{"investigation":{"slug":"hector-lending","entity_name":"Hector Lending","trust_score":8,"severity_base":null,"score_modifier":0,"confidence":0.88,"status":"published","content_type":"investigation","summary":"Hector Lending is a defunct DeFi lending protocol built on the Fantom blockchain and operated by Hector Network (also known as Hector DAO). It was one of several products in an ecosystem whose treasury declined from approximately $110 million to near zero through a combination of alleged team mismanagement, three separate security incidents, and a court-ordered receivership. The broader Hector Network entered BVI receivership in February 2024 and subsequently obtained US Chapter 15 bankruptcy recognition — the first DAO ever to do so — in July 2024.","sections":[{"content":"Hector Lending was a collateralized lending product deployed on the Fantom blockchain by Hector Network (formerly Hector Finance / Hector DAO), a DeFi project that launched in late 2021. The broader ecosystem centered on two native tokens: HEC, a rebase governance token modeled after OlympusDAO's OHM, and TOR, a partially algorithmic stablecoin. At its peak in late 2021 and early 2022 the Hector Network treasury held approximately $110 million in assets. Hector Lending was positioned as a lending and borrowing product within this ecosystem, operating entirely on Fantom. As of 2024, DefiLlama reports Hector Lending's TVL at approximately $7,600 with zero active loans, reflecting its complete operational collapse. The protocol's team operated entirely pseudonymously under Greek deity names including Zeus, Poseidon, Prometheus, and Agenor, making accountability for subsequent mismanagement and security incidents difficult.","heading":"Protocol Overview and History","sources":[{"url":"https://defillama.com/protocol/hector-lending","name":"defillama.com","type":"other","credibility":3},{"url":"https://blog.fantom.foundation/fantom-ecosystem-spotlight-hector-finance/","name":"blog.fantom.foundation","type":"other","credibility":3},{"url":"https://iq.wiki/wiki/hector-network","name":"iq.wiki","type":"other","credibility":3}],"severity":"medium"},{"content":"Hector Network and its sub-protocols experienced at least three confirmed security incidents between 2022 and 2024. The first was a ransomware attack in 2022 against the team's self-managed hosting platform, for which an undisclosed amount in Bitcoin was paid as ransom; the team did not disclose this event to investors at the time. The second incident occurred on June 2, 2023, when an unknown party exploited an unlimited USDC spending approval on a beta cross-chain bridge contract on Fantom, draining approximately $653,000. DefiLlama classifies this as a protocol logic vulnerability. The team did not issue a timely post-mortem. The third and most financially damaging incident — though it affected the redemption contract rather than Hector Lending directly — occurred on January 15, 2024. A $2.7 million loss resulted from exploitation of the HectorRedemptionTreasury contract, a smart contract deployed to distribute liquidation proceeds to token holders. According to CertiK's post-mortem, a privileged address was added as an eligible wallet via the centralized AddEligibleWallet function (transaction 0x1b813d9), then called mintWithdraw (transaction 0xd1b342c) to drain the treasury. CertiK had completed an audit on December 19, 2023 — weeks before the exploit — that explicitly flagged this centralization risk and urged the team to explore alternatives. The team chose to retain the mechanism for operational convenience; CertiK formally marked the finding as acknowledged but unresolved. Blockchain analysis suggests the January 2024 exploit was either an inside job or a private key compromise, as the attacker had access to the team's deployer account. In total, direct security losses across the ecosystem are estimated at approximately $40 million when combined with the $8 million lost due to the Multichain bridge collapse in July 2023.","heading":"Security Incidents and Exploits","sources":[{"url":"https://www.certik.com/resources/blog/post-mortem-hector-network","name":"certik.