{"investigation":{"slug":"ionic-protocol","entity_name":"Ionic Protocol","trust_score":18,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"Ionic Protocol (also known as Ionic Money) is a decentralized non-custodial lending and borrowing protocol deployed on the Mode Network (OP Superchain). It is a rebrand of Midas Capital, which suffered two separate exploits in 2023 totaling approximately $1.26 million. In February 2025, Ionic itself was exploited via a social engineering attack involving a counterfeit LBTC token, resulting in losses estimated between $8.6 million and $12.3 million; funds were partially laundered through Tornado Cash and have not been recovered.","sections":[{"content":"Ionic Protocol is a decentralized money market protocol on the Mode Network, an OP Superchain Layer 2. It enables users to lend and borrow crypto assets without custodians via smart contracts. The project describes itself as self-bootstrapped with no external funding and a community-driven governance model. The team does not publicly disclose founding members. Ionic launched alongside the Mode Network mainnet and is a direct rebrand of Midas Capital, which the same team operated from approximately 2021 before sunsetting it.","heading":"Overview","sources":[{"url":"https://medium.com/@ionicmoney/ionic-protocol-introduction-e6e0b748f538","name":"medium.com","type":"other","credibility":3},{"url":"https://doc.ionic.money/ionic-documentation/ionic-protocol/introduction","name":"doc.ionic.money","type":"other","credibility":3},{"url":"https://www.ionic.money/","name":"ionic.money","type":"other","credibility":3}],"severity":"medium"},{"content":"Ionic Protocol is a direct continuation and rebrand of Midas Capital. Midas Capital was exploited twice in 2023. The first exploit occurred on January 15, 2023, when an attacker exploited a read-only reentrancy vulnerability in the WMATIC-stMATIC Curve LP token used as collateral, manipulating virtual prices to borrow assets and exit with approximately $660,000 worth of MATIC, which was sent to centralized exchanges. The second exploit occurred on June 17, 2023, when an attacker on BNB Chain exploited a rounding error in the protocol's Compound V2-derived codebase, using flash loans and artificially inflated voucher values to drain approximately $600,000. Both vulnerabilities were known issues with documented workarounds at the time of exploitation. On-chain investigator ZachXBT publicly noted that when the Ionic project went live, it used Midas' old audit report from 2022 — predating both 2023 hacks — and directly confronted the team about this over direct messages. ZachXBT later stated publicly that 'Ionic is just Midas wearing a carnival mask.'","heading":"Rebrand from Midas Capital and Pattern of Exploits","sources":[{"url":"https://medium.com/midas-capital/midas-exploit-post-mortem-1ae266222994","name":"medium.com","type":"other","credibility":3},{"url":"https://immunebytes.com/blog/midas-capital-hack-june-17-2023-detailed-analysis/","name":"immunebytes.com","type":"other","credibility":3},{"url":"https://beincrypto.com/midas-capital-releases-660000-exploit-post-mortem-defi-attacks-carry-into-2023/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://beincrypto.com/midas-capital-pool-exploited/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://x.com/zachxbt/status/1886792512917864953","name":"x.com","type":"other","credibility":3},{"url":"https://www.bitget.com/news/detail/12560604547626","name":"bitget.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On or around February 4–8, 2025, Ionic Money suffered its most severe security incident. The attack was a two-stage social engineering and exploitation scheme. In the social engineering phase, the attacker impersonated members of the Lombard Finance team in business development communications with the Ionic team beginning as early as December 12, 2024. The attacker deployed a counterfeit LBTC smart contract (0x964dd444e3192f636322229080a576077b06fba3) on January 9, 2025. After several weeks of BD discussions, the Ionic team was deceived into approving the fraudulent token as legitimate collateral and set up a Balancer liquidity pool (funded with approximately $400,000) along with API3 oracle price feeds for the fake asset. In the exploitation phase, the attacker minted 250 fake LBTC tokens and deposited them as collateral, then borrowed legitimate protocol assets including MBTC, uniBTC, wrsETH, WETH, and STONE. The attacker's total expenditure was reportedly 0.01 ETH. Loss estimates vary by source: Rekt News cited approximately $6.9 million; Halborn and most secondary sources cited $8.6 million; the official post-mortem and CertiK placed the figure at $12.3 million in supply assets taken. After the exploit, the attacker bridged approximately 1,204 ETH (roughly $3.2 million) from Mode Network to Ethereum and laundered those funds through Tornado Cash. Additional stolen assets (MBTC and iBTC) were swapped