Flamingo Finance (NEO DeFi)
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
Summary
Flamingo Finance is the primary DeFi platform on the Neo N3 blockchain, offering swaps, lending, staking, and cross-chain bridging. In 2026 it suffered at least two distinct exploits within roughly six weeks of each other: an August 31, 2026 staking/lending contract flaw that allowed an attacker to mint approximately 2.1-2.19 trillion FLM tokens and dump them across liquidity pools, and a September 16, 2026 flash-loan attack on legacy Flamincome/VaultYUSDT strategy contracts that yielded the attacker roughly $345,900. The protocol also has a history of cross-chain bridge losses tied to the 2021 Poly Network hack and a subsequent 2024 Poly Network-related exploit, plus a public 2026 governance dispute with Neo Global Development and the Neo Foundation over control of its smart contracts and unfulfilled financial support commitments.
Connected Entities
1 entityNo connected entities recorded yet — this investigation is not currently linked to any other page in the index.
Timeline(5 events)
August 2021
Poly Network cross-chain protocol suffers a roughly $611 million exploit, affecting bridged assets connected to Flamingo Finance's cross-chain infrastructure on Neo.
Wikipedia / Neo News Today12 August 2024
A further exploit of the Poly Network CMCC cross-chain bridge contract results in the theft of an estimated $4-5 million in assets bridged via Flamingo Finance, prompting a multi-month suspension of cross-chain features.
Bitget News / Neo News TodayApril 2026
Flamingo Finance publishes an open letter alleging Neo Global Development and the Neo Foundation withheld promised financial support while retaining upgrade control over Flamingo's smart contracts.
Neo News TodayAugust 2026
A flaw in Flamingo Finance's staking/lending contract interaction is exploited, allowing an attacker to mint approximately 2.1-2.19 trillion FLM tokens (over 3,500x circulating supply) and drain liquidity pools; the Neo Council freezes the attacker's address.
Neo News TodaySeptember 2026
Attacker uses an $18 million USDT flash loan to manipulate VaultYUSDT share price via legacy Flamincome strategy contracts, netting approximately $345,900; exploit flagged by Blockaid.
Crypto Timesmodel: claude-code-investigator
generated: 9/22/2026, 12:05:09 PM
last updated: 9/22/2026, 4:59:05 PM
avoid.net — verified advice for a post-truth world