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/hector-lending","name":"defillama.com","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/?id=hector-network-compensation-fund-theft","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/hector-dao-allegedly-ceases-communication-with-investors-after-hack","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://medium.com/coinmonks/hector-network-making-d-in-dao-stands-for-ditzy-or-duplicitous-352d4eccc423","name":"medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Between late 2021 and mid-2023, the Hector Network treasury declined from approximately $110 million to $16 million. Community members and activist investor groups — including a collective known as the RFV Raiders and a community member using the pseudonym Lilbagscientist — publicly accused the pseudonymous team of 'slow-rugging': paying themselves inflated salaries while failing to deliver working products. Critics alleged the team paid itself $52 million in compensation over the project's lifespan without delivering meaningful utility. DL News reported that the team spent approximately $14 million every six months without building useful products, and that the HEC token dropped over 99% from its peak. The team responded to these accusations by characterizing them as a 'coordinated attack,' restricting governance voting rights for recently purchased tokens, and reportedly blocking and banning dissenting community members from governance forums. Hector Network's Discord server went dark in September 2023, eliminating investor communication channels. When the January 2024 hack occurred, the team's last communication to investors was on January 18, 2024, after which they went silent, allegedly deleting the Google Group email address that had served as their sole remaining communication channel. These accusations of mismanagement remain alleged and have not resulted in criminal charges as of the investigation date, but the team's conduct — including the undisclosed ransomware payment in 2022 and refusal to provide expense breakdowns — has been documented by multiple credible outlets.","heading":"Alleged Treasury Mismanagement and Slow Rug Accusations","sources":[{"url":"https://www.dlnews.com/articles/defi/hector-network-dao-rage-quits-after-draining-100m-treasury/","name":"dlnews.com","type":"other","credibility":3},{"url":"https://www.dlnews.com/articles/defi/rebel-investors-say-hector-network-is-slow-rugging-them/","name":"dlnews.com","type":"other","credibility":3},{"url":"https://www.dlnews.com/articles/defi/hector-network-shuts-down-discord-server/","name":"dlnews.com","type":"other","credibility":3},{"url":"https://medium.com/coinmonks/hector-network-making-d-in-dao-stands-for-ditzy-or-duplicitous-352d4eccc423","name":"medium.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/hector-dao-allegedly-ceases-communication-with-investors-after-hack","name":"cointelegraph.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On July 15, 2023, Hector Network token holders voted with 83.31% support in favor of dissolving the project and liquidating its remaining treasury assets via governance proposal HIP 42. This decision followed the Multichain bridge collapse on July 6, 2023, which caused Hector Network to lose $8 million as bridged assets depegged from their Ethereum-side collateral. At the time of the vote the treasury held approximately $16 million. The liquidation effort was derailed by the January 15, 2024 exploit of the redemption contract. Following the hack, the liquidation committee sought judicial intervention. On February 19, 2024, the Eastern Caribbean Supreme Court (British Virgin Islands) issued an order placing Hector Network into receivership and appointing Interpath BVI — with directors James Drury and Paul Pretlove — as interim receivers. A final receivership order was issued on April 9, 2024. Interpath took custody of remaining assets valued at approximately $9.3 million, moving them into a new Gnosis Safe multisig wallet controlled exclusively by Interpath employees. The BVI receivership was subsequently recognized in the United States: on July 15, 2024, U.S. Bankruptcy Judge Michael B. Kaplan granted recognition of the BVI receivership as a foreign main proceeding under Chapter 15, marking the first time a DAO had obtained such recognition in US bankruptcy law. This ruling was described as groundbreaking by legal commentators at Bloomberg Law and Global Restructuring Review.","heading":"Rage Quit Vote and Receivership","sources":[{"url":"https://www.dlnews.com/articles/defi/hector-network-rage-quit-transitions-into-receivership/","name":"dlnews.com","type":"other","credibility":3},{"url":"https://www.offshorealert.com/hector-enterprise-inc-v-hector-dao-et-al-receivership-order-hector-network-defi-crypto-failure/","name":"offshorealert.com","type":"other","credibility":3},{"url":"https://news.bloomberglaw.com/us-law-week/how-hector-daos-bankruptcy-case-is-shaping-the-future-of-defi","name":"news.bloomberglaw.com","type":"other","credibility":3},{"url":"https://globalrestructuringreview.com/article/hector-dao-secures-us-recognition-in-groundbreaking-ch15-ruling","name":"globalrestructuringreview.