{"investigation":{"slug":"akropolis","entity_name":"Akropolis","trust_score":30,"severity_base":null,"score_modifier":0,"confidence":0.78,"status":"published","content_type":"investigation","summary":"Akropolis is an Ethereum-based DeFi protocol founded in 2017 by Ana Andrianova and Kate Kurbanova, offering yield aggregation and undercollateralized lending through its Delphi and Sparta products. On November 12, 2020, the protocol suffered a $2.03 million DAI exploit via a reentrancy and flash loan attack — a vulnerability that was missed across multiple third-party smart contract audits. The project subsequently rebranded to Kaon in early 2025, having never recovered the stolen funds or fully compensated affected users.","sections":[{"content":"Akropolis is a decentralized finance protocol built on Ethereum, incorporated in Gibraltar, and founded in 2017 by Anastasia (Ana) Andrianova and Kate Kurbanova. The protocol was conceived as a blockchain-based alternative to traditional pension and savings infrastructure, drawing on the founding team's experience with institutional finance. Andrianova, who holds a degree from the University of Oxford, cited the 2008 Lehman Brothers collapse as a motivation for building transparent, autonomous financial systems. The project raised $2.4 million USD in an initial coin offering (ICO) completed on July 16, 2019, at a price of $0.00813 per AKRO token. Akropolis operated two principal user-facing products: Sparta, an undercollateralized lending pool where members contributed liquidity and earned interest; and Delphi, a yield farming aggregator that automated dollar-cost averaging and returns across integrated DeFi protocols. The protocol also issued two governance tokens: AKRO (primary network token used for staking, governance, and collateral) and ADEL (Delphi-specific governance token). In late 2020, the project entered a partnership with Yearn Finance, integrating Yearn vault technology into the Delphi product and establishing institutional business development collaboration. By December 2024, the team announced a full rebrand of AKRO to Kaon (KAON), completed on exchanges in February 2025.","heading":"Overview","sources":[{"url":"https://iq.wiki/wiki/akropolis","name":"iq.wiki","type":"other","credibility":3},{"url":"https://kriptomat.io/cryptocurrency-prices/akropolis-akro-price/what-is/","name":"kriptomat.io","type":"other","credibility":3},{"url":"https://icodrops.com/akropolis/","name":"icodrops.com","type":"other","credibility":3},{"url":"https://www.kucoin.com/announcement/en-kucoin-will-support-the-akropolis-akro-rebranding-to-kaon-akro-20241202","name":"kucoin.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On November 12, 2020, Akropolis's Delphi savings pools were drained of 2,030,841.02 DAI (approximately $2.03 million at the time) in a sophisticated attack combining a reentrancy vulnerability with a flash loan from derivatives platform dYdX. The attacker deployed a malicious ERC-20-like smart contract with a custom hook function. The exploit proceeded as follows: the attacker called the SavingsModule's deposit() function using the malicious fake token; during the transferFrom callback of that fake token, the attacker's contract re-entered deposit() with 800,000 real DAI borrowed via a dYdX flash loan. Because the system minted pool tokens based on balance changes without reentrancy guards, the attacker received a disproportionate number of pool tokens for each deposit cycle. The attacker repeated this sequence across 17 transactions, each extracting tranches of approximately $50,000, for a total theft of 2,030,841 DAI. The stolen funds were immediately forwarded to a separate wallet address. Security firm PeckShield, which conducted the root cause analysis, identified the main exploit transaction hash as 0xe1f375a47172b5612d96496a4599247049f07c9a7d518929fbe296b0c281e04d and attributed the funds to attacker