{"investigation":{"slug":"arbix-finance","entity_name":"Arbix Finance","trust_score":2,"severity_base":null,"score_modifier":0,"confidence":1,"status":"published","content_type":"investigation","summary":"Arbix Finance was a yield farming protocol on Binance Smart Chain (BSC) that executed a deliberate rug pull on January 4, 2022, draining approximately $10 million in user funds. The anonymous development team minted 10 million unbacked ARBX tokens, dumped them on PancakeSwap to collapse the price, drained all user vaults, bridged the stolen assets to Ethereum via AnySwap, laundered them through Tornado Cash, and deleted the project website, Twitter, and Telegram accounts. Despite holding a CertiK audit from November 2021, the exploited contract fell entirely outside the audit scope.","sections":[{"content":"Arbix Finance presented itself as an arbitrage-focused yield farming protocol built on Binance Smart Chain. It marketed single-asset vaults in which users could deposit BEP-20 tokens — including BTCB, ETH, BUSD, CAKE, BSC-USD, BSC-USDC, ADA, DOT, DOGE, LINK, XRP, and WBNB — to earn competitive yields described as 'optimal yield with low risk.' The platform launched in late 2021 and obtained a smart contract audit from blockchain security firm CertiK on November 19, 2021, which contributed to early user trust. By early January 2022, the project had accumulated approximately $10 million in total value locked (TVL) from retail depositors.","heading":"Background","sources":[{"url":"https://www.bleepingcomputer.com/news/security/crypto-platform-arbix-flagged-as-a-rugpull-transfers-10-million/","name":"","type":"other","credibility":3},{"url":"https://www.quadrigainitiative.com/casestudy/arbixfinancerugpull.php","name":"","type":"other","credibility":3},{"url":"https://rekt.news/arbix-rekt","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"In the early hours of January 4, 2022 (approximately 3:00 AM UTC), the Arbix Finance development team executed a coordinated exit scam. The operators deployed a separate, unaudited ERC-20 ARBX token contract containing eight mint() functions gated by an onlyOwner modifier. Using this contract, they minted 10 million ARBX tokens distributed across eight addresses, with 4.5 million tokens minted to a single address (0x161262d172699cf0a5e09b6cdfa5fee7f32c183d). These tokens were then dumped on PancakeSwap, collapsing the ARBX price from approximately $1.42 to near zero and generating an estimated $50,000 in proceeds. Simultaneously, the operators drained all user vaults, redirecting approximately $10 million in deposited assets to unverified pools under their control. The stolen portfolio included approximately $1 million in BTCB, $920,000 in Binance-pegged ETH, $2.25 million in BSC-USD, $1.7 million in BUSD, $1.4 million in CAKE, $1 million in BSC-USDC, and smaller amounts of ADA, DOT, DOGE, LINK, XRP, and WBNB. Following the drain, the team deleted the project website, Twitter account, and Telegram channel. CertiK issued a community alert on January 4-5, 2022, warning users to cease all interaction with the protocol.","heading":"The Rug Pull","sources":[{"url":"https://rekt.news/arbix-rekt","name":"","type":"other","credibility":3},{"url":"https://www.bleepingcomputer.com/news/security/crypto-platform-arbix-flagged-as-a-rugpull-transfers-10-million/","name":"","type":"other","credibility":3},{"url":"https://www.infosecurity-magazine.com/news/crypto-firm-pulls-rug-investors/","name":"","type":"other","credibility":3},{"url":"https://www.bankinfosecurity.com/suspected-cryptocurrency-rug-pull-nets-actors-10-million-a-18257","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"On-chain records available through BscScan document the primary wallet associated with the rug pull at address 0x4714a26e4e2e1334c80575332ec9eb043b61a2c4 on BSC. The ARBX token contract (0xd20ef93050c0943f74f5f8ff0cc97c74139d6437 on BSC) contained