{"investigation":{"slug":"belt-finance","entity_name":"Belt Finance","trust_score":28,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"Belt Finance (belt.fi) is a multi-strategy yield aggregator and stableswap AMM built primarily on Binance Smart Chain (BSC), developed by South Korean blockchain firm Ozys. On May 29, 2021, the protocol was exploited via a flash loan attack that netted the attacker approximately $6.23 million in BUSD and caused an estimated $50 million in total pool losses. The protocol announced a phased compensation plan for affected users but full repayment status remains unverified; the protocol has continued operating in diminished form, with current TVL of approximately $12 million as of 2025.","sections":[{"content":"On May 29, 2021, Belt Finance suffered a flash loan attack on its BSC 4Belt (USDT/USDC/BUSD/DAI) pool. The attacker deployed a smart contract that borrowed approximately 385 million BUSD from PancakeSwap via flash loans, then exploited a valuation flaw in the beltBUSD vault. By performing repeated BUSD/USDT swaps through Ellipsis DEX, the attacker manipulated the valuation of shares within the protocol — a bug tied to the integration with the Venus strategy — allowing withdrawal of more funds than were deposited. The attack contract was executed eight times in succession, yielding approximately 6,234,753 BUSD (approximately $6.23 million) in profit to the attacker. The total loss to the beltBUSD pool was approximately $50 million, comprising roughly $43.8 million in fees and the $6.23 million directly extracted. beltBUSD vault users suffered a 21.36% loss of funds; 4Belt pool users lost 5.51%. Belt Finance immediately paused deposits and withdrawals upon discovering the attack and patched the underlying vulnerability. Security firm Halborn later described the root cause as a 'faulty assumption that all strategies within Belt's multi-strategy vault would be balanced,' consistent with a class of oracle manipulation attacks previously seen on Harvest Finance in October 2020.","heading":"May 2021 Flash Loan Exploit","sources":[{"url":"https://www.coindesk.com/markets/2021/05/30/belt-finance-victim-of-flash-loan-attack-in-latest-exploit-of-a-bsc-defi-protocol","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-belt-finance-hack-may-2021","name":"halborn.com","type":"other","credibility":3},{"url":"https://decrypt.co/72358/belt-finance-exploited-6-2-million-flash-loan-attack","name":"decrypt.co","type":"other","credibility":3},{"url":"https://www.vidma.io/blog/the-belt-finance-exploit-a-6-3m-flash-loan-attack-on-bsc","name":"vidma.io","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/belt-finance-loses-millions-in-latest-bsc-based-defi-exploit","name":"cointelegraph.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the May 2021 exploit, Belt Finance announced a phased compensation program for affected users. A snapshot was taken of 4Belt pool and 4BELT token holders at the time of the attack, and affected parties received remedy4BELT (r4BELT) tokens proportional to their pre-attack holdings. To claim compensation, users were required to pair their 4BELT with r4BELT as a PancakeSwap LP and stake the LP on Belt Finance to receive distributed compensation over time. The team committed 67% of the unlocked portion of its build allocation — approximately 864 BELT per day — toward the r4BELT compensation fund. Additionally, Belt Finance announced a $3 million BELT token buyback fund intended to increase the token's buy-side pressure and partially offset holder losses. BELT token holders were also included in compensation given the token dumped approximately 54% in the immediate aftermath of the attack. No independent third-party verification of full compensation completion has been found in available sources.","heading":"Compensation Plan","sources":[{"url":"https://www.coindesk.com/business/2021/06/02/belt-finance-to-compensate-users-following-623m-attack","name":"coindesk.com","type":"other","credibility":3},{"url":"https://beincrypto.com/belt-finance-unveils-defi-hack-compensation-plan/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://finance.yahoo.com/news/belt-finance-unveils-defi-hack-053317193.html","name":"finance.yahoo.com","type":"other","credibility":3},{"url":"https://crypto.news/belt-finance-compensate-users-6-3-million-attack/","name":"crypto.news","type":"other","credibility":3}],"severity":"medium"},{"content":"Belt Finance was developed by Ozys, a South Korean blockchain technology company incorporated in approximately 2017–2018. Ozys is also the developer behind KLAYswap, the largest DeFi service on the Klaytn network, and Orbit Chain, a cross-chain bridge protocol. Ozys is a member of the Klaytn Governance