address 0x9f26ae5cd245bfeeb5926d61497550f79d9c6c1c. The affected pools were Akropolis's yCurve and sUSD Curve integration pools. CEO Ana Andrianova acknowledged the breach publicly: 'Two attack vectors have unfortunately been missed despite two audits.' Akropolis halted all stablecoin pool activity immediately following discovery of the exploit. The team proposed that the attacker return the funds within 48 hours in exchange for a $200,000 bug bounty and protection of the attacker's identity. No funds were returned.","heading":"Incident Details: November 2020 Flash Loan Exploit","sources":[{"url":"https://peckshield.medium.com/akropolis-incident-root-cause-analysis-c11ee59e05d4","name":"peckshield.medium.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/tech/2020/11/12/defi-project-akropolis-drained-of-2m-in-dai","name":"coindesk.com","type":"other","credibility":3},{"url":"https://decrypt.co/48081/defi-platform-akropolis-admits-to-being-hacked-for-2-million","name":"decrypt.co","type":"other","credibility":3},{"url":"https://www.theblock.co/linked/84490/defi-project-akropolis-exploited-for-over-2-million","name":"theblock.co","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/akropolis-defi-protocol-paused-as-hackers-get-away-with-2m-in-dai","name":"cointelegraph.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The exploit's primary on-chain footprint is well-documented by independent security researchers. The main exploit transaction — 0xe1f375a47172b5612d96496a4599247049f07c9a7d518929fbe296b0c281e04d — is traceable on Ethereum mainnet and shows the double-deposit pattern enabled by the reentrancy flaw. The initial flash loan transaction is recorded at hash 0xddf8c15880a20efa0f3964207d345ff71fbb9400032b5d33b9346876bd131dc2. The receiving wallet for stolen funds, 0x9f26ae5cd245bfeeb5926d61497550f79d9c6c1c, accepted the 2,030,841 DAI drain across 17 sequential transactions. PeckShield's independent analysis confirmed the balance-based pool token minting mechanism as the exploitable surface, noting the absence of reentrancy guards in the deposit logic and the lack of validation that deposited tokens match registered contract addresses. The AKRO token contract is tracked on Etherscan at address 0x8ab7404063ec4dbcfd4598215992dc3f8ec853d7. No on-chain evidence was found indicating the attacker's funds were recovered or returned. ZachXBT has flagged the Akropolis entity in trust intelligence contexts, though a specific public thread from ZachXBT exclusively dedicated to Akropolis was not located during this investigation.","heading":"On-Chain Evidence","sources":[{"url":"https://peckshield.medium.com/akropolis-incident-root-cause-analysis-c11ee59e05d4","name":"peckshield.medium.com","type":"other","credibility":3},{"url":"https://etherscan.io/token/0x8ab7404063ec4dbcfd4598215992dc3f8ec853d7","name":"etherscan.io","type":"other","credibility":3},{"url":"https://quadrigainitiative.com/casestudy/akropolisattacked.php","name":"quadrigainitiative.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Prior to the November 2020 exploit, the Akropolis Delphi savings pools had undergone smart contract audits by multiple security firms, including CertiK, SmartDec, and Pessimistic. CertiK published a formal audit of the AKRO token smart contracts and reported that the contracts followed good practices and were structurally sound. MixBytes also performed auditing work for the protocol. Despite this multi-firm audit coverage, the reentrancy vulnerability in the SavingsModule deposit logic and the absence of deposited-token validity checks were not identified before deployment. Andrianova publicly acknowledged that both attack vectors were missed across both audits. Following the hack, the team committed to adding a ReentrancyGuard to all affected contracts and implementing token-address validation in deposit flows. The project also announced a bug bounty program in the