Zunami Protocol
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·2d7Lt6…EGiySummary
Zunami Protocol is an Ethereum-based DeFi yield aggregator and stablecoin issuer (UZD, zETH) that suffered at least four separate security incidents between January 2023 and May 2025, losing a combined estimated $2.86 million or more in user funds. The protocol is notable for ignoring a prior warning from SlowMist before its largest smart contract exploit, and for a May 2025 incident in which an admin key compromise allegedly drained $500,000, with the team subsequently going silent for weeks and development activity having ceased months prior.
Connected Entities
1 entitiesTimeline(8 events)
26 January 2023
Zunami Protocol's fund transfer is sandwich-attacked in the mempool; approximately $49,000 is lost.
February 2023
A series of 13 flash loan transactions exploit price gaps between Zunami liquidity pools; combined losses from January and February 2023 incidents totals approximately $260,000 per Zunami's own disclosure.
June 2023
SlowMist privately notifies Zunami Protocol of the price manipulation vulnerability that would later be exploited; team response is described as 'unpleasant' and no fix is applied.
13 August 2023
Zunami Protocol is exploited via a flash loan price manipulation attack targeting the MIMCurveStakeDao strategy; approximately $2.1 million (1,184 ETH) is drained from zETH and UZD pools on Curve Finance. UZD falls over 99% and zETH falls over 88%.
14 August 2023
Zunami confirms the exploit on social media; stolen funds are laundered via Tornado Cash. PeckShield, CertiK, Halborn, and Ackee Blockchain publish post-mortem analyses.
September 2023
Zunami Protocol completes an angel funding round and announces development of a V2 update.
14 May 2025
An admin key compromise results in the theft of approximately $500,000 in zunUSD and zunETH collateral. An admin role is granted 7 minutes before 296,456 LP tokens are transferred to an attacker wallet. Funds are laundered via Tornado Cash.
May 2025
Zunami team CEO and CTO make public statements; CTO alleges Russian police involvement and possible laptop cloning. Team subsequently goes silent for approximately three weeks. GitHub shows no commits for at least three months prior.
Decision Log
- hash: HWnMRzo82LLDxthnr8vjaC5RkB9yEGSpBgePDJhuPMDk
This investigation is cryptographically anchored to the Solana blockchain (1 event). 16 of 20 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:39 AM
last updated: 8/30/2026, 1:16:30 AM
avoid.net — verified advice for a post-truth world