control (OFAC) on April 23, 2026, along with 28 other individuals and entities, for allegedly operating and protecting a network of scam compounds that coerce human-trafficking victims into perpetrating 'pig butchering' crypto-investment fraud against American citizens. The designations, made under executive orders targeting significant malicious cyber-enabled activities, freeze all U.S.-linked assets and prohibit Americans from transacting with any designated party. Parallel law enforcement actions by Thailand, including a July 2025 Thai Criminal Court arrest warrant and raids seizing assets worth over 1.17 billion baht, and a November 2025 Thai revocation of Kok An's and his three children's fraudulently obtained Thai nationality, reflect a sustained international enforcement campaign against his network.

Ambient Finance (formerly CrocSwap, operated by Crocodile Labs) is a decentralized exchange protocol that runs an entire DEX inside a single smart contract, combining concentrated and ambient liquidity on Ethereum and several L2 networks. On October 17, 2024, the protocol's frontend suffered a DNS hijacking attack deploying Inferno Drainer malware to drain wallets of users who interacted with the compromised site; the underlying smart contracts were unaffected and the team reimbursed all affected users in ETH. ZachXBT has flagged this entity.

Apyx Finance is a DeFi protocol that issues apxUSD, a synthetic dollar stablecoin backed primarily by preferred equity shares of digital asset treasury companies, most notably Strategy's STRC preferred stock, rather than by fiat or crypto-native collateral. On June 4, 2026, apxUSD fell to approximately $0.93 during a Bitcoin drawdown that pushed STRC below its $100 par value, a roughly 7% deviation from peg. The protocol characterized this episode as expected behavior intrinsic to its equity-backed design, a framing that drew skepticism from market participants who noted structural risks including liquidity mismatches between 24/7 crypto markets and exchange-hours equity trading, leverage stacking in downstream DeFi venues, and the protocol's exclusion of US and EU persons from participation.

zkSync Era is an EVM-compatible ZK rollup Layer 2 network on Ethereum, developed by Matter Labs and governed through the ZK Nation framework. The network launched its ZK token in June 2024 to significant community controversy over airdrop eligibility and alleged Sybil-farming failures. In April 2025, an admin private-key compromise allowed an attacker to mint 111 million unclaimed ZK tokens worth approximately $5 million from airdrop contracts, though 90% of funds were later recovered via a bounty agreement.

Mach-O Man is a four-stage macOS malware kit attributed to North Korea's Lazarus Group (Chollima division), publicly disclosed in April 2026 by researchers at Bitso's Quetzal Team and the ANY.RUN sandbox platform. The campaign uses ClickFix social engineering — delivering fake meeting invitations via Telegram — to trick cryptocurrency and fintech executives into executing a terminal command that deploys a modular toolkit capable of stealing macOS Keychain secrets, browser credentials, session cookies, and crypto wallet extension data. Security researchers have linked the same threat actor cluster to over $575 million stolen from Drift Protocol and KelpDAO in April 2026 alone, and Lazarus Group's cumulative cryptocurrency theft since 2017 is estimated to exceed $7.3 billion.

Honeyland is a mobile-first, play-to-earn blockchain strategy game built on Solana by Hexagon Studios (Singapore), where players manage bee colonies to earn the native HXD token. The project raised $4 million prior to its public token launch in March 2023 and was acquired by Montreal-based Bravo Ready Studios in July 2025. No confirmed fraud, hack, or regulatory action has been identified; the primary risk factors are severe token price depreciation (approximately 99.9% from all-time high), low trading liquidity, and the structural sustainability challenges common to play-to-earn game economies.

Chen Zhi (also known as 'Vincent'), age 37, is the founder and chairman of Prince Holding Group, a Cambodia-based multinational conglomerate indicted in October 2025 by a federal grand jury in the Eastern District of New York (EDNY) for operating forced-labor cryptocurrency fraud compounds across Cambodia. The U.S. Department of Justice filed a civil forfeiture action for approximately 127,271 BTC (valued at approximately $15 billion), the largest forfeiture action in DOJ history. Chen Zhi was arrested on January 6, 2026 in Cambodia and extradited to China; his Cambodian citizenship was revoked prior to extradition.

BonkBot is a Solana-focused Telegram trading bot launched in 2023, affiliated with the BONK memecoin community but operated as a legally separate entity. It has grown to become one of the largest Telegram-based trading bots by volume, reporting over $14 billion in lifetime trades and more than 500,000 total users, with all 1% trading fees directed toward purchasing and burning BONK tokens. The platform operated in a custodial manner for most of its history before announcing a non-custodial key management system upgrade in October 2024; a March 2024 incident in which 302 users lost approximately $523,000 in SOL highlighted custody risks common to this class of product, though BonkBot attributed the losses to a compromise at a rival bot (Solareum) rather than its own infrastructure.

Zedcex Exchange Ltd. and Zedxion Exchange Ltd. are two UK-registered cryptocurrency exchanges designated by the U.S. Treasury's Office of Foreign Assets Control (OFAC) on January 30, 2026, in the first-ever U.S. sanctions action specifically targeting digital asset exchanges linked to Iran's Islamic Revolutionary Guard Corps (IRGC). On-chain analysis by TRM Labs identified approximately $1 billion in IRGC-associated flows through the two platforms between 2023 and 2025, routed almost exclusively in USDT on the TRON blockchain. Both entities are connected to Babak Morteza Zanjani, a previously OFAC-sanctioned Iranian financier convicted of embezzling billions from Iran's National Oil Company whose death sentence was commuted in 2024.

Robinhood Crypto, LLC is the cryptocurrency trading subsidiary of publicly-traded Robinhood Markets, Inc. (NASDAQ: HOOD), offering retail crypto trading in the United States and Europe. The entity has accumulated over $170 million in regulatory fines and settlements across multiple U.S. jurisdictions since 2020 related to AML deficiencies, misleading disclosures, customer asset restrictions, and cybersecurity failures, though it remains a licensed and operational platform with growing global ambitions including the $200 million acquisition of Bitstamp completed in June 2025.

The 'graphalgo' campaign is a North Korean state-sponsored software supply-chain operation attributed to the Lazarus Group, active since at least May 2025 and publicly disclosed in February 2026. Threat actors impersonate cryptocurrency-sector recruiters using fabricated companies — most notably 'Veltrix Capital' — to deliver coding-assessment repositories seeded with malicious npm and PyPI packages that install a remote-access trojan (RAT) targeting developer systems and cryptocurrency wallets. By April 2026 the campaign had respawned under new personas including 'Blockmerce' and 'Bridgers Finance', with operatives registering a real U.S. LLC to enhance credibility.

Synthetix is an Ethereum-based decentralized derivatives liquidity protocol originally launched in 2017 as Havven by Australian entrepreneur Kain Warwick, rebranding in 2018 to enable the creation of synthetic assets tracking real-world prices. The protocol reached a peak total value locked during the 2021 DeFi bull market and has been a pioneer in on-chain derivatives, but has faced recurring issues including a critical oracle exploit in 2019, persistent front-running vulnerabilities, a contentious DWF Labs market-maker arrangement, and a prolonged sUSD stablecoin depeg crisis beginning in 2025 triggered by the SIP-420 protocol overhaul.

Tudou Guarantee was a Chinese-language, Telegram-based illicit marketplace that processed over $12 billion in USDT transactions, making it the third-largest such marketplace in recorded history. Operated as an escrow and guarantee service for vendors selling stolen data, money laundering services, scam infrastructure, and AI deepfake tools to pig-butchering and other fraud operators, it emerged as the primary successor to Huione Guarantee following that platform's May 2025 shutdown. Tudou ceased public Telegram transactions in January 2026 following the arrest and extradition of Prince Group chairman Chen Zhi to China.

Bitcoin Cash (BCH) is a proof-of-work cryptocurrency that forked from Bitcoin on August 1, 2017, at block 478,559, increasing the block size limit from 1 MB to 8 MB to enable higher on-chain transaction throughput. It is classified as a commodity by U.S. regulators and ranked approximately #14 by market capitalization (~$8.8B as of May 2026). The project carries meaningful reputational risk tied to its primary promoter Roger Ver, who was indicted for $48 million in tax fraud in 2024 and reached a deferred prosecution settlement; additionally, the network experienced a contentious hash war in 2018 that split the chain, and Bitcoin.com operated a wallet app and website that allegedly misled users into purchasing BCH instead of Bitcoin.

On April 16, 2026, Rhea Finance — the leading DeFi hub on the NEAR blockchain, formed by the March 2025 merger of Ref Finance and Burrow Finance — was exploited for an estimated $18.4 million (initially reported as $7.6 million) via a two-phase attack combining fake token pool seeding with a slippage-protection bypass in its margin trading module. Approximately $9 million in assets was subsequently recovered or frozen, including $3.291 million USDT frozen by Tether, leaving an estimated $8–9 million outstanding as of late April 2026.

Stable (STABLE) is a specialized Layer-1 'Stablechain' blockchain engineered to optimize stablecoin transactions by using USDT as its native gas token for predictable, low-cost settlements. The STABLE token is used for validator staking, governance, and ecosystem alignment. Market cap ~$914M. Limited independent coverage and relatively new project with low confidence in assessment due to sparse verifiable information.

On January 8, 2026, the Truebit Protocol smart contract on Ethereum was exploited via an integer overflow vulnerability in a legacy, unaudited Purchase contract (deployed circa 2021, compiled with Solidity v0.5.3), allowing an attacker to mint TRU tokens at near-zero cost and drain 8,535 ETH (approximately $26.2–26.6 million) from the bonding-curve reserve. The stolen funds were fully laundered through Tornado Cash by January 11, 2026, and no meaningful recovery has been reported. The incident caused TRU token to collapse approximately 99.9% within 24 hours, and the same primary attacker address was linked by PeckShield to a prior Sparkle Protocol exploit approximately 12 days earlier.

