{"investigation":{"slug":"griffinai","entity_name":"GriffinAI","trust_score":28,"severity_base":null,"score_modifier":0,"confidence":0.78,"status":"published","content_type":"investigation","summary":"Griffin AI is a Web3 no-code AI agent builder on BNB Chain that launched its native GAIN token on Binance Alpha on September 24, 2025. Within hours of launch, an attacker exploited a misconfigured LayerZero cross-chain peer to mint 5 billion unauthorized GAIN tokens and dump approximately $3 million worth into the market, crashing the token 87-90% and erasing roughly $36 million in market capitalization. The team subsequently enacted a token migration, a $2.5 million recovery fund, and a re-launch on October 6, 2025, though GAIN continues to trade approximately 95% below its all-time high.","sections":[{"content":"On September 24, 2025, Griffin AI listed its GAIN token across Binance Alpha, KuCoin, MEXC, HTX, and Gate.io. The token opened at approximately $0.05 and surged more than 400% to around $0.24 within hours, reaching a peak fully diluted valuation near $224 million. Within the same trading session, an attacker exploited a critical vulnerability in the project's LayerZero cross-chain configuration.\n\nAccording to security firm QuillAudits, the attacker compromised the admin externally-owned account (EOA) on BNB Chain (0x54a978238984d581edd3a9359dda9be53a930a7e), likely through phishing. Using that compromised key, the attacker called the `setPeer` function on the legitimate GriffinAI OFT contract, registering a fraudulent Ethereum contract as a trusted LayerZero peer. The attacker then deployed a malicious contract on Ethereum, minted 5 billion fake $TTTTT tokens, and bridged them to BNB Chain via LayerZero. Due to the manipulated peer configuration, this triggered the minting of 5 billion legitimate $GAIN tokens on BNB Chain — inflating total supply from 1 billion to approximately 5.3 billion.\n\nThe attacker liquidated approximately 147.5 million GAIN tokens on PancakeSwap, obtaining roughly 2,955 BNB (approximately $2.93-3 million at the time). The proceeds were converted to approximately 720-876 ETH via deBridge, distributed across six laundering wallets, and the majority was sent through Tornado Cash. Security firm GoPlus Security was among the first to flag the exploit, within approximately 22 minutes of the attack. The event erased approximately $36 million in market capitalization.","heading":"The September 2025 Mint-and-Dump Exploit","sources":[{"url":"https://rekt.news/griffinai-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://www.quillaudits.com/blog/hack-analysis/griffin-ai-exploit","name":"quillaudits.com","type":"other","credibility":3},{"url":"https://beincrypto.com/griffin-ai-gain-token-crash-exploit/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://crypto.news/griffin-ai-price-attacker-mints-5b-gain-tokens-2025/","name":"crypto.news","type":"other","credibility":3},{"url":"https://icobench.com/news/griffin-ais-gain-token-suffers-2-93m-mint-and-dump-exploit/","name":"icobench.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Security researchers identified the root cause as an unauthorized LayerZero peer configuration enabled by admin key compromise. The LayerZero Omnichain Fungible Token (OFT) standard allows cross-chain token transfers by trusting configured peer contracts. When an attacker gains access to the admin wallet and calls `setPeer`, they can register any arbitrary contract — including malicious ones — as a trusted cross-chain counterpart.\n\nGoPlus Security described the exploit mechanism: 'The attacker added a fake LayerZero Peer on Ethereum, minting fake TTTTT tokens, and used it to bypass cross-chain checks — then minted 5 billion GAIN on BSC.' This attack vector was characterized as similar to the earlier Yala protocol hack, suggesting a repeating class of vulnerability in LayerZero-based OFT deployments.