{"investigation":{"slug":"flamingo-finance","entity_name":"Flamingo Finance","trust_score":26,"severity_base":26,"score_modifier":0,"confidence":0.72,"status":"published","content_type":"investigation","summary":"Flamingo Finance is a DeFi platform built on the Neo N3 blockchain, offering a cross-chain asset wrapper, swap pools, a lending vault, and staking of its native FLM token. Since 2024 the protocol has been hit by a recurring pattern of exploits — a Poly Network cross-chain bridge hack, a staking-contract bug that let an attacker mint trillions of FLM, and a flash-loan attack on its Flamincome vaults — while its maintainers have publicly accused Neo Global Development and the Neo Foundation of withholding promised support and control over its smart contracts.","sections":[{"content":"On September 16, 2026, blockchain security firm Blockaid reported that an attacker had exploited older Flamincome vault contracts associated with Flamingo Finance. According to the report, the attacker used a flash loan of approximately $18 million in USDT to manipulate the share price of the VaultYUSDT vault, staking USDP liquidity-provider tokens into a strategy contract and then redeeming liquid aUSDT to extract value. The attacker's realized profit was reported at approximately $345,900 in USDT. Blockaid did not publicly disclose the full mechanics of the underlying pricing flaw. Blockaid identified a linked wallet that had received 0.1 ETH from Tornado Cash prior to the exploit and later moved 144.15 ETH through the cross-chain bridge aggregator LI.FI, a pattern consistent with attempts to obscure the funds' origin and destination. Crypto Times reported it contacted Flamingo Finance for comment but had not received a response at the time of publication. This incident is distinct from the much larger staking-contract exploit that had occurred on Flamingo roughly two weeks earlier.","heading":"Flash Loan Exploit of Flamincome VaultYUSDT (September 2026)","sources":[{"url":"https://www.cryptotimes.io/2026/09/16/blockaid-flags-flamingofinance-contract-exploit-345-9k-stolen/","name":"Crypto Times — Blockaid flags FlamingoFinance contract exploit, $345.9K stolen","type":"news_article","credibility":2},{"url":"https://coinedition.com/crypto-live-news/flamingofinance-loses-346000-in-defi-exploit-using-18m/","name":"CoinEdition — FlamingoFinance Loses $346,000 in DeFi Exploit Using $18M Flash Loan","type":"news_article","credibility":2}],"severity":"high"},{"content":"Neo News Today reported, in an article published August 31, 2026, that Flamingo Finance's staking contract had been exploited through a flaw in how the platform's lending contract called its staking contract to release LP tokens. The miscalculation inflated reward amounts and, combined with a compounding issue triggerable by withdrawing very small amounts, allowed an attacker to mint approximately 2.19 trillion FLM — reportedly more than 3,500 times the roughly 570 million FLM circulating before the attack. The attacker sold the minted FLM across the FLM/WBTC, FLM/FUSD, and FLM/bNEO liquidity pools, collapsing the token's price and draining most of the protocol's remaining WBTC and FUSD. Approximately 11,000 bNEO reportedly remained in the pools because the platform's OrderBook contract prevented further price imbalancing. Flamingo lead developer \"Atlazor\" and team lead \"Mr.Google\" discussed the incident in the project's Discord server, with Mr.Google writing that \"the damage may be irreversible.\" The Neo Council voted to freeze the attacker's wallet address on the Neo N3 network. As of the article's publication, Flamingo had issued no official statement on its website or social channels, and the team said a full post-mortem was still underway with no conclusions finalized. A separate Neo News Today weekly roundup covering August 24–30, 2026 confirmed the exploit occurred within that window and drained \"most\" of the protocol's remaining assets, without providing exact dollar figures.","heading":"Staking Contract Exploit — Trillions of FLM Minted (August 2026)","sources":[{"url":"https://neonewstoday.com/defi/flamingo-finance-exploited-through-staking-contract-vulnerability-trillions-of-flm-minted/","name":"Neo News Today — Flamingo Finance exploited through staking contract vulnerability; trillions