{"investigation":{"slug":"furucombo","entity_name":"Furucombo","trust_score":10,"severity_base":null,"score_modifier":0,"confidence":1,"status":"published","content_type":"investigation","summary":"Furucombo is an Ethereum-based DeFi composability protocol launched in March 2020 that enables users to batch complex multi-protocol transactions via a drag-and-drop interface. On February 27, 2021, the protocol suffered a critical 'evil contract' exploit in which an attacker spoofed a new Aave v2 implementation via Furucombo's proxy, draining approximately $14–15 million in ETH and ERC-20 tokens from 22 users who had granted standing token approvals to the platform. The team responded with a compensation plan issuing iouCOMBO tokens subject to a 360-day vesting schedule, but the incident exposed fundamental risks in delegatecall-based proxy architectures and broad token approval models.","sections":[{"content":"Furucombo was launched in March 2020 as a DeFi aggregation and composability platform on Ethereum. It allows users to construct multi-step DeFi strategies — such as flash loans, token swaps, lending position management, and yield farming — by chaining protocol interactions in a single transaction using a visual drag-and-drop interface. Supported integrations have included Aave, Uniswap, Compound, Curve, SushiSwap, and others. The platform expanded to Polygon and later introduced the Protocolink SDK for developer use. Furucombo's native governance token, COMBO (contract: 0xfFffFffF2ba8F66D4e51811C5190992176930278), has a maximum supply of 100 million tokens, with approximately 50% allocated to the community and the remainder distributed among the core team, advisors, investors, and development and mitigation funds. To function, users must grant ERC-20 token approvals to Furucombo's proxy contract, a design that proved to be the primary attack surface in the February 2021 exploit.","heading":"Background","sources":[{"url":"https://furucombo.app/","name":"","type":"other","credibility":3},{"url":"https://docs.furucombo.app/","name":"","type":"other","credibility":3},{"url":"https://etherscan.io/token/0xfFffFffF2ba8F66D4e51811C5190992176930278","name":"","type":"other","credibility":3},{"url":"https://finematics.com/how-to-use-furucombo/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"On February 27, 2021 at approximately 16:47 UTC, an unknown attacker exploited a critical vulnerability in Furucombo's proxy contract architecture. The attack is categorized as an 'evil contract' or 'uninitialized proxy' exploit. Furucombo's proxy routed delegatecalls to whitelisted handler contracts, one of which was the Aave v2 lending pool — itself an upgradeable proxy contract. The attacker discovered that Aave v2's proxy had an uninitialized implementation slot. By constructing a malicious transaction that called Furucombo's proxy, which in turn delegatecalled into Aave v2's proxy, the attacker was able to invoke the 'initialize' function on Aave's proxy and point its implementation to the attacker's own evil contract address. From that point, any subsequent delegatecall routed through Furucombo's proxy to the Aave v2 handler executed arbitrary attacker-controlled logic. Because users had already granted unlimited ERC-20 token approvals to Furucombo's proxy contract, the attacker was able to call transferFrom on behalf of victims and drain their wallets. The vulnerability did not require users to initiate a new transaction — existing approval grants were sufficient. Furucombo's team detected the attack and removed the Aave v2 lending pool from its registry contract at approximately 17:46 UTC, roughly 59 minutes after the first malicious transaction. Total user losses were reported as approximately $14–15 million across 21 distinct asset types, affecting 22 user addresses. Cream Finance's treasury was also among the victims, confirming a loss of $1.1 million. The attacker's externally owned address is 0xb624e2b10b84a41687caec94bdd484e48d76b212. The malicious contract was deployed at 0x86765dde9304bea32f65330d266155c4fa0c4f04. The setup transaction hash is 0x6a14869266a1dcf3f51b102f44b7af7d0a56f1766e5b1908ac80a6a23dbaf449 and the primary attack transaction hash is 0x8bf64bd802d039d03c63bf3614afc042f345e158ea0814c74be4b5b14436afb9. Furucombo subsequently deployed a new proxy contract at 