{"investigation":{"slug":"bond-protocol","entity_name":"Bond Protocol","trust_score":54,"severity_base":null,"score_modifier":8,"confidence":0.72,"status":"draft","content_type":"investigation","summary":"Bond Protocol is a permissionless DeFi infrastructure platform launched in October 2022, originating from OlympusDAO's bonding mechanism, that enables protocols to create bond markets for treasury diversification and Protocol Owned Liquidity (POL). The protocol suffered a smart contract exploit in October 2022 in which approximately 30,437 OHM tokens (~$300,000) were drained from its Fixed-Expiry Teller contract; all funds were returned by the attacker within hours of the incident. The protocol raised a $2.5M seed round from credible venture investors and has since expanded to Ethereum, Arbitrum, and Optimism, though it shows signs of reduced activity as of 2025-2026.","sections":[{"content":"Bond Protocol launched on October 3, 2022, positioning itself as the next evolution of OlympusDAO's bonding-as-a-service infrastructure. The platform provides a permissionless system allowing any individual, DAO, protocol, venture capital firm, or fund to create bond markets in which a quote token can be exchanged for a vested payout token at a discount. The protocol's stated mission is to address two inefficiencies in the crypto industry: limited options for treasury diversification and high sell pressure from token distribution mechanisms. Its two primary products are Permissionless Bonds and Options Liquidity Mining (OLM), the latter enabling protocols to mint ERC-20 call options as liquidity incentives. The protocol is deployed on Ethereum, Arbitrum, and Optimism. Bond Protocol describes itself as credibly neutral and solely focused on providing bonds-as-a-service infrastructure rather than operating its own treasury or native token.","heading":"Background and Overview","sources":[{"url":"https://docs.bondprotocol.finance/","name":"Bond Protocol Documentation - Protocol Overview","type":"official","credibility":2},{"url":"https://iq.wiki/wiki/bond-protocol","name":"Bond Protocol - IQ.wiki","type":"research","credibility":2},{"url":"https://moralis.com/web3-wiki/bond-protocol/","name":"Bond Protocol - Moralis Web3 Wiki","type":"research","credibility":2}],"severity":"low"},{"content":"On October 21, 2022, Bond Protocol's Fixed-Expiry Teller smart contract was exploited. An attacker deployed a malicious contract at approximately 05:20 UTC and executed a private transaction at 05:22 UTC, exploiting a missing input validation in the contract's redeem() function. The attacker passed in counterfeit ERC-20 bond tokens with OHM as the underlying asset, tricking the contract into releasing real OHM held as vesting collateral. Approximately 30,437 OHM tokens, valued at roughly $300,000 at the time, were drained from three of OlympusDAO's active bond markets. Critically, all drained funds were returned to the OlympusDAO treasury wallet by the attacker within hours of the exploit. The incident is widely characterized as a white hat action, in part because Bond Protocol's Immunefi bug bounty program had a maximum payout of $3.3 million — substantially larger than the amount taken. This exploit is properly characterized as a security vulnerability suffered by Bond Protocol, not an act of fraud, misappropriation, or insider misconduct by the protocol's team. Bond Protocol paused new bond market creation and submitted a contract patch validating the input bond token. The vulnerability existed in an audited commit but was not caught by any of the three auditors (yAcademy, Sherlock, and Zellic) who had reviewed the codebase prior to the incident.","heading":"October 2022 Smart Contract Exploit (Suffered Hack)","sources":[{"url":"https://medium.com/@Bond_Protocol/bond-protocol-incident-report-e0aa1dfdeab","name":"Bond Protocol Incident Report - Fixed-Expiry Teller Exploit (Medium)","type":"official","credibility":2},{"url":"https://www.theblock.co/post/178927/hacker-drains-olympus-dao","name":"Hacker drains $300,000 from Olympus DAO on Bond Protocol - The Block","type":"news_article","credibility":1},{"url":"https://decrypt.co/112627/hacker-300k-olympus-dao","name":"Hacker Steals $300K From Olympus DAO, Then Returns It All the Same Day - Decrypt","type":"news_article","credibility":1},{"url":"https://www.halborn.com/blog/post/explained-the-olympusdao-hack-october-2022","name":"Explained: The OlympusDAO Hack (October 2022) - Halborn","type":"research","credibility":2},{"url":"https://beincrypto.com/olympusdao-suffer-300k-exploit-white-hat-hacker-returns-all-funds/","name":"OlympusDAO Suffer $300K Exploit, White Hat Hacker Returns All Funds - BeInCrypto","type":"news_article","credibility":2}],"severity":"medium"},{"content":"Bond Protocol closed a $2.5 million seed round in October 2022, led by Chapter One and IDEO CoLab Ventures, with additional participation from Alchemy Ventures and Hypersphere Ventures, as well as strategic angel investors. The round was announced publicly and confirmed by both Bond Protocol and Chapter One. No additional funding rounds have been publicly reported as of mid-2026. The protocol has not issued a native governance token. The participation of recognized institutional crypto investors (IDEO CoLab, Alchemy Ventures, Hypersphere) provides a degree of external credibility, though seed-stage backing alone does not guarantee protocol safety or longevity.","heading":"Funding and Investors","sources":[{"url":"https://medium.com/@Bond_Protocol/announcing-our-2-5m-seed-round-ff5891ffa654","name":"Announcing our $2.5M Seed Round - Bond Protocol on Medium","type":"official","credibility":2},{"url":"https://mirror.xyz/chapterone.eth/1Ok70pz4qbTJe1EriUFAh9rmUIMD2thgEFMDZFxXpWQ","name":"Chapter One Invests in Bond Protocol's Seed Round","type":"news_article","credibility":2}],"severity":"low"},{"content":"Bond Protocol's smart contracts were audited by three firms prior to launch: yAcademy, Sherlock, and Zellic. Audit reports are published in the protocol's GitHub repository under bond-contracts/audits. Despite three independent audits, the validation bug that enabled the October 2022 exploit was present in the audited commit but was not identified by any of the auditing firms. Following the exploit, Bond Protocol committed to deploying a fix and working with security professionals to review the broader codebase for additional weaknesses. The existence of multiple audits from recognized firms is a positive indicator, though the audit miss demonstrates that even multi-firm coverage does not eliminate smart contract risk.","heading":"Smart Contract Audits","sources":[{"url":"https://github.com/Bond-Protocol/bond-contracts/tree/master/audits","name":"Bond Protocol GitHub - Audits Directory","type":"official","credibility":2},{"url":"https://medium.com/@Bond_Protocol/bond-protocol-incident-report-e0aa1dfdeab","name":"Bond Protocol Incident Report - Fixed-Expiry Teller Exploit (Medium)","type":"official","credibility":2}],"severity":"medium"},{"content":"Bond Protocol reported a $22.9 million increase in Total Bonded Value (TBV) during Q1 2023, representing 147% growth from the start of that quarter. As of the reporting period, Arbitrum accounted for 1,536 total bondings compared to 1,410 on Ethereum mainnet, indicating cross-chain adoption. The frontend dApp was updated as recently as February 2026 based on GitHub commit history, and option-contracts were updated in November 2024. However, Tracxn listed the company as having a single employee as of mid-2026, and some third-party databases have flagged the entity as potentially out of business. No native governance token or public treasury has been disclosed. The current state of active usage, TVL, and team size is difficult to confirm independently due to limited recent public disclosures.","heading":"Operational Status and