bZx Protocol
Summary
bZx Protocol was an Ethereum-based decentralized margin trading and lending protocol founded in 2017 by Tom Bean and Kyle Kistner. The protocol suffered four separate security incidents between 2020 and 2021, culminating in a ~$55 million hack attributed to a phishing-induced private key compromise. Following a transfer of control to a DAO structure, the successor Ooki DAO was sued by the CFTC for operating an unregistered derivatives exchange, ultimately receiving a default judgment, trading bans, and a court-ordered shutdown in June 2023.
Connected Entities
1 entities · 10 linked investigations- + 7 more
Timeline(17 events)
2017-08
Tom Bean and Kyle Kistner conceive bZx Protocol after reading 0x, Kyber, and Bancor whitepapers.
Decrypt / bZx team interviews2019-06
Fulcrum DeFi margin trading interface launches on Ethereum mainnet.
IQ.wiki / Ivan on Tech Academy2020-02-15
First flash loan attack on Fulcrum: attacker exploits undercollateralization logic bug, netting approximately $350,000 in ETH.
CoinDesk2020-02-18
Second flash loan attack: attacker manipulates sUSD price oracle on Kyber Network and extracts approximately $633,000 in ETH.
CoinDesk2020-09-14
Third exploit: iToken duplication bug allows attacker to mint ~$8.1 million in tokens including LINK, ETH, USDT, USDC, and DAI.
Finance Magnates / bZx Incident Report2021-08-23
bZeroX, LLC transfers protocol control to bZx DAO; founders describe move as making the protocol 'enforcement-proof'.
CFTC Press Release 8590-222021-11-05
Fourth and largest breach: phishing email compromises developer private keys; over $55 million drained from Polygon and BSC deployments and affected user wallets.
CoinDesk / The Record2021-11-12
Kaspersky attributes November 2021 hack to BlueNoroff, a North Korean state-linked threat actor.
Halborn Security blog2022-05-02
Class action Sarcuni et al. v. bZx DAO filed in S.D. California alleging negligence and joint and several liability of all BZRX token holders.
Skadden Insights2022-09-22
CFTC simultaneously settles charges against bZeroX LLC and founders ($250,000 penalty) and files new civil enforcement action against Ooki DAO.
CFTC Press Release 8590-222023-03
U.S. district court rules bZx DAO plausibly constitutes a 'general partnership' under California law, opening all BZRX token holders to joint and several liability.
The Block2023-06-09
Judge William H. Orrick grants CFTC default judgment against Ooki DAO: $643,542 penalty, permanent trading bans, and mandatory website shutdown ordered.
CFTC Press Release 8715-23Decision Log
- hash: ECTKSPnvLnYAGipfcakjRdue5cbPcFV7tJf3SmML6ux7
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-5
generated: 5/30/2026, 12:58:35 PM
last updated: 5/30/2026, 12:58:41 PM
avoid.net — verified advice for a post-truth world