of FLM minted","type":"news_article","credibility":2},{"url":"https://neonewstoday.com/week-in-review/neo-news-week-in-review-august-24-august-30/","name":"Neo News Today — Week in Review: August 24 – August 30","type":"news_article","credibility":2},{"url":"https://www.kucoin.com/news/insight/NEO/6a970d025acca50007b90c48","name":"KuCoin — commentary on Flamingo Finance exploit","type":"social_media","credibility":3}],"severity":"critical"},{"content":"The 2026 exploits were not isolated. On August 12, 2024, the Poly Network cross-chain bridge — used by Flamingo to wrap and unwrap assets between Neo N3 and other chains — was exploited through its Cross-Chain Management Contract, with Flamingo estimating the attacker took roughly $4–5 million, about 20–25% of the bridge's cross-chain assets, from the bridge's hot wallet (the cold wallet was reportedly unaffected). Wrapped f- and p-assets (including fUSDT, fWBTC, fWETH, fBNB, fCAKE, pWING, and pONT) subsequently traded at roughly 75–80% of the value of their unwrapped counterparts, and the attacker did not return the funds despite a bounty offer. In response, Flamingo outlined an \"Asset Support Initiative\" to compensate affected users for 50% of realized losses using up to 40 million FLOCKS tokens (reported value of roughly $2.5 million at the time) distributed over 24 monthly payments, contingent on users migrating assets to a new, fully backed cross-chain standard; the plan was described as not yet finalized. Separately, Wikipedia's overview of Poly Network documents an earlier, far larger August 2021 exploit of the Poly Network protocol (approximately $611 million across Ethereum, BSC, and Polygon) that did not directly involve Flamingo but affected the broader cross-chain infrastructure Flamingo relies on. Taken together, public reporting describes Flamingo Finance's cross-chain bridge and core smart contracts as having been exploited on at least three separate occasions across 2024 and 2026, including two incidents within roughly two weeks of each other in August–September 2026.","heading":"Pattern of Recurring Exploits and Bridge Incidents","sources":[{"url":"https://neonewstoday.com/defi/flamingo-finance-announces-asset-support-initiative-in-wake-of-third-poly-network-hack/","name":"Neo News Today — Flamingo Finance Announces Asset Support Initiative in Wake of Third Poly Network Hack","type":"news_article","credibility":2},{"url":"https://www.bitget.com/news/detail/12560604166311","name":"Bitget News (via CryptoNews) — Flamingo Finance post-mortem on Poly Network bridge exploit","type":"news_article","credibility":2},{"url":"https://en.wikipedia.org/wiki/Poly_Network_exploit","name":"Wikipedia — Poly Network exploit","type":"other","credibility":2}],"severity":"high"},{"content":"On April 22, 2026, Flamingo Finance published an open letter, covered by Neo News Today, alleging that Neo Global Development (NGD) and the Neo Foundation (NF) had failed to deliver promised financial and operational support. The letter stated that Flamingo does not control upgrade authority over its own smart contracts — that authority sits with NGD and the NF — and alleged that responsiveness from both organizations deteriorated after a public falling-out between Neo co-founders Erik Zhang and Da Hongfei became visible in late December 2025. Flamingo said it rejected an NGD proposal to mint additional FLM for market makers in response to Binance's April 2025 Monitoring Tag designation on FLM, on the grounds that it would dilute token holders, and instead funded operations with private capital (reported at roughly 103,000 USDT and 20 million FLM, together valued at approximately $300,000 at the time). The letter listed three disbursements it said NGD and NF had promised but never delivered, including roughly 100,000 USDT tied to bridge-hack fallout, about 20 BTC and 600,000 USDT in Neo Legacy-related assets, and roughly 100,000 USDT from NF's sale of ONT and WING tokens received as Poly Network compensation. The letter also noted that the Neo Legacy MainNet had shut down on October 31, 2025, and that FLM was delisted from Binance spot trading effective November 12, 2025. No public response from NGD or the Neo Foundation to these allegations was found in available reporting; this section therefore reflects Flamingo's