{"investigation":{"slug":"abracadabra-spell","entity_name":"Abracadabra Spell","trust_score":10,"severity_base":null,"score_modifier":0,"confidence":1,"status":"published","content_type":"investigation","summary":"Abracadabra.money is a multi-chain DeFi lending protocol that allows users to mint the MIM (Magic Internet Money) USD-pegged stablecoin using interest-bearing tokens as collateral. The protocol has been compromised three times since January 2024, losing a combined total of over $21 million, and its founding ecosystem was shaken in January 2022 when co-founder Daniele Sestagalli's associate — Wonderland's pseudonymous treasury manager known as 0xSifu — was publicly identified as Michael Patryn, a convicted felon and co-founder of the fraudulent exchange QuadrigaCX. The SPELL token has declined approximately 99.5% from its November 2021 all-time high, and the protocol's total value locked has collapsed from over $776 million to under $30 million.","sections":[{"content":"Abracadabra.money is a decentralized lending protocol founded in 2021 by Daniele Sestagalli and a pseudonymous co-founder known as 'Squirrel.' The protocol operates across multiple chains including Ethereum, Avalanche, Fantom, BNB Chain, and Arbitrum. Its core mechanism allows users to deposit interest-bearing tokens (ibTKNs) — such as yvWETH, xSUSHI, and similar yield-generating assets — as collateral to borrow MIM, a USD-pegged algorithmic stablecoin. SPELL is the native governance and reward token; holders who stake SPELL receive sSPELL and earn a share of protocol fees. The protocol was part of the 'Frog Nation' ecosystem, a collection of interconnected DeFi projects — including Wonderland (TIME token) and Popsicle Finance (ICE token) — that shared team members and mutual dependencies. SPELL reached an all-time high of approximately $0.035 in November 2021. As of early 2026, the token has declined approximately 99.5% from that peak. TVL peaked above $776 million in January 2022 and has since contracted to an estimated $11–30 million range.","heading":"Background","sources":[{"url":"https://www.gemini.com/cryptopedia/abracadabra-money-spell-token-abracadabra-crypto-lending","name":"","type":"other","credibility":3},{"url":"https://defillama.com/protocol/abracadabra","name":"","type":"other","credibility":3},{"url":"https://cryptoticker.io/en/rise-and-fall-spell-token/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"On January 27, 2022, on-chain investigator ZachXBT publicly revealed that 0xSifu — the pseudonymous Chief Financial Officer and treasury manager of Wonderland, the TIME-token rebasing protocol within the Frog Nation ecosystem — was in fact Michael Patryn, also formerly known as Omar Dhanani. Patryn co-founded the Canadian cryptocurrency exchange QuadrigaCX alongside Gerald Cotten, who disappeared in 2019 with an alleged $169 million of investor funds. Prior to his role at QuadrigaCX, Patryn had pleaded guilty in the United States to conspiracy to commit credit card fraud, burglary, grand larceny, and computer fraud; he operated a site called Shadowcrew that allegedly trafficked 1.5 million stolen card numbers, and served approximately 18 months in prison.\n\nDaniele Sestagalli, who founded Wonderland, Abracadabra.money, and Popsicle Finance, subsequently admitted he had been informed of Patryn's real identity approximately one month before ZachXBT's public disclosure and had chosen not to inform the community. Sestagalli's admission intensified the reputational damage to all three protocols. On-chain analysis conducted following the scandal revealed that treasury management at Wonderland involved mixing personal wallets with treasury funds, a lack of documentation, and heavily centralized decision-making. An $8.4 million withdrawal from the Wonderland multi-sig treasury was identified as having occurred in the lead-up to the crisis, allegedly to avoid a liquidation. Despite the scandal, a Wonderland DAO vote narrowly elected to continue protocol operations rather than unwind; 88% of TIME token votes