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/hector-dao-files-chapter-15-bankruptcy","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://brownrudnick.com/client_news/brown-rudnick-achieves-landmark-ruling-in-the-treatment-of-daos-in-bankruptcy/","name":"brownrudnick.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Investors in Hector Network suffered severe losses across multiple vectors. The HEC governance token declined over 99% from its all-time high. The TOR stablecoin, which was designed to maintain a $1 peg, fell to approximately $0.13. Investors who participated in the July 2023 rage-quit redemption process faced additional harm when the $2.7 million destined for distribution was stolen in the January 2024 exploit. Interpath, acting as court-appointed receiver, stated it was investigating the recovery of the stolen $2.7 million, describing it as an asset belonging to the DAO. As of the February 2024 receivership order, remaining assets under Interpath custody were valued at $9.3 million — a fraction of the treasury's $110 million peak. A separate US civil lawsuit further complicated the US Chapter 15 recognition timeline, delaying final distributions. DL News reported in 2024 that investors faced additional time and legal costs due to a new US lawsuit filed against the estate. Activist investors had previously warned of the team's governance manipulation, including alleged deletion and editing of governance documents and censorship of dissenting forum posts, which Hector Network's team did not publicly rebut with documentary evidence.","heading":"Investor Harm and Outstanding Recovery Efforts","sources":[{"url":"https://www.dlnews.com/articles/defi/hector-network-rage-quit-transitions-into-receivership/","name":"dlnews.com","type":"other","credibility":3},{"url":"https://www.dlnews.com/articles/defi/hector-network-liquidation-stalled-over-new-us-lawsuit/","name":"dlnews.com","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/?id=hector-network-compensation-fund-theft","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://www.dlnews.com/articles/defi/hector-network-dao-rage-quits-after-draining-100m-treasury/","name":"dlnews.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Hector Network commissioned multiple security audits over its lifespan, including an audit by CertiK completed on December 19, 2023. CertiK's audit of the redemption contract explicitly identified centralization risks in the AddEligibleWallet function and recommended that the team implement alternative mechanisms to reduce the single point of failure. The Hector team acknowledged this finding but declined to implement the recommended changes, citing operational convenience. CertiK marked the issue as acknowledged but not resolved. Less than four weeks later, on January 15, 2024, the exact vulnerability identified in that audit was exploited to drain $2.7 million. CertiK published a post-mortem confirming that the auditor had forewarned the team of the risk prior to the exploit. This sequence of events — a specific warning, an explicit team decision not to remediate, followed by exploitation of the warned vulnerability — has been cited by security researchers and community members as evidence of negligence at minimum. The June 2023 bridge exploit ($653,000) similarly stemmed from a protocol logic flaw on a contract that was described as being in beta, suggesting Hector Network deployed unaudited or under-audited contracts to production.","heading":"Audit History and Ignored Warnings","sources":[{"url":"https://www.certik.com/resources/blog/post-mortem-hector-network","name":"certik.com","type":"other","credibility":3},{"url":"https://medium.com/coinmonks/hector-network-making-d-in-dao-stands-for-ditzy-or-duplicitous-352d4eccc423","name":"medium.