{"investigation":{"slug":"ambient","entity_name":"Ambient Finance","trust_score":42,"severity_base":null,"score_modifier":-10,"confidence":0.72,"status":"published","content_type":"investigation","summary":"Ambient Finance (formerly CrocSwap, operated by Crocodile Labs) is a decentralized exchange protocol that runs an entire DEX inside a single smart contract, combining concentrated and ambient liquidity on Ethereum and several L2 networks. On October 17, 2024, the protocol's frontend suffered a DNS hijacking attack deploying Inferno Drainer malware to drain wallets of users who interacted with the compromised site; the underlying smart contracts were unaffected and the team reimbursed all affected users in ETH. ZachXBT has flagged this entity.","sections":[{"content":"Ambient Finance, previously known as CrocSwap and operated by Crocodile Labs, is a DEX and AMM protocol launched on Ethereum mainnet in July 2023. The protocol's primary architectural distinction is that the entire DEX runs inside a single smart contract, with AMM pools implemented as lightweight data structures. This design reduces gas costs and allows Ambient to combine concentrated liquidity (Uniswap v3-style), ambient constant-product liquidity (Uniswap v2-style), and knockout liquidity (directional limit orders). As of May 2026, Ambient operates across seven networks: Ethereum, Scroll, Blast, Swellchain, Plume Mainnet, Canto. Cumulative all-time trading volume exceeds $5.1 billion.","heading":"Protocol Overview","sources":[{"url":"https://docs.ambient.finance/","name":"docs.ambient.finance","type":"other","credibility":3},{"url":"https://defillama.com/protocol/ambient","name":"defillama.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Ambient Finance was founded by Douglas (Doug) Colkitt (CEO), who spent ~10 years at Citadel Securities as a quantitative researcher before transitioning to DeFi. In July 2023, Ambient raised a $6.5 million seed round at an $80 million network valuation led by BlockTower Capital, with participation from Jane Street, Circle, Tensai Capital, Susa Ventures, Quantstamp, and Naval Ravikant. The company's legal entity is Crocodile Labs, reportedly based in Sarasota, Florida.","heading":"Team and Funding","sources":[{"url":"https://crocswap.medium.com/ambient-finance-raises-seed-round-funding-78328f4fa7e","name":"crocswap.medium.com","type":"other","credibility":3},{"url":"https://tokeninsight.com/en/news/decentralized-exchange-ambient-raises-6.5m-in-seed-round-led-by-blocktower-capital","name":"tokeninsight.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On October 17, 2024, Ambient Finance's primary domain was compromised via a DNS hijacking attack. Attackers redirected the domain to a malicious clone deploying Inferno Drainer malware. Web3 security firm Blockaid identified the attack, noting the attacker's C2 server was created within 24 hours, indicating a premeditated campaign. Users who approved transactions during the attack had their wallets drained. Ambient posted its first public notice on X at 6:47 AM UTC warning users not to interact with the site. The underlying smart contracts and on-chain funds were unaffected. Domain control was recovered within ~2 hours; a temporary deployment at croc.finance was established October 19. On October 26, Ambient announced full reimbursement in ETH completed for all affected users.","heading":"Frontend DNS Hijacking Incident (October 2024)","sources":[{"url":"https://coinpaper.com/5737/ambient-finance-recovers-domain-after-major-hack","name":"coinpaper.com","type":"other","credibility":3},{"url":"https://mpost.io/blockaid-ambient-finance-front-end-suspected-to-be-hacked/","name":"mpost.io","type":"other","credibility":3},{"url":"https://crypto.news/defi-exchange-ambient-finance-recovers-domain-after-dns-attack/","name":"crypto.news","type":"other","credibility":3}],"severity":"medium"},{"content":"CertiK Skynet assigns Ambient Finance a score of 74.30 (BBB rating) but records no completed CertiK audit and no third-party audit on file. No active bug bounty program is recorded and team verification is listed as unconfirmed. Independent code audits are not prominently linked in the protocol's public documentation. The single-contract DEX architecture means a critical vulnerability would affect all pools simultaneously. The October 2024 DNS hijacking was an infrastructure-level attack, not a smart contract exploit, but demonstrated that users were exposed to asset loss from the official domain.","heading":"Security Posture and Audit Transparency","sources":[{"url":"https://skynet.certik.com/projects/ambient-finance","name":"skynet.certik.com","type":"other","credibility":3},{"url":"https://cantina.xyz/blog/a-guide-to-prevent-dns-hijacking-for-web3","name":"cantina.xyz","type":"other","credibility":3}],"severity":"medium"},{"content":"Cumulative all-time protocol volume exceeds $5.1 billion across all deployments, with Scroll ($3.1 billion) and Blast ($1.5 billion) accounting for the majority. However, current TVL has declined significantly: as of May 2026, the protocol holds approximately $2.58 million in TVL across all chains. Thirty-day trading volume stands at approximately $1.66 million. The