the privileged mint() function used to generate unbacked tokens. The stolen BSC assets were bridged to Ethereum through AnySwap (later renamed Multichain) using USDT as the bridge asset, converting the total haul to approximately 2,500 ETH (valued at roughly $9.9 million at the time). On Ethereum, funds flowed through address 0xdc85c1eb22b0ece7be559a83fd788fe57f5a7a9f before being routed into Tornado Cash, a cryptocurrency mixing service, to obfuscate the transaction trail. CertiK's Skytrace on-chain analysis tool was used to map the fund movement from BSC through AnySwap to Ethereum and into the mixer. A key minting destination address on BSC is 0x161262d172699cf0a5e09b6cdfa5fee7f32c183d, which received 4.5 million of the minted ARBX tokens that were subsequently dumped on PancakeSwap. The audited Arbix contracts did not include the exploited token contract, meaning CertiK's November 2021 audit provided no coverage over the mechanism actually used to execute the theft.","heading":"On-Chain Evidence","sources":[{"url":"https://bscscan.com/address/0x4714a26e4e2e1334c80575332ec9eb043b61a2c4","name":"","type":"other","credibility":3},{"url":"https://bscscan.com/address/0xd20ef93050c0943f74f5f8ff0cc97c74139d6437","name":"","type":"other","credibility":3},{"url":"https://rekt.news/arbix-rekt","name":"","type":"other","credibility":3},{"url":"https://www.bleepingcomputer.com/news/security/crypto-platform-arbix-flagged-as-a-rugpull-transfers-10-million/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"No public information identifying the founders or developers behind Arbix Finance has been established. The team operated entirely anonymously, with no KYC requirements, no doxxed team members, and no verifiable corporate registration linked to the project. Following the rug pull, all official communications channels — website, Twitter (@ArbixFinance), and Telegram — were permanently deleted, eliminating any remaining means of contact or accountability. As of the time of reporting, the identities of the Arbix Finance operators remain unknown and no arrests or legal actions against named individuals have been publicly confirmed. The anonymous structure of the project is consistent with a deliberate design to prevent post-incident accountability.","heading":"Team Anonymity","sources":[{"url":"https://www.bleepingcomputer.com/news/security/crypto-platform-arbix-flagged-as-a-rugpull-transfers-10-million/","name":"","type":"other","credibility":3},{"url":"https://www.infosecurity-magazine.com/news/crypto-firm-pulls-rug-investors/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Arbix Finance represents a confirmed, deliberate exit scam (rug pull) and is assigned a trust score of 2 out of 100. The incident demonstrates multiple compounding risk factors: an anonymous and unaccountable development team; a privileged mint() function in an unaudited contract that enabled unlimited token issuance; deliberate misdirection through an incomplete audit presented as a full security clearance; the use of cross-chain bridges (AnySwap) and mixing services (Tornado Cash) to launder stolen funds; and the premeditated deletion of all project communication channels. The CertiK audit, while legitimate for the contracts within its scope, did not cover the exploited contract — a gap that allowed the project to display audit credentials while retaining an unchecked backdoor. Recovery of user funds is considered highly unlikely. This incident is frequently cited as a canonical example of a BSC rug pull in post-mortem analyses of the 2021-2022 DeFi bull market. Rug pulls accounted for 37% of total cryptocurrency fraud revenue in 2021, generating approximately $2.8 billion industrywide.","heading":"Risk