{"investigation":{"slug":"cypher","entity_name":"Cypher Protocol","trust_score":12,"severity_base":null,"score_modifier":0,"confidence":0.88,"status":"published","content_type":"investigation","summary":"Cypher Protocol was a Solana-based cross-margin decentralized exchange (DEX) and perpetuals trading platform that suffered a critical smart contract exploit in August 2023 resulting in approximately $1 million in losses. Following the exploit, an insider contributor known as 'Hoak' systematically drained over $314,000 from the community redemption fund established to reimburse hack victims, admitting publicly to gambling the funds away. The protocol appears effectively defunct, having failed to deliver meaningful restitution to users who received roughly 31 cents on the dollar from the original exploit fund before that fund itself was embezzled.","sections":[{"content":"On August 7, 2023, Cypher Protocol experienced a critical smart contract exploit that resulted in the theft of approximately $1,035,203 in digital assets, including roughly 38,530 SOL and $123,184 USDC. The protocol immediately froze its smart contracts and publicly acknowledged the incident on social media. The exploit was identified by security firm Halborn as stemming from two distinct business-logic vulnerabilities: (1) an isolated sub-account state tracking error in which the protocol failed to properly update the master account's cache when sub-accounts were switched to isolated mode, disabling cross-collateralization checks; and (2) a margin check failure in which defective margin validation combined with inactive oracle price feeds allowed unauthorized borrowing that should have been blocked. The attacker operated multiple primary accounts to exploit these weaknesses, draining the protocol's margin lending infrastructure. The exploit coincided with Cypher's biannual developer event 'mtnDAO,' held in Salt Lake City, which the protocol co-hosted with fellow Solana trading protocol marginfi. On-chain sleuth ZachXBT and forensics firms Chainalysis and TRM Labs assisted the team in tracing stolen funds, leading to the freezing of approximately $600,000 across centralized exchanges. The attacker's initial funding was traced to KuCoin and Binance, and shortly after the exploit an attempted transfer of $30,000 USDC to a Binance Solana address was identified. No formal attribution of the external exploit to a named individual or group was publicly confirmed.","heading":"August 2023 Smart Contract Exploit","sources":[{"url":"https://www.coindesk.com/business/2023/08/07/solana-based-cypher-protocol-experiences-exploit-freezes-smart-contract","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-cypher-protocol-hack-august-2023","name":"halborn.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/cypher-protocol-solana-hack-exploited-smart-contract","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://beincrypto.com/solana-dex-cypher-protocol-loses-exploit/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://unchainedcrypto.com/solana-based-cypher-protocol-loses-1-million-in-exploit/","name":"unchainedcrypto.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the August 2023 exploit, Cypher Protocol established a community redemption contract intended to reimburse affected users. The protocol offered a 'socialized losses policy' under which users would receive approximately 31 cents for every dollar held at the time the protocol was frozen. In December 2023, a pseudonymous core contributor operating under the handle 'Hoak' began systematically withdrawing funds from the redemption contract. Over several months, Hoak executed 36 separate withdrawal transactions, transferring funds through an intermediary wallet before sending them to Binance. The total amount confirmed taken was approximately $314,674 in USDT, USDC, and SOL. A separate wallet associated with Hoak held an additional $184,077 in tokens including ETH and ORCA. The theft was discovered in May 2024 when a Discord user reported being unable to complete a withdrawal. Hoak publicly admitted to the theft on May 14, 2024, stating: 'To address the elephant in the room, the allegations are true, I took the funds and gambled them away.' He attributed his actions to a 'crippling gambling addiction and probably multiple other psychological factors that went by