{"investigation":{"slug":"bondly","entity_name":"Bondly","trust_score":22,"severity_base":null,"score_modifier":0,"confidence":0.78,"status":"published","content_type":"investigation","summary":"Bondly Finance is a DeFi and NFT protocol launched in September 2020 that suffered a major exploit on July 14-15, 2021, in which 373 million BONDLY tokens were minted via owner-level credentials and sold into liquidity pools, causing an 82% token price collapse and approximately $5.9-7.5 million in losses. The exploit originated from the protocol owner's address, prompting blockchain security firm PeckShield to allege a potential rug pull, though the team attributed it to compromised credentials belonging to CEO Brandon Smith. Following acquisition by Animoca Brands in September 2021 and a rebrand to Forj in May 2022, the project has undergone significant leadership changes; the original founder departed under a cloud of unresolved questions about the exploit's true origin.","sections":[{"content":"Bondly Finance was launched in September 2020 by founder and CEO Brandon Smith, a former managing partner at Shuttle Capital. The protocol described itself as an interoperable, transparent DeFi swap platform built initially on the Polkadot blockchain, offering a suite of products including BondSwap (cross-chain token swaps), a decentralized exchange, and BondProtect (smart contract-based escrow and payment protection). The native BONDLY token was issued as an ERC-20 token on Ethereum and used for governance and ecosystem utility. The project gained early high-profile attention through an NFT partnership with YouTuber Logan Paul in February 2021, during which Paul sold approximately $3.5 million in NFT collectibles in 24 hours through Bondly's platform. Additional celebrity partnerships included musician Lewis Capaldi and gaming company Atari.","heading":"Background and Launch","sources":[{"url":"https://iq.wiki/wiki/bondly-finance","name":"iq.wiki","type":"other","credibility":3},{"url":"https://cryptopotato.com/american-youtuber-logan-paul-teams-up-with-bondly-finance-to-release-nft/","name":"cryptopotato.com","type":"other","credibility":3},{"url":"https://dailyhodl.com/2021/02/24/logan-paul-sells-3500000-in-crypto-art-in-just-24-hours-through-polkadot-based-project/","name":"dailyhodl.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On July 14-15, 2021, Bondly Finance suffered a critical exploit. Beginning at approximately 12:16 AM UTC on July 15, an attacker transferred 373,088,023 BONDLY tokens from the Bondly Staking Rewards contract. Of these, 200,460,000 tokens were used to mint zenBONDLY on the MANTRA DAO ZENTEREST platform to borrow additional crypto assets in a multi-chain attack spanning Ethereum, Binance Smart Chain, and Polygon. The newly minted and stolen tokens were sold into liquidity pools, enabling the attacker to extract value while causing the BONDLY price to collapse approximately 82% within seven hours — from roughly $0.063 to $0.01. Total estimated losses ranged from $5.9 million to $7.5 million depending on the valuation methodology used. The attacker pre-funded transactions using Tornado.Cash at 02:03 PM UTC on July 14 and subsequently moved approximately 501 ETH back through Tornado.Cash at 08:15 AM UTC on July 15, obscuring fund traceability. The attack did not exploit a technical vulnerability in the smart contract code. Instead, the perpetrator used owner-level permissions to execute the token minting — the precise mechanism that controls the entire token supply.","heading":"July 2021 Exploit: Infinite Mint and Token Collapse","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-bondly-finance-hack-july-2021","name":"halborn.com","type":"other","credibility":3},{"url":"https://forj.medium.com/bondly-attack-july-14th-2021-postmortem-beb7cf02e9ba","name":"forj.medium.com","type":"other","credibility":3},{"url":"https://www.quadrigainitiative.com/casestudy/bondlyfinanceadminwalletcompromise.php","name":"quadrigainitiative.com","type":"other","credibility":3},{"url":"https://medium.com/mantra-dao/bondly-exploit-how-it-unfolded-on-zenterest-postmortem-d8120d8d784b","name":"medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Blockchain security firm PeckShield analyzed the on-chain data and issued a public statement shortly after the incident. PeckShield CEO Xuxian Jiang stated: 'It is potentially