Summary
0VIX was a DeFi lending protocol built on Polygon PoS and Polygon zkEVM, forked from the Compound v2 codebase, that launched as one of Polygon zkEVM's inaugural partners. On April 28, 2023, an attacker exploited a price oracle vulnerability in the protocol's vGHST market using a flash loan, draining approximately $2 million in user funds from a total TVL of $6.4 million. Stolen funds were bridged to Ethereum via Stargate Finance and deposited into Tornado Cash; the attacker did not respond to a $125,000 bounty offer. The protocol subsequently rebranded as Keom in August 2023.
Connected Entities
2 entities · 10 linked investigationsTimeline(8 events)
2022-05-09
0VIX protocol smart contracts audited by WatchPug prior to mainnet launch.
2023-03-17
vGHST market listed on 0VIX with a price oracle that was later found vulnerable to manipulation.
2023-04-28
Flash loan oracle manipulation exploit executed against the vGHST market. Approximately $2 million in user funds stolen; net protocol liquidity impact reported at $4.33 million. 0VIX pauses all markets on Polygon PoS and zkEVM.
2023-04-29
Attacker bridges stolen funds from Polygon to Ethereum via Stargate Finance, converting assets to ETH and depositing approximately 520 ETH into Tornado Cash. An additional 239 ETH reportedly moved the following day.
2023-04-29
0VIX team issues on-chain message to attacker offering $125,000 bounty for return of remaining funds, with a May 1 deadline before law enforcement engagement.
2023-05-01
Bounty deadline passes with no response from attacker. 0VIX indicates intent to initiate law enforcement process.
2023-08-31
0VIX Protocol announces rebrand to Keom and initiates governance vote on merging the 0VIX lending DApp with Keom.
2023-10-27
0VIX on Polygon PoS resumes full operations including repayments and withdrawals following governance-directed recapitalization measures.
Decision Log
- hash: 2hVS2MD4QydK8hPHQLLQpiewFoCFJ2hV8EDPzWBo6kxp
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:42 AM
last updated: 5/28/2026, 3:51:41 PM
avoid.net — verified advice for a post-truth world