unchecked for too long,' and said his problematic behavior traced back to November 2021. Hoak denied involvement in the original August 2023 exploit. Cypher founder Barrett confirmed the allegations, expressed that Hoak had stayed on to help rebuild after the exploit, and reported that he had submitted Hoak's identity and documentation of the theft to law enforcement. As of the last available reporting in May 2024, no public announcement of an arrest or formal criminal charges against Hoak had been made.","heading":"Insider Theft of Redemption Funds (2023–2024)","sources":[{"url":"https://www.coindesk.com/business/2024/05/14/insider-at-solanas-cypher-protocol-admits-to-stealing-300k","name":"coindesk.com","type":"other","credibility":3},{"url":"https://decrypt.co/230757/solana-developer-confession-theft-cypher-protocol","name":"decrypt.co","type":"other","credibility":3},{"url":"https://www.theblock.co/post/294459/cypher-protocol-contributor-admits-to-taking-and-gambling-funds-recovered-from-exploit","name":"theblock.co","type":"other","credibility":3},{"url":"https://bitcoinist.com/gambled-away-solanas-cypher-protocol-dev-confesses-stealing-300000/","name":"bitcoinist.com","type":"other","credibility":3},{"url":"https://cryptonews.com/news/cypher-protocol-developer-confesses-to-stealing-300000-in-user-funds-and-gambling-away/","name":"cryptonews.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On-chain investigator ZachXBT played a documented role at two distinct points in the Cypher Protocol incident. During the August 2023 exploit, ZachXBT assisted the Cypher team in tracing stolen funds and helped coordinate the freezing of approximately $600,000 across centralized exchanges. As a result of this collaboration, ZachXBT had collected personal identifying information about team members including Hoak. Following Hoak's May 2024 public confession, ZachXBT publicly confirmed knowing Hoak and stated he possessed Hoak's personal information from the 2023 investigation. ZachXBT indicated willingness to share that information with law enforcement as needed. ZachXBT has flagged Cypher Protocol as a high-risk entity given the combination of the external exploit and the subsequent insider theft from the victim compensation fund.","heading":"ZachXBT Involvement and Flagging","sources":[{"url":"https://decrypt.co/230757/solana-developer-confession-theft-cypher-protocol","name":"decrypt.co","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2024/05/14/insider-at-solanas-cypher-protocol-admits-to-stealing-300k","name":"coindesk.com","type":"other","credibility":3},{"url":"https://bitcoinist.com/gambled-away-solanas-cypher-protocol-dev-confesses-stealing-300000/","name":"bitcoinist.com","type":"other","credibility":3}],"severity":"medium"},{"content":"In the immediate aftermath of the August 2023 exploit, Cypher Protocol froze approximately $600,000 of the stolen funds with the assistance of Chainalysis, TRM Labs, and ZachXBT. On August 16, 2023, the protocol announced a redemption plan providing users with a pro-rata distribution based on a snapshot of balances at the time the protocol was frozen, valued at approximately 31 cents on the dollar. The protocol also airdropped 50 million tokens to affected depositors. On August 23, 2023, Cypher announced plans for a public token sale as an additional mechanism for user restitution. The subsequent insider theft by Hoak from the redemption contract between December 2023 and May 2024 further undermined what remained of the recovery fund, stealing over $314,000 that had been earmarked for victim compensation. The net result for users was substantially less than the already-reduced 31-cent-on-the-dollar recovery rate initially offered. No evidence of a completed successful recovery program or protocol relaunch was identified in available sources.","heading":"Recovery Efforts and User Restitution","sources":[{"url":"https://www.coindesk.com/business/2023/08/23/hacked-crypto-exchange-cypher-plans-to-hold-public-token-sale","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.banklesstimes.com/news/2023/08/24/solanas-cypher-refunds-under-a-third-of-user-funds-after-debilitating-hack/","name":"banklesstimes.com","type":"other","credibility":3},{"url":"https://bitcoinist.com/cypher-protocol-freezes-600000-stolen-funds-on-cexs/","name":"bitcoinist.com","type":"other","credibility":3},{"url":"https://cryptopotato.com/cypher-protocol-will-pass-exploit-losses-off-to-its-community/","name":"cryptopotato.