{"investigation":{"slug":"easyfi","entity_name":"EasyFi","trust_score":10,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"EasyFi was a Layer 2 DeFi lending protocol operating on Polygon Network, forked from Compound Finance, that suffered one of the largest DeFi hacks of 2021 when an attacker compromised the CEO's MetaMask admin keys on April 19, 2021, stealing approximately $81 million in EASY tokens and stablecoins. The protocol attempted a hard fork and compensation plan, but a significant portion of token holders on decentralized exchanges alleged they remained uncompensated, and community members raised concerns about transparency, censorship of dissent, and the fundamental security failure of managing over $100 million in assets through a single admin key held in a browser extension. ZachXBT has flagged EasyFi as a high-risk entity.","sections":[{"content":"On April 19, 2021, EasyFi suffered a major security breach in which an attacker obtained the admin private keys of CEO and co-founder Ankitt Gaur. According to Gaur's post-mortem, the attacker compromised the dedicated computer used for official project transactions — a machine that had been offline for over a week — and extracted the MetaMask wallet's seed phrase directly from disk. This allowed the attacker to transfer approximately 2.98 million EASY tokens (representing roughly 30% of total supply, valued at approximately $75 million at the time) and an additional $6 million in stablecoins (USD, DAI, USDT) from liquidity pools, for a total loss estimated between $59 million and $81 million depending on token valuation methodology. The stolen stablecoin funds were routed through Ren Bridge to Ethereum, converted into approximately 123 Bitcoin, and subsequently laundered through Chipmixer before being deposited to Binance and peer-to-peer exchanges including Noones and Paxful. Key attacker addresses identified on-chain include 0x437147da920714fec4822f0666d940945f9c972b (primary) and 0x6324b1f720a07435269ae84285b1bafa4800fb3e (Matic network). The attack method mirrored the December 2020 Nexus Mutual compromise, in which a malicious or altered version of MetaMask was deployed against a targeted individual. Open-source threat research by Taylor Monahan has suggested the laundering patterns are consistent with those used by sophisticated organized threat actors, with references in linked attribution materials to North Korean state-sponsored hacking operations, though no formal law enforcement attribution has been publicly confirmed.","heading":"The April 2021 Hack","sources":[{"url":"https://www.coindesk.com/markets/2021/04/20/defi-protocol-easyfi-reports-hack-loss-of-over-80m-in-funds","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-easyfi-hack-april-2021","name":"halborn.com","type":"other","credibility":3},{"url":"https://cryptobriefing.com/easyfi-hacked-over-80-million-metamask-attack/","name":"cryptobriefing.com","type":"other","credibility":3},{"url":"https://thedefiant.io/news/hacks/compound-finance-fork-easyfi-loses-over-60m-in-admin-key-hack","name":"thedefiant.io","type":"other","credibility":3},{"url":"https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/hacks-and-thefts/easyfi.md","name":"github.com","type":"other","credibility":3},{"url":"https://chainbulletin.com/easyfi-hack-was-caused-by-compromised-admin-keys","name":"chainbulletin.com","type":"other","credibility":3}],"severity":"medium"},{"content":"EasyFi's security architecture at the time of the hack has been widely criticized as fundamentally inadequate for a protocol holding over $100 million in user assets. The protocol's admin functions — including the ability to drain liquidity pools — were controlled by a single private key held in a MetaMask browser extension on one individual's personal computer. Industry observers and security researchers noted that EasyFi did not implement multi-signature wallet controls, which would have required multiple keyholders to authorize large transactions. By contrast, protocols such as Lido Finance distributed admin key generation among 11 trusted DeFi participants. The EasyFi smart contracts were audited by Halborn Security, and the audit covered smart contract logic; however, operational key management — the attack vector actually exploited — fell outside smart contract audit scope. CertiK data from 2021 identified 286 centralization risks across DeFi protocols in that year alone, and EasyFi's incident became a canonical example of single-point-of-failure admin key risk in DeFi security discourse.","heading":"Critical Centralization and Security Failures","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-easyfi-hack-april-2021","name":"halborn.com","type":"other","credibility":3},{"url":"https://chainbulletin.com/easyfi-hack-was-caused-by-compromised-admin-keys","name":"chainbulletin.com","type":"other","credibility":3},{"url":"https://www.scmagazine.com/analysis/application-security/centralization-ironically-most-common-cause-of-decentralized-finance-hacks","name":"scmagazine.com","type":"other","credibility":3},{"url":"https://www.linkedin.com/pulse/easyfi-lending-protocol-smart-contract-final-audit-halborn-jimoh","name":"linkedin.