Filecoin (FIL) is a decentralized storage network built by Protocol Labs, founded by Juan Benet. Raised a record $257M in a 2017 ICO via SAFT structure. SEC classified FIL as a security in Binance/Kraken lawsuits but later removed FIL from the Binance complaint (July 2024). Miner protests erupted at mainnet launch (October 2020) over economic model requiring heavy collateral. Mining historically concentrated in China. Binance delisted FIL/BNB pairs in October 2024.

Vanilla Drainer is a Drainer-as-a-Service (DaaS) criminal platform first documented in October 2024 that provides phishing kits and malicious smart contract infrastructure to affiliate fraudsters in exchange for a 15-20% commission on stolen proceeds. Blockchain investigator Darkbit attributed at least $5.27 million in cryptocurrency thefts to the service within a three-week window in mid-2025, and the Security Alliance (SEAL) identified Vanilla Drainer as one of the two primary drainer families deployed via Google Ads malvertising campaigns that stole more than $1.27 million between March 13-30, 2026. No operators have been publicly identified and no law enforcement actions against the service have been confirmed as of mid-2026.

Ethena is a synthetic-dollar protocol launched on Ethereum in 2023, issuing USDe — a delta-neutral synthetic dollar backed by crypto spot collateral and offsetting short perpetual futures positions rather than fiat bank deposits. The protocol also issues a governance token (ENA) and a yield-bearing staked variant (sUSDe) marketed as an 'Internet Bond.' While it achieved a peak supply exceeding $14 billion in 2025, it has faced regulatory enforcement in Germany under MiCAR, a localized depeg event on Binance in October 2025, ongoing counterparty and negative-funding-rate risk critiques, and comparisons — contested by the founding team — to the failed Terra/UST model.

A persistent, multi-vector phishing network impersonating Uniswap across fake airdrops, cloned interfaces, and fraudulent Google Search advertisements has operated across multiple campaigns since at least 2022. The most recent and documented wave, active from late 2025 through May 2026, uses drainer-as-a-service tooling — primarily the AngelFerno kit — to trick victims into signing malicious wallet-approval transactions via Google Ads placed above legitimate Uniswap search results. Verified aggregate losses across the discrete 2025–2026 Google Ads campaign episodes reach approximately $1.63 million; broader industry-wide wallet drainer losses in 2024 reached $494 million across all protocols according to Scam Sniffer, but that figure is not attributable to Uniswap impersonation alone.

Hedera is a public distributed ledger technology platform using a patented hashgraph consensus mechanism, launched to mainnet in September 2019. In March 2023, the network suffered a protocol-level exploit in its Smart Contract Service that drained approximately $600,000 in liquidity pool tokens from three decentralized exchanges, requiring a full mainnet proxy shutdown for 41 hours. The platform operates under a council governance model comprising up to 39 global enterprises, which provides institutional stability but draws criticism for centralization relative to permissionless blockchains.

On February 22, 2026, the YieldBlox DAO-managed lending pool on Stellar's Blend V2 protocol was drained of approximately $10.97 million via a thin-liquidity oracle manipulation attack targeting the USTRY/USDC pair on the Stellar DEX. An attacker inflated the Reflector VWAP oracle price of USTRY from approximately $1.05 to $107 with a single low-volume trade costing roughly $5, then used overvalued USTRY collateral to borrow the pool's entire XLM and USDC reserves. Stellar Tier-1 validators froze approximately 48 million XLM (~$7.5 million) before the funds could be fully bridged out; the protocol developer Script3 committed to full depositor compensation and the attacker rejected a 10% white-hat bounty offer.

On March 15, 2026, Venus Protocol's BNB Chain Core Pool was exploited via a donation-attack supply-cap bypass targeting the THENA (THE) token market, resulting in approximately $3.7 to $5.07 million in extracted assets and $2.15 million in residual bad debt. The attacker conducted a nine-month preparation phase funded by 7,447 ETH received through Tornado Cash, and exploited a getCashPrior() vulnerability in Venus's Compound-forked vToken contracts that had been documented in a May 2023 Code4rena audit and previously exploited on Venus's zkSync deployment in February 2025, yet was not patched across all protocol deployments prior to this larger incident.

HyperFund (also marketed as HyperVerse, HyperCapital, HyperNation, and HyperTech) was a cryptocurrency investment scheme that raised approximately $1.89 billion from global investors between June 2020 and November 2022 by promising daily passive returns of 0.5–1% backed by purported large-scale crypto mining operations. The U.S. Department of Justice and the Securities and Exchange Commission both filed charges in January 2024, alleging the scheme had no legitimate mining revenues and operated as a pyramid and Ponzi structure in which new investor deposits funded earlier investors' withdrawals. Co-founder Xue 'Sam' Lee remains at large following a temporary detention in Dubai; co-promoter Rodney 'Bitcoin Rodney' Burton is held without bail with trial scheduled for September 14, 2026; and co-promoter Brenda 'Bitcoin Beautee' Chunga has pleaded guilty and awaits sentencing.

On March 22, 2026, an attacker compromised Resolv Labs' AWS Key Management Service (KMS) infrastructure to steal the SERVICE_ROLE private key controlling the USR minting contract. Using this key, the attacker deposited approximately $100,000-$200,000 in USDC across two transactions and minted approximately 80 million unbacked USR tokens at a 400-500x over-mint ratio, ultimately extracting roughly $23-$25 million in ETH. The exploit crashed USR's dollar peg by approximately 70-80% within 17 minutes, created functional insolvency for the Resolv protocol ($95M assets vs $173M liabilities), and spread cascading losses across at least 15 Morpho vaults and Fluid/Instadapp lending markets. The Resolv Foundation subsequently launched a tiered compensation plan in late May 2026 and reported completing over $77 million in phase-one redemptions by late May 2026.

Zerion is a non-custodial DeFi portfolio tracker and multi-chain wallet founded in 2016, supporting 50+ blockchains including Ethereum and Solana. The platform has experienced multiple security incidents over its history, including a 2026 social engineering attack attributed to North Korean threat actors that resulted in approximately $100,000 in company internal wallet losses, though user funds were unaffected in each incident. Zerion also shut down its ZERO Layer-2 network in May 2026 after 1.5 years due to low adoption, with assets bridgeable until July 31, 2026.

DeXe (DEXE) is a DAO governance infrastructure protocol enabling permissionless DAO creation and management. TVL tripled from ~$500M to ~$1.7B between end of 2024 and early Q2 2026. Over 100 DAOs launched on the platform by end of 2024. However, only ~50,000 holders suggests high concentration risk with capital flows growing faster than user growth. DEXE token remains down ~63% from its March 2021 ATH of $33.54. No major security incidents or regulatory actions found. Limited independent media coverage relative to its TVL. Treasury growth has significantly outpaced token price appreciation.

Beginning approximately January 2, 2026, blockchain investigator ZachXBT flagged an active, automated campaign draining hundreds of wallets across at least a dozen EVM-compatible chains, with over $107,000 stolen in mostly sub-$2,000 increments consolidated into a single aggregation address (0xAc2e5153170278e24667a580baEa056ad8Bf9bFB). The root cause was not confirmed at the time of ZachXBT's initial disclosure; suspected vectors included token-approval abuse, malicious signature exploits, a fake-MetaMask phishing email campaign, and possible spillover from the Trust Wallet browser-extension supply-chain compromise of December 2025. This entry serves as a consumer-protection warning and on-chain address flag.

On June 2, 2026, the U.S. Treasury's Office of Foreign Assets Control (OFAC) added four Iranian cryptocurrency exchanges — Nobitex, Wallex, Bitpin, and Ramzinex — to the Specially Designated Nationals (SDN) list under counterterrorism and Iran financial-sector authorities, representing the Treasury Department's largest single enforcement action to date against Iran's digital asset economy. The four exchanges collectively handled approximately 78 percent of Iran's attributed 2025 crypto volume, totaling roughly $7.78 billion, and were alleged to have facilitated sanctions evasion, terrorist financing for the IRGC, and support for other U.S.-designated entities including Hamas. The action forms the third layer of a five-month OFAC enforcement campaign that began in January 2026 and has frozen nearly $500 million in regime-linked cryptocurrency.

Mantle is a modular Ethereum Layer 2 network launched in July 2023, emerging from a merger of the BitDAO DAO and the Mantle L2 project. The MNT token was converted 1:1 from BitDAO's BIT token following a May 2023 community vote. The protocol holds a treasury of over $6 billion in assets and ranked approximately #43 by market cap as of mid-2026, but carries notable centralization risks including a single sequencer, zero-delay contract upgrade capability, and deep strategic and financial dependence on Bybit, the centralized exchange that held approximately 60% of the initial BIT token supply and suffered a $1.5 billion North Korean hack in February 2025.

A broad category of unauthorized cryptocurrency tokens, fake airdrop campaigns, and wallet-draining sites have emerged exploiting FIFA World Cup 2026 branding ahead of the tournament, which runs June 11 through July 19, 2026. None of these tokens or projects hold any official affiliation with FIFA. Law enforcement agencies including the FBI Internet Crime Complaint Center and the Los Angeles County Sheriff's Department have issued public warnings, while cybersecurity firm Group-IB has attributed a coordinated phishing and payment-theft campaign to a Chinese-speaking threat actor called GHOST STADIUM, estimating potential financial losses in the range of $71 million to $474 million for premium-ticket fraud alone.