\n\nQuillAudits noted that the attacker's BSC wallet (0xf3d17326130f90c1900bc0b69323c4c7e2d58db2) retained approximately 800 million excess minted $GAIN tokens after the dump, with no recovery of those funds reported. Approximately 29 ETH remained in address 0x469CF0E22403E1af404926a25eadB34a7Bd85F4d after laundering operations. Founder Oliver Feldmeier attributed the breach to 'a misconfigured LayerZero (cross-chain messaging) set-up and compromised key.'","heading":"Technical Vulnerability Analysis","sources":[{"url":"https://www.quillaudits.com/blog/hack-analysis/griffin-ai-exploit","name":"quillaudits.com","type":"other","credibility":3},{"url":"https://quillaudits.medium.com/griffin-ai-exploit-6c60bcfd4a0e","name":"quillaudits.medium.com","type":"other","credibility":3},{"url":"https://www.defendor.xyz/griffin-ais-3m-token-heist-how-admin-keys-turned-their-bridge-into-a-money-printer/","name":"defendor.xyz","type":"other","credibility":3},{"url":"https://www.cryptopolitan.com/griffin-ai-crash-unauthorized-gain-minting/","name":"cryptopolitan.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Blockchain investigator ZachXBT flagged the Griffin AI exploit and the affiliated laundering activity. While the specific content of ZachXBT's flag was published on his Telegram channel (@investigations), multiple aggregator sources cite ZachXBT linking the attacker's laundering operations to individuals previously identified as facilitating DPRK (North Korean state-sponsored) crypto hacking proceeds, though this attribution should be treated with moderate caution as it is relayed through secondary sources rather than a verified primary post.\n\nThe web3isgoinggreat.com database catalogued the incident as a confirmed exploit, noting CEO Feldmeier's attribution to 'a misconfigured LayerZero set-up and compromised key.' The incident was also covered by CryptoRank, BeInCrypto, crypto.news, The Merkle, and Cryptopolitan. GoPlus Security issued an on-chain alert within approximately 22 minutes of the exploit occurring.","heading":"ZachXBT Flag and External Investigator Activity","sources":[{"url":"https://www.web3isgoinggreat.com/?id=griffin-ai-exploit","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://beincrypto.com/griffin-ai-gain-token-crash-exploit/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://cryptorank.io/news/feed/be3ee-griffin-ai-crashes-90-as-attacker-mints-5b-coins-after-binance-alpha-debut","name":"cryptorank.io","type":"other","credibility":3},{"url":"https://themerkle.com/griffin-ais-gain-token-suffers-90-crash-after-exploit/","name":"themerkle.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the exploit, Griffin AI founder Oliver Feldmeier issued a public apology, taking 'full responsibility' for the incident. The team took several immediate steps: they removed authorized liquidity pools on BNB Chain, requested all listed exchanges (KuCoin, MEXC, HTX, Gate.io, Binance Alpha) to pause GAIN deposits, withdrawals, and trading, and coordinated with security firms.\n\nThe team announced a migration to a new, fully-audited GAIN token. On October 6, 2025, the re-launch took place at 6:00 PM Singapore Time. Pre-hack token holders received new GAIN tokens in a 1:1 ratio via airdrop based on a snapshot of balances before the exploit. Binance reportedly covered approximately half of the replacement tokens given back to users.