Assessment","sources":[{"url":"https://rekt.news/arbix-rekt","name":"","type":"other","credibility":3},{"url":"https://www.quadrigainitiative.com/casestudy/arbixfinancerugpull.php","name":"","type":"other","credibility":3},{"url":"https://www.malwarebytes.com/blog/scams/2022/01/10m-of-funds-goes-missing-in-what-appears-to-be-a-cryptocurrency-rug-pull","name":"","type":"other","credibility":3},{"url":"https://skynet.certik.com/projects/arbix","name":"","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021-11-19","event":"CertiK conducts smart contract audit of Arbix Finance vault contracts; exploited ARBX token contract is outside audit scope.","source":""},{"date":"2021-12-10","event":"Alleged pre-staging: 4.5 million ARBX tokens minted to address 0x161262d172699cf0a5e09b6cdfa5fee7f32c183d.","source":""},{"date":"2022-01-04","event":"Rug pull executed at approximately 3:00 AM UTC: 10 million ARBX tokens minted across 8 addresses and dumped on PancakeSwap; all user vaults drained of approximately $10 million; assets bridged from BSC to Ethereum via AnySwap; funds routed through Tornado Cash; website, Twitter, and Telegram deleted.","source":""},{"date":"2022-01-04","event":"CertiK issues community alert warning users not to interact with Arbix Finance and confirms rug pull via Skytrace on-chain analysis.","source":""},{"date":"2022-01-05","event":"BleepingComputer, Infosecurity Magazine, BankInfoSecurity, Malwarebytes, and multiple crypto outlets publish coverage of the incident.","source":""}],"sources_used":[{"url":"https://www.bleepingcomputer.com/news/security/crypto-platform-arbix-flagged-as-a-rugpull-transfers-10-million/","name":"","type":"other","archive_url":"http://web.archive.org/web/20251214103228/https://www.bleepingcomputer.com/news/security/crypto-platform-arbix-flagged-as-a-rugpull-transfers-10-million/","credibility":3,"archive_timestamp":"2025-12-14T10:32:28+00:00"},{"url":"https://www.quadrigainitiative.com/casestudy/arbixfinancerugpull.php","name":"","type":"other","archive_url":"http://web.archive.org/web/20260208175838/https://quadrigainitiative.com/casestudy/arbixfinancerugpull.php","credibility":3,"archive_timestamp":"2026-02-08T17:58:38+00:00"},{"url":"https://rekt.news/arbix-rekt","name":"","type":"other","archive_url":"http://web.archive.org/web/20260513155842/https://rekt.news/arbix-rekt","credibility":3,"archive_timestamp":"2026-05-13T15:58:42+00:00"},{"url":"https://www.infosecurity-magazine.com/news/crypto-firm-pulls-rug-investors/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260301053045/https://www.infosecurity-magazine.com/news/crypto-firm-pulls-rug-investors/","credibility":3,"archive_timestamp":"2026-03-01T05:30:45+00:00"},{"url":"https://www.bankinfosecurity.com/suspected-cryptocurrency-rug-pull-nets-actors-10-million-a-18257","name":"","type":"other","archive_url":"https://web.archive.org/web/20260830131455/https://www.bankinfosecurity.com/suspected-cryptocurrency-rug-pull-nets-actors-10-million-a-18257","credibility":3,"archive_timestamp":"2026-08-30T13:14:55+00:00"},{"url":"https://bscscan.com/address/0x4714a26e4e2e1334c80575332ec9eb043b61a2c4","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://bscscan.com/address/0xd20ef93050c0943f74f5f8ff0cc97c74139d6437","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.malwarebytes.com/blog/scams/2022/01/10m-of-funds-goes-missing-in-what-appears-to-be-a-cryptocurrency-rug-pull","name":"","type":"other","archive_url":"https://web.archive.org/web/20260830093415/https://www.malwarebytes.com/blog/scams/2022/01/10m-of-funds-goes-missing-in-what-appears-to-be-a-cryptocurrency-rug-pull","credibility":3,"archive_timestamp":"2026-08-30T09:34:15+00:00"},{"url":"https://skynet.certik.com/projects/arbix","name":"","type":"other","archive_url":"http://web.archive.org/web/20251012105702/https://skynet.certik.com/projects/arbix","credibility":3,"archive_timestamp":"2025-10-12T10:57:02+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-5","created_at":"2026-05-04T02:54:52.036208+00:00","updated_at":"2026-08-30T13:44:38.777388+00:00"}}