On June 8, 2026, an attacker exploited a proof-validation parsing flaw in Syscoin's native UTXO bridge relay, minting approximately 5 billion unauthorized SYS tokens — valued at roughly $10 million at the time — without performing the required corresponding burn transaction on the NEVM side. Syscoin, an established Bitcoin-merged-mining blockchain project founded in 2014, is the victim of this infrastructure incident rather than a fraudulent actor itself. The bridge remains paused as of the reporting date pending a security-reviewed fix, and the unauthorized token supply inflation presents an unresolved dilution risk to SYS holders.

Phantom Wallet is a self-custody, non-custodial cryptocurrency wallet developed by Phantom Technologies, Inc., headquartered in San Francisco. Originally launched in 2021 as a Solana-focused browser extension, it has expanded to support Ethereum, Bitcoin, Polygon, Base, and Sui across browser extensions and mobile apps, with approximately 15 million monthly active users and $25 billion in self-custodied assets as of early 2025. The company is well-funded and has engaged constructively with US regulators, though it faces an active civil lawsuit alleging a browser-extension security flaw, and its users have been materially targeted by phishing impersonators and fake app-store clones.

Three Sheffield teenagers carried out an armed home-invasion robbery on June 18, 2024 at a flat in Hoxton, east London, stealing approximately £3.1 million (reported as $4.3M USD in some outlets) in cryptocurrency from a victim they had located using a misappropriated law-enforcement database. Blockchain investigator ZachXBT publicly identified the ringleader online as 'Faris Ali' in October 2024; Sheffield Crown Court proceedings name the ringleader as Faris Hassan. All three perpetrators pleaded guilty and were sentenced to a combined 16 years in youth detention at Sheffield Crown Court on November 7, 2025, with the stolen cryptocurrency recovered within 72 hours and returned to the victim.

On February 1, 2026, CrossCurve — a cross-chain DEX and bridge protocol operating under the EYWA brand — suffered a critical exploit of its ReceiverAxelar bridge contract via a missing Axelar Gateway validation check. Approximately $1.4 million in liquid assets were confirmed stolen, while the total PortalV2 contract balance drained was approximately $3 million (including largely illiquid EYWA tokens). No funds were recovered as of the investigation date.

A large-scale industrialized campaign of Ethereum address-poisoning attacks surged sharply following the December 3, 2025 Fusaka protocol upgrade, which reduced per-transaction gas fees by approximately 67% and made high-volume dust-transfer campaigns economically viable at unprecedented scale. Two high-profile victims suffered a combined loss of approximately $62.2 million between December 2025 and January 2026, with a single victim losing $49,999,950 in USDT on December 19, 2025. An independent academic study published by Carnegie Mellon University researchers (Tsuchiya et al., presented at USENIX Security 2025) quantified the broader campaign at 270 million on-chain poisoning attempts targeting 17 million wallets across Ethereum and BNB Smart Chain from July 2022 to June 2024, with confirmed losses of at least $83.8 million over that earlier study period.

Spicenet is an early-stage DeFi interoperability protocol founded in 2023 and headquartered in Kingston, Canada, with a technical hub in Bengaluru, India. The project raised $3.4 million in a December 2024 seed round led by Hack VC and Magnus Capital, and is building a cross-chain brokerage network comprising two products — Spice Flow (multi-chain distribution) and Spice Edge (execution layer). As of May 2026, Spicenet remains pre-mainnet; no regulatory actions, fraud allegations, or security breaches have been publicly documented.

Hxro Network is a decentralized derivatives and liquidity primitive built on the Solana blockchain, providing shared exchange, risk management, and settlement infrastructure for on-chain futures, options, and parimutuel betting markets. The project raised $49 million across two token rounds in 2021 from well-regarded institutional investors including Jump Crypto, Blockchain Capital, Susquehanna International Group, and Alameda Research. While the team is publicly identified with traditional finance credentials and multiple third-party security audits have been completed, the HXRO token has experienced a severe decline from its all-time high, and the network has struggled to achieve meaningful adoption relative to competing Solana derivatives protocols.

Cega (cega.fi) was a decentralized exotic options and structured products protocol that operated from June 2022 through late 2024 on Solana, Ethereum, and Arbitrum. Founded by Arisa Toyosaki, a named former derivatives trader, and backed by Dragonfly Capital, Pantera Capital, and Coinbase Ventures, the protocol processed over $500 million in cumulative transaction volume without a reported user fund loss. In November 2024 Cega was acquired by an undisclosed party and wound down its public-facing product suite, urging remaining depositors to withdraw.

Socket Protocol (also marketed as Bungee Exchange) is a cross-chain interoperability and liquidity-routing protocol founded in 2021 by Vaibhav Chellani and Rishabh Khurana. On January 16, 2024, a newly deployed route module containing an unvalidated calldata vulnerability was exploited, draining approximately $3.3 million from approximately 230 wallets that had granted infinite token approvals to the SocketGateway contract. In an unusual outcome for a DeFi exploit, Socket negotiated the return of 1,032 ETH (~$2.3 million) from the attacker and covered the remaining ~$1.1 million shortfall itself, making all affected users whole.

Claynosaurz is a Solana-native NFT collection and web3 animation studio launched in November 2022, comprising 10,222 animated 3D dinosaur characters. Founded by Montreal-based animation professionals with verifiable film industry credits, the project has delivered multiple product milestones including physical merchandise, a Solana Phone exclusive NFT drop, cross-chain expansion to Sui, and a forthcoming Gameloft mobile game. No fraud, rug pull, or regulatory actions have been identified; the primary risk factors relate to NFT market depreciation, complex multi-token ecosystem mechanics, and the inherent execution risk of an early-stage gaming and entertainment IP.

Ondo Finance is a real-world asset (RWA) tokenization protocol founded in 2021 by former Goldman Sachs executives Nathan Allman and Justin Schmidt. The platform offers tokenized exposure to U.S. Treasury securities (OUSG, USDY) and, since September 2025, a broader set of tokenized equities via Ondo Global Markets. The protocol held over $1.8 billion in TVL as of late 2025 and received formal notice in November 2025 that a two-year SEC investigation had been closed without charges.

Clockwork was a Solana-based smart-contract automation protocol that allowed developers to schedule transactions and build event-driven on-chain programs without relying on centralized cloud infrastructure. Founded in 2021 as Cronos and rebranded in 2022, the project raised $4 million in seed funding from Multicoin Capital, Asymmetric, and Solana Ventures before its founder announced an orderly shutdown effective October 31, 2023, citing limited commercial upside. No fraud, security exploits, or regulatory actions have been identified; the shutdown is assessed as a voluntary wind-down of a legitimate infrastructure project.

Flash Trade (flash.trade) is a non-custodial, asset-backed perpetuals and spot exchange built on Solana, founded in early 2023 by Anas Khader and Zoheb Shahzan (previously of the Investin project). The protocol is bootstrapped, has undergone multiple third-party security audits, publishes an open-source reference implementation, and has processed over $20 billion in cumulative trading volume. No exploits, regulatory actions, or fraud allegations have been identified; primary risk factors are a modest TVL (~$10.7M), a low-cap governance token (FAF, ~$3.7M market cap), oracle dependency on Pyth Network, and limited public background on the founding team.

Cropper Finance is a permissionless automated market maker (AMM) and yield farming protocol built on the Solana blockchain, launched in mid-2021. The platform raised approximately $1.1–1.5 million across seed and public rounds and underwent security audits by Halborn Security, but operates with a pseudonymous-to-anonymous founding team and has experienced severe TVL and token value decline since its 2021 peak. As of 2025–2026 the protocol shows minimal trading activity, negligible TVL, and near-zero community engagement, raising questions about long-term viability.

Crossmint is a New York-based web3 infrastructure company founded in 2022 by Alfonso Gómez-Jordana Mañas and Rodrigo Fernández Touza. It provides APIs and no-code tools for embedded wallets, NFT minting, stablecoin orchestration, and AI-agent payments, reporting over 40,000 enterprise and developer customers. The company raised $23.6 million in March 2025 led by Ribbit Capital, holds SOC 2 Type II certification, a VASP license, and received MiCA authorization in Spain in December 2025.

Sky (formerly MakerDAO) is a DeFi lending protocol founded by Rune Christensen that governs the DAI/USDS stablecoin system. Rebranded in August 2024 with USDS and SKY token migration. Key risks include the March 2020 Black Thursday oracle failure ($8.32M in losses, $28M class action dismissed), governance centralization (top 3 holders controlled 78%+ of votes per academic research), DAI depeg events, and USDS freeze function controversy. No SEC/CFTC enforcement actions exist. USDS supply grew ~86% to ~$9.86B through 2025.

Fragmetric (fragmetric.xyz) is a Solana-native liquid restaking protocol that issues fragSOL, fragJTO, and fragBTC as Liquid Restaking Tokens (LRTs) built on Jito's restaking infrastructure. The protocol raised $12 million across seed and strategic rounds from recognized institutional backers including Hashed, Finality Capital, and RockawayX, and has undergone multiple independent security audits by Certora and Quantstamp. Material risks include smart-contract complexity inherent to restaking, slashing exposure through Node Consensus Networks (NCNs), partial team pseudonymity, and significant FRAG token price depreciation following the July 2025 listing.

Aptos is a Layer-1 proof-of-stake blockchain founded in 2021 by Mo Shaikh and Avery Ching, former employees of Meta's Diem (Libra) project, using the Move programming language originally developed for Diem. The project raised $350 million across two rounds in 2022 from investors including a16z, FTX Ventures, Jump Crypto, and Three Arrows Capital, launching its mainnet in October 2022 amid significant criticism over opaque tokenomics, low initial throughput, and heavy insider allocations. While Aptos has since grown its DeFi TVL above $1 billion, attracted institutional partnerships with BlackRock, Microsoft, and Brevan Howard, and received digital commodity classification from the SEC and CFTC in 2026, early controversies around token distribution, FTX investor exposure, a 5-hour network outage in October 2023, and the departure of co-founder CEO Mo Shaikh in December 2024 remain part of the project's documented record.