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/hector-lending","name":"defillama.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021-11","event":"Hector Network (Hector DAO) launches on Fantom with HEC rebase token; treasury builds to approximately $110 million at peak.","source":"","date_original":"2021-11-01"},{"date":"2022","event":"Hector Lending deployed as a lending product within the Hector ecosystem on Fantom.","source":"","date_original":"2022-01-01"},{"date":"2022-06","event":"Undisclosed ransomware attack targets Hector Network's self-managed hosting platform; team pays an undisclosed BTC ransom and does not publicly disclose the incident to investors.","source":"","date_original":"2022-06-01"},{"date":"2023-03","event":"Activist investor group RFV Raiders and community member Lilbagscientist publicly accuse the Hector team of slow-rugging — paying $14 million in team salaries every six months without delivering products.","source":"","date_original":"2023-03-01"},{"date":"2023-06-02","event":"Hector Network suffers a $653,000 exploit on a beta bridge contract via an unlimited USDC spending approval. The team does not issue a timely post-mortem. DefiLlama classifies the incident as a protocol logic vulnerability on Fantom.","source":""},{"date":"2023-07-06","event":"Multichain bridge collapses; Hector Network loses $8 million in treasury assets as bridged tokens depegged from Ethereum-side collateral.","source":""},{"date":"2023-07-15","event":"Hector DAO token holders pass governance proposal HIP 42 with 83.31% support, voting to dissolve the project and distribute remaining treasury assets (~$16 million) to token holders.","source":""},{"date":"2023-09","event":"Hector Network Discord server goes dark, removing primary investor communication channel.","source":"","date_original":"2023-09-01"},{"date":"2023-12-19","event":"CertiK completes audit of the HectorRedemptionTreasury contract and flags centralization risk in the AddEligibleWallet function as unresolved after the team declines to implement recommended changes.","source":""},{"date":"2024-01-15","event":"HectorRedemptionTreasury exploit: attacker adds an eligible wallet via AddEligibleWallet (tx 0x1b813d9), then calls mintWithdraw (tx 0xd1b342c) to drain $2.7 million. Blockchain analysis suggests an inside job or private key compromise.","source":""},{"date":"2024-01-18","event":"Hector Network team sends final communication to investors, then goes silent, allegedly deleting the Google Group email address used for investor contact.","source":""},{"date":"2024-02-19","event":"Eastern Caribbean Supreme Court (BVI) issues receivership order placing Hector Network under the custody of Interpath BVI, with James Drury and Paul Pretlove as receivers. Remaining assets valued at approximately $9.3 million.","source":""},{"date":"2024-04-09","event":"BVI courts issue final receivership order appointing Interpath on a full and final basis.","source":""},{"date":"2024-07-15","event":"U.S. Bankruptcy Judge Michael B. Kaplan grants Chapter 15 recognition of the BVI receivership, marking the first time a DAO has obtained US bankruptcy recognition as a debtor.","source":""}],"sources_used":[{"url":"https://defillama.com/protocol/hector-lending","name":"defillama.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://blog.fantom.foundation/fantom-ecosystem-spotlight-hector-finance/","name":"blog.fantom.foundation","type":"other","archive_url":"http://web.archive.org/web/20260608165719/https://blog.fantom.foundation/fantom-ecosystem-spotlight-hector-finance/","credibility":3,"archive_timestamp":"2026-06-08T16:57:19+00:00"},{"url":"https://iq.wiki/wiki/hector-network","name":"iq.wiki","type":"other","archive_url":"http://web.archive.org/web/20260212100412/https://iq.wiki/wiki/hector-network","credibility":3,"archive_timestamp":"2026-02-12T10:04:12+00:00"},{"url":"https://www.certik.com/resources/blog/post-mortem-hector-network","name":"certik.com","type":"other","archive_url":"http://web.archive.org/web/20260220113635/https://www.certik.com/resources/blog/post-mortem-hector-network","credibility":3,"archive_timestamp":"2026-02-20T11:36:35+00:00"},{"url":"https://www.web3isgoinggreat.com/?id=hector-network-compensation-fund-theft","name":"web3isgoinggreat.com","type":"other","archive_url":"http://web.archive.org/web/20260413113118/https://www.web3isgoinggreat.com/?id=hector-network-compensation-fund-theft","credibility":3,"archive_timestamp":"2026-04-13T11:31:18+00:00"},{"url":"https://cointelegraph.com/news/hector-dao-allegedly-ceases-communication-with-investors-after-hack","name":"cointelegraph.