protocol does not yet have a native token; no official token launch date has been announced despite community discussion of an anticipated airdrop.","heading":"TVL and Usage Metrics","sources":[{"url":"https://defillama.com/protocol/ambient","name":"defillama.com","type":"other","credibility":3},{"url":"https://cryptorank.io/ico/ambient-finance","name":"cryptorank.io","type":"other","credibility":3}],"severity":"medium"},{"content":"ZachXBT has flagged Ambient Finance as an entity of interest. The specific basis has not been independently confirmed through a publicly accessible post as of May 2026. The flag may relate to the October 2024 DNS hijacking incident, the Inferno Drainer deployment targeting protocol users, or other signals. Additionally, a domain variant ambient-finance.com has been observed hosting an alleged airdrop claims page; the protocol's canonical domain is ambient.finance. No SEC/CFTC enforcement actions have been identified against Ambient Finance or Crocodile Labs.","heading":"ZachXBT Flag and Risk Assessment","sources":[{"url":"https://skynet.certik.com/projects/ambient-finance","name":"skynet.certik.com","type":"other","credibility":3},{"url":"https://ambient.finance/","name":"ambient.finance","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021","event":"Crocodile Labs founded by Douglas Colkitt; CrocSwap development begins.","source":"","date_original":"2021-01-01"},{"date":"2023-07-11","event":"Ambient Finance raises $6.5M seed round led by BlockTower Capital; Ethereum mainnet launch.","source":""},{"date":"2024-10-17","event":"DNS hijacking attack compromises ambient.finance frontend; Inferno Drainer malware deployed.","source":""},{"date":"2024-10-17","event":"Ambient confirms smart contracts unaffected; warns users not to interact with site.","source":""},{"date":"2024-10-20","event":"Original ambient.finance domain fully restored and secured.","source":""},{"date":"2024-10-26","event":"Full reimbursement in ETH completed for all affected users.","source":""}],"sources_used":[{"url":"https://docs.ambient.finance/","name":"docs.ambient.finance","type":"other","archive_url":"http://web.archive.org/web/20260730164026/https://docs.ambient.finance/","credibility":3,"archive_timestamp":"2026-07-30T16:40:26+00:00"},{"url":"https://defillama.com/protocol/ambient","name":"defillama.com","type":"other","archive_url":"http://web.archive.org/web/20251018131649/https://defillama.com/protocol/ambient","credibility":3,"archive_timestamp":"2025-10-18T13:16:49+00:00"},{"url":"https://crocswap.medium.com/ambient-finance-raises-seed-round-funding-78328f4fa7e","name":"crocswap.medium.com","type":"other","archive_url":"http://web.archive.org/web/20251017182503/https://crocswap.medium.com/ambient-finance-raises-seed-round-funding-78328f4fa7e","credibility":3,"archive_timestamp":"2025-10-17T18:25:03+00:00"},{"url":"https://tokeninsight.com/en/news/decentralized-exchange-ambient-raises-6.5m-in-seed-round-led-by-blocktower-capital","name":"tokeninsight.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://coinpaper.com/5737/ambient-finance-recovers-domain-after-major-hack","name":"coinpaper.com","type":"other","archive_url":"http://web.archive.org/web/20260308144910/https://coinpaper.com/5737/ambient-finance-recovers-domain-after-major-hack","credibility":3,"archive_timestamp":"2026-03-08T14:49:10+00:00"},{"url":"https://mpost.io/blockaid-ambient-finance-front-end-suspected-to-be-hacked/","name":"mpost.io","type":"other","archive_url":"https://web.archive.org/web/20260830043811/https://mpost.io/blockaid-ambient-finance-front-end-suspected-to-be-hacked/","credibility":3,"archive_timestamp":"2026-08-30T04:38:11+00:00"},{"url":"https://crypto.news/defi-exchange-ambient-finance-recovers-domain-after-dns-attack/","name":"crypto.news","type":"other","archive_url":"http://web.archive.org/web/20251008192749/https://crypto.news/defi-exchange-ambient-finance-recovers-domain-after-dns-attack/","credibility":3,"archive_timestamp":"2025-10-08T19:27:49+00:00"},{"url":"https://skynet.certik.com/projects/ambient-finance","name":"skynet.certik.com","type":"other","archive_url":"http://web.archive.org/web/20260412132853/https://skynet.certik.com/projects/ambient-finance","credibility":3,"archive_timestamp":"2026-04-12T13:28:53+00:00"},{"url":"https://cantina.xyz/blog/a-guide-to-prevent-dns-hijacking-for-web3","name":"cantina.xyz","type":"other","archive_url":"http://web.archive.org/web/20260421132702/https://cantina.xyz/blog/a-guide-to-prevent-dns-hijacking-for-web3","credibility":3,"archive_timestamp":"2026-04-21T13:27:02+00:00"},{"url":"https://cryptorank.io/ico/ambient-finance","name":"cryptorank.io","type":"other","archive_url":"https://web.archive.org/web/20260829235507/https://cryptorank.io/ico/ambient-finance","credibility":3,"archive_timestamp":"2026-08-29T23:55:07+00:00"},{"url":"https://ambient.finance/","name":"ambient.finance","type":"other","archive_url":"http://web.archive.org/web/20260829044418/https://ambient.finance/","credibility":3,"archive_timestamp":"2026-08-29T04:44:18+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-5","created_at":"2026-05-04T02:54:28.462918+00:00","updated_at":"2026-08-30T05:14:05.454086+00:00"}}