Jupiter Perps is a perpetual-futures decentralized exchange (DEX) built on Solana, operated by Jupiter Exchange, offering up to 250x leveraged trading on SOL, ETH, and wBTC against a shared liquidity pool called JLP (Jupiter Liquidity Pool). The protocol has grown to become the dominant perps venue on Solana with a JLP TVL that surpassed $2 billion in September 2025 and over $100 billion in cumulative trading volume as of 2024. The platform has undergone multiple independent smart contract audits with no critical exploits against its own contracts reported, though JLP token holdings in third-party vaults were implicated as stolen assets in the April 2026 Drift Protocol breach.

Euler Finance is an Ethereum-based non-custodial lending protocol founded in 2020 by Michael Bentley (PhD, Oxford) that pioneered permissionless lending for long-tail ERC-20 assets. On March 13, 2023, the protocol suffered a ~$197 million flash loan exploit — the largest DeFi hack of 2023 — caused by a missing health check in the donateToReserves() function. In an unusual outcome, the attacker, who communicated under the alias 'Jacob,' returned approximately $240 million in assets (including ETH price appreciation) over three weeks following on-chain negotiations, enabling full user restitution. The protocol relaunched as Euler V2 in September 2024 with a modular architecture, 45+ security audits, and subsequently grew TVL to over $1.5 billion by early 2025.

Lifinity was a proactive market maker and oracle-based decentralized exchange built on Solana, operating from February 2022 until it voluntarily shut down in December 2025 after processing approximately $150 billion in lifetime trading volume. The protocol was notable for its use of Pyth oracle pricing instead of traditional AMM mechanics, a no-VC community-funded launch via a veIDO, and a transparent wind-down that distributed roughly $43.4 million in treasury assets to LFNTY token holders. Risk factors include an anonymous pseudonymous founder operating as 'Durden' or 'durdenwannabe,' a $699,090 pool drainage incident in December 2023 caused by a protocol-level bug, and structural dependence on the Pyth oracle as a single external pricing dependency.

Flare (FLR) is a Layer-1 blockchain founded by Hugo Philion focused on cross-chain data oracles (FTSO) and interoperability, with deep roots in the XRP ecosystem. The FLR token airdrop to XRP holders was delayed two years (snapshot Dec 2020, distribution Jan 2023), crashing 83-87% on launch day. Critics noted the airdrop delivered only 15% upfront rather than the expected 1:1 ratio. Protos reported the network attracted just 80 new users per day despite its billion-dollar valuation. A Flare 2.0 upgrade targeting TEE-based confidential compute is planned for Q3 2026. Current metrics show ~860K active addresses, ~500K daily transactions, and ~$200M TVL.

Sei Network is a Layer 1 blockchain developed by Sei Labs, co-founded in 2021 by Jayendra Jog and Jeff Feng, designed to optimize high-throughput trading and DeFi with a parallelized EVM architecture. The project raised $35 million across seed and Series A rounds from prominent crypto VCs, launched its mainnet in August 2023, and has grown to over $600 million in TVL as of mid-2025. While no regulatory enforcement actions have been brought against Sei Labs or the Sei Foundation directly, the project faced community backlash over its 2023 airdrop distribution and carries structural risk concerns related to token unlock schedules, insider allocation concentration, and a low validator decentralization score.

Light Protocol is a Solana-native ZK compression infrastructure layer developed by Luminous Labs Lda, a Portugal-based company co-founded in 2021 by Swen Schäferjohann. The protocol reduces on-chain state storage costs by up to 99% using zero-knowledge proofs and has undergone multiple independent security audits including formal circuit verification. No fraud allegations, regulatory actions, or fund-loss incidents have been identified; primary risk signals are inherent ZK/smart-contract complexity, partially unaudited SDK tooling, and infrastructure scaling concerns raised by Solana node operators.

Lulo (lulo.fi), formerly known as Flexlend, is a Solana-based DeFi lending aggregator that automatically routes stablecoin deposits to the highest-yielding protocols on the network, including Kamino, Drift, Marginfi, Morpho, Maple, and Pendle. Founded in 2022 and formally launched in early 2024, the protocol has grown to over $86 million in TVL and surpassed $100 million in cumulative deposits, supported by five independent security audits and backing from Circle Ventures and Solana Ventures. The platform's primary risk profile is composability-layer exposure: deposits are routed across multiple third-party protocols, meaning a failure at any underlying venue could affect user funds, although Lulo's 'Protected' tier includes automated on-chain coverage for such events.

Starknet is a permissionless ZK-rollup Layer 2 network on Ethereum, developed by Israeli cryptography firm StarkWare Industries. It uses STARK-based validity proofs and the Cairo programming language to scale Ethereum throughput. The project launched its STRK token in February 2024 and reached L2Beat Stage 1 decentralization in May 2025, but has faced significant community criticism over its airdrop eligibility criteria and an early, aggressive token unlock schedule for investors and early contributors.

On March 15, 2022, Agave (an Aave fork on Gnosis Chain) and Hundred Finance (a Compound fork deployed on Gnosis Chain) were simultaneously exploited via a reentrancy attack that abused post-transfer callback hooks in Gnosis Chain's non-standard ERC-677 bridged tokens, resulting in combined losses of approximately $11.7 million. Hundred Finance suffered a second major exploit in April 2023 on Optimism ($7.4 million), after which the protocol voted to shut down permanently in August 2023. Agave continued operating in diminished capacity before its DAO formally wound down in early 2024.

StablR is a Malta-based, MiCA-regulated stablecoin issuer holding an Electronic Money Institution license from the Malta Financial Services Authority (MFSA), backed by strategic investors including Tether and Kraken. On May 24, 2026, an attacker compromised a single private key on the issuer's 1-of-3 minting multisig, gaining full administrative control and minting approximately 8.35 million USDR and 4.5 million EURR (~$13.5 million face value in unbacked tokens). The attacker extracted an estimated $2.8 million net profit after selling into thin DEX liquidity, causing both stablecoins to depeg by more than 20%; StablR subsequently froze minting and redemption, acknowledged the breach caused a MiCA-mandated 1:1 reserve shortfall, and engaged law enforcement and external cybersecurity firms.

ALEX Lab is a Bitcoin DeFi protocol built on the Stacks blockchain, offering a decentralized exchange, yield farming, cross-chain bridging via XLink, and a token launchpad. The protocol suffered two significant security incidents: a May 2024 exploit of its XLink bridge via a compromised private key (alleged to be linked to North Korea's Lazarus Group) that drained approximately $4.3 million, and a second smart contract vault exploit in June 2025 that resulted in roughly $8.3 million in losses. Despite user reimbursement pledges and post-exploit security upgrades, the repeated nature of major incidents materially reduces trust.

Injective Protocol is a Layer 1 blockchain built on the Cosmos SDK, designed for decentralized finance applications including derivatives, perpetuals, and spot trading via a fully on-chain order book. Founded in 2018 by Eric Chen and Albert Chon and backed by Binance Labs, Pantera Capital, and Mark Cuban, it launched its canonical mainnet in November 2021 and has grown to a top-tier DeFi chain. No regulatory enforcement actions have been identified against Injective; however, concerns exist around a 2025-2026 bug bounty dispute involving an alleged $500 million critical vulnerability, validator stake concentration, and third-party scams impersonating the protocol.

Decaf (decaf.so) is a non-custodial stablecoin wallet and payments platform built on Solana and Stellar, founded in 2022 and headquartered in Miami, FL, targeting emerging-market users who need low-cost cross-border payments and fiat cash-out. The company has raised a seed round from recognizable crypto-native and fintech investors including Visa, and has established formal partnerships with Circle, MoneyGram, and the Stellar Development Foundation. No regulatory actions, hacks, or fraud allegations have been identified as of the investigation date.

Zcash (ZEC) is a privacy-focused proof-of-work cryptocurrency launched on October 28, 2016, notable as one of the first large-scale deployments of zero-knowledge proofs (zk-SNARKs) outside academia. The project has a transparent organizational history, credentialed academic founders, and a resolved SEC investigation, but has faced significant controversies including a critical counterfeiting vulnerability disclosed in 2019, ongoing governance disputes that caused the entire Electric Coin Company development team to resign in January 2026, and regulatory pressure in multiple jurisdictions resulting in exchange delistings.

Raydium is an automated market maker (AMM) and decentralized exchange built on the Solana blockchain, launched in February 2021 and widely regarded as Solana's primary liquidity hub. On December 16, 2022, the protocol suffered a major security incident in which an attacker compromised an admin private key — suspected to be via a trojan on a team virtual machine — and drained approximately $4.4 million from eight constant product liquidity pools. Raydium responded with a patched program, a community-approved compensation plan funded by team-held RAY tokens, and has since migrated authority to a Squads multisig with hardware wallet and timelock protections.

Frax Finance is a decentralized stablecoin protocol launched in December 2020, originally pioneering a fractional-algorithmic design for its FRAX stablecoin. Following the collapse of algorithmic stablecoins in 2022, the protocol voted in 2023 to move to full collateralization, and has since expanded into a broader DeFi ecosystem including liquid staking (frxETH), a lending market (Fraxlend), a Layer 2 blockchain (Fraxtal), and a fully-backed institutional stablecoin (frxUSD) collateralized by BlackRock's BUIDL fund. The protocol faces documented concerns about historical centralization via a core-team-controlled multisig, an unresolved bug bounty attribution dispute, and prior security incidents including a DNS domain hijacking and an X account compromise.