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://medium.com/coinmonks/hector-network-making-d-in-dao-stands-for-ditzy-or-duplicitous-352d4eccc423","name":"medium.com","type":"other","archive_url":"http://web.archive.org/web/20241007050135/https://medium.com/coinmonks/hector-network-making-d-in-dao-stands-for-ditzy-or-duplicitous-352d4eccc423","credibility":3,"archive_timestamp":"2024-10-07T05:01:35+00:00"},{"url":"https://www.dlnews.com/articles/defi/hector-network-dao-rage-quits-after-draining-100m-treasury/","name":"dlnews.com","type":"other","archive_url":"http://web.archive.org/web/20260617124232/https://www.dlnews.com/articles/defi/hector-network-dao-rage-quits-after-draining-100m-treasury/","credibility":3,"archive_timestamp":"2026-06-17T12:42:32+00:00"},{"url":"https://www.dlnews.com/articles/defi/rebel-investors-say-hector-network-is-slow-rugging-them/","name":"dlnews.com","type":"other","archive_url":"http://web.archive.org/web/20260617162918/https://www.dlnews.com/articles/defi/rebel-investors-say-hector-network-is-slow-rugging-them/","credibility":3,"archive_timestamp":"2026-06-17T16:29:18+00:00"},{"url":"https://www.dlnews.com/articles/defi/hector-network-shuts-down-discord-server/","name":"dlnews.com","type":"other","archive_url":"http://web.archive.org/web/20260617124218/https://www.dlnews.com/articles/defi/hector-network-shuts-down-discord-server/","credibility":3,"archive_timestamp":"2026-06-17T12:42:18+00:00"},{"url":"https://www.dlnews.com/articles/defi/hector-network-rage-quit-transitions-into-receivership/","name":"dlnews.com","type":"other","archive_url":"http://web.archive.org/web/20260617124040/https://www.dlnews.com/articles/defi/hector-network-rage-quit-transitions-into-receivership/","credibility":3,"archive_timestamp":"2026-06-17T12:40:40+00:00"},{"url":"https://www.offshorealert.com/hector-enterprise-inc-v-hector-dao-et-al-receivership-order-hector-network-defi-crypto-failure/","name":"offshorealert.com","type":"other","archive_url":"https://web.archive.org/web/20260829152521/https://www.offshorealert.com/hector-enterprise-inc-v-hector-dao-et-al-receivership-order-hector-network-defi-crypto-failure/","credibility":3,"archive_timestamp":"2026-08-29T15:25:21+00:00"},{"url":"https://news.bloomberglaw.com/us-law-week/how-hector-daos-bankruptcy-case-is-shaping-the-future-of-defi","name":"news.bloomberglaw.com","type":"other","archive_url":"http://web.archive.org/web/20260220115052/https://news.bloomberglaw.com/us-law-week/how-hector-daos-bankruptcy-case-is-shaping-the-future-of-defi","credibility":3,"archive_timestamp":"2026-02-20T11:50:52+00:00"},{"url":"https://globalrestructuringreview.com/article/hector-dao-secures-us-recognition-in-groundbreaking-ch15-ruling","name":"globalrestructuringreview.com","type":"other","archive_url":"https://web.archive.org/web/20260830042828/https://globalrestructuringreview.com/article/hector-dao-secures-us-recognition-in-groundbreaking-ch15-ruling","credibility":3,"archive_timestamp":"2026-08-30T04:28:28+00:00"},{"url":"https://cointelegraph.com/news/hector-dao-files-chapter-15-bankruptcy","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20260211152537/https://cointelegraph.com/news/hector-dao-files-chapter-15-bankruptcy","credibility":3,"archive_timestamp":"2026-02-11T15:25:37+00:00"},{"url":"https://brownrudnick.com/client_news/brown-rudnick-achieves-landmark-ruling-in-the-treatment-of-daos-in-bankruptcy/","name":"brownrudnick.com","type":"other","archive_url":"http://web.archive.org/web/20260220123209/https://brownrudnick.com/client_news/brown-rudnick-achieves-landmark-ruling-in-the-treatment-of-daos-in-bankruptcy/","credibility":3,"archive_timestamp":"2026-02-20T12:32:09+00:00"},{"url":"https://www.dlnews.com/articles/defi/hector-network-liquidation-stalled-over-new-us-lawsuit/","name":"dlnews.com","type":"other","archive_url":"http://web.archive.org/web/20260617124039/https://www.dlnews.com/articles/defi/hector-network-liquidation-stalled-over-new-us-lawsuit/","credibility":3,"archive_timestamp":"2026-06-17T12:40:39+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:41.87353+00:00","updated_at":"2026-08-30T05:14:11.068418+00:00"}}