\n\nGriffin AI also established a $2.5 million recovery fund — described as equal to the full amount the attacker obtained from selling counterfeit tokens to community members — to enable affected buyers to recover value over time through a buyback-and-burn mechanism. Post-relaunch, GAIN continues to trade approximately 95% below its all-time high of approximately $0.028, with a current price around $0.0013 as of mid-2026.","heading":"Team Response and Token Migration","sources":[{"url":"https://blog.griffinai.io/news/griffin-ai-re-launch","name":"blog.griffinai.io","type":"other","credibility":3},{"url":"https://cryptopotato.com/the-wait-is-over-griffin-ai-is-re-launching-its-gain-token-on-major-exchanges/","name":"cryptopotato.com","type":"other","credibility":3},{"url":"https://www.btcc.com/en-US/square/Beincrypto/1013862","name":"btcc.com","type":"other","credibility":3},{"url":"https://www.coingecko.com/en/coins/griffin-ai","name":"coingecko.com","type":"other","credibility":3}],"severity":"medium"},{"content":"At launch on September 24, 2025, GAIN reached a peak valuation of approximately $224 million fully diluted. Following the exploit, the token collapsed to a valuation near $7 million — a roughly 97% drawdown within a single trading session. As of May 2026, GAIN trades at approximately $0.0013, representing a decline of approximately 95.3% from its all-time high of $0.028.\n\nGriffin AI claims more than 15,000 live agents deployed on its platform and continues to operate as a no-code DeFi agent builder. The project is listed on CoinGecko and CoinMarketCap with active trading. However, the token's price trajectory has not recovered materially since the October 2025 re-launch, and trading volumes remain limited relative to the immediate post-exploit period.\n\nFounder Oliver Feldmeier previously founded one of Europe's first regulated digital asset exchanges, which completed a NASDAQ IPO. No regulatory actions against Griffin AI or its founders have been identified in available sources as of May 2026.","heading":"Market Impact and Current Status","sources":[{"url":"https://www.coingecko.com/en/coins/griffin-ai","name":"coingecko.com","type":"other","credibility":3},{"url":"https://coinmarketcap.com/currencies/griffin-ai/","name":"coinmarketcap.com","type":"other","credibility":3},{"url":"https://www.binance.com/en/price/griffin-ai","name":"binance.com","type":"other","credibility":3},{"url":"https://chainwire.org/2025/09/24/griffin-ai-lists-gain-on-leading-exchanges-launches-utility-token-on-bnb-chain/","name":"chainwire.org","type":"other","credibility":3}],"severity":"medium"},{"content":"The exploit exposed several critical security deficiencies at the time of launch. The use of a single admin EOA with authority to call `setPeer` on production cross-chain contracts represented a significant single point of failure — a compromised private key was sufficient to trigger a supply inflation capable of destroying the project's market capitalization.\n\nThe token launched on Binance Alpha and multiple centralized exchanges on the same day as its BNB Chain deployment, creating a narrow window in which a compromise would have maximum impact due to active trading. No independent audit had apparently cleared the cross-chain configuration prior to launch, as post-incident analysis by QuillAudits was conducted after the fact.\n\nThe laundering of exploit proceeds through Tornado Cash renders full fund recovery unlikely. Approximately 4.85 billion phantom GAIN tokens remained in the attacker's wallet after the initial dump, representing a continuing overhang risk if those tokens were ever used, though the token migration to a new contract mitigated this for the re-launched token. The `$0.0013` current price versus `$0.24` peak suggests the market has not fully restored confidence following the incident.","heading":"Security Posture and Risk Factors","sources":[{"url":"https://www.quillaudits.com/blog/hack-analysis/griffin-ai-exploit","name":"quillaudits.com","type":"other","credibility":3},{"url":"https://rekt.news/griffinai-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://www.defendor.xyz/griffin-ais-3m-token-heist-how-admin-keys-turned-their-bridge-into-a-money-printer/","name":"defendor.xyz","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/?id=griffin-ai-exploit","name":"web3isgoinggreat.