a rug pull as the owner...pulls the trigger in transferring out 373M $BONDLY to sell.' PeckShield's analysis confirmed that the minting operation was executed from Bondly's own owner address via an owner transfer function — not from an external exploiter wallet. This finding was central to community suspicion that the exploit was internally orchestrated. The Bondly team, in their official postmortem, attributed the breach to a compromised password account belonging to CEO Brandon Smith, which allegedly contained the mnemonic recovery phrase for his hardware wallet. The team stated that through 'a well-orchestrated strategy,' an attacker gained access to this password account and used it to access the BONDLY smart contract and corporate wallets. Sam Kim, founder of Umbrella Network, offered a dissenting view, suggesting that a private key compromise was a more probable explanation than an intentional rug pull, noting that abandoning a public project with known team identities for under $10 million carried substantial legal and reputational risk. No independent forensic investigation results have been made public. No funds were recovered. The true origin of the attack — external hack versus internal misconduct — was never definitively established by a credible third party.","heading":"Rug Pull Allegations and Contested Origin of the Attack","sources":[{"url":"https://cryptobriefing.com/bondly-finance-exploited-for-millions-potential-rug-pull/","name":"cryptobriefing.com","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-bondly-finance-hack-july-2021","name":"halborn.com","type":"other","credibility":3},{"url":"https://www.quadrigainitiative.com/casestudy/bondlyfinanceadminwalletcompromise.php","name":"quadrigainitiative.com","type":"other","credibility":3},{"url":"https://forj.medium.com/bondly-attack-july-14th-2021-postmortem-beb7cf02e9ba","name":"forj.medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On July 16, 2021, the day after the exploit became public, CEO Brandon Smith voluntarily took a leave of absence. According to the official postmortem, the leave was taken 'to eliminate any potential conflicts of interest with the investigation.' Co-founder Harry Liu assumed CEO responsibilities. Smith's departure was framed as voluntary and temporary in official communications, but he did not return to the company in a public-facing leadership role. In September 2021, Animoca Brands entered into a binding agreement to acquire a majority stake in Bondly, with Harry Liu formally confirmed as CEO under the new ownership structure. The terms of the Animoca acquisition were not publicly disclosed, though Animoca described the deal as 'not material' to its operations. The Animoca acquisition occurred approximately two months after the exploit, raising community questions about whether the incident depressed valuation and enabled a discounted acquisition.","heading":"Founder Departure and Leadership Changes","sources":[{"url":"https://forj.medium.com/bondly-attack-july-14th-2021-postmortem-beb7cf02e9ba","name":"forj.medium.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2021/09/17/games-maker-animoca-brands-to-acquire-majority-stake-in-bondly","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.animocabrands.com/animoca-brands-to-acquire-majority-stake-in-bondly","name":"animocabrands.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the exploit, Bondly deployed a replacement BONDLY token contract and initiated a compensation program. Token holders were able to claim replacement tokens starting August 29, 2021, through a dedicated claim portal at tokenclaim.bondly.finance, using a snapshot taken prior to the incident. Liquidity pool providers received their full BONDLY allocation plus an additional 30% bonus. A 'Diamond Hands' bonus was offered to holders who retained all new tokens through at least October 27, 2021, to incentivize continued holding. Despite the compensation plan, the token continued to decline in value significantly. The token reached an all-time high of approximately $0.202 on November 24, 2021, before declining sharply. By the end of 2022, the price had fallen from $0.097 to approximately $0.0052 — a decline of roughly 95% from the all-time high. No stolen funds were recovered from the attacker.","heading":"Token Holder Compensation and