supported removing Sifu as treasurer. Abracadabra's SPELL token and MIM stablecoin experienced significant sell pressure immediately following the revelations, with one wallet alone allegedly dumping approximately $130 million in MIM in the days following the disclosure.","heading":"The Wonderland Controversy","sources":[{"url":"https://rekt.news/sifu-scandal","name":"","type":"other","credibility":3},{"url":"https://www.coindesk.com/tech/2022/01/27/how-did-a-former-quadriga-exec-end-up-running-a-defi-protocol-wonderland-founder-explains","name":"","type":"other","credibility":3},{"url":"https://www.theblock.co/post/132340/wonderland-votes-out-quadrigacx-co-founder-sifu-and-is-considering-shutting-down","name":"","type":"other","credibility":3},{"url":"https://decrypt.co/91968/how-wonderland-daniele-sestagalli-defi-avoided-shutting-down-after-michael-patryn-scandal","name":"","type":"other","credibility":3},{"url":"https://www.vice.com/en/article/crypto-co-founder-revealed-to-be-infamous-fraudster-investors-shaken/","name":"","type":"other","credibility":3},{"url":"http://www.quadrigainitiative.com/casestudy/wonderlandmoneysifuscandal.php","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Prior to the Terra/LUNA collapse in May 2022, Abracadabra.money operated a leveraged yield strategy known as 'Degenbox.' This mechanism allowed users to deposit TerraUSD (UST) as collateral, borrow up to 90% of its value in MIM, swap that MIM back to UST via Curve Finance's liquidity pools, and re-deposit the resulting UST to compound yields from Terra's Anchor Protocol — which was offering approximately 20% APY on UST at the time. This recursive leverage loop created concentrated systemic exposure between MIM and UST.\n\nWhen confidence in Daniele Sestagalli and the broader Frog Nation ecosystem eroded in late January 2022 following the Sifu revelations, approximately $500 million worth of UST positions were alleged to have been unwound from Degenbox within a short window. Analysts noted at the time that mass unwinding of Degenbox positions could create a liquidation cascade capable of depegging UST. Several months later, in May 2022, the UST-LUNA ecosystem collapsed entirely, causing further MIM instability. The interconnected leverage between MIM and UST — magnified through Degenbox — was identified by multiple analysts as a significant vector of contagion risk between the two stablecoin systems. MIM briefly depegged during periods of peak stress.","heading":"Degenbox & Terra Exposure","sources":[{"url":"https://pontem.network/posts/wonderland-time-and-mim-scandal-what-you-need-to-know","name":"","type":"other","credibility":3},{"url":"https://www.investing.com/analysis/can-terras-ust-stablecoin-hold-its-peg-200617570","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Abracadabra.money has suffered three confirmed smart contract exploits since January 2024, totaling over $21 million in losses.\n\n**January 2024 — $6.5 Million Rounding Exploit:** On or around January 30, 2024, an attacker exploited a rounding precision error in the protocol's Cauldron V3 and V4 smart contracts on Ethereum mainnet. The attacker leveraged flash loans to manipulate the totalBorrow.elastic accounting variable by repeatedly calling repayment functions, causing the protocol to underestimate its true debt load. The attacker then borrowed funds without adequate collateral backing. Approximately 2,740 ETH and 2.2 million MIM — valued at roughly $6.5 million — were stolen. The exploit caused MIM to briefly depeg to $0.76 before recovering. CertiK identified the rounding bug as the root cause. The Abracadabra DAO treasury subsequently bought back MIM from the open market to restore stability.