Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·5CqW8b…HsVLSummary
Ooki Protocol (formerly bZx Protocol) is a decentralized margin trading and lending protocol on Ethereum that was the subject of the first-ever CFTC enforcement action against a DAO, resulting in a 2023 default judgment ordering the protocol to cease operations and pay $643,542 in penalties. The protocol suffered four separate security incidents between 2020 and 2021 totaling over $64 million in losses, including a $55 million phishing-based hack attributed by Kaspersky to the North Korean state-linked BlueNoroff group. Following the CFTC judgment, the Ooki DAO's website was ordered shut down and the protocol has been effectively defunct.
Connected Entities
2 entities- + 7 more
Timeline(14 events)
2017
bZx Protocol founded by Tom Bean and Kyle Kistner after reading DeFi whitepapers from 0x, Kyber, and Bancor.
June 2019
bZeroX, LLC begins operating the bZx Protocol, offering leveraged margin trading and lending without regulatory registration.
15 February 2020
First flash loan attack on bZx Protocol: attacker manipulates WBTC price oracle and nets approximately 1,193 ETH (~$318,000).
18 February 2020
Second flash loan attack on bZx Protocol within four days: attacker manipulates sUSD price feed, netting approximately $633,000.
14 September 2020
Third bZx exploit: iToken duplication bug allows attacker to mint tokens without collateral; approximately $8.1 million in LINK, ETH, and stablecoins stolen. Majority later recovered.
23 August 2021
bZeroX transfers control of the bZx Protocol to the bZx DAO. Founders market the transfer to the community as making operations 'enforcement-proof.'
5 November 2021
Fourth and largest bZx hack: phishing email compromises a developer's private keys; approximately $55 million stolen across Polygon and Binance Smart Chain.
12 November 2021
Kaspersky attributes the November 2021 bZx hack to BlueNoroff, a subgroup of North Korea's state-sponsored Lazarus Group (APT38).
December 2021
bZx DAO rebrands as Ooki DAO; BZRX token migrated to OOKI token at a 1:10 ratio.
May 2022
Class action lawsuit Sarcuni et al. v. bZx DAO et al. filed in U.S. District Court, S.D. California, alleging negligent security practices caused $55 million hack.
22 September 2022
CFTC simultaneously: (1) files and settles charges against bZeroX LLC and founders Tom Bean and Kyle Kistner for $250,000; and (2) files the first-ever federal charges against a DAO — Ooki DAO — for CEA violations.
27 March 2023
U.S. District Court denies motion to dismiss in Sarcuni class action, finding bZx/Ooki DAO is plausibly a general partnership and token holders are plausibly liable as partners.
8 June 2023
U.S. District Judge William H. Orrick grants CFTC default judgment against Ooki DAO: $643,542 penalty, permanent trading bans, and order to shut down the Ooki DAO website.
9 June 2023
CFTC Division of Enforcement Director Ian McGinley declares ruling demonstrates 'DeFi is not a regulatory-free zone.' Ooki DAO announces shutdown.
Decision Log
- hash: 23oJZKzc3DcD4gE73T2M2Nd9wikDxkp1ZzxK5RrDiQyC
This investigation is cryptographically anchored to the Solana blockchain (1 event). 32 of 36 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:55:01 AM
last updated: 9/11/2026, 5:45:57 AM
5 viewsavoid.net — verified advice for a post-truth world