Council alongside organizations including Binance, Huobi, MakerDAO, LG Electronics, and Kakao. The company's portfolio of products has experienced multiple significant security incidents: Belt Finance in May 2021 ($6.23M extracted), KLAYswap in February 2022 (alleged ~$2M drained), and Orbit Bridge on December 31, 2023 ($81.5M extracted). Following the Orbit Chain hack, Ozys published a statement alleging the firm's former CISO had made firewall infrastructure vulnerable prior to departing the company on December 6, 2023. The pattern of security incidents across multiple Ozys-developed protocols has drawn scrutiny from the crypto security community.","heading":"Developer Background: Ozys","sources":[{"url":"https://blockworks.co/news/80-million-lost-orbit-bridge","name":"blockworks.co","type":"other","credibility":3},{"url":"https://unchainedcrypto.com/orbit-chain-announces-significant-clue-in81-million-new-years-eve-hack/","name":"unchainedcrypto.com","type":"other","credibility":3},{"url":"https://rekt.news/orbit-bridge-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://bsc.news/post/belt-fi-project-insight-an-amm-incorporating-multi-strategy-yield-optimization","name":"bsc.news","type":"other","credibility":3}],"severity":"medium"},{"content":"Belt Finance underwent multiple smart contract audits prior to and following its 2021 exploit. Documented audits include: an initial audit by SOOHO (a Consensys-backed Korean security firm), a second audit by HAECHI AUDIT covering v2 updates, a third SOOHO audit for HECO Belt Finance, and a fourth in-progress audit by DeDaub covering v3 cross-chain swap functionality. The protocol also maintained a bug bounty program through Immunefi with rewards reportedly up to $1 million. Despite these audits and the bug bounty program, the May 2021 flash loan exploit succeeded. The exploited vulnerability — an incorrect share valuation assumption in the multi-strategy vault — was not caught by prior auditors, illustrating the limitations of smart contract auditing in detecting integration-level logic flaws. Belt Finance's original smart contracts were forked from yearn.finance, Curve, and Pickle Finance.","heading":"Audit and Security History","sources":[{"url":"https://docs.belt.fi/security-and-risks","name":"docs.belt.fi","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-belt-finance-hack-may-2021","name":"halborn.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Belt Finance operated on HECO (Huobi Eco Chain) in addition to BSC and Klaytn. On November 22, 2023, the HECO Chain bridge was exploited for approximately $86–115 million in assets in an incident affecting HTX exchange and the Heco Chain Ethereum Bridge. In response, Belt Finance suspended all deposits to HECO network pools. Belt Finance V4, announced for launch on January 4, 2024, does not include HECO network support. HECO Network formally ceased operations on January 15, 2025, removing that deployment from service entirely.","heading":"HECO Chain Exposure (2023)","sources":[{"url":"https://www.coindesk.com/tech/2023/11/22/justin-sun-confirms-htx-heco-chain-exploited-after-100m-in-suspicious-transfers","name":"coindesk.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/heco-chain-bridge-hack-86-million-lost","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://coinmarketcap.com/academy/article/52cb9dfd-1370-47cc-a30e-dc3a67bbcd9a","name":"coinmarketcap.com","type":"other","credibility":3}],"severity":"medium"},{"content":"As of 2025, Belt Finance continues to operate as a yield aggregator and AMM. Belt Finance V4 was announced with a target launch date of January 4, 2024, following a two-week delay for additional audits and testing, and was intended to expand to Ethereum, BNB Chain, Polygon, and Klaytn. Current total value locked (TVL) per DefiLlama stands at approximately $12.17 million, predominantly on BSC. This represents a substantial decline from peak TVL levels following the May 2021 exploit. The BELT token trades at approximately $0.03–0.035 USD as of mid-2025. The protocol remains operational but at significantly reduced scale compared to its 2021 peak.","heading":"Current Protocol Status","sources":[{"url":"https://defillama.com/protocol/belt-finance","name":"defillama.com","type":"other","credibility":3},{"url":"https://coinmarketcap.com/currencies/belt/","name":"coinmarketcap.com","type":"other","credibility":3},{"url":"https://belt.fi/","name":"belt.fi","type":"other","credibility":3}],"severity":"medium"},{"content":"AVOID.NET records indicate Belt Finance was flagged by on-chain investigator ZachXBT, though specific public posts by ZachXBT explicitly naming Belt Finance have not been independently located in available indexed sources. The project appears in risk-awareness databases including IsThisCoinAScam, which notes the project website has at times been unreachable — flagged as a risk indicator. The May 2021 exploit was widely covered by crypto security outlets and is a well-documented historical event. Any claims of a direct ZachXBT investigation specific to Belt Finance beyond the hack coverage are treated as low-confidence pending a verifiable source.","heading":"ZachXBT and Community Flags","sources":[{"url":"https://isthiscoinascam.com/check/belt","name":"isthiscoinascam.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021-04","event":"Belt Finance launches on BSC as a multi-strategy yield aggregator and stableswap AMM built by Ozys.","source":"BSC News project insight","source_url":"https://bsc.news/post/belt-fi-project-insight-an-amm-incorporating-multi-strategy-yield-optimization","date_original":"2021-04-01"},{"date":"2021-05-29","event":"Flash loan exploit executes against the beltBUSD vault eight times, netting the attacker approximately $6.23 million BUSD. Total pool losses estimated at $50 million. Belt Finance pauses deposits and withdrawals.","source":"CoinDesk","source_url":"https://www.coindesk.com/markets/2021/05/30/belt-finance-victim-of-flash-loan-attack-in-latest-exploit-of-a-bsc-defi-protocol"},{"date":"2021-05-30","event":"BELT token dumps approximately 54% in the immediate aftermath of the exploit becoming public.","source":"Decrypt","source_url":"https://decrypt.co/72358/belt-finance-exploited-6-2-million-flash-loan-attack"},{"date":"2021-06-02","event":"Belt Finance announces phased compensation plan including r4BELT airdrop for affected vault users and a $3 million BELT buyback fund.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2021/06/02/belt-finance-to-compensate-users-following-623m-attack"},{"date":"2021-06-03","event":"Halborn publishes post-mortem analysis of the Belt Finance hack, identifying the root cause as a faulty valuation assumption in the multi-strategy vault.","source":"Halborn","source_url":"https://www.halborn.com/blog/post/explained-the-belt-finance-hack-may-2021"},{"date":"2022-02","event":"KLAYswap, another Ozys-developed protocol, is exploited for approximately $2 million.","source":"Rekt News / Blockworks","source_url":"https://blockworks.co/news/80-million-lost-orbit-bridge","date_original":"2022-02-01"},{"date":"2023-11-22","event":"HECO Chain bridge exploited for approximately $87–115 million. Belt Finance suspends all HECO deposits. Withdrawals expected after V4 launch.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2023/11/22/justin-sun-confirms-htx-heco-chain-exploited-after-100m-in-suspicious-transfers"},{"date":"2023-12-31","event":"Orbit Bridge (Orbit Chain), also developed by Ozys, is exploited for approximately $81.5 million on New Year's Eve.","source":"Blockworks","source_url":"https://blockworks.co/news/80-million-lost-orbit-bridge"},{"date":"2024-01-04","event":"Belt Finance V4 launches (delayed two weeks from original December 2023 date), adding Ethereum, Polygon support and dropping HECO.","source":"Belt Finance official","source_url":"https://belt.fi/"},{"date":"2025-01-15","event":"HECO Network formally ceases operations, permanently ending Belt Finance's HECO deployment.","source":"CoinMarketCap","source_url":"https://coinmarketcap.com/academy/article/52cb9dfd-1370-47cc-a30e-dc3a67bbcd9a"}],"sources_used":[{"url":"https://www.coindesk.com/markets/2021/05/30/belt-finance-victim-of-flash-loan-attack-in-latest-exploit-of-a-bsc-defi-protocol","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20260915161656/https://www.coindesk.com/markets/2021/05/30/belt-finance-victim-of-flash-loan-attack-in-latest-exploit-of-a-bsc-defi-protocol","credibility":3,"archive_timestamp":"2026-09-15T16:16:56+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-belt-finance-hack-may-2021","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260513002321/https://www.halborn.com/blog/post/explained-the-belt-finance-hack-may-2021","credibility":3,"archive_timestamp":"2026-05-13T00:23:21+00:00"},{"url":"https://decrypt.co/72358/belt-finance-exploited-6-2-million-flash-loan-attack","name":"decrypt.co","type":"other","archive_url":"http://web.archive.org/web/20251207061659/https://decrypt.co/72358/belt-finance-exploited-6-2-million-flash-loan-attack","credibility":3,"archive_timestamp":"2025-12-07T06:16:59+00:00"},{"url":"https://www.vidma.io/blog/the-belt-finance-exploit-a-6-3m-flash-loan-attack-on-bsc","name":"vidma.io","type":"other","archive_url":"http://web.archive.org/web/20260116114718/https://www.vidma.io/blog/the-belt-finance-exploit-a-6-3m-flash-loan-attack-on-bsc","credibility":3,"archive_timestamp":"2026-01-16T11:47:18+00:00"},{"url":"https