\n\n**March 2025 — $13 Million GMX Flash Loan Attack:** In March 2025, an attacker exploited state-tracking errors in Abracadabra's Cauldron contracts that integrated with GMX V2 liquidity pools (GM pools). The attacker executed a three-phase attack: (1) deposited funds into GMX in a transaction designed to fail, trapping assets in the OrderAgent contract; (2) borrowed protocol funds and self-liquidated, removing the position from on-chain records while collateral remained locked; (3) took out a new loan using the now-nonexistent position as phantom collateral. Approximately 6,262 ETH (~$13 million) was drained. Abracadabra announced a 20% bounty on recovered funds and stated it could cover half the loss immediately.\n\n**October 2025 — $1.8 Million Logic Error:** On October 4, 2025, an attacker exploited a business logic flaw in the deprecated PrivilegedCauldronV4 contracts via the protocol's cook() multi-action entrypoint. Action 5 (borrow) set a solvency check flag to true, but Action 0 reset the CookStatus struct, effectively disabling the check. This allowed under-collateralized borrowing. Approximately 1,793,766 MIM and 395 ETH (~$1.8 million) were stolen. The attacker subsequently used Tornado Cash to launder proceeds. This was identified as Abracadabra's third major exploit in under two years. A controversy emerged around this incident when Synnax Labs alleged that PeckShield had audited the relevant contracts but failed to detect the vulnerability, and then refunded and removed the audit report after the exploit.\n\nSeparately, on-chain investigators observed following the January 2022 Sifu scandal that funds were moved through Tornado Cash from wallets associated with the Wonderland treasury multisig, and that transactions remained queued to send funds to Sifu's personal wallet even after his removal from the DAO.","heading":"On-Chain Evidence & Security Incidents","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-abracadabra-money-hack-march-2025","name":"","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-abracadabra-hack-october-2025","name":"","type":"other","credibility":3},{"url":"https://www.theblock.co/post/348059/hacker-steals-13-million-in-abracadabras-magic-internet-money-seemingly-using-a-flash-loan-attack","name":"","type":"other","credibility":3},{"url":"https://www.observers.com/6-5m-abracadabra-exploit-led-to-magic-internet-money-stablecoin-depeg/","name":"","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/abracadabra-s-6-49m-loss-leads-to-mim-stablecoin-destabilization","name":"","type":"other","credibility":3},{"url":"https://threesigma.xyz/blog/exploit/mimspell-abracadabra-hack-breakdown","name":"","type":"other","credibility":3},{"url":"https://blockworks.com/news/rounding-exploit-magic-internet-money","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Abracadabra.money was co-founded by Daniele Sestagalli (also known as Daniele Sesta), an Italian-born engineer and computer scientist, and a pseudonymous developer known only as 'Squirrel,' whose real identity has never been publicly confirmed. Sestagalli is also the founder of Wonderland (TIME) and Popsicle Finance (ICE), collectively marketed under the 'Frog Nation' brand. The protocol is described as incorporated in Switzerland.\n\nThe most significant team-level risk event was Sestagalli's own admitted concealment of Michael Patryn's identity for approximately one month before ZachXBT's public disclosure in January 2022. Sestagalli has stated he met Patryn when Patryn contacted him as an early Abracadabra investor and that the relationship evolved gradually. Sestagalli subsequently published an apology but remained in a leadership role across the Frog Nation protocols. The team's reliance on pseudonymous contributors and a history of centralized multi-sig treasury management — with documented mixing of personal and treasury funds — represent ongoing governance risk factors. As of mid-2026, Sestagalli remains publicly associated with the protocol.","heading":"Team & Ownership","sources":[{"url":"https://marketrealist.com/p/abracadabra-money-founder-net-worth/","name":"","type":"other","credibility":3},{"url":"https://cryptobriefing.com/who-is-daniele-sestagalli/","name":"","type":"other","credibility":3},{"url":"https://rekt.news/sifu-scandal","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"As of the date of this