Activity","sources":[{"url":"https://medium.com/@Bond_Protocol/bond-protocol-q2-2023-report-294f1182807a","name":"Bond Protocol Q2 2023 Report - Medium","type":"official","credibility":2},{"url":"https://tracxn.com/d/companies/bond-protocol/__08BRVAbdZE7a7v6-gIXCDcG-bTmkjyJ-zzbMf5dwb9c","name":"Bond Protocol - Tracxn Company Profile","type":"research","credibility":3},{"url":"https://github.com/bond-protocol","name":"Bond-Protocol GitHub Organization","type":"official","credibility":2},{"url":"https://defillama.com/protocol/bond-protocol","name":"Bond Protocol TVL - DefiLlama","type":"on_chain","credibility":2}],"severity":"medium"},{"content":"No regulatory actions, SEC investigations, CFTC proceedings, DOJ charges, or civil lawsuits specifically targeting Bond Protocol have been identified. The protocol does not issue a native token, which reduces its exposure to securities law risk compared to token-issuing DeFi projects. No sanctions, OFAC designations, or law enforcement actions have been found. This section will be updated if new regulatory information emerges.","heading":"Regulatory and Legal Status","sources":[],"severity":"low"}],"timeline":[{"date":"2022-07-15","event":"Bond Protocol formally introduced as the next evolution of OlympusDAO's bonds-as-a-service infrastructure.","source":"Bond Protocol Medium","source_url":"https://medium.com/@Bond_Protocol/introducing-bond-protocol-8476881f84e4"},{"date":"2022-10-03","event":"Bond Protocol officially launched on Ethereum mainnet, enabling permissionless bond market creation.","source":"Bond Protocol Documentation","source_url":"https://docs.bondprotocol.finance/"},{"date":"2022-10-06","event":"Bond Protocol announced a $2.5M seed round led by Chapter One and IDEO CoLab Ventures, with Alchemy Ventures and Hypersphere Ventures also participating.","source":"Bond Protocol Medium","source_url":"https://medium.com/@Bond_Protocol/announcing-our-2-5m-seed-round-ff5891ffa654"},{"date":"2022-10-21","event":"Attacker exploited a missing input validation in Bond Protocol's Fixed-Expiry Teller smart contract, draining approximately 30,437 OHM (~$300,000) from three OlympusDAO bond markets. The attacker returned all funds within hours. Bond Protocol paused new market creation and submitted a contract patch.","source":"The Block / Decrypt / Bond Protocol Incident Report","source_url":"https://www.theblock.co/post/178927/hacker-drains-olympus-dao"},{"date":"2023","event":"Bond Protocol reported $22.9M increase in Total Bonded Value in Q1 2023, representing 147% quarter-over-quarter growth.","source":"Bond Protocol Q2 2023 Report","source_url":"https://medium.com/@Bond_Protocol/bond-protocol-q2-2023-report-294f1182807a","date_original":"2023-01-01"},{"date":"2023-07","event":"Bond Protocol expanded with Options Liquidity Mining (OLM) product, enabling protocols to mint ERC-20 call options as incentives.","source":"Bond Protocol Medium","source_url":"https://medium.com/@Bond_Protocol/introducing-options-liquidity-mining-9beee41e6fdf","date_original":"2023-07-01"},{"date":"2024-11-22","event":"Bond Protocol's option-contracts repository updated on GitHub, indicating ongoing development.","source":"Bond-Protocol GitHub","source_url":"https://github.com/bond-protocol"},{"date":"2026-02-10","event":"Bond Protocol dApp frontend updated on GitHub, the most recent activity found as of mid-2026.","source":"Bond-Protocol GitHub","source_url":"https://github.com/bond-protocol"}],"sources_used":[{"url":"https://medium.com/@Bond_Protocol/bond-protocol-incident-report-e0aa1dfdeab","name":"Bond Protocol Incident Report - Fixed-Expiry Teller Exploit","type":"official","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.theblock.co/post/178927/hacker-drains-olympus-dao","name":"Hacker drains $300,000 from Olympus DAO on Bond Protocol - The Block","type":"news_article","archive_url":"http://web.archive.org/web/20260218155559/https://www.theblock.co/post/178927/hacker-drains-olympus-dao","credibility":1,"archive_timestamp":"2026-02-18T15:55:59+00:00"},{"url":"https://decrypt.co/112627/hacker-300k-olympus-dao","name":"Hacker