Astroport is an automated market maker (AMM) DEX originally launched on the Terra blockchain in December 2021, developed by a joint venture of Delphi Labs, Terraform Labs, We3, and Attic Lab. The protocol suffered catastrophic TVL loss during the May 2022 Terra/Luna ecosystem collapse and was subsequently rebuilt as a multi-chain AMM spanning Neutron, Sei, Injective, and Terra 2.0. In July 2024, Astroport was directly exploited via a reentrancy vulnerability in IBC hooks on the Terra chain, resulting in approximately $6.4 million in losses.

Aave is a decentralized, non-custodial liquidity protocol built on Ethereum and multiple other blockchains, enabling users to supply assets to earn interest or borrow against overcollateralized positions. Founded in 2017 as ETHLend by Finnish lawyer Stani Kulechov, it rebranded to Aave in 2020 and grew into the largest DeFi lending platform by total value locked, holding roughly 60% market share in DeFi lending. A multi-year SEC investigation into the AAVE token closed without enforcement in December 2025. In April 2026 Aave was a downstream victim of the $292 million Kelp DAO rsETH bridge exploit (attributed to North Korea's Lazarus Group): the attacker used now-unbacked rsETH as collateral to borrow roughly $190 million, leaving Aave with bad debt and triggering an $8.45 billion, 48-hour deposit run that cut TVL from ~$45.8B to ~$28.6B. Aave's own smart contracts were not exploited — the loss stemmed from accepting compromised external collateral. The protocol led the industry-wide 'DeFi United' restitution coalition (raising over $300 million in ETH), pursued recovery of roughly $71 million in frozen attacker funds in U.S. court, and restored rsETH operations by late May 2026. Residual concerns are the bad-debt overhang from the April incident and ongoing governance tensions between token holders and Aave Labs, but the protocol remains a fundamentally legitimate blue-chip lending platform.

Bedrock Protocol is a multi-asset liquid restaking protocol developed by RockX, offering synthetic Bitcoin (uniBTC), liquid-staked ETH (uniETH), and IoTeX staking (uniIOTX). On September 27, 2024, the protocol suffered a critical smart contract exploit in which a flawed minting function allowed an attacker to mint uniBTC tokens at a 1:1 ETH-to-BTC ratio, draining approximately $2 million from DEX liquidity pools. Subsequent investigation by security firm Fuzzland, disclosed in June 2025, alleged that a former Fuzzland employee planted a supply-chain backdoor to execute the attack; Fuzzland stated it compensated Bedrock for losses and reported the matter to law enforcement.

LCX Exchange (Liechtenstein Cryptoassets Exchange) is a regulated crypto trading platform incorporated in Liechtenstein and registered with the country's Financial Market Authority (FMA). On January 8, 2022, the exchange suffered a hot wallet compromise resulting in the theft of approximately $6.8–7.94 million in various cryptocurrencies; LCX subsequently covered all user losses from company funds and cooperated with multi-jurisdictional law enforcement, ultimately freezing approximately 60% of stolen assets. As of 2024–2025, LCX remains operational, holds multiple licenses under the Liechtenstein Blockchain Act (TVTG), and has filed a pre-application for a pan-European MiCA license.

Convex Finance is a decentralized finance yield-optimization protocol launched in May 2021 on Ethereum, designed to boost rewards for Curve Finance liquidity providers and CRV stakers by aggregating veCRV voting power. The protocol rapidly became one of the largest DeFi platforms by total value locked, peaking near $21 billion in January 2022, and accumulated controlling influence over Curve governance by holding approximately 47–50% of all veCRV supply at peak. The team has remained anonymous since launch, and the protocol experienced a critical multi-signature vulnerability in December 2021 — discovered and disclosed by OpenZeppelin — which was patched without any loss of user funds.

Famous Fox Federation (FFF) is a Solana-native NFT ecosystem founded in September 2021, comprising a genesis collection of 7,777 fox PFP NFTs and several sub-collections under the 'Foxosphere' umbrella. The team, operating under the pseudonyms 'DraxxTs' and 'FoxyDev', has built and shipped multiple on-chain utilities including the Rafffle raffle platform, the Citrus NFT lending protocol, a token marketplace, and gamified staking missions. No regulatory actions, exploits, or rug-pull incidents have been identified through public sources, though the founders remain pseudonymous and $FOXY token value has declined substantially from its all-time high.

PaintSwap is a decentralized NFT marketplace and DeFi protocol originally launched on the Fantom Opera blockchain in May 2021, which migrated to the Sonic chain (formerly Fantom) in late 2024. The platform operates an open NFT marketplace, an AMM DEX, yield farming, and an on-chain idle MMORPG called Estfor Kingdom, all powered by its native BRUSH token. No confirmed rug pull, hack, or regulatory action has been identified; the primary documented incident is a domain hijacking by a third-party registrar in October 2025.

Alchemix Finance is an Ethereum-based DeFi protocol that offers self-repaying loans, allowing users to deposit yield-bearing collateral and borrow synthetic assets whose debt is automatically paid down by the underlying yield. The protocol has experienced several notable security incidents since its February 2021 launch, including a June 2021 alETH transmuter bug (~2,700 ETH overclaimed), and a July 2023 Curve pool exploit (~$20M stolen and subsequently fully returned). Alchemix has maintained operational continuity through each incident and continues to develop a V3 upgrade with an active Immunefi bug bounty program.

Jito Labs is a San Francisco-based software company that builds MEV (maximal extractable value) and liquid staking infrastructure for the Solana blockchain, most notably the Jito-Solana validator client and the JitoSOL liquid staking protocol. The company was named as a defendant in a civil RICO class action (Aguilar v. Baton Corporation, S.D.N.Y., No. 1:25-cv-00880) alleging it enabled insider front-running on the Pump.fun memecoin platform; plaintiffs voluntarily dismissed all claims against Jito Labs on September 26, 2025, without settlement payment, though the court later granted leave to refile and the broader case against co-defendants continues. Jito Labs previously suspended its public mempool in March 2024 after sandwich-attack bots exploited the feature, and subsequently took enforcement action against validators conducting such attacks in 2025.

BigONE is a Seychelles-registered centralized cryptocurrency exchange that launched globally in November 2017, evolving from Yunbi.com, a China-based exchange backed by Li Xiaolai's INBlockchain fund. In July 2025 the exchange suffered a $27 million supply-chain hack; simultaneously, blockchain investigator ZachXBT alleged the platform had processed at least $60 million in pig-butchering and romance-scam proceeds through a single deposit address over the prior seven months. The exchange operates without a license from major financial regulators (FCA, ASIC, CySEC) and carries a documented history of alleged wash trading, user complaints about frozen withdrawals, and tournament prize disputes.

On August 2, 2016, Bitfinex — a Hong Kong-based cryptocurrency exchange — was breached by hacker Ilya Lichtenstein, who exploited security failures in the exchange's multi-signature wallet architecture to steal 119,756 BTC (approximately $72 million at the time). Bitfinex controversially socialized the losses across all user accounts with a 36.067% haircut and issued BFX debt tokens, which were fully redeemed at par by April 2017. In February 2022, the U.S. Department of Justice arrested Lichtenstein and his wife Heather Morgan after seizing approximately 94,000 BTC worth $3.6 billion — the largest financial seizure in DOJ history at the time — and both subsequently pleaded guilty; Lichtenstein was sentenced to 5 years (released early in January 2026) and Morgan to 18 months.

Bunni Protocol is a Uniswap liquidity-incentive layer developed by Timeless Finance that evolved from a Uniswap v3 LP-token wrapper (v1) to a full DEX built on Uniswap v4 hooks (v2). On September 2, 2025, Bunni v2 suffered an $8.4 million flash-loan exploit caused by a rounding-direction vulnerability in its withdrawal mechanism — a class of issue that multiple auditors had flagged in advance. The team announced permanent shutdown in October 2025, citing the inability to fund the six-to-seven-figure re-audit required for a secure relaunch.

Cork Protocol is an Ethereum-based DeFi protocol offering tokenized depeg protection instruments analogous to credit default swaps, founded in 2023 by Phil Fogel and Rob Schmitt and backed by a16z CSX. On May 28, 2025, the protocol suffered a critical smart contract exploit resulting in approximately $12 million in losses, attributed to missing access controls in its Uniswap V4 hook integration. Stolen funds were subsequently laundered through Tornado Cash; a rebuilt version dubbed Cork Phoenix launched on mainnet in January 2026.

Cryptsy was a Florida-based altcoin exchange that operated from May 2013 until its collapse in January 2016, at which time it was one of the largest altcoin trading platforms by volume. Founder Paul Vernon, known as 'Big Vern,' allegedly staged a hack narrative to conceal his personal theft of over $1 million in customer funds, then fled to China, remotely destroyed the customer database, and was later designated a federal fugitive. A U.S. federal court issued a $8.2 million default judgment against Vernon in 2017, and a 17-count criminal indictment was unsealed in January 2022; Vernon remains a fugitive believed to be residing in China.

Avalanche (AVAX) is a Layer-1 proof-of-stake blockchain launched in September 2020 by Ava Labs, a company co-founded by Cornell University computer scientist Emin Gün Sirer alongside Maofan 'Ted' Yin and Kevin Sekniqi. The network is distinguished by its tri-chain architecture (X-Chain, P-Chain, C-Chain) and the Avalanche Consensus Protocol, which targets sub-second transaction finality. While the project has accumulated significant institutional backing, ETF filings, and a March 2026 CFTC/SEC commodity classification, it has also faced a significant 2022 whistleblower scandal alleging weaponization of litigation against competitors, multiple DeFi exploits on its ecosystem, and two disclosed critical infrastructure vulnerabilities.