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the hack, CEO Ankitt Gaur announced a $1 million bounty for the return of stolen funds and proposed a hard fork of the EASY token to a new EZ token. The token ticker was changed from EASY to EZ after consultations with exchanges. Binance halted EASY trading, took a snapshot of user holdings as of April 27, 2021, and distributed new EZ tokens at a 1:1 ratio to eligible holders. EasyFi announced an Interim Compensation Plan providing 25% of lost deposits immediately in stablecoins and 75% as EZ IOU tokens redeemable for EZ v2 at a 25% discount on spot price. The hard fork rendered the attacker's remaining stolen EASY tokens effectively worthless on the new contract. However, the compensation plan has been the subject of significant criticism. According to community reporting, users who had traded EASY on decentralized exchanges and non-partner platforms were categorized as 'disapproved transactions' and denied equivalent 1:1 compensation, despite having conducted legitimate market activity. Multiple reports allege that EasyFi community members who raised critical questions in the project's Telegram channels were banned without explanation, and that the team delayed public disclosure of the hack for approximately four days. No formal police report or First Information Report (FIR) from Indian authorities has been publicly documented, despite the scale of the loss.","heading":"Post-Hack Response and Compensation Controversy","sources":[{"url":"https://medium.com/easify-network/interim-compensation-plan-8fa81e46ada4","name":"medium.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/reeling-from-post-hack-price-slump-easyfi-reveals-community-compensation-plan","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://medium.com/coinmonks/the-fall-of-easyfi-network-c4c6773a1378","name":"medium.com","type":"other","credibility":3},{"url":"https://bitcoinist.com/security-incident-easyfi-to-compensate-100-of-the-depositors-net-balances/","name":"bitcoinist.com","type":"other","credibility":3},{"url":"https://medium.com/easify-network/easyfi-security-incident-66c02a277a91","name":"medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Community accounts, including a detailed Medium post published under the title 'EasyFi.Network Class Action Lawsuit,' allege a pattern of information suppression and preferential treatment in the aftermath of the hack. Specific alleged conduct includes: banning users from official Telegram channels for asking critical questions; a four-day delay between the hack occurring and public warnings being issued to the community; a two-tiered token swap system that allegedly favored centralized exchange users over decentralized exchange users; and attempts to restrict free-market trading of the original EASY token despite the team having no legal authority to do so. These allegations are sourced primarily from community-authored Medium posts and are classified as low-to-medium confidence claims absent independent verification. The absence of a publicly documented law enforcement complaint, given the $81 million scale of the alleged theft, has also been cited by community members as a red flag. EasyFi's official stance characterized all post-hack actions as necessary steps to protect the broader user community.","heading":"Community Allegations and Transparency Concerns","sources":[{"url":"https://medium.com/coinmonks/the-fall-of-easyfi-network-c4c6773a1378","name":"medium.com","type":"other","credibility":3},{"url":"https://gbaglobal.org/blog/2021/04/29/after-the-hack-is-easyfi-trustworthy/","name":"gbaglobal.org","type":"other","credibility":3},{"url":"https://www.cryptoscoop.io/reeling-from-post-hack-price-slump-easyfi-reveals-community-compensation-plan/","name":"cryptoscoop.io","type":"other","credibility":3}],"severity":"medium"},{"content":"The EASY token price fell approximately 50% immediately following the hack announcement, dropping from approximately $25–$26 to $13.50–$16.65 in under 24 hours. The token continued declining; by the time the compensation plan was announced in early May 2021, the price had fallen to approximately $11.30, representing a cumulative weekly decline of approximately 33.8%. EasyFi published a 2022 roadmap indicating plans to continue development, and a 'Protocol Version 1 Launch' was documented in late 2021. However, no major exchange relisting or recovery of trading volumes has been documented in public records. The EZ token remains listed on CoinMarketCap and CoinGecko but trades at negligible volume as of 2024–2025. The protocol's Medium channel shows diminishing post frequency after 2022.","heading":"Token Market