0xA013AfbB9A92cEF49e898C87C060e6660E050569.","heading":"The Hack","sources":[{"url":"https://medium.com/furucombo/furucombo-post-mortem-march-2021-ad19afd415e","name":"","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-furucombo-evil-contract-hack-feb-2021","name":"","type":"other","credibility":3},{"url":"https://cryptobriefing.com/defi-tx-bundler-furucombo-hacked-14-million/","name":"","type":"other","credibility":3},{"url":"https://x.com/creamdotfinance/status/1365778386849726466","name":"","type":"other","credibility":3},{"url":"https://www.vidma.io/blog/the-furucombo-hack-a-14-million-lesson-in-smart-contract-vulnerabilities","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"On-chain data corroborates the attack timeline and scale. The attacker's externally owned address (0xb624e2b10b84a41687caec94bdd484e48d76b212) is labeled 'Furucombo Hacker' on Etherscan. Following the exploit, the address held over 4,560 ETH (valued at roughly $6.8 million at the time) and more than $7 million in ERC-20 tokens, including approximately 5.5 million DAI. The attacker subsequently transferred a substantial portion of funds through Tornado Cash, the privacy mixer, to obscure the trail and hinder attribution. The Furucombo proxy contract involved in the hack (0x52F9eea36F57d86A0F051419Fd11e4A256359C8f, labeled 'Proxy v0.1' on Etherscan) shows the relevant approval-drain transactions in its history. The new replacement proxy (0x9901bac880caecad999e292811db9c1db3e86f8a, labeled 'Proxy V2.0.0') was deployed following the incident. Furucombo also engaged security researchers Dedaub and samczsun for post-incident on-chain monitoring. The attacker's identity has not been publicly established as of the date of this report.","heading":"On-Chain Evidence","sources":[{"url":"https://etherscan.io/address/0xb624e2b10b84a41687caec94bdd484e48d76b212","name":"","type":"other","credibility":3},{"url":"https://etherscan.io/address/0x52F9eea36F57d86A0F051419Fd11e4A256359C8f","name":"","type":"other","credibility":3},{"url":"https://etherscan.io/address/0x9901bac880caecad999e292811db9c1db3e86f8a","name":"","type":"other","credibility":3},{"url":"https://www.coinspect.com/learn-evm-attacks/cases/furucombo/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the attack, Furucombo's team acknowledged the incident publicly and committed to compensating all 22 affected users. On or around March 8–9, 2021, the team announced a compensation mechanism built around iouCOMBO tokens — ERC-20 tokens representing future claims on COMBO tokens drawn from a designated recovery pool. A total of 5 million iouCOMBO tokens were allocated: 1 million from the core team's reserves and 4 million from the community growth fund. These tokens were subject to a 360-day linear vesting schedule beginning March 1, 2021, with an initial claimable tranche available at launch (projected for April 2021, pending completion of security audits). As an illustration provided by the team: a victim holding 1,000 iouCOMBO tokens who locked them on April 14 could immediately claim approximately 125 tokens, with the remainder vesting linearly over the following 315 days. The COMBO token price fell approximately 18.7% within 24 hours of the compensation announcement. The team reported the incident to law enforcement and engaged Certora for a full post-incident audit. The protocol subsequently introduced Dedaub and samczsun as additional security monitors. However, the compensation was in the form of the team's own governance token rather than direct dollar-equivalent restitution, meaning victims bore exposure to COMBO price volatility over the vesting period. Furucombo has continued operating as a protocol and launched subsequent products including Protocolink, though its TVL and user activity have remained significantly diminished relative to pre-hack levels.","heading":"Team & Recovery","sources":[{"url":"https://cryptobriefing.com/furucombo-will-issue-iou-tokens-compensate-hack-victims/","name":"","type":"other","credibility":3},{"url":"https://medium.com/furucombo/furucombo-post-mortem-march-2021-ad19afd415e","name":"","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/furucombo-to-issue-ioucombo-tokens-to-repay-victims-of-15m-attack","name":"","type":"other","credibility":3},{"url":"https://defillama.com/protocol/furucombo","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"The