Stellar (XLM) is a payments-focused blockchain co-founded by Jed McCaleb in 2014, ranked #22 by market cap (~$5.4B). The Stellar Development Foundation (SDF) is a non-profit with active institutional adoption including Franklin Templeton's BENJI fund ($1.98B AUM) and MoneyGram integration. No regulatory enforcement actions exist. Key risks include McCaleb's prior associations (Mt. Gox, eDonkey), SDF centralization (~30B XLM retained), a 35-day undetected Soroban Protocol 23 bug in October 2025, and third-party wallet/phishing incidents.

Kevin Rose is an American internet entrepreneur, venture investor, and co-founder of the PROOF Collective and Moonbirds NFT project. On January 25, 2023, Rose was the victim of a sophisticated spear-phishing attack in which he was socially engineered into signing a malicious transaction, resulting in the theft of approximately 40 NFTs valued at an estimated $1.09–$1.5 million USD from his personal krovault.eth wallet. Rose is categorized as a victim of crypto fraud, not a perpetrator; the incident is notable for illustrating signature-based approval risks in NFT marketplaces.

On March 19, 2026, DeFi protocol Neutrl experienced a suspected DNS hijack of its frontend domain, in which attackers allegedly social-engineered the protocol's DNS provider to redirect user traffic to a malicious interface targeting Permit2 wallet approvals. Neutrl paused its smart contracts as a precaution, migrated to new infrastructure by March 21, and confirmed all user funds remained safe via the protocol's custodial isolation framework. This incident is considered the earliest confirmed event in a six-week cluster of DeFi frontend hijacks in early 2026 that also struck HypurrFi (April 3) and CoW Swap (April 14).

XDC Network is an enterprise-grade, EVM-compatible Layer-1 blockchain co-founded in 2017 by Atul Khekade and Ritesh Kakkad through XinFin, focused on trade finance, payments, and RWA tokenization. The mainnet has been operational since 2019 with 801M+ transactions processed and 178K+ smart contracts deployed. XDC 2.0 upgrade (Q4 2024) introduced Byzantine fault tolerance security. ISO 20022-aligned for institutional interoperability. Co-founders operate a $125M XVC Tech investment fund. No major security incidents or regulatory actions found. Limited independent media coverage and relatively low public scrutiny for its market cap.

On April 3, 2026, the frontend domain hypurr.fi of HypurrFi — a DeFi lending protocol on Hyperliquid EVM — was hijacked via a social engineering attack targeting the domain registrar Openprovider. No user funds were confirmed drained and the protocol's smart contracts remained intact throughout; the team migrated frontend operations to hypurrfi.com and subsequently recovered control of the original domain. The incident is part of a documented six-week cluster of DeFi registrar-level frontend attacks in March–April 2026 targeting Neutrl, HypurrFi, and CoW Swap.

Arbitrum is an Ethereum Layer-2 optimistic rollup developed by Offchain Labs, co-founded in 2018 by Princeton academics Steven Goldfeder, Ed Felten (former U.S. Deputy Chief Technology Officer), and Harry Kalodner. It is the largest Layer-2 by total value locked and has achieved L2BEAT Stage 1 decentralization through its BoLD permissionless validation protocol launched in early 2025. The protocol has faced significant governance controversies since its March 2023 ARB token launch, including the AIP-1 pre-ratification scandal, a Gaming Catalyst Program funding dispute, vote-buying incidents, and a high-profile April 2026 Security Council emergency freeze of $71M in ETH linked to North Korean hackers that reignited centralization debates.

Gamma Strategies is a non-custodial, automated concentrated liquidity management protocol operating across multiple EVM chains, allowing users to deposit assets into managed vaults (Hypervisors) that actively rebalance Uniswap V3 and similar DEX positions. On January 4, 2024, the protocol suffered a price manipulation exploit across four vaults resulting in approximately $3.4–6.2 million in losses, caused by misconfigured price change thresholds in deposit proxy settings. The protocol paused deposits, engaged OpenZeppelin for a remediation audit, and committed to a long-term user compensation plan funded by protocol revenue, though full recovery of lost funds was not guaranteed at launch of that plan.

On November 22, 2023, the HECO Chain cross-chain bridge and the HTX exchange (formerly Huobi), both linked to entrepreneur Justin Sun, were simultaneously exploited in what security researchers attributed to a private key compromise. The HECO bridge lost approximately $87 million in various tokens; additional HTX hot wallet losses brought confirmed totals to roughly $113 million. Blockchain analytics firm Elliptic subsequently attributed the attack to North Korea's Lazarus Group, which began laundering funds through Tornado Cash in March 2024.

Polygon (formerly Matic Network) is a Layer 2 scaling solution for Ethereum, originally founded in 2017 by Jaynti Kanani, Sandeep Nailwal, and Anurag Arjun. The project rebranded from Matic Network to Polygon in February 2021 and has grown into one of the most widely used Ethereum scaling platforms, though it has faced regulatory scrutiny from the SEC, allegations of token misallocation by on-chain analytics firm ChainArgos, and a significant undisclosed security vulnerability patched in 2021. The network's native token migrated from MATIC to POL in September 2024 as part of a broader Polygon 2.0 roadmap.

Ionic Money is a decentralized money market protocol operating on Mode Network (an OP Superchain L2), rebranded from Midas Capital after two exploits on that predecessor protocol in 2023. In February 2025, Ionic Money suffered a social engineering attack in which attackers impersonating the Lombard Finance team convinced the protocol to list a counterfeit LBTC token as collateral, resulting in approximately $8.6–8.8 million in losses. The protocol and its affiliated ecosystem protocols on Mode Network absorbed significant bad debt, with no confirmed user compensation as of mid-2025.

Kannagi Finance was a decentralized yield aggregator launched on zkSync Era in June 2023. On July 29, 2023, its anonymous team executed an exit scam, draining approximately $2.13 million in user deposits and deleting all online presence. The incident is considered the first major rug pull on the zkSync Era network, with at least $1.1 million subsequently routed through the Tornado Cash mixer.

Lodestar Finance is an Arbitrum-based decentralized money market protocol that enables lending, borrowing, and leveraged trading against crypto collateral. On December 10, 2022, the protocol suffered a flash loan exploit in which an attacker manipulated the price oracle for the plvGLP collateral token, draining approximately $6.9 million from depositors. The protocol subsequently relaunched in April 2023 with a V2 update, partially compensating victims with recovered GLP assets and esLODE tokens, though the attacker was never identified and no confirmed negotiated return of funds occurred.

Odin.fun is a Bitcoin-native memecoin launchpad built on the Runes protocol, using the Internet Computer (ICP) blockchain as a settlement layer for fast, low-cost trading. The platform launched in early 2025 and attracted backing from the Taproot Wizards Ordinals project, but has suffered at least two confirmed security exploits — a $178,000 authentication vulnerability in April 2025 and a $7 million liquidity manipulation attack in August 2025 — with the latter draining user funds that the team has acknowledged it cannot fully repay from its own treasury.

Orion Protocol is a decentralized liquidity aggregator that connects centralized and decentralized exchanges into a single non-custodial trading interface, launched in 2020 with its native ORN token. On February 2, 2023, the protocol suffered a reentrancy exploit that drained approximately $3 million across its Ethereum and Binance Smart Chain deployments through a malicious fake-token attack against an unaudited exchange contract. The protocol subsequently rebranded to Lumia in late 2024, migrating all ORN tokens to LUMIA at a 1:1 ratio.

Exponent Finance is a Solana-based yield tokenization protocol launched in late 2024 that enables users to separate yield-bearing assets into tradable Principal Tokens (PT) and Yield Tokens (YT), analogous to Pendle Finance on Ethereum. The protocol has attracted $7.1 million in venture funding from institutional backers including Multicoin Capital, Solana Ventures, and RockawayX, and processed over $2 billion in yield volume across 35,000+ users. Key risk considerations include a small but growing team, a SAFE-plus-token-warrant capital structure suggesting a future token launch, TVL that experienced a sharp 60%+ drawdown tied to incentive expiry, and an audit history that is active but still maturing.

Fuse Wallet is a Solana-based smart wallet developed by Squads Labs, the team behind Squads Protocol, Solana's leading multisig and smart account infrastructure. Launched in public TestFlight in June 2024 and on the Apple App Store in December 2025, Fuse replaces traditional seed phrases with a multi-factor authentication model built on Squads Protocol's audited smart account standard. Squads Labs has raised approximately $40.9 million across multiple funding rounds from institutional investors including Electric Capital, Coinbase Ventures, and Multicoin Capital, and no known regulatory actions, hacks, or fraud allegations have been identified against the product.

Penpie is a yield optimizer and vote-escrowed liquidity layer built on top of Pendle Finance, developed by the Magpie XYZ team. On September 3, 2024, the protocol was exploited for approximately $27 million through a reentrancy vulnerability in its batch reward harvesting function, compounded by a permissionlessly registered fake Pendle market. The attacker laundered substantially all stolen funds through Tornado Cash within days, rejecting a negotiated bounty offer from the Penpie team.

Pike Finance is a natively cross-chain lending protocol built on Wormhole's messaging layer and Circle's Cross-Chain Transfer Protocol (CCTP), which launched its beta mainnet in early 2024. Within days of launch, the protocol suffered two separate exploits on April 26 and April 30, 2024, draining approximately $299K and $1.68M respectively for a combined loss of roughly $1.98M. The first exploit stemmed from an improperly validated CCTP integration; the second arose from a storage layout corruption introduced during the emergency patch, allowing attackers to reinitialize and take over spoke contracts.