investigation, no public record has been located of a formal enforcement action against Abracadabra.money, the SPELL token, or MIM by the U.S. Securities and Exchange Commission (SEC), the Commodity Futures Trading Commission (CFTC), or equivalent regulatory bodies in other jurisdictions. The protocol operates as a decentralized autonomous organization (DAO) and has not publicly registered any of its tokens as securities. The broader DeFi lending sector remains under active regulatory scrutiny in the United States and European Union; Abracadabra.money has not been cited in public regulatory filings identified at the time of this research. The anonymous co-founder ('Squirrel') and the Frog Nation structure — with multiple protocols sharing team members and treasury infrastructure — may present compliance challenges if regulators pursue enforcement against interconnected DeFi ecosystems. This section will require updating as the regulatory environment for DeFi evolves.","heading":"Regulatory Status","sources":[{"url":"https://www.cftc.gov/LawRegulation/EnforcementActions/index.htm","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Abracadabra.money presents a high-to-critical risk profile across multiple dimensions:\n\n**Smart Contract Risk (Critical):** The protocol has been exploited three times in under two years (January 2024, March 2025, October 2025), losing a combined total of over $21 million. Each exploit exploited distinct logic and rounding vulnerabilities in different Cauldron contract versions, suggesting systemic weaknesses in the protocol's security review processes. The October 2025 incident further implicated an auditor (PeckShield) in failing to detect the vulnerability before the hack.\n\n**Stablecoin Peg Risk (High):** MIM has experienced multiple depeg events — notably falling to $0.76 following the January 2024 exploit — and was subjected to concentrated sell pressure during the 2022 Sifu scandal. Its peg stability depends on arbitrage incentives and DAO treasury intervention, which have not always been rapid enough to prevent temporary dislocations.\n\n**Governance and Team Risk (High):** The concealment of Michael Patryn's identity by co-founder Daniele Sestagalli demonstrated a failure of fiduciary transparency to the community. The protocol's DAO structure concentrates meaningful influence in a small number of token holders and a partially anonymous team.\n\n**Systemic Contagion Risk (High):** The Degenbox strategy created recursive leverage loops between MIM and Terra's UST that amplified losses during the 2022 Terra collapse. Similar integration risks exist in the GMX Cauldron design that was exploited in March 2025.\n\n**Market Risk (High):** SPELL has declined approximately 99.5% from its all-time high. TVL has contracted from over $776 million to under $30 million, reflecting substantially reduced user trust and capital allocation.","heading":"Risk Assessment","sources":[{"url":"https://www.theblock.co/post/373453/abracadabra-loses-1-8-million-in-protocols-third-major-defi-hack-since-2024","name":"","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-abracadabra-money-hack-march-2025","name":"","type":"other","credibility":3},{"url":"https://www.investingcube.com/spell-token-price-prediction-abracadabras-fall-from-grace-cryptocurrencies/","name":"","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021-11","event":"Abracadabra.money launches; SPELL token reaches all-time high of approximately $0.035.","source":"","date_original":"2021-11-01"},{"date":"2022-01-15","event":"Wonderland (Frog Nation) records near all-time high TVL of approximately $776 million.","source":""},{"date":"2022-01-27","event":"ZachXBT publicly reveals that 0xSifu, Wonderland's pseudonymous CFO/treasury manager, is Michael Patryn — convicted felon and QuadrigaCX co-founder. Daniele Sestagalli admits he knew Patryn's real identity for approximately one month prior to the disclosure.","source":""},{"date":"2022-01-29","event":"Wonderland DAO votes 88% in favor of removing Sifu as treasury