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Cypher Protocol was a cross-margin decentralized exchange built on the Solana blockchain, offering leveraged perpetuals trading and a loyalty rewards program that accrued points redeemable against a potential future airdrop. The protocol grew rapidly on Solana in part due to this loyalty program and was considered one of the emerging DeFi venues on the chain. The exploit and subsequent insider theft occurred during a period when Solana's DeFi ecosystem was rebuilding after the FTX collapse and broader market downturn of 2022. Following the exploit, Cypher's total value locked (TVL) dropped over 50%, falling from approximately $1.2 million to under $510,000. Halborn's post-mortem noted that the vulnerabilities exploited were business-logic and implementation errors that preventative security audits could have identified before the protocol launched, suggesting the contracts were deployed without a comprehensive third-party audit. The founder, known publicly as Barrett, maintained public communication throughout both incidents.","heading":"Protocol Background and Context","sources":[{"url":"https://www.coindesk.com/business/2023/08/07/solana-based-cypher-protocol-experiences-exploit-freezes-smart-contract","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-cypher-protocol-hack-august-2023","name":"halborn.com","type":"other","credibility":3},{"url":"https://solanafloor.com/news/cypher-protocol-exploit-a-blow-to-solanas-emerging-defi-scene","name":"solanafloor.com","type":"other","credibility":3},{"url":"https://dailycoin.com/inside-solana-cypher-protocol-exploit-how-did-it-happen/","name":"dailycoin.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2023-08-07","event":"Cypher Protocol smart contract exploited; approximately $1,035,203 in SOL and USDC stolen via margin-check and isolated sub-account vulnerabilities.","source":""},{"date":"2023-08-07","event":"Cypher Protocol freezes smart contract and publicly announces the exploit, contacts the hacker, and initiates investigation with Chainalysis, TRM Labs, and ZachXBT.","source":""},{"date":"2023-08-07","event":"Attacker transfers 30,000 USDC to Binance Solana address 'kiing.sol' in apparent attempt to cash out stolen funds.","source":""},{"date":"2023-08-10","event":"Cypher Protocol announces approximately $600,000 of stolen funds have been frozen across centralized exchanges.","source":""},{"date":"2023-08-16","event":"Cypher Protocol announces 'socialized losses policy' redemption plan; affected users to receive approximately 31 cents on the dollar based on snapshot balances.","source":""},{"date":"2023-08-23","event":"Cypher Protocol announces plans for a public token sale as an additional user restitution mechanism; 50 million tokens airdropped to affected depositors.","source":""},{"date":"2023-12","event":"Core contributor 'Hoak' allegedly begins systematic withdrawals from the Cypher redemption contract, per his later public admission.","source":"","date_original":"2023-12-01"},{"date":"2024-05-14","event":"Hoak publicly confesses on Twitter/X to stealing $314,674 from the Cypher redemption contract over 36 transactions and gambling the funds away, citing a 'crippling gambling addiction.'","source":""},{"date":"2024-05-14","event":"Cypher founder Barrett confirms the theft, states he has submitted Hoak's identity and evidence to law enforcement, and is following their lead on next steps.","source":""},{"date":"2024-05-14","event":"ZachXBT publicly confirms he has Hoak's personal identifying information from the 2023 exploit investigation and will share with law enforcement as needed.","source":""}],"sources_used":[{"url":"https://www.coindesk.com/business/2023/08/07/solana-based-cypher-protocol-experiences-exploit-freezes-smart-contract","name":"coindesk.