Render Network (RENDER) is a decentralized GPU rendering network for AI and 3D graphics founded by Jules Urbach (OTOY CEO, 70+ patents). $30M raised in December 2021 from Multicoin Capital, Solana Foundation, and Alameda Research. Migrated from Ethereum to Solana in November 2023. No protocol-level exploits recorded. Key concerns include Alameda Research co-investment, OTOY's 5% perpetual fee and dual governance role, ~50% treasury/escrow token concentration, and 86% decline from ATH. OctaneX featured in Apple M4 keynote.

DRiP Haus (drip.haus) is a Solana-based digital collectibles distribution platform that uses compressed NFT technology to enable creators to deliver free or low-cost weekly drops to subscribers. Founded in late 2022 by Vibhu Norby, a named serial entrepreneur with a verifiable track record, the company raised $11.5 million across two funding rounds before being acquired by Jupiter, Solana's leading DeFi aggregator, in an all-cash deal announced April 2, 2025. No regulatory actions, fraud allegations, or significant security incidents have been identified; the primary risk factors are platform-level policy changes that reduced accessibility for collectors and the uncertainties inherent in post-acquisition integration.

Bitcoin (BTC) is the world's first decentralized cryptocurrency, introduced in a 2008 whitepaper by the pseudonymous Satoshi Nakamoto and launched in January 2009. As of May 2026, it is the largest cryptocurrency by market capitalization (~$1.6T), classified as a digital commodity by U.S. regulators, and backed by institutional infrastructure including 11 SEC-approved spot ETFs. Bitcoin's established protocol and regulatory clarity distinguish it from most crypto assets, though it carries material risks including market volatility, mining centralization, illicit-use association, and exchange counterparty exposure.

QuadrigaCX was Canada's largest cryptocurrency exchange, founded in 2013 by Gerald Cotten and Michael Patryn. Following CEO Gerald Cotten's reported death in India in December 2018, approximately C$215 million owed to over 76,000 customers became inaccessible. The Ontario Securities Commission concluded in June 2020 that Cotten had operated the exchange as a Ponzi scheme for years, committing fraud through fictitious trading accounts and misappropriating roughly C$169 million in customer funds.

Raft Protocol was an Ethereum-based over-collateralized stablecoin protocol that allowed users to mint R, a USD-pegged stablecoin, against liquid staking derivative (LSD) collateral such as stETH and cbETH. On November 10, 2023, an attacker exploited a precision rounding error in the protocol's share-token minting contract using a flash loan, minting approximately $6.7 million in unbacked R stablecoins and draining roughly $3.3 million worth of ETH from the protocol. In a notable twist, the attacker lost money on the exploit — a coding error in their own attack script sent 1,570 ETH (~$3.25 million) to a burn address, leaving them with a net loss of approximately 4 ETH after gas and flash loan costs.

Optimism is an Ethereum Layer 2 optimistic rollup network operated by OP Labs PBC, with ecosystem governance stewarded by the Optimism Foundation. Launched on mainnet in January 2021, it issues the OP governance token and anchors the Superchain — a shared framework that powers Base, Zora, Mode, and more than two dozen other OP Stack-based chains. The network has a credible technical pedigree and documented decentralization progress, but retains meaningful centralization in its sequencer and upgrade-key infrastructure, and has experienced several notable security incidents.

Resolv Labs is a UAE-based DeFi startup that operates the Resolv Protocol, issuing the USR delta-neutral stablecoin backed by ETH collateral hedged with perpetual futures short positions. On March 22, 2026, an attacker compromised the protocol's off-chain signing infrastructure via stolen contractor credentials, minting approximately 80 million unbacked USR tokens and extracting roughly $25 million in ETH, causing USR to depeg by up to 97% within minutes. The protocol acknowledged effective insolvency in the immediate aftermath and has since initiated a tiered compensation plan while rebuilding infrastructure security.

Firedancer is an independent, high-performance Solana validator client developed by Jump Crypto (Jump Trading Group), written from scratch in C primarily by a team led by Chief Science Officer Dr. Kevin Bowers and founding engineer Ritchie Patel. Released under the Apache 2.0 open-source license, it aims to increase Solana's throughput toward one million transactions per second while improving network resilience through client diversity. As of May 2026, the client is live on Solana mainnet with roughly 20% of validators running it, though full rollout remains cautious pending completion of comprehensive third-party security audits. The project carries a notable backer-risk signal: Jump Crypto's parent subsidiary Tai Mo Shan settled SEC charges for $123 million in December 2024 over TerraUSD manipulation, and a separate CFTC investigation was reported in 2024 with no publicly disclosed outcome as of this writing.

Roger Ver (born 1979, San Jose, California) is an entrepreneur and early Bitcoin investor nicknamed 'Bitcoin Jesus' for his prominent role evangelizing cryptocurrency beginning in 2011. He later became CEO and Executive Chairman of Bitcoin.com and a principal promoter of Bitcoin Cash (BCH) following the 2017 hard fork. In April 2024 he was arrested in Spain on a U.S. Department of Justice indictment charging mail fraud, tax evasion, and filing false tax returns related to approximately $48 million in allegedly concealed capital gains; in October 2025 he resolved the charges without prison time by entering a deferred prosecution agreement and paying $49.9 million.

Seneca Protocol is an omnichain CDP (collateralized debt position) protocol deployed on Ethereum mainnet and Arbitrum that allowed users to borrow a stablecoin (senUSD) against yield-bearing collateral assets. On February 28, 2024, a critical arbitrary external-call vulnerability in the protocol's Chamber contract was exploited, resulting in approximately $6.4 million in user funds being drained. Roughly 80% of stolen funds were returned after an on-chain negotiation, but a net loss of approximately $1.28 million remained, and evidence surfaced that the vulnerability had been reported to the team prior to launch.

Aave V3 is the third major iteration of the Aave decentralized lending protocol, one of the largest in DeFi with over $14 billion in total value locked across 21 chains as of May 2026. The protocol's core smart contracts have not been directly exploited; however, in April 2026, a $292 million bridge exploit targeting integrated asset KelpDAO's rsETH generated significant bad debt on Aave V3 markets, an event flagged by on-chain investigator ZachXBT. The protocol demonstrated institutional resilience by coordinating a cross-industry recovery fund (DeFi United) that ultimately raised over $327 million, with full rsETH operations restored by May 25, 2026.

BCAP is the world's first tokenized venture capital fund interest, issued in April 2017 as a Regulation D security token. It represents a non-voting economic interest in Blockchain Capital's Fund III. The firm manages $2B+ AUM with portfolio companies including Coinbase, Kraken, and Circle. Key risks include a $6.3M SIM-swap attack on co-founder Bart Stephens, Brock Pierce founding controversy, Epstein/Coinbase periphery connections, and effectively zero secondary market liquidity despite the token wrapper. No SEC enforcement actions exist.

THORChain is a decentralized cross-chain liquidity protocol built on the Cosmos SDK that enables native asset swaps across major blockchains without wrapped tokens. The protocol has suffered at least six significant security incidents since 2021, including a May 15, 2026 exploit in which a malicious validator node exploited a GG20 threshold signature scheme vulnerability to drain approximately $10.7–10.8 million across nine chains. THORChain has also faced documented use by the North Korean Lazarus Group as a primary money laundering channel, a $200 million insolvency crisis in early 2025 requiring a debt-to-equity restructuring, and ongoing questions about its permissionless design and unwillingness to block illicit flows.

Canton Network (CC) is an enterprise-grade Layer-1 blockchain developed by Digital Asset Holdings, designed for tokenizing real-world assets with configurable privacy features and institutional-grade compliance. Ranked approximately #18 by market cap at roughly $5.9 billion as of May 2026, the network has attracted major institutional validators including DTCC, Goldman Sachs, Visa, and Euroclear, and its parent company Digital Asset is pursuing a reported $300 million fundraise at a $2 billion valuation led by a16z crypto. The network faces documented criticism from crypto-native observers over centralization trade-offs, data mutability departing from traditional blockchain immutability norms, and concentrated influence held by co-founder DRW Trading Group.

Uniswap is a decentralized exchange (DEX) protocol built on Ethereum, founded in November 2018 by Hayden Adams and operated commercially by Uniswap Labs. It is the largest DEX by trading volume globally, using an automated market maker (AMM) model. The protocol has faced significant regulatory scrutiny — including an SEC Wells notice in April 2024 (closed without action in February 2025), a CFTC settlement resulting in a $175,000 penalty in September 2024, and a multi-year scam-token class action dismissed with prejudice in March 2026 — while remaining operationally active and technologically mature through its v4 release.

SIR.trading (Synthetics Implemented Right) is an Ethereum-based DeFi protocol launched on February 20, 2025, offering leveraged trading without liquidation risk or volatility decay. On March 30, 2025, an attacker exploited a transient storage vulnerability in the protocol's Vault contract to drain the entire $355,000 TVL — one of the first documented real-world exploits targeting Ethereum's EIP-1153 transient storage feature introduced in the Dencun upgrade. The protocol subsequently relaunched after completing additional security audits, but no stolen funds were recovered.

On April 9, 2023, SushiSwap's RouteProcessor2 contract — deployed just one day earlier across 14 blockchain networks — was exploited due to a failure to validate user-supplied pool addresses, allowing an attacker to redirect token transfers from wallets that had approved the contract. Approximately $3.3 million (roughly 1,800 WETH) was drained, with a single high-profile victim (@0xsifu) accounting for the majority of losses. Whitehat security teams front-ran further exploitation and recovered over $750,000, while SushiSwap committed to making all affected users whole through a two-tier compensation process.