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2025-09-24","event":"Griffin AI lists GAIN token on Binance Alpha, KuCoin, MEXC, HTX, and Gate.io. Token opens at $0.05 and surges over 400% to approximately $0.24, reaching a peak fully diluted valuation near $224 million.","source":""},{"date":"2025-09-24","event":"Attacker compromises the admin EOA on BNB Chain (0x54a978238984d581edd3a9359dda9be53a930a7e), calls `setPeer` to register a fraudulent Ethereum contract as a trusted LayerZero peer, and mints 5 billion unauthorized GAIN tokens on BNB Chain.","source":""},{"date":"2025-09-24","event":"GoPlus Security issues an on-chain alert approximately 22 minutes after the exploit. Attacker dumps 147.5 million GAIN on PancakeSwap for approximately 2,955 BNB (~$3 million). Proceeds converted to ~720 ETH via deBridge and routed through Tornado Cash.","source":""},{"date":"2025-09-24","event":"GAIN collapses 87-90% from peak, market capitalization falls from ~$224 million to approximately $7 million. Griffin AI requests all exchanges halt GAIN deposits, withdrawals, and trading.","source":""},{"date":"2025-09-25","event":"Founder Oliver Feldmeier issues public apology, takes 'full responsibility,' and attributes breach to 'a misconfigured LayerZero cross-chain messaging set-up and compromised key.' ZachXBT flags the incident on his Telegram channel, with secondary sources citing his linkage of attacker laundering activity to DPRK-affiliated wallets.","source":""},{"date":"2025-09-25","event":"Griffin AI announces migration to a new fully-audited GAIN token and establishment of a $2.5 million recovery fund to compensate affected buyers.","source":""},{"date":"2025-10-06","event":"Griffin AI re-launches GAIN token on major exchanges. Pre-hack holders receive new GAIN 1:1 via airdrop. Binance covers approximately half of replacement tokens distributed to affected users.","source":""},{"date":"2026-05-26","event":"GAIN trades at approximately $0.0013, approximately 95.3% below its all-time high of ~$0.028. No regulatory actions have been identified against Griffin AI or its founders.","source":""}],"sources_used":[{"url":"https://rekt.news/griffinai-rekt","name":"rekt.news","type":"other","archive_url":"http://web.archive.org/web/20260608210855/https://rekt.news/griffinai-rekt","credibility":3,"archive_timestamp":"2026-06-08T21:08:55+00:00"},{"url":"https://www.quillaudits.com/blog/hack-analysis/griffin-ai-exploit","name":"quillaudits.com","type":"other","archive_url":"http://web.archive.org/web/20260515113553/https://www.quillaudits.com/blog/hack-analysis/griffin-ai-exploit","credibility":3,"archive_timestamp":"2026-05-15T11:35:53+00:00"},{"url":"https://beincrypto.com/griffin-ai-gain-token-crash-exploit/","name":"beincrypto.com","type":"other","archive_url":"http://web.archive.org/web/20251023042824/https://beincrypto.com/griffin-ai-gain-token-crash-exploit/","credibility":3,"archive_timestamp":"2025-10-23T04:28:24+00:00"},{"url":"https://crypto.news/griffin-ai-price-attacker-mints-5b-gain-tokens-2025/","name":"crypto.news","type":"other","archive_url":"http://web.archive.org/web/20251011171655/https://crypto.news/griffin-ai-price-attacker-mints-5b-gain-tokens-2025/","credibility":3,"archive_timestamp":"2025-10-11T17:16:55+00:00"},{"url":"https://icobench.com/news/griffin-ais-gain-token-suffers-2-93m-mint-and-dump-exploit/","name":"icobench.com","type":"other","archive_url":"http://web.archive.org/web/20251013191427/https://icobench.com/news/griffin-ais-gain-token-suffers-2-93m-mint-and-dump-exploit/","credibility":3,"archive_timestamp":"2025-10-13T19:14:27+00:00"},{"url":"https://quillaudits.medium.com/griffin-ai-exploit-6c60bcfd4a0e","