Redeployment","sources":[{"url":"https://forj.medium.com/update-on-token-redeployment-8a77bd2347fe","name":"forj.medium.com","type":"other","credibility":3},{"url":"https://tokenclaim.bondly.finance/","name":"tokenclaim.bondly.finance","type":"other","credibility":3},{"url":"https://forj.medium.com/how-to-claim-my-new-bondly-tokens-5d94273d95cf","name":"forj.medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"In May 2022, Bondly Finance and Animoca Brands announced a strategic rebrand of the entity to Forj, pivoting the business focus toward Web3 mass-audience onboarding across music, sports, lifestyle, and gaming verticals. The BONDLY token ticker was retained on exchanges. As of 2023-2024, the BONDLY/Forj token had declined to approximately $0.00048 as of January 2025, representing a loss of approximately 99.7% from the all-time high. The project continues to operate as an Animoca Brands subsidiary, though trading volume and market capitalization have remained minimal. No regulatory actions by the SEC, CFTC, or other authorities against Bondly Finance, Forj, Brandon Smith, or associated individuals have been identified in available public records.","heading":"Rebrand to Forj and Ongoing Project Status","sources":[{"url":"https://www.prnewswire.com/news-releases/bondly-finance-announces-strategic-rebrand-to-forj-301551278.html","name":"prnewswire.com","type":"other","credibility":3},{"url":"https://www.animocabrands.com/animoca-brands-to-acquire-majority-stake-in-bondly","name":"animocabrands.com","type":"other","credibility":3},{"url":"https://www.coingecko.com/en/coins/forj","name":"coingecko.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The Bondly exploit exposed critical security architecture failures regardless of whether the attack was internal or external. The protocol's admin/owner key was held by a single individual (the CEO) without a multi-signature requirement. The mnemonic recovery phrase for the hardware wallet was allegedly stored in a cloud-accessible password account, negating the security benefit of hardware wallet storage. The token contract granted a single owner address unconstrained minting authority over the entire BONDLY supply with no time-locks, caps, or multi-party authorization requirements. Following the incident, Bondly announced implementation of a multi-signature wallet scheme. Halborn Security's post-incident analysis noted that these structural vulnerabilities meant the entire token supply was exposed to a single point of failure, whether through external compromise or insider action.","heading":"Security Architecture Failures","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-bondly-finance-hack-july-2021","name":"halborn.com","type":"other","credibility":3},{"url":"https://forj.medium.com/bondly-attack-july-14th-2021-postmortem-beb7cf02e9ba","name":"forj.medium.com","type":"other","credibility":3},{"url":"https://www.quadrigainitiative.com/casestudy/bondlyfinanceadminwalletcompromise.php","name":"quadrigainitiative.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2020-09","event":"Bondly Finance launched by founder Brandon Smith on Polkadot blockchain","source":"","date_original":"2020-09-01"},{"date":"2021-02-24","event":"Logan Paul NFT drop via Bondly generates approximately $3.5 million in sales in 24 hours","source":""},{"date":"2021-07-14","event":"Attacker pre-funds exploit transactions via Tornado.Cash; 373 million BONDLY tokens transferred from Staking Rewards contract starting at 12:16 AM UTC July 15","source":""},{"date":"2021-07-15","event":"BONDLY token price collapses 82% within hours; Bondly team advises users to stop trading; PeckShield alleges potential rug pull based on owner-address origin of minted tokens","source":""},{"date":"2021-07-16","event":"CEO Brandon Smith voluntarily takes leave of absence; co-founder Harry Liu assumes CEO role","source":""},{"date":"2021-07-19","event":"Bondly publishes initial postmortem attributing attack to compromised CEO password account containing hardware wallet recovery phrase","source":""},{"date":"2021-08-29","event":"Replacement BONDLY token claim portal opens for affected holders","source":""},{"date":"2021-09-17","event":"Animoca Brands announces binding agreement to acquire majority stake in Bondly; Harry Liu confirmed as CEO","source":""},{"date":"2021-11-24","event":"BONDLY token reaches all-time high of approximately $0.202","source":""},{"date":"2022-05","event":"Bondly