Quant Network (QNT) is a UK-incorporated enterprise blockchain interoperability platform built on proprietary Overledger technology. Founded by Gilbert Verdian, the company has verified partnerships with major UK banks (Barclays, HSBC, Lloyds, NatWest) through the UK Regulated Liability Network, and completed Project Rosalind with the Bank of England and BIS. No SEC enforcement actions exist. Key concerns include closed-source code limiting auditability, centralized governance, a pay-to-play developer licensing model, and some partnership announcements with limited verifiable follow-through.

Aerodrome Finance is a decentralized exchange (DEX) and automated market maker (AMM) launched on August 28, 2023 on Coinbase's Base Layer-2 network. It operates a ve(3,3) tokenomics model inherited from Velodrome Finance and has grown to become the dominant DEX on Base by total value locked and trading volume. The protocol has no history of smart contract exploits but suffered a significant DNS hijacking attack in November 2025 that resulted in approximately $700,000 to $1 million in user losses.

Dialect (dialect.to) is a Solana-focused smart messaging and infrastructure company best known for co-developing the Blinks (Blockchain Links) and Actions standard with the Solana Foundation, launched in June 2024. Founded in 2021 by Chris Osborn, a named founder with a verifiable academic and professional background, the company raised a $4.1M seed round in March 2022 led by Multicoin Capital and Jump Crypto. No regulatory actions, fraud allegations, or confirmed security incidents specific to Dialect have been documented; the principal risk surface is the Blinks protocol itself, which introduces phishing and malicious-endpoint attack vectors that Dialect attempts to mitigate through a public registry of verified actions.

Helius (helius.dev) is a Toronto-founded, Solana-focused developer infrastructure company offering RPC nodes, enhanced APIs, webhooks, data streaming, and validator services. Founded in June 2022 by former Coinbase and AWS engineers, the company has raised $34.85 million across three rounds led by Founders Fund, Haun Ventures, and Foundation Capital, and operates as a key infrastructure layer for the Solana ecosystem. No regulatory actions or security breaches have been identified against Helius; the main risk signals are minor service reliability incidents and unresolved workplace conduct allegations against its CEO.

The DAO was a decentralized autonomous organization launched on Ethereum in April 2016 that raised approximately $150 million in ETH — the largest crowdfund in history at the time. On June 17, 2016, an unknown attacker exploited a reentrancy vulnerability in its smart contract code, draining approximately 3.6 million ETH (roughly $60–70 million at the time). The incident led to a contentious Ethereum hard fork on July 20, 2016, splitting the chain into Ethereum (ETH) and Ethereum Classic (ETC), and triggered the SEC's 2017 finding that DAO tokens were unregistered securities.

Treasure DAO is an Arbitrum-based NFT gaming and metaverse ecosystem centered around the MAGIC token, founded in 2021 by John Patten and Karel Vuong. In March 2022, its NFT marketplace suffered a critical smart contract exploit in which attackers purchased approximately $1.4 million worth of NFTs at zero cost by passing a zero-quantity parameter to the buyItem() function, bypassing all payment validation. The project has since undergone significant restructuring, including the shutdown of its proprietary zkSync-based Treasure Chain in May 2025, mass layoffs, and a strategic pivot toward AI agent infrastructure.

Chainlink is a decentralized blockchain oracle network founded in 2017 by Sergey Nazarov and Steve Ellis, with Cornell University professor Ari Juels co-authoring the whitepaper. The protocol provides smart contracts with tamper-resistant access to off-chain data and computation, holding an estimated 69–70% share of the oracle market and enabling over $26 trillion in cumulative transaction value as of 2025. No regulatory actions have been filed against Chainlink or its parent entity, Chainlink Labs; the primary documented concerns center on token-supply centralization and a 2020 campaign by an anonymous entity publishing unverified fraud allegations that were subsequently discredited.

No verifiable information about an entity named 'Burgeleth' was found across any indexed web source as of May 2026. Exhaustive searches across news outlets, blockchain explorers, social media platforms, regulatory databases, domain registries, and crypto-specific intelligence sources (ZachXBT, Chainalysis, Scam Sniffer) returned zero results matching this name in a crypto or financial context. The slug may refer to an extremely obscure or newly created entity, an alternate spelling of a different entity, or a name that has not yet generated any publicly indexed presence.

Porkbun LLC is a legitimate ICANN-accredited domain registrar founded circa 2014-2015, headquartered in Sherwood, Oregon, and managing over 3.45 million domains. While the company is not itself a scam operation, it has attracted scrutiny from the crypto security community — including on-chain investigator ZachXBT — for hosting phishing infrastructure linked to Angel Drainer and Inferno Drainer wallet-draining services, including fake Ledger sites. Third-party tracking platforms document hundreds of flagged phishing domains registered through Porkbun and allege that the company's abuse-response enforcement has been inadequate, with a majority of reported domains remaining active after formal abuse reports.

Pendle is a permissionless yield-trading protocol on Ethereum, launched in 2021 by TN Lee and Vu Nguyen, that allows users to separate and trade the principal and yield components of yield-bearing assets. In September 2024, Penpie — an independent yield optimizer built on top of Pendle — suffered a $27 million reentrancy exploit that was made possible in part by Pendle's permissionless market creation design. Although Pendle's own contracts were not directly exploited, the protocol's architecture contributed to the attack surface, and all 11,261 ETH in stolen funds were subsequently laundered through Tornado Cash.

Bittensor is a decentralized blockchain protocol functioning as a peer-to-peer marketplace for machine intelligence, using the TAO token to reward AI model contributors. In July 2024, the protocol was the target of a supply chain attack via a malicious version of its official PyPI package, resulting in the theft of approximately $28 million in TAO tokens from 32 wallets. A civil lawsuit filed in January 2025 alleges that former Opentensor Foundation employees orchestrated the attack, and on-chain investigator ZachXBT identified a key suspect through NFT wash-trade analysis and Railgun de-mixing.

Ledger SAS is a Paris-based hardware cryptocurrency wallet manufacturer founded in 2014, producing the Nano S and Nano X devices used by millions worldwide. Despite its status as a legitimate and established company, Ledger has been involved in two major security incidents: a 2020 customer database breach exposing over 1 million email addresses and 272,000 physical addresses, and a December 2023 supply chain attack on its @ledgerhq/connect-kit npm package that drained approximately $600,000–$850,000 from users of multiple DeFi protocols via the Angel Drainer malware-as-a-service. A third-party data breach via payment processor Global-e was disclosed in January 2026.

Transak is a fiat-to-crypto on-ramp infrastructure provider founded in 2019 and serving over 8 million users across 160+ countries, with integrations into major platforms including MetaMask, Phantom, and Uniswap. In October 2024, a phishing attack on an employee's laptop led to unauthorized access to a third-party KYC vendor's dashboard, exposing the personal identity documents of approximately 92,554 users globally, including names, dates of birth, government-issued IDs, and selfie photos. The breach resulted in a $601,000 class action settlement covering U.S.-based affected users, and the Stormous ransomware group claimed responsibility, alleging extraction of over 300GB of data.

TON (The Open Network) is a layer-1 blockchain originally developed by Telegram, abandoned in 2020 following an SEC enforcement action that compelled a $18.5 million penalty and $1.22 billion investor return, and subsequently revived by an independent TON Foundation. By 2024, rapid ecosystem growth attracted a significant wave of phishing campaigns, wallet drainer toolkits, pyramid schemes, and rug pull activity, with over 1,200 fraud cases reported in H1 2024 alone. In May 2026, Pavel Durov announced Telegram would reassume control as the network's largest validator, reintroducing centralization risk to a network already under scrutiny for facilitating illicit marketplaces.

Trezor is a legitimate Prague-based hardware wallet manufacturer (SatoshiLabs) and one of the oldest in the industry, but it has accumulated a significant threat ecosystem around its brand. A January 2024 breach of its third-party support portal exposed contact data for approximately 66,000 users, which subsequently fueled targeted phishing campaigns delivered via email, physical mail, and fake apps. Trezor hardware devices have also been subject to disclosed physical attack vectors, including an alleged unpatchable flaw in the STM32 microcontroller used in the Trezor T model.

Compound Finance is an Ethereum-based decentralized lending protocol founded in 2017 by Robert Leshner and Geoffrey Hayes that allows users to lend and borrow cryptocurrencies algorithmically. The protocol has been subject to multiple significant security and governance incidents, including a 2021 smart contract bug that placed up to ~280,000 COMP tokens (approximately $80–90 million) at risk, a 2024 alleged governance takeover by a whale known as 'Humpy,' and a July 2024 front-end DNS hijacking attack tied to the Squarespace registrar migration. Despite these incidents, the core smart contract protocol has not been exploited; the recurring issues have primarily affected token distribution, governance integrity, and front-end infrastructure.

Velodrome Finance is an automated market maker (AMM) and decentralized exchange (DEX) launched on June 2, 2022, on the Optimism Layer 2 network. It is a fork and improvement of Andre Cronje's Solidly Exchange, implementing a ve(3,3) governance and liquidity incentive model. The protocol has experienced three documented security incidents: an insider theft of $350,000 by a team member in August 2022, a DNS/frontend social-engineering attack in November–December 2023 resulting in approximately $250,000 in user losses, and a second DNS hijacking in November 2025 attributed to a NameSilo registrar insider, resulting in estimated losses of $700,000–$1,000,000. Smart contracts have not been directly exploited; all monetary losses have stemmed from front-end and operational security failures.

CoinSpot is an Australian cryptocurrency exchange founded in 2013 by Russell Wilson and headquartered in Melbourne. It is registered with AUSTRAC as a Digital Currency Exchange (since May 2018) and holds ISO 27001 certification. On November 8, 2023, the platform suffered a suspected private key compromise resulting in the loss of approximately 1,283 ETH (~$2.4 million USD), with stolen funds bridged to Bitcoin via THORChain and Wan Bridge. No customer funds were reported lost in the incident.