Furucombo exploit represents a high-severity instance of smart contract vulnerability arising from two compounding design weaknesses: (1) an uninitialized upgradeable proxy in an integrated third-party protocol (Aave v2) that Furucombo's own proxy did not validate before executing delegatecalls, and (2) a broad, persistent token approval model that granted Furucombo's proxy contract unlimited access to users' wallet balances without requiring per-transaction confirmation. Together, these flaws allowed a single attacker to drain $14–15 million from 22 users in under one hour without those users initiating any new transactions. The attack did not require a flash loan or complex financial manipulation — only the ability to route a delegatecall through an insufficiently validated proxy. Several systemic risk factors remain relevant for users considering Furucombo today: the protocol's core function still relies on users granting broad token approvals to a central proxy; the compensation paid to hack victims was denominated in the team's own depreciating governance token rather than stablecoins or ETH; and post-incident TVL has remained very low relative to pre-hack levels, limiting confidence in a robust recovery. No independent confirmation has been published that victims received full dollar-equivalent compensation. The attacker has not been identified or prosecuted. Users interacting with any DeFi aggregator that requires broad pre-approvals face analogous risk profiles. The trust score of 10/100 reflects the severity and scale of the exploit, the nature of the compensation mechanism, the persistent approval-based risk model, and the lack of evidence of full restitution.","heading":"Risk Assessment","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-furucombo-evil-contract-hack-feb-2021","name":"","type":"other","credibility":3},{"url":"https://www.vidma.io/blog/the-furucombo-hack-a-14-million-lesson-in-smart-contract-vulnerabilities","name":"","type":"other","credibility":3},{"url":"https://www.quadrigainitiative.com/casestudy/furucombodefihack.php","name":"","type":"other","credibility":3},{"url":"https://cryptobriefing.com/furucombo-will-issue-iou-tokens-compensate-hack-victims/","name":"","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2020-03","event":"Furucombo launches on Ethereum mainnet as a DeFi composability and transaction batching platform.","source":"","date_original":"2020-03-01"},{"date":"2021-02-27","event":"At approximately 16:47 UTC, an attacker deploys an evil contract and exploits Furucombo's proxy via an uninitialized Aave v2 upgradeable proxy, draining approximately $14–15 million in ETH and ERC-20 tokens from 22 user addresses in under one hour.","source":""},{"date":"2021-02-27","event":"Cream Finance confirms its treasury lost $1.1 million in the Furucombo attack via a public Twitter post.","source":""},{"date":"2021-02-27","event":"At approximately 17:46 UTC, Furucombo removes the Aave v2 lending pool from its registry contract, halting the attack approximately 59 minutes after it began.","source":""},{"date":"2021-02-27","event":"Attacker begins moving stolen funds through Tornado Cash to obscure on-chain trail. Attacker address 0xb624e2b10b84a41687caec94bdd484e48d76b212 holds ~4,560 ETH and ~$7M in ERC-20 tokens post-attack.","source":""},{"date":"2021-03","event":"Furucombo publishes post-mortem, acknowledges vulnerability, commits to compensating all affected users, and deploys replacement proxy contract at 0xA013AfbB9A92cEF49e898C87C060e6660E050569.","source":"","date_original":"2021-03-01"},{"date":"2021-03-08","event":"Furucombo announces iouCOMBO token compensation plan: 5 million iouCOMBO tokens (1M from core team, 4M from community fund) subject to a 360-day linear vesting schedule starting March 1, 2021.","source":""},{"date":"2021-04","event":"iouCOMBO tokens scheduled for distribution to hack victims following completion of security audits. COMBO token price had fallen approximately 18.7% within 24 hours of the compensation