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.halborn.com/blog/post/explained-the-cypher-protocol-hack-august-2023","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260605230517/https://www.halborn.com/blog/post/explained-the-cypher-protocol-hack-august-2023","credibility":3,"archive_timestamp":"2026-06-05T23:05:17+00:00"},{"url":"https://cointelegraph.com/news/cypher-protocol-solana-hack-exploited-smart-contract","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20260330132906/https://cointelegraph.com/news/cypher-protocol-solana-hack-exploited-smart-contract","credibility":3,"archive_timestamp":"2026-03-30T13:29:06+00:00"},{"url":"https://beincrypto.com/solana-dex-cypher-protocol-loses-exploit/","name":"beincrypto.com","type":"other","archive_url":"http://web.archive.org/web/20250902112533/https://beincrypto.com/solana-dex-cypher-protocol-loses-exploit//","credibility":3,"archive_timestamp":"2025-09-02T11:25:33+00:00"},{"url":"https://unchainedcrypto.com/solana-based-cypher-protocol-loses-1-million-in-exploit/","name":"unchainedcrypto.com","type":"other","archive_url":"https://web.archive.org/web/20260829184833/https://unchainedcrypto.com/solana-based-cypher-protocol-loses-1-million-in-exploit/","credibility":3,"archive_timestamp":"2026-08-29T18:48:33+00:00"},{"url":"https://www.coindesk.com/business/2024/05/14/insider-at-solanas-cypher-protocol-admits-to-stealing-300k","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20251019114453/https://www.coindesk.com/business/2024/05/14/insider-at-solanas-cypher-protocol-admits-to-stealing-300k","credibility":3,"archive_timestamp":"2025-10-19T11:44:53+00:00"},{"url":"https://decrypt.co/230757/solana-developer-confession-theft-cypher-protocol","name":"decrypt.co","type":"other","archive_url":"http://web.archive.org/web/20260416172334/https://decrypt.co/230757/solana-developer-confession-theft-cypher-protocol","credibility":3,"archive_timestamp":"2026-04-16T17:23:34+00:00"},{"url":"https://www.theblock.co/post/294459/cypher-protocol-contributor-admits-to-taking-and-gambling-funds-recovered-from-exploit","name":"theblock.co","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://bitcoinist.com/gambled-away-solanas-cypher-protocol-dev-confesses-stealing-300000/","name":"bitcoinist.com","type":"other","archive_url":"http://web.archive.org/web/20251215050713/https://bitcoinist.com/gambled-away-solanas-cypher-protocol-dev-confesses-stealing-300000/","credibility":3,"archive_timestamp":"2025-12-15T05:07:13+00:00"},{"url":"https://cryptonews.com/news/cypher-protocol-developer-confesses-to-stealing-300000-in-user-funds-and-gambling-away/","name":"cryptonews.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.coindesk.com/business/2023/08/23/hacked-crypto-exchange-cypher-plans-to-hold-public-token-sale","name":"coindesk.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.banklesstimes.com/news/2023/08/24/solanas-cypher-refunds-under-a-third-of-user-funds-after-debilitating-hack/","name":"banklesstimes.com","type":"other","archive_url":"http://web.archive.org/web/20260513195649/https://www.banklesstimes.com/news/2023/08/24/solanas-cypher-refunds-under-a-third-of-user-funds-after-debilitating-hack/","credibility":3,"archive_timestamp":"2026-05-13T19:56:49+00:00"},{"url":"https://bitcoinist.com/cypher-protocol-freezes-600000-stolen-funds-on-cexs/","name":"bitcoinist.com","type":"other","archive_url":"http://web.archive.org/web/20260512221526/https://bitcoinist.com/cypher-protocol-freezes-600000-stolen-funds-on-cexs/","credibility":3,"archive_timestamp":"2026-05-12T22:15:26+00:00"},{"url":"https://cryptopotato.com/cypher-protocol-will-pass-exploit-losses-off-to-its-community/","name":"cryptopotato.com","type":"other","archive_url":"http://web.archive.org/web/20250124212254/https://cryptopotato.com/cypher-protocol-will-pass-exploit-losses-off-to-its-community/","credibility":3,"archive_timestamp":"2025-01-24T21:22:54+00:00"},{"url":"https://solanafloor.com/news/cypher-protocol-exploit-a-blow-to-solanas-emerging-defi-scene","name":"solanafloor.com","type":"other","archive_url":"http://web.archive.org/web/20260211155135/https://solanafloor.com/news/cypher-protocol-exploit-a-blow-to-solanas-emerging-defi-scene","credibility":3,"archive_timestamp":"2026-02-11T15:51:35+00:00"},{"url":"https://dailycoin.com/inside-solana-cypher-protocol-exploit-how-did-it-happen/","name":"dailycoin.com","type":"other","archive_url":"https://web.archive.org/web/20260829132434/https://dailycoin.com/inside-solana-cypher-protocol-exploit-how-did-it-happen/","credibility":3,"archive_timestamp":"2026-08-29T13:24:34+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:39.358684+00:00","updated_at":"2026-08-30T05:14:10.324564+00:00"}}