manager; a second vote elects to continue protocol operations rather than unwind.","source":""},{"date":"2022-01-27","event":"SPELL, TIME, and ICE tokens crash on news of the Sifu scandal; approximately $130 million in MIM is dumped by a single wallet within days.","source":""},{"date":"2022-05","event":"Terra/LUNA ecosystem collapses. Abracadabra's Degenbox strategy — which created recursive MIM-UST leverage loops — suffers significant contagion losses. MIM experiences depeg pressure.","source":"","date_original":"2022-05-01"},{"date":"2024-01-30","event":"First major exploit: rounding precision bug in Cauldron V3/V4 contracts allows attacker to drain approximately $6.5 million in ETH and MIM. MIM briefly depegs to $0.76.","source":""},{"date":"2025-03","event":"Second major exploit: attacker drains approximately $13 million (6,262 ETH) via state-tracking flaw in GMX V2 Cauldron integration using a multi-step self-liquidation attack.","source":"","date_original":"2025-03-01"},{"date":"2025-10-04","event":"Third major exploit: logic error in deprecated PrivilegedCauldronV4 cook() function allows attacker to bypass solvency checks and steal approximately 1,793,766 MIM and 395 ETH (~$1.8 million). Funds laundered via Tornado Cash. PeckShield subsequently alleged to have missed the vulnerability in a prior audit.","source":""}],"sources_used":[{"url":"https://www.gemini.com/cryptopedia/abracadabra-money-spell-token-abracadabra-crypto-lending","name":"","type":"other","archive_url":"http://web.archive.org/web/20260416094649/https://www.gemini.com/cryptopedia/abracadabra-money-spell-token-abracadabra-crypto-lending","credibility":3,"archive_timestamp":"2026-04-16T09:46:49+00:00"},{"url":"https://defillama.com/protocol/abracadabra","name":"","type":"other","archive_url":"http://web.archive.org/web/20250907052830/https://defillama.com/protocol/abracadabra","credibility":3,"archive_timestamp":"2025-09-07T05:28:30+00:00"},{"url":"https://cryptoticker.io/en/rise-and-fall-spell-token/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260120111713/https://cryptoticker.io/en/rise-and-fall-spell-token/","credibility":3,"archive_timestamp":"2026-01-20T11:17:13+00:00"},{"url":"https://rekt.news/sifu-scandal","name":"","type":"other","archive_url":"http://web.archive.org/web/20260313104848/https://rekt.news/sifu-scandal","credibility":3,"archive_timestamp":"2026-03-13T10:48:48+00:00"},{"url":"https://www.coindesk.com/tech/2022/01/27/how-did-a-former-quadriga-exec-end-up-running-a-defi-protocol-wonderland-founder-explains","name":"","type":"other","archive_url":"http://web.archive.org/web/20260607192822/https://www.coindesk.com/tech/2022/01/27/how-did-a-former-quadriga-exec-end-up-running-a-defi-protocol-wonderland-founder-explains","credibility":3,"archive_timestamp":"2026-06-07T19:28:22+00:00"},{"url":"https://www.theblock.co/post/132340/wonderland-votes-out-quadrigacx-co-founder-sifu-and-is-considering-shutting-down","name":"","type":"other","archive_url":"http://web.archive.org/web/20260226074151/https://www.theblock.co/post/132340/wonderland-votes-out-quadrigacx-co-founder-sifu-and-is-considering-shutting-down","credibility":3,"archive_timestamp":"2026-02-26T07:41:51+00:00"},{"url":"https://decrypt.co/91968/how-wonderland-daniele-sestagalli-defi-avoided-shutting-down-after-michael-patryn-scandal","name":"","type":"other","archive_url":"http://web.archive.org/web/20260315023850/https://decrypt.co/91968/how-wonderland-daniele-sestagalli-defi-avoided-shutting-down-after-michael-patryn-scandal","credibility":3,"archive_timestamp":"2026-03-15T02:38:50+00:00"},{"url":"https://www.vice.com/en/article/crypto-co-founder-revealed-to-be-infamous-fraudster-investors-shaken/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260219070931/https://www.vice.com/en/article/crypto-co-founder-revealed-to-be-infamous-fraudster-investors-shaken/","credibility":3,"archive_timestamp":"2026-02-19T07:09:31+00:00"},{"url":"http://www.quadrigainitiative.com/casestudy/wonderlandmoneysifuscandal.php","