name":"quillaudits.medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.defendor.xyz/griffin-ais-3m-token-heist-how-admin-keys-turned-their-bridge-into-a-money-printer/","name":"defendor.xyz","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-job","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.cryptopolitan.com/griffin-ai-crash-unauthorized-gain-minting/","name":"cryptopolitan.com","type":"other","archive_url":"http://web.archive.org/web/20251010074132/https://www.cryptopolitan.com/griffin-ai-crash-unauthorized-gain-minting/","credibility":3,"archive_timestamp":"2025-10-10T07:41:32+00:00"},{"url":"https://www.web3isgoinggreat.com/?id=griffin-ai-exploit","name":"web3isgoinggreat.com","type":"other","archive_url":"http://web.archive.org/web/20260307022312/https://www.web3isgoinggreat.com/?id=griffin-ai-exploit","credibility":3,"archive_timestamp":"2026-03-07T02:23:12+00:00"},{"url":"https://cryptorank.io/news/feed/be3ee-griffin-ai-crashes-90-as-attacker-mints-5b-coins-after-binance-alpha-debut","name":"cryptorank.io","type":"other","archive_url":"https://web.archive.org/web/20260830032922/https://cryptorank.io/news/feed/be3ee-griffin-ai-crashes-90-as-attacker-mints-5b-coins-after-binance-alpha-debut","credibility":3,"archive_timestamp":"2026-08-30T03:29:22+00:00"},{"url":"https://themerkle.com/griffin-ais-gain-token-suffers-90-crash-after-exploit/","name":"themerkle.com","type":"other","archive_url":"http://web.archive.org/web/20260519220802/https://themerkle.com/griffin-ais-gain-token-suffers-90-crash-after-exploit/","credibility":3,"archive_timestamp":"2026-05-19T22:08:02+00:00"},{"url":"https://blog.griffinai.io/news/griffin-ai-re-launch","name":"blog.griffinai.io","type":"other","archive_url":"http://web.archive.org/web/20260112051703/https://blog.griffinai.io/news/griffin-ai-re-launch","credibility":3,"archive_timestamp":"2026-01-12T05:17:03+00:00"},{"url":"https://cryptopotato.com/the-wait-is-over-griffin-ai-is-re-launching-its-gain-token-on-major-exchanges/","name":"cryptopotato.com","type":"other","archive_url":"http://web.archive.org/web/20251110041036/https://cryptopotato.com/the-wait-is-over-griffin-ai-is-re-launching-its-gain-token-on-major-exchanges/","credibility":3,"archive_timestamp":"2025-11-10T04:10:36+00:00"},{"url":"https://www.btcc.com/en-US/square/Beincrypto/1013862","name":"btcc.com","type":"other","archive_url":"https://web.archive.org/web/20260829083925/https://www.btcc.com/en-US/square/Beincrypto/1013862","credibility":3,"archive_timestamp":"2026-08-29T08:39:25+00:00"},{"url":"https://www.coingecko.com/en/coins/griffin-ai","name":"coingecko.com","type":"other","archive_url":"http://web.archive.org/web/20250925144539/https://www.coingecko.com/en/coins/griffin-ai","credibility":3,"archive_timestamp":"2025-09-25T14:45:39+00:00"},{"url":"https://coinmarketcap.com/currencies/griffin-ai/","name":"coinmarketcap.com","type":"other","archive_url":"http://web.archive.org/web/20260518181033/https://coinmarketcap.com/currencies/griffin-ai/","credibility":3,"archive_timestamp":"2026-05-18T18:10:33+00:00"},{"url":"https://www.binance.com/en/price/griffin-ai","name":"binance.com","type":"other","archive_url":"https://web.archive.org/web/20260829083258/https://www.binance.com/en/price/griffin-ai","credibility":3,"archive_timestamp":"2026-08-29T08:32:58+00:00"},{"url":"https://chainwire.org/2025/09/24/griffin-ai-lists-gain-on-leading-exchanges-launches-utility-token-on-bnb-chain/","name":"chainwire.org","type":"other","archive_url":"http://web.archive.org/web/20260207144155/https://chainwire.org/2025/09/24/griffin-ai-lists-gain-on-leading-exchanges-launches-utility-token-on-bnb-chain/","credibility":3,"archive_timestamp":"2026-02-07T14:41:55+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:21.012939+00:00","updated_at":"2026-08-30T03:54:59.194564+00:00"}}