Steals $300K From Olympus DAO, Then Returns It All the Same Day - Decrypt","type":"news_article","archive_url":"http://web.archive.org/web/20260421134808/https://decrypt.co/112627/hacker-300k-olympus-dao","credibility":1,"archive_timestamp":"2026-04-21T13:48:08+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-olympusdao-hack-october-2022","name":"Explained: The OlympusDAO Hack (October 2022) - Halborn","type":"research","archive_url":"http://web.archive.org/web/20260517001923/https://www.halborn.com/blog/post/explained-the-olympusdao-hack-october-2022","credibility":2,"archive_timestamp":"2026-05-17T00:19:23+00:00"},{"url":"https://beincrypto.com/olympusdao-suffer-300k-exploit-white-hat-hacker-returns-all-funds/","name":"OlympusDAO Suffer $300K Exploit, White Hat Hacker Returns All Funds - BeInCrypto","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://medium.com/@Bond_Protocol/announcing-our-2-5m-seed-round-ff5891ffa654","name":"Announcing our $2.5M Seed Round - Bond Protocol Medium","type":"official","archive_url":"http://web.archive.org/web/20260725083722/https://medium.com/@Bond_Protocol/announcing-our-2-5m-seed-round-ff5891ffa654","credibility":2,"archive_timestamp":"2026-07-25T08:37:22+00:00"},{"url":"https://mirror.xyz/chapterone.eth/1Ok70pz4qbTJe1EriUFAh9rmUIMD2thgEFMDZFxXpWQ","name":"Chapter One Invests in Bond Protocol Seed Round","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://github.com/Bond-Protocol/bond-contracts/tree/master/audits","name":"Bond Protocol GitHub - Audits Directory","type":"official","archive_url":"https://web.archive.org/web/20260819125831/https://github.com/Bond-Protocol/bond-contracts/tree/master/audits","credibility":2,"archive_timestamp":"2026-08-19T12:58:31+00:00"},{"url":"https://docs.bondprotocol.finance/","name":"Bond Protocol Documentation - Protocol Overview","type":"official","archive_url":"http://web.archive.org/web/20260420134627/https://docs.bondprotocol.finance/","credibility":2,"archive_timestamp":"2026-04-20T13:46:27+00:00"},{"url":"https://medium.com/@Bond_Protocol/bond-protocol-q2-2023-report-294f1182807a","name":"Bond Protocol Q2 2023 Report - Medium","type":"official","archive_url":"http://web.archive.org/web/20251016164252/https://medium.com/@Bond_Protocol/bond-protocol-q2-2023-report-294f1182807a","credibility":2,"archive_timestamp":"2025-10-16T16:42:52+00:00"},{"url":"https://defillama.com/protocol/bond-protocol","name":"Bond Protocol TVL - DefiLlama","type":"on_chain","archive_url":"http://web.archive.org/web/20250914053952/https://defillama.com/protocol/bond-protocol","credibility":2,"archive_timestamp":"2025-09-14T05:39:52+00:00"},{"url":"https://github.com/bond-protocol","name":"Bond-Protocol GitHub Organization","type":"official","archive_url":"https://web.archive.org/web/20260819125740/https://github.com/bond-protocol","credibility":2,"archive_timestamp":"2026-08-19T12:57:40+00:00"},{"url":"https://medium.com/@Bond_Protocol/introducing-bond-protocol-8476881f84e4","name":"Introducing Bond Protocol - Medium","type":"official","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://iq.wiki/wiki/bond-protocol","name":"Bond Protocol - IQ.wiki","type":"research","archive_url":"http://web.archive.org/web/20260112204205/https://iq.wiki/wiki/bond-protocol","credibility":2,"archive_timestamp":"2026-01-12T20:42:05+00:00"},{"url":"https://cryptodaily.co.uk/2022/10/hacker-siphons-300000-from-olympus-dao-returns-it-hours-later","name":"Hacker Siphons $300,000 From Olympus DAO, Returns It Hours Later - Crypto Daily","type":"news_article","archive_url":"https://web.archive.org/web/20260819151244/https://cryptodaily.co.uk/2022/10/hacker-siphons-300000-from-olympus-dao-returns-it-hours-later","credibility":2,"archive_timestamp":"2026-08-19T15:12:44+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:47.168409+00:00","updated_at":"2026-08-25T07:51:35.864+00:00"}}