Finance announces strategic rebrand to Forj under Animoca Brands ownership","source":"","date_original":"2022-05-01"},{"date":"2022-12-31","event":"BONDLY/Forj token ends year at approximately $0.0052, down roughly 95% from all-time high","source":""},{"date":"2025","event":"Forj (BONDLY) token price approximately $0.00048, representing a loss of over 99% from all-time high","source":"","date_original":"2025-01-01"}],"sources_used":[{"url":"https://iq.wiki/wiki/bondly-finance","name":"iq.wiki","type":"other","archive_url":"http://web.archive.org/web/20260610213247/https://iq.wiki/wiki/bondly-finance","credibility":3,"archive_timestamp":"2026-06-10T21:32:47+00:00"},{"url":"https://cryptopotato.com/american-youtuber-logan-paul-teams-up-with-bondly-finance-to-release-nft/","name":"cryptopotato.com","type":"other","archive_url":"http://web.archive.org/web/20260609023520/https://cryptopotato.com/american-youtuber-logan-paul-teams-up-with-bondly-finance-to-release-nft/","credibility":3,"archive_timestamp":"2026-06-09T02:35:20+00:00"},{"url":"https://dailyhodl.com/2021/02/24/logan-paul-sells-3500000-in-crypto-art-in-just-24-hours-through-polkadot-based-project/","name":"dailyhodl.com","type":"other","archive_url":"http://web.archive.org/web/20251115114447/https://dailyhodl.com/2021/02/24/logan-paul-sells-3500000-in-crypto-art-in-just-24-hours-through-polkadot-based-project/","credibility":3,"archive_timestamp":"2025-11-15T11:44:47+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-bondly-finance-hack-july-2021","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260207102419/https://www.halborn.com/blog/post/explained-the-bondly-finance-hack-july-2021","credibility":3,"archive_timestamp":"2026-02-07T10:24:19+00:00"},{"url":"https://forj.medium.com/bondly-attack-july-14th-2021-postmortem-beb7cf02e9ba","name":"forj.medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.quadrigainitiative.com/casestudy/bondlyfinanceadminwalletcompromise.php","name":"quadrigainitiative.com","type":"other","archive_url":"http://web.archive.org/web/20260209175005/https://quadrigainitiative.com/casestudy/bondlyfinanceadminwalletcompromise.php","credibility":3,"archive_timestamp":"2026-02-09T17:50:05+00:00"},{"url":"https://medium.com/mantra-dao/bondly-exploit-how-it-unfolded-on-zenterest-postmortem-d8120d8d784b","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"forbiddenaccess","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cryptobriefing.com/bondly-finance-exploited-for-millions-potential-rug-pull/","name":"cryptobriefing.com","type":"other","archive_url":"http://web.archive.org/web/20251008072139/https://cryptobriefing.com/bondly-finance-exploited-for-millions-potential-rug-pull/","credibility":3,"archive_timestamp":"2025-10-08T07:21:39+00:00"},{"url":"https://www.coindesk.com/business/2021/09/17/games-maker-animoca-brands-to-acquire-majority-stake-in-bondly","name":"coindesk.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.animocabrands.com/animoca-brands-to-acquire-majority-stake-in-bondly","name":"animocabrands.com","type":"other","archive_url":"http://web.archive.org/web/20251110020708/https://www.animocabrands.com/animoca-brands-to-acquire-majority-stake-in-bondly","credibility":3,"archive_timestamp":"2025-11-10T02:07:08+00:00"},{"url":"https://forj.medium.com/update-on-token-redeployment-8a77bd2347fe","name":"forj.medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://tokenclaim.bondly.finance/","name":"tokenclaim.bondly.finance","type":"other","archive_url":"http://web.archive.org/web/20260308033619/https://tokenclaim.bondly.finance/","credibility":3,"archive_timestamp":"2026-03-08T03:36:19+00:00"},{"url":"https://forj.medium.com/how-to-claim-my-new-bondly-tokens-5d94273d95cf","name":"forj.medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.prnewswire.com/news-releases/bondly-finance-announces-strategic-rebrand-to-forj-301551278.html","name":"prnewswire.com","type":"other","archive_url":"http://web.archive.org/web/20260829203633/https://www.prnewswire.com/news-releases/bondly-finance-announces-strategic-rebrand-to-forj-301551278.html","credibility":3,"archive_timestamp":"2026-08-29T20:36:33+00:00"},{"url":"https://www.coingecko.com/en/coins/forj","name":"coingecko.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:55.665979+00:00","updated_at":"2026-09-01T07:26:08.599032+00:00"}}