side of the dispute only.","heading":"Governance Dispute with Neo Global Development and Neo Foundation","sources":[{"url":"https://neonewstoday.com/defi/flamingo-finance-airs-support-dispute-with-ngd-and-nf-in-open-letter/","name":"Neo News Today — Flamingo Finance airs support dispute with NGD and NF in open letter","type":"news_article","credibility":2},{"url":"https://neonewstoday.com/defi/binance-assigns-monitoring-tag-to-flamingo-finances-flm-token/","name":"Neo News Today — Binance assigns Monitoring Tag to Flamingo Finance's FLM token","type":"news_article","credibility":2}],"severity":"medium"},{"content":"Flamingo Finance is a DeFi protocol built on the Neo N3 blockchain combining a cross-chain asset wrapper, a swap/liquidity module (Flamincome), a lending vault, perpetual trading, and a DAO governance layer, with FLM as its native token. Its initial modules (Wrapper and Flamincome) launched September 23, 2020, with the Vault following on September 25, 2020, triggering a \"FLM Mint Rush\" that reportedly attracted more than $1.5 billion in wrapped or staked value within about four days, according to Neo News Today's contemporaneous coverage. Flamingo's total value locked has since fallen sharply; third-party trackers showed figures in the tens of millions of dollars as of late 2026, down from its 2020 peak, though figures vary by source and snapshot date. FLM's reported circulating supply was approximately 569.8 million against a 1 billion maximum supply prior to the August 2026 minting exploit, with an all-time-high price of $1.59 set September 28, 2020.","heading":"Platform Background","sources":[{"url":"https://defillama.com/protocol/flamingo-finance","name":"DefiLlama — Flamingo Finance protocol page","type":"research","credibility":2},{"url":"https://coinmarketcap.com/currencies/flamingo/","name":"CoinMarketCap — Flamingo (FLM)","type":"research","credibility":2}],"severity":"low"}],"timeline":[{"date":"2020-09-23","event":"Flamingo Finance launches its Wrapper and Flamincome modules on Neo N3.","source":"Neo News Today (via search aggregation)","source_url":"https://defillama.com/protocol/flamingo-finance","date_evidence":"the first modules, Wrapper and Flamincome, went live on September 23, 2020"},{"date":"2024-08-12","event":"Poly Network's Cross-Chain Management Contract is exploited, disrupting Flamingo Finance's cross-chain bridge and affecting an estimated $4-5 million in wrapped assets.","source":"Bitget News / CryptoNews","source_url":"https://www.bitget.com/news/detail/12560604166311","date_evidence":"The Poly Network cross-chain CMCC bridge contract was subject to an exploit on August 12, 2024."},{"date":"2024-08-21","event":"Flamingo Finance announces an Asset Support Initiative to partially compensate users affected by the Poly Network bridge hack.","source":"Neo News Today","source_url":"https://neonewstoday.com/defi/flamingo-finance-announces-asset-support-initiative-in-wake-of-third-poly-network-hack/","date_evidence":"Published 2024/08/21 at 11:29 by Hassan Shittu"},{"date":"2025-04","event":"Binance assigns a Monitoring Tag to FLM as part of an expanded review of listed tokens.","source":"Neo News Today","source_url":"https://neonewstoday.com/defi/binance-assigns-monitoring-tag-to-flamingo-finances-flm-token/"},{"date":"2025-10-31","event":"Neo Legacy MainNet shuts down.","source":"Neo News Today (open letter coverage)","source_url":"https://neonewstoday.com/defi/flamingo-finance-airs-support-dispute-with-ngd-and-nf-in-open-letter/","date_evidence":"Neo Legacy MainNet shut down on Oct. 31 (2025)"},{"date":"2025-11-12","event":"FLM is delisted from Binance spot trading.","source":"Neo News Today (open letter coverage)","source_url":"https://neonewstoday.com/defi/flamingo-finance-airs-support-dispute-with-ngd-and-nf-in-open-letter/","date_evidence":"FLM was delisted from Binance spot trading on Nov. 12 (2025)"},{"date":"2025-12","event":"Public dispute between Neo co-founders Erik Zhang and Da Hongfei becomes visible, which Flamingo later says affected NGD/NF responsiveness.","source":"Neo News Today (open letter coverage)","source_url":"https://neonewstoday.com/defi/flamingo-finance-airs-support-dispute-with-ngd-and-nf-in-open-letter/"},{"date":"2026-04-22","event":"Flamingo Finance publishes an open letter alleging NGD