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829123439/http://www.quadrigainitiative.com/casestudy/wonderlandmoneysifuscandal.php","credibility":3,"archive_timestamp":"2026-08-29T12:34:39+00:00"},{"url":"https://pontem.network/posts/wonderland-time-and-mim-scandal-what-you-need-to-know","name":"","type":"other","archive_url":"http://web.archive.org/web/20260612120032/https://pontem.network/posts/wonderland-time-and-mim-scandal-what-you-need-to-know","credibility":3,"archive_timestamp":"2026-06-12T12:00:32+00:00"},{"url":"https://www.investing.com/analysis/can-terras-ust-stablecoin-hold-its-peg-200617570","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.halborn.com/blog/post/explained-the-abracadabra-money-hack-march-2025","name":"","type":"other","archive_url":"http://web.archive.org/web/20260317033205/https://www.halborn.com/blog/post/explained-the-abracadabra-money-hack-march-2025","credibility":3,"archive_timestamp":"2026-03-17T03:32:05+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-abracadabra-hack-october-2025","name":"","type":"other","archive_url":"http://web.archive.org/web/20260513002750/https://www.halborn.com/blog/post/explained-the-abracadabra-hack-october-2025","credibility":3,"archive_timestamp":"2026-05-13T00:27:50+00:00"},{"url":"https://www.theblock.co/post/348059/hacker-steals-13-million-in-abracadabras-magic-internet-money-seemingly-using-a-flash-loan-attack","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.observers.com/6-5m-abracadabra-exploit-led-to-magic-internet-money-stablecoin-depeg/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260314122501/https://www.observers.com/6-5m-abracadabra-exploit-led-to-magic-internet-money-stablecoin-depeg/","credibility":3,"archive_timestamp":"2026-03-14T12:25:01+00:00"},{"url":"https://cointelegraph.com/news/abracadabra-s-6-49m-loss-leads-to-mim-stablecoin-destabilization","name":"","type":"other","archive_url":"http://web.archive.org/web/20260214073028/https://cointelegraph.com/news/abracadabra-s-6-49m-loss-leads-to-mim-stablecoin-destabilization","credibility":3,"archive_timestamp":"2026-02-14T07:30:28+00:00"},{"url":"https://threesigma.xyz/blog/exploit/mimspell-abracadabra-hack-breakdown","name":"","type":"other","archive_url":"http://web.archive.org/web/20260607081117/https://threesigma.xyz/blog/exploit/mimspell-abracadabra-hack-breakdown","credibility":3,"archive_timestamp":"2026-06-07T08:11:17+00:00"},{"url":"https://blockworks.com/news/rounding-exploit-magic-internet-money","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://marketrealist.com/p/abracadabra-money-founder-net-worth/","name":"","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://cryptobriefing.com/who-is-daniele-sestagalli/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260219093815/https://cryptobriefing.com/who-is-daniele-sestagalli/","credibility":3,"archive_timestamp":"2026-02-19T09:38:15+00:00"},{"url":"https://www.cftc.gov/LawRegulation/EnforcementActions/index.htm","name":"","type":"other","archive_url":"http://web.archive.org/web/20260630112333/https://www.cftc.gov/LawRegulation/EnforcementActions/index.htm","credibility":3,"archive_timestamp":"2026-06-30T11:23:33+00:00"},{"url":"https://www.theblock.co/post/373453/abracadabra-loses-1-8-million-in-protocols-third-major-defi-hack-since-2024","name":"","type":"other","archive_url":"http://web.archive.org/web/20260719162220/https://www.theblock.co/post/373453/abracadabra-loses-1-8-million-in-protocols-third-major-defi-hack-since-2024","credibility":3,"archive_timestamp":"2026-07-19T16:22:20+00:00"},{"url":"https://www.investingcube.com/spell-token-price-prediction-abracadabras-fall-from-grace-cryptocurrencies/","name":"","type":"other","archive_url":"https://web.archive.org/web/20260830005711/https://www.investingcube.com/cryptocurrency/spell-token-price-prediction-abracadabras-fall-from-grace-cryptocurrencies/","credibility":3,"archive_timestamp":"2026-08-30T00:57:11+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:35.553746+00:00","updated_at":"2026-08-30T01:16:28.627795+00:00"}}