Impact and Protocol Trajectory","sources":[{"url":"https://cointelegraph.com/news/reeling-from-post-hack-price-slump-easyfi-reveals-community-compensation-plan","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://www.coinbase.com/price/easyfi","name":"coinbase.com","type":"other","credibility":3},{"url":"https://coinmarketcap.com/currencies/easyfi/","name":"coinmarketcap.com","type":"other","credibility":3},{"url":"https://medium.com/easify-network/easyfi-roadmap-2022-5f94cbbc8395","name":"medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"EasyFi was founded by Ankitt Gaur (CEO) and Anshul Dhir as a Layer 2 DeFi lending protocol built on Polygon (then Matic) Network, structured as a fork of Compound Finance. The protocol aimed to offer lower gas fees than Ethereum mainnet DeFi alternatives while providing standard lending and borrowing functionality. EasyFi became a Binance Innovation Zone project within seven months of launch, and at its peak its market capitalization reached approximately $50 million. The EASY token was listed on major exchanges including Binance and traded on decentralized platforms on Polygon and Ethereum. The Halborn Security firm conducted a smart contract audit of the lending protocol prior to the April 2021 incident.","heading":"Background and Protocol Overview","sources":[{"url":"https://blockonomi.com/easyfi-guide/","name":"blockonomi.com","type":"other","credibility":3},{"url":"https://www.crunchbase.com/organization/easyfi","name":"crunchbase.com","type":"other","credibility":3},{"url":"https://tracxn.com/d/companies/easyfi/__8w98Z6QokAZD1UFWk8ppUarbZ_WS0Fw8ux650ruN-2Y","name":"tracxn.com","type":"other","credibility":3},{"url":"https://www.newsbtc.com/news/company/easyfi-lending-protocol-goes-live-with-money-markets-on-polygon/","name":"newsbtc.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2020","event":"EasyFi founded by Ankitt Gaur and Anshul Dhir as a Compound Finance fork on Polygon (Matic) Network.","source":"","date_original":"2020-01-01"},{"date":"2021-04","event":"EasyFi launched on Binance Smart Chain and partnered with PancakeSwap for yield farming incentives, becoming a Binance Innovation Zone project.","source":"","date_original":"2021-04-01"},{"date":"2021-04-19","event":"Attacker compromised CEO Ankitt Gaur's computer and extracted MetaMask admin seed phrase, stealing 2.98 million EASY tokens (~$75M) and $6M in stablecoins from liquidity pools. Total loss estimated at ~$81 million.","source":""},{"date":"2021-04-20","event":"EasyFi publicly disclosed the hack. CEO Ankitt Gaur posted a security incident report on Medium. Deposits and withdrawals suspended. Gaur offered a $1 million bounty for return of funds.","source":""},{"date":"2021-04-20","event":"EASY token price dropped approximately 50%, falling from ~$25 to ~$13.50 within 24 hours of disclosure.","source":""},{"date":"2021-04-27","event":"Binance halted EASY trading pairs and took a snapshot of user holdings, distributing new EZ tokens at a 1:1 ratio to eligible holders.","source":""},{"date":"2021-04-28","event":"EasyFi executed a hard fork, launching EZ token (v2) and rendering the attacker's stolen EASY tokens worthless on the new contract. Ticker changed from EASY to EZ.","source":""},{"date":"2021-05","event":"Stolen funds traced through Ren Bridge to Ethereum, converted to ~123 Bitcoin, laundered via Chipmixer, and deposited to Binance and P2P exchanges (Noones, Paxful).","source":"","date_original":"2021-05-01"},{"date":"2021-05-08","event":"EasyFi revealed community compensation plan: 25% immediate stablecoin payout, 75% in EZ IOU tokens redeemable for EZ v2. Users on decentralized exchanges alleged they were categorized as ineligible for full 1:1 swap compensation.","source":""},{"date":"2021-05","event":"Community members published accounts alleging bans from EasyFi Telegram for asking critical questions and alleged discriminatory compensation treatment for DEX users.","source":"","date_original":"2021-05-01"},{"date":"2022","event":"EasyFi published 2022 roadmap indicating continued development plans. Protocol activity and community engagement reportedly declined significantly following the hack.","source":"","date_original":"2022-01-01"}],"sources_used":[{"url":"https://www.coindesk.com/markets/2021/04/20/defi-protocol-easyfi-reports-hack-loss-of-over-80m-in-funds","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20260726033923/https://www.coindesk.com/markets/2021/04/20/defi-protocol-easyfi-reports-hack-loss-of-over-80m-in-funds","credibility":3,"archive_timestamp":"2026-07-26T03:39:23+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-easyfi-hack-april-2021","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260725204120/https://www.halborn.com/blog/post/explained-the-easyfi-hack-april-2021","credibility":3,"archive_timestamp":"2026-07-25T20:41:20+00:00"},{"url":"https://cryptobriefing.com/easyfi-hacked-over-80-million-metamask-attack/","name":"cryptobriefing.com","type":"other","archive_url":"http://web.archive.org/web/20260314102859/https://cryptobriefing.com/easyfi-hacked-over-80-million-metamask-attack/","credibility":3,"archive_timestamp":"2026-03-14T10:28:59+00:00"},{"url":"https://thedefiant.io/news/hacks/compound-finance-fork-easyfi-loses-over-60m-in-admin-key-hack","name":"thedefiant.io","type":"other","archive_url":"http://web.archive.org/web/20260722230023/https://thedefiant.io/news/hacks/compound-finance-fork-easyfi-loses-over-60m-in-admin-key-hack","credibility":3,"archive_timestamp":"2026-07-22T23:00:23+00:00"},{"url":"https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/hacks-and-thefts/easyfi.md","name":"github.com","type":"other","archive_url":"http://web.archive.org/web/20260725142824/https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/hacks-and-thefts/easyfi.md","credibility":3,"archive_timestamp":"2026-07-25T14:28:24+00:00"},{"url":"https://chainbulletin.com/easyfi-hack-was-caused-by-compromised-admin-keys","name":"chainbulletin.com","type":"other","archive_url":"http://web.archive.org/web/20260123210111/https://chainbulletin.com/easyfi-hack-was-caused-by-compromised-admin-keys","credibility":3,"archive_timestamp":"2026-01-23T21:01:11+00:00"},{"url":"https://www.scmagazine.com/analysis/application-security/centralization-ironically-most-common-cause-of-decentralized-finance-hacks","name":"scmagazine.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.linkedin.com/pulse/easyfi-lending-protocol-smart-contract-final-audit-halborn-jimoh","name":"linkedin.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://medium.com/easify-network/interim-compensation-plan-8fa81e46ada4","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cointelegraph.com/news/reeling-from-post-hack-price-slump-easyfi-reveals-community-compensation-plan","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20260726001406/https://cointelegraph.com/news/reeling-from-post-hack-price-slump-easyfi-reveals-community-compensation-plan","credibility":3,"archive_timestamp":"2026-07-26T00:14:06+00:00"},{"url":"https://medium.com/coinmonks/the-fall-of-easyfi-network-c4c6773a1378","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://bitcoinist.com/security-incident-easyfi-to-compensate-100-of-the-depositors-net-balances/","name":"bitcoinist.com","type":"other","archive_url":"https://web.archive.org/web/20260830162558/https://bitcoinist.com/security-incident-easyfi-to-compensate-100-of-the-depositors-net-balances/","credibility":3,"archive_timestamp":"2026-08-30T16:25:58+00:00"},{"url":"https://medium.com/easify-network/easyfi-security-incident-66c02a277a91","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://gbaglobal.org/blog/2021/04/29/after-the-hack-is-easyfi-trustworthy/","name":"gbaglobal.org","type":"other","archive_url":"http://web.archive.org/web/20260511031607/https://gbaglobal.org/blog/2021/04/29/after-the-hack-is-easyfi-trustworthy/","credibility":3,"archive_timestamp":"2026-05-11T03:16:07+00:00"},{"url":"https://www.cryptoscoop.io/reeling-from-post-hack-price-slump-easyfi-reveals-community-compensation-plan/","name":"cryptoscoop.io","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-job","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.coinbase.com/price/easyfi","name":"coinbase.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://coinmarketcap.com/currencies/easyfi/","name":"coinmarketcap.com","type":"other","archive_url":"http://web.archive.org/web/20250906142822/https://coinmarketcap.com/currencies/easyfi/","credibility":3,"archive_timestamp":"2025-09-06T14:28:22+00:00"},{"url":"https://medium.com/easify-network/easyfi-roadmap-2022-5f94cbbc8395","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://blockonomi.com/easyfi-guide/","name":"blockonomi.com","type":"other","archive_url":"https://web.archive.org/web/20260830082809/https://blockonomi.com/defi-yield-protocol-ecosystem/","credibility":3,"archive_timestamp":"2026-08-30T08:28:09+00:00"},{"url":"https://www.crunchbase.com/organization/easyfi","name":"crunchbase.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://tracxn.com/d/companies/easyfi/__8w98Z6QokAZD1UFWk8ppUarbZ_WS0Fw8ux650ruN-2Y","name":"tracxn.com","type":"other","archive_url":"http://web.archive.org/web/20260830131319/https://tracxn.com/d/companies/easyfi/__8w98Z6QokAZD1UFWk8ppUarbZ_WS0Fw8ux650ruN-2Y","credibility":3,"archive_timestamp":"2026-08-30T13:13:19+00:00"},{"url":"https://www.newsbtc.com/news/company/easyfi-lending-protocol-goes-live-with-money-markets-on-polygon/","name":"newsbtc.com","type":"other","archive_url":"https://web.archive.org/web/20260829203338/https://www.newsbtc.com/news/company/easyfi-lending-protocol-goes-live-with-money-markets-on-polygon/","credibility":3,"archive_timestamp":"2026-08-29T20:33:38+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:58.27368+00:00","updated_at":"2026-08-30T16:47:12.990222+00:00"}}