announcement.","source":"","date_original":"2021-04-01"}],"sources_used":[{"url":"https://furucombo.app/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260606005316/https://furucombo.app/","credibility":3,"archive_timestamp":"2026-06-06T00:53:16+00:00"},{"url":"https://docs.furucombo.app/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260602170028/https://docs.furucombo.app/","credibility":3,"archive_timestamp":"2026-06-02T17:00:28+00:00"},{"url":"https://etherscan.io/token/0xfFffFffF2ba8F66D4e51811C5190992176930278","name":"","type":"other","archive_url":"http://web.archive.org/web/20260602170029/https://etherscan.io/token/0xfFffFffF2ba8F66D4e51811C5190992176930278","credibility":3,"archive_timestamp":"2026-06-02T17:00:29+00:00"},{"url":"https://finematics.com/how-to-use-furucombo/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260422214938/https://finematics.com/how-to-use-furucombo/","credibility":3,"archive_timestamp":"2026-04-22T21:49:38+00:00"},{"url":"https://medium.com/furucombo/furucombo-post-mortem-march-2021-ad19afd415e","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.halborn.com/blog/post/explained-the-furucombo-evil-contract-hack-feb-2021","name":"","type":"other","archive_url":"http://web.archive.org/web/20260121125317/https://www.halborn.com/blog/post/explained-the-furucombo-evil-contract-hack-feb-2021","credibility":3,"archive_timestamp":"2026-01-21T12:53:17+00:00"},{"url":"https://cryptobriefing.com/defi-tx-bundler-furucombo-hacked-14-million/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260308104400/https://cryptobriefing.com/defi-tx-bundler-furucombo-hacked-14-million/","credibility":3,"archive_timestamp":"2026-03-08T10:44:00+00:00"},{"url":"https://x.com/creamdotfinance/status/1365778386849726466","name":"","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.vidma.io/blog/the-furucombo-hack-a-14-million-lesson-in-smart-contract-vulnerabilities","name":"","type":"other","archive_url":"http://web.archive.org/web/20260513081650/https://www.vidma.io/blog/the-furucombo-hack-a-14-million-lesson-in-smart-contract-vulnerabilities","credibility":3,"archive_timestamp":"2026-05-13T08:16:50+00:00"},{"url":"https://etherscan.io/address/0xb624e2b10b84a41687caec94bdd484e48d76b212","name":"","type":"other","archive_url":"https://web.archive.org/web/20260830085326/https://etherscan.io/address/0xb624e2b10b84a41687caec94bdd484e48d76b212","credibility":3,"archive_timestamp":"2026-08-30T08:53:26+00:00"},{"url":"https://etherscan.io/address/0x52F9eea36F57d86A0F051419Fd11e4A256359C8f","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829192724/https://etherscan.io/address/0x52F9eea36F57d86A0F051419Fd11e4A256359C8f","credibility":3,"archive_timestamp":"2026-08-29T19:27:24+00:00"},{"url":"https://etherscan.io/address/0x9901bac880caecad999e292811db9c1db3e86f8a","name":"","type":"other","archive_url":"https://web.archive.org/web/20260830085144/https://etherscan.io/address/0x9901bac880caecad999e292811db9c1db3e86f8a","credibility":3,"archive_timestamp":"2026-08-30T08:51:44+00:00"},{"url":"https://www.coinspect.com/learn-evm-attacks/cases/furucombo/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260607042421/https://www.coinspect.com/learn-evm-attacks/cases/furucombo/","credibility":3,"archive_timestamp":"2026-06-07T04:24:21+00:00"},{"url":"https://cryptobriefing.com/furucombo-will-issue-iou-tokens-compensate-hack-victims/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260116221659/https://cryptobriefing.com/furucombo-will-issue-iou-tokens-compensate-hack-victims/","credibility":3,"archive_timestamp":"2026-01-16T22:16:59+00:00"},{"url":"https://cointelegraph.com/news/furucombo-to-issue-ioucombo-tokens-to-repay-victims-of-15m-attack","name":"","type":"other","archive_url":"http://web.archive.org/web/20260310064900/https://cointelegraph.com/news/furucombo-to-issue-ioucombo-tokens-to-repay-victims-of-15m-attack","credibility":3,"archive_timestamp":"2026-03-10T06:49:00+00:00"},{"url":"https://defillama.com/protocol/furucombo","name":"","type":"other","archive_url":"http://web.archive.org/web/20260602170028/https://defillama.com/protocol/furucombo","credibility":3,"archive_timestamp":"2026-06-02T17:00:28+00:00"},{"url":"https://www.quadrigainitiative.com/casestudy/furucombodefihack.php","name":"","type":"other","archive_url":"https://web.archive.org/web/20260830164401/https://www.quadrigainitiative.com/casestudy/furucombodefihack.php","credibility":3,"archive_timestamp":"2026-08-30T16:44:01+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:58.921157+00:00","updated_at":"2026-08-30T16:47:13.128901+00:00"}}