and the Neo Foundation withheld promised support and control of its contracts.","source":"Neo News Today","source_url":"https://neonewstoday.com/defi/flamingo-finance-airs-support-dispute-with-ngd-and-nf-in-open-letter/","date_evidence":"Publication date: April 22, 2026"},{"date":"2026-08","event":"Flamingo Finance's staking contract is exploited; an attacker mints approximately 2.19 trillion FLM and drains most of the protocol's remaining liquidity, within the week of August 24-30, 2026 per Neo News Today's weekly roundup.","source":"Neo News Today","source_url":"https://neonewstoday.com/defi/flamingo-finance-exploited-through-staking-contract-vulnerability-trillions-of-flm-minted/"},{"date":"2026-08-31","event":"Neo News Today publishes detailed reporting on the staking contract exploit and FLM over-minting.","source":"Neo News Today","source_url":"https://neonewstoday.com/defi/flamingo-finance-exploited-through-staking-contract-vulnerability-trillions-of-flm-minted/","date_evidence":"August 31, 2026"},{"date":"2026-09-16","event":"Blockaid reports a flash loan exploit of Flamingo's older Flamincome VaultYUSDT contracts, netting the attacker roughly $345,900.","source":"Crypto Times","source_url":"https://www.cryptotimes.io/2026/09/16/blockaid-flags-flamingofinance-contract-exploit-345-9k-stolen/","date_evidence":"blockaid-flags-flamingofinance-contract-exploit-345-9k-stolen (published 2026/09/16)"}],"sources_used":[{"url":"https://www.cryptotimes.io/2026/09/16/blockaid-flags-flamingofinance-contract-exploit-345-9k-stolen/","name":"Crypto Times — Blockaid flags FlamingoFinance contract exploit, $345.9K stolen","type":"news_article","credibility":2},{"url":"https://coinedition.com/crypto-live-news/flamingofinance-loses-346000-in-defi-exploit-using-18m/","name":"CoinEdition — FlamingoFinance Loses $346,000 in DeFi Exploit Using $18M Flash Loan","type":"news_article","credibility":2},{"url":"https://neonewstoday.com/defi/flamingo-finance-exploited-through-staking-contract-vulnerability-trillions-of-flm-minted/","name":"Neo News Today — Flamingo Finance exploited through staking contract vulnerability; trillions of FLM minted","type":"news_article","credibility":2},{"url":"https://neonewstoday.com/week-in-review/neo-news-week-in-review-august-24-august-30/","name":"Neo News Today — Week in Review: August 24 – August 30","type":"news_article","credibility":2},{"url":"https://www.kucoin.com/news/insight/NEO/6a970d025acca50007b90c48","name":"KuCoin — commentary on Flamingo Finance exploit","type":"social_media","credibility":3},{"url":"https://neonewstoday.com/defi/flamingo-finance-announces-asset-support-initiative-in-wake-of-third-poly-network-hack/","name":"Neo News Today — Flamingo Finance Announces Asset Support Initiative in Wake of Third Poly Network Hack","type":"news_article","credibility":2},{"url":"https://www.bitget.com/news/detail/12560604166311","name":"Bitget News (via CryptoNews) — Flamingo Finance post-mortem on Poly Network bridge exploit","type":"news_article","credibility":2},{"url":"https://en.wikipedia.org/wiki/Poly_Network_exploit","name":"Wikipedia — Poly Network exploit","type":"other","credibility":2},{"url":"https://neonewstoday.com/defi/flamingo-finance-airs-support-dispute-with-ngd-and-nf-in-open-letter/","name":"Neo News Today — Flamingo Finance airs support dispute with NGD and NF in open letter","type":"news_article","credibility":2},{"url":"https://neonewstoday.com/defi/binance-assigns-monitoring-tag-to-flamingo-finances-flm-token/","name":"Neo News Today — Binance assigns Monitoring Tag to Flamingo Finance's FLM token","type":"news_article","credibility":2},{"url":"https://defillama.com/protocol/flamingo-finance","name":"DefiLlama — Flamingo Finance protocol page","type":"research","credibility":2},{"url":"https://coinmarketcap.com/currencies/flamingo/","name":"CoinMarketCap — Flamingo (FLM)","type":"research","credibility":2}],"source_tags":[],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-09-22T12:08:19.055445+00:00","updated_at":"2026-10-27T19:04:48.317+00:00"},"source_quality":{"total":12,"tier1":0,"tier2":0,"tier3":0,"unrated":12},"follower_count":null,"content_updated_at":"2026-10-27T19:04:48.802Z","last_fact_checked_at":"2026-10-27T19:04:48.564Z","fact_check_next_allowed_at":null,"update_next_allowed_at":null}