aftermath. The incident is widely cited in the DeFi security community as an illustration of audit coverage gaps for compound attack vectors (flash loan combined with reentrancy), which were not a standard audit focus at that time. A post-mortem was published on the Akropolis Substack, though the original URL returned a 404 at time of this investigation.","heading":"Audit Failures and Security Practices","sources":[{"url":"https://medium.com/akropolis/akro-token-security-audit-by-certik-fd9d908cd98d","name":"medium.com","type":"other","credibility":3},{"url":"https://www.certik.com/projects/akropolis","name":"certik.com","type":"other","credibility":3},{"url":"https://medium.com/certik/akro-token-the-smart-contract-audit-provided-by-certik-f727921735b6","name":"medium.com","type":"other","credibility":3},{"url":"https://decrypt.co/48081/defi-platform-akropolis-admits-to-being-hacked-for-2-million","name":"decrypt.co","type":"other","credibility":3}],"severity":"medium"},{"content":"Akropolis was co-founded by Anastasia (Ana) Andrianova and Kate Kurbanova in 2017. Andrianova serves as CEO and holds a degree from the University of Oxford; her background is in institutional asset management and she has cited firsthand exposure to the 2007-2009 financial crisis as the impetus for the project's focus on transparent, decentralized savings infrastructure. Kurbanova serves as Co-Founder with responsibility for Operations and People. The project is incorporated in Gibraltar. The full team roster, including technical leads and advisors, was publicly listed on the Akropolis wiki. The project raised $2.4 million in its 2019 ICO. A planned collaboration with Yearn Finance was announced in December 2020, shortly after the hack, positioning Akropolis as Yearn's institutional outreach partner while integrating Yearn's vault technology. This collaboration did not result in a formal legal merger. No regulatory actions, law enforcement referrals, or court filings related to the founding team or the protocol were found during this investigation.","heading":"Team and Background","sources":[{"url":"https://wiki.akropolis.io/team/","name":"wiki.akropolis.io","type":"other","credibility":3},{"url":"https://kriptomat.io/cryptocurrency-prices/akropolis-akro-price/what-is/","name":"kriptomat.io","type":"other","credibility":3},{"url":"https://www.crunchbase.com/organization/akropolis","name":"crunchbase.com","type":"other","credibility":3},{"url":"https://thedefiant.io/news/defi/yearn-partners-with-akropolis-in-move-for-institutional-defi","name":"thedefiant.io","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the $2.03 million exploit, the Akropolis team published a compensation plan for affected users. The plan offered 50% of losses as vested AKRO tokens (vAKRO) at a fixed rate of $0.012 per AKRO — the pre-hack price — with a 24-month linear vesting schedule. The remaining 50% was to be accrued from future protocol revenue. The team also announced a consolidation of its two governance tokens: ADEL would be swapped to AKRO at a 1:15 ratio (one ADEL to fifteen AKRO), with a snapshot date of February 1, 2021, and a swap window running from March through May 2021. Only ADEL held on personal wallet addresses was eligible; tokens held on centralized exchanges were excluded. Vesting periods extended 24 months from swap completion. The compensation structure was entirely denominated in the project's own native token, meaning affected users bore additional price risk on AKRO. There is no public evidence that the full $2.03 million equivalent was ever repaid to users. The Delphi v1.0 product received maintenance support for up to six months following the post-hack fixes and re-audits.","heading":"Compensation and Recovery Efforts","sources":[{"url":"https://medium.com/akropolis/akropolis-january-update-adel-akro-swap-hack-compensation-more-4bb78a728c1d","name":"medium.com","type":"other","credibility":3},{"url":"https://cryptobriefing.com/defi-project-akropolis-lost-2-million-heres-what-theyre-doing-about-it/","name":"cryptobriefing.com","type":"other","credibility":3},{"url":"https://www.livebitcoinnews.com/akropolis-proposes-unique-deal-to-hacker-following-crypto-theft/","name":"livebitcoinnews.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Akropolis presents several dimensions of risk for users and researchers evaluating trust. First, the protocol suffered a $2.03 million exploit in November 2020 that bypassed multiple professional security audits; the technical vulnerability (reentrancy combined with unvalidated token deposits) represents a fundamental smart contract security failure. Second, the compensation plan issued to hack victims was denominated entirely in AKRO tokens — a depreciating asset that reached its all-time high of approximately $0.08 in April 2021 before declining sharply; users accepting vAKRO compensation faced significant value erosion over the 24-month vesting period. Third, the AKRO token has lost the overwhelming majority of its value since the 2019 ICO price of $0.00813, with the token reaching a reported low of $0.0000973 in August 2025. Fourth, the project underwent a rebranding to Kaon (KAON) in December 2024, completing exchange transitions in February 2025; rebranding following a high-profile security incident and sustained token value decline is a noted risk pattern. Fifth, the Delphi and Sparta products have been deprecated in favor of open-source development, and protocol activity has significantly diminished. No active regulatory investigations, law enforcement actions, or verified fraud allegations against the founding team were found. The ZachXBT flag associated with this entity in the AVOID.NET database was not linked to a specific public investigation thread at the time of this report. On balance, the protocol's exploit history, audit failures, token depreciation, and rebranding activity support a trust score of 30/100.","heading":"Risk Assessment","sources":[{"url":"https://www.vidma.io/blog/akropolis-hack-2-million-dai-heist-exposes-defi-vulnerabilities","name":"vidma.io","type":"other","credibility":3},{"url":"https://coinbureau.com/review/akropolis-akro","name":"coinbureau.com","type":"other","credibility":3},{"url":"https://coinspot.zendesk.com/hc/en-us/articles/11925309531919-CoinSpot-will-support-the-Akropolis-AKRO-Rebranding-Plan-to-Kaon-AKRO","name":"coinspot.zendesk.com","type":"other","credibility":3},{"url":"https://www.coinlore.com/coin/akropolis/historical-data","name":"coinlore.com","type":"other","credibility":3},{"url":"https://insights.glassnode.com/defi-attacks-flash-loans-centralized-price-oracles/","name":"insights.glassnode.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2017","event":"Akropolis founded by Ana Andrianova and Kate Kurbanova in Gibraltar, initially focused on blockchain-based pension and savings infrastructure.","source":"","date_original":"2017-01-01"},{"date":"2019-07-16","event":"AKRO token ICO completed, raising $2.4 million USD at $0.00813 per token.","source":""},{"date":"2020-11-12","event":"Akropolis Delphi savings pools exploited via reentrancy attack combined with a dYdX flash loan. 2,030,841 DAI ($2.03 million) stolen across 17 transactions. All stablecoin pools halted.","source":""},{"date":"2020-11-13","event":"CEO Ana Andrianova acknowledges the exploit publicly. PeckShield publishes root cause analysis. Team proposes $200,000 bug bounty if attacker returns funds within 48 hours.","source":""},{"date":"2020-12","event":"Akropolis and Yearn Finance announce strategic collaboration, integrating Yearn vault technology and establishing Akropolis as Yearn's institutional outreach partner.","source":"","date_original":"2020-12-01"},{"date":"2021","event":"Akropolis publishes compensation plan: 50% of hack losses to be paid in vAKRO (24-month linear vesting at $0.012/AKRO); ADEL-to-AKRO swap announced at 1:15 ratio.","source":"","date_original":"2021-01-01"},{"date":"2021-02","event":"Snapshot date for ADEL-to-AKRO swap eligibility.","source":"","date_original":"2021-02-01"},{"date":"2021-04","event":"AKRO token reaches all-time high of approximately $0.08.","source":"","date_original":"2021-04-01"},{"date":"2024-12-02","event":"Akropolis announces full rebranding to Kaon (KAON). Major exchanges including KuCoin, Gate.io, and CoinSpot announce support for the 1:1 token transition.","source":""},{"date":"2025-02-11","event":"Exchange trading of Akropolis (AKRO) halted for rebrand completion. Token transitions to Kaon (KAON) on supported exchanges.","source":""}],"sources_used":[{"url":"https://iq.wiki/wiki/akropolis","name":"iq.wiki","type":"other","archive_url":"http://web.archive.org/web/20260516210221/https://iq.wiki/wiki/akropolis","credibility":3,"archive_timestamp":"2026-05-16T21:02:21+00:00"},{"url":"https://kriptomat.io/cryptocurrency-prices/akropolis-akro-price/what-is/","name":"kriptomat.io","type":"other","archive_url":"https://web.archive.org/web/20260829193636/https://kriptomat.io/cryptocurrency-prices/akropolis-akro-price/what-is/","credibility":3,"archive_timestamp":"2026-08-29T19:36:36+00:00"},{"url":"https://icodrops.com/akropolis/","name":"icodrops.com","type":"other","archive_url":"http://web.archive.org/web/20260307055333/https://icodrops.com/akropolis/","credibility":3,"archive_timestamp":"2026-03-07T05:53:33+00:00"},{"url":"https://www.kucoin.com/announcement/en-kucoin-will-support-the-akropolis-akro-rebranding-to-kaon-akro-20241202","name":"kucoin.com","type":"other","archive_url":"http://web.archive.org/web/20260829202718/https://www.kucoin.com/announcement/en-kucoin-will-support-the-akropolis-akro-rebranding-to-kaon-akro-20241202","credibility":3,"archive_timestamp":"2026-08-29T20:27:18+00:00"},{"url":"https://peckshield.medium.com/akropolis-incident-root-cause-analysis-c11ee59e05d4","name":"peckshield.medium.com","type":"other","archive_url":"http://web.archive.org/web/20251025095342/https://peckshield.medium.com/akropolis-incident-root-cause-analysis-c11ee59e05d4","credibility":3,"archive_timestamp":"2025-10-25T09:53:42+00:00"},{"url":"https://www.coindesk.com/tech/2020/11/12/defi-project-akropolis-drained-of-2m-in-dai","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20260727042300/https://www.coindesk.com/tech/2020/11/12/defi-project-akropolis-drained-of-2m-in-dai","credibility":3,"archive_timestamp":"2026-07-27T04:23:00+00:00"},{"url":"https://decrypt.co/48081/defi-platform-akropolis-admits-to-being-hacked-for-2-million","name":"decrypt.co","type":"other","archive_url":"http://web.archive.org/web/20260512004621/https://decrypt.co/48081/defi-platform-akropolis-admits-to-being-hacked-for-2-million","credibility":3,"archive_timestamp":"2026-05-12T00:46:21+00:00"},{"url":"https://www.theblock.co/linked/84490/defi-project-akropolis-exploited-for-over-2-million","name":"theblock.co","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cointelegraph.com/news/akropolis-defi-protocol-paused-as-hackers-get-away-with-2m-in-dai","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20260708024554/https://cointelegraph.com/news/akropolis-defi-protocol-paused-as-hackers-get-away-with-2m-in-dai","credibility":3,"archive_timestamp":"2026-07-08T02:45:54+00:00"},{"url":"https://etherscan.io/token/0x8ab7404063ec4dbcfd4598215992dc3f8ec853d7","name":"etherscan.io","type":"other","archive_url":"http://web.archive.org/web/20260812064932/https://etherscan.io/token/0x8ab7404063ec4dbcfd4598215992dc3f8ec853d7","credibility":3,"archive_timestamp":"2026-08-12T06:49:32+00:00"},{"url":"https://quadrigainitiative.com/casestudy/akropolisattacked.php","name":"quadrigainitiative.com","type":"other","archive_url":"https://web.archive.org/web/20260830091434/https://quadrigainitiative.com/casestudy/akropolisattacked.php","credibility":3,"archive_timestamp":"2026-08-30T09:14:34+00:00"},{"url":"https://medium.com/akropolis/akro-token-security-audit-by-certik-fd9d908cd98d","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.certik.com/projects/akropolis","name":"certik.com","type":"other","archive_url":"https://web.archive.org/web/20260829201127/https://skynet.certik.com/projects/akropolis","credibility":3,"archive_timestamp":"2026-08-29T20:11:27+00:00"},{"url":"https://medium.com/certik/akro-token-the-smart-contract-audit-provided-by-certik-f727921735b6","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://wiki.akropolis.io/team/","name":"wiki.akropolis.io","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-job","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.crunchbase.com/organization/akropolis","name":"crunchbase.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://thedefiant.io/news/defi/yearn-partners-with-akropolis-in-move-for-institutional-defi","name":"thedefiant.io","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://medium.com/akropolis/akropolis-january-update-adel-akro-swap-hack-compensation-more-4bb78a728c1d","name":"medium.com","type":"other","archive_url":"http://web.archive.org/web/20251006014256/https://medium.com/akropolis/akropolis-january-update-adel-akro-swap-hack-compensation-more-4bb78a728c1d","credibility":3,"archive_timestamp":"2025-10-06T01:42:56+00:00"},{"url":"https://cryptobriefing.com/defi-project-akropolis-lost-2-million-heres-what-theyre-doing-about-it/","name":"cryptobriefing.com","type":"other","archive_url":"http://web.archive.org/web/20260315013303/https://cryptobriefing.com/defi-project-akropolis-lost-2-million-heres-what-theyre-doing-about-it/","credibility":3,"archive_timestamp":"2026-03-15T01:33:03+00:00"},{"url":"https://www.livebitcoinnews.com/akropolis-proposes-unique-deal-to-hacker-following-crypto-theft/","name":"livebitcoinnews.com","type":"other","archive_url":"https://web.archive.org/web/20260829203002/https://www.livebitcoinnews.com/akropolis-proposes-unique-deal-to-hacker-following-crypto-theft/","credibility":3,"archive_timestamp":"2026-08-29T20:30:02+00:00"},{"url":"https://www.vidma.io/blog/akropolis-hack-2-million-dai-heist-exposes-defi-vulnerabilities","name":"vidma.io","type":"other","archive_url":"http://web.archive.org/web/20260418191558/https://www.vidma.io/blog/akropolis-hack-2-million-dai-heist-exposes-defi-vulnerabilities","credibility":3,"archive_timestamp":"2026-04-18T19:15:58+00:00"},{"url":"https://coinbureau.com/review/akropolis-akro","name":"coinbureau.com","type":"other","archive_url":"http://web.archive.org/web/20260513221230/https://coinbureau.com/review/akropolis-akro","credibility":3,"archive_timestamp":"2026-05-13T22:12:30+00:00"},{"url":"https://coinspot.zendesk.com/hc/en-us/articles/11925309531919-CoinSpot-will-support-the-Akropolis-AKRO-Rebranding-Plan-to-Kaon-AKRO","name":"coinspot.zendesk.com","type":"other","archive_url":"http://web.archive.org/web/20251016104042/https://coinspot.zendesk.com/hc/en-us/articles/11925309531919-CoinSpot-will-support-the-Akropolis-AKRO-Rebranding-Plan-to-Kaon-AKRO","credibility":3,"archive_timestamp":"2025-10-16T10:40:42+00:00"},{"url":"https://www.coinlore.com/coin/akropolis/historical-data","name":"coinlore.com","type":"other","archive_url":"http://web.archive.org/web/20251210054609/https://www.coinlore.com/coin/akropolis/historical-data","credibility":3,"archive_timestamp":"2025-12-10T05:46:09+00:00"},{"url":"https://insights.glassnode.com/defi-attacks-flash-loans-centralized-price-oracles/","name":"insights.glassnode.com","type":"other","archive_url":"http://web.archive.org/web/20260518061522/https://insights.glassnode.com/defi-attacks-flash-loans-centralized-price-oracles/","credibility":3,"archive_timestamp":"2026-05-18T06:15:22+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:55:00.526835+00:00","updated_at":"2026-08-30T16:47:13.475174+00:00"}}