://cointelegraph.com/news/belt-finance-loses-millions-in-latest-bsc-based-defi-exploit","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20251104212615/https://cointelegraph.com/news/belt-finance-loses-millions-in-latest-bsc-based-defi-exploit","credibility":3,"archive_timestamp":"2025-11-04T21:26:15+00:00"},{"url":"https://www.coindesk.com/business/2021/06/02/belt-finance-to-compensate-users-following-623m-attack","name":"coindesk.com","type":"other","archive_url":"https://web.archive.org/web/20260915234830/https://www.coindesk.com/business/2021/06/02/belt-finance-to-compensate-users-following-623m-attack","credibility":3,"archive_timestamp":"2026-09-15T23:48:30+00:00"},{"url":"https://beincrypto.com/belt-finance-unveils-defi-hack-compensation-plan/","name":"beincrypto.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://finance.yahoo.com/news/belt-finance-unveils-defi-hack-053317193.html","name":"finance.yahoo.com","type":"other","archive_url":"https://web.archive.org/web/20260830163402/https://finance.yahoo.com/news/belt-finance-unveils-defi-hack-053317193.html","credibility":3,"archive_timestamp":"2026-08-30T16:34:02+00:00"},{"url":"https://crypto.news/belt-finance-compensate-users-6-3-million-attack/","name":"crypto.news","type":"other","archive_url":"http://web.archive.org/web/20251009084532/https://crypto.news/belt-finance-compensate-users-6-3-million-attack/","credibility":3,"archive_timestamp":"2025-10-09T08:45:32+00:00"},{"url":"https://blockworks.co/news/80-million-lost-orbit-bridge","name":"blockworks.co","type":"other","archive_url":"http://web.archive.org/web/20260227024748/https://blockworks.co/news/80-million-lost-orbit-bridge","credibility":3,"archive_timestamp":"2026-02-27T02:47:48+00:00"},{"url":"https://unchainedcrypto.com/orbit-chain-announces-significant-clue-in81-million-new-years-eve-hack/","name":"unchainedcrypto.com","type":"other","archive_url":"https://web.archive.org/web/20260829195812/https://unchainedcrypto.com/orbit-chain-announces-significant-clue-in81-million-new-years-eve-hack/","credibility":3,"archive_timestamp":"2026-08-29T19:58:12+00:00"},{"url":"https://rekt.news/orbit-bridge-rekt","name":"rekt.news","type":"other","archive_url":"http://web.archive.org/web/20260513153300/https://rekt.news/orbit-bridge-rekt","credibility":3,"archive_timestamp":"2026-05-13T15:33:00+00:00"},{"url":"https://bsc.news/post/belt-fi-project-insight-an-amm-incorporating-multi-strategy-yield-optimization","name":"bsc.news","type":"other","archive_url":null,"credibility":3,"archive_error":"error:gone","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://docs.belt.fi/security-and-risks","name":"docs.belt.fi","type":"other","archive_url":"http://web.archive.org/web/20260512030115/https://docs.belt.fi/security-and-risks","credibility":3,"archive_timestamp":"2026-05-12T03:01:15+00:00"},{"url":"https://www.coindesk.com/tech/2023/11/22/justin-sun-confirms-htx-heco-chain-exploited-after-100m-in-suspicious-transfers","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20260725211244/https://www.coindesk.com/tech/2023/11/22/justin-sun-confirms-htx-heco-chain-exploited-after-100m-in-suspicious-transfers","credibility":3,"archive_timestamp":"2026-07-25T21:12:44+00:00"},{"url":"https://cointelegraph.com/news/heco-chain-bridge-hack-86-million-lost","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20251130194653/https://cointelegraph.com/news/heco-chain-bridge-hack-86-million-lost","credibility":3,"archive_timestamp":"2025-11-30T19:46:53+00:00"},{"url":"https://coinmarketcap.com/academy/article/52cb9dfd-1370-47cc-a30e-dc3a67bbcd9a","name":"coinmarketcap.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://defillama.com/protocol/belt-finance","name":"defillama.com","type":"other","archive_url":"http://web.archive.org/web/20250914211219/https://defillama.com/protocol/belt-finance","credibility":3,"archive_timestamp":"2025-09-14T21:12:19+00:00"},{"url":"https://coinmarketcap.com/currencies/belt/","name":"coinmarketcap.com","type":"other","archive_url":"http://web.archive.org/web/20260821174959/https://coinmarketcap.com/currencies/belt/","credibility":3,"archive_timestamp":"2026-08-21T17:49:59+00:00"},{"url":"https://belt.fi/","name":"belt.fi","type":"other","archive_url":"http://web.archive.org/web/20260202094339/https://belt.fi/","credibility":3,"archive_timestamp":"2026-02-02T09:43:39+00:00"},{"url":"https://isthiscoinascam.com/check/belt","name":"isthiscoinascam.com","type":"other","archive_url":"http://web.archive.org/web/20260518101052/https://isthiscoinascam.com/check/belt","credibility":3,"archive_timestamp":"2026-05-18T10:10:52+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:56.831881+00:00","updated_at":"2026-09-15T23:55:18.405006+00:00"}}