and used to borrow from Ironclad and Layerbank on Move Protocol, where approximately $3.7 million remained in outstanding loans. Ionic's official post-mortem characterized the incident as 'not a code-based breach' and stated the protocol core remains secure. The team stated it was working with investigative partners, law enforcement, and affected parties to trace and hold perpetrators accountable, and appealed directly to the attacker for negotiation. No confirmed recovery or compensation has been reported.","heading":"February 2025 Exploit — Social Engineering via Fake LBTC Collateral","sources":[{"url":"https://rekt.news/ionic-money-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-ionic-money-hack-february-2025","name":"halborn.com","type":"other","credibility":3},{"url":"https://quadrigainitiative.com/casestudy/ionicmoneyfakelbtccollateralsocialengineering.php","name":"quadrigainitiative.com","type":"other","credibility":3},{"url":"https://www.chaincatcher.com/en/article/2165720","name":"chaincatcher.com","type":"other","credibility":3},{"url":"https://www.panewslab.com/en/articles/6d4lap4z","name":"panewslab.com","type":"other","credibility":3},{"url":"https://postmortem.s3.us-east-1.amazonaws.com/postmortem.pdf","name":"postmortem.s3.us-east-1.amazonaws.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On-chain investigator ZachXBT publicly flagged Ionic Protocol in connection with the February 2025 exploit. ZachXBT noted that the predecessor protocol Midas was exploited twice in 2023, and that prior to the 2025 incident he had directly confronted the Ionic team via direct messages about the security continuity risk of rebranding without addressing prior vulnerabilities. The team reportedly responded by stating that the Midas vulnerabilities were due to known issues in the Compound codebase that had since been fixed. ZachXBT's public post-exploit commentary described the rebrand as cosmetic rather than a genuine security overhaul. No regulatory charges against individuals have been identified in connection with ZachXBT's flagging.","heading":"ZachXBT Flags","sources":[{"url":"https://x.com/zachxbt/status/1886792512917864953","name":"x.com","type":"other","credibility":3},{"url":"https://www.bitget.com/news/detail/12560604547626","name":"bitget.com","type":"other","credibility":3},{"url":"https://followin.io/en/feed/16108999","name":"followin.io","type":"other","credibility":3}],"severity":"medium"},{"content":"The ION token reached an all-time high of approximately $0.0694 and has since declined more than 99.9% to trade well below $0.0001. Circulating supply is reported at approximately 301.58 million ION out of a total supply of 1 billion ION. Market capitalization is negligible relative to peak. Total value locked (TVL) on DeFiLlama stood at approximately $2 million as of post-exploit data, sharply lower than pre-exploit levels. The token is listed on CoinGecko and tracked on Coinbase and Gate.com price pages but has minimal trading volume.","heading":"Token and Market Status","sources":[{"url":"https://www.coingecko.com/en/coins/ionic-protocol","name":"coingecko.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/ionic-protocol","name":"defillama.com","type":"other","credibility":3},{"url":"https://www.gate.com/price/ionic-protocol-ion","name":"gate.com","type":"other","credibility":3},{"url":"https://www.coincarp.com/currencies/ionic-protocol/","name":"coincarp.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Several due diligence concerns have been identified. First, when Ionic launched it relied on a 2022 audit of the Midas codebase that predated two security incidents in 2023, meaning the audit did not reflect the exploited versions of the code. Second, the protocol's processes for vetting and listing collateral assets failed to identify a months-long social engineering campaign, despite the attacker having begun interactions in December 2024 with a counterfeit asset. Third, the protocol approved an oracle integration and a funded Balancer liquidity pool for an asset that had not been validated as legitimate. Fourth, the founding team's identities are not publicly disclosed, which limits accountability. These concerns were raised by ZachXBT and independently documented by security firms Halborn and Immunebytes.","heading":"Operational Due Diligence Concerns","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-ionic-money-hack-february-2025","name":"halborn.com","type":"other","credibility":3},{"url":"https://immunebytes.com/blog/midas-capital-hack-june-17-2023-detailed-analysis/","name":"immunebytes.com","type":"other","credibility":3},{"url":"https://x.com/zachxbt/status/1886792512917864953","name":"x.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the February 2025 exploit, the attacker (exploiter address 0x9E34d89C013Da3BF65fc02b59B6F27D710850430) used cross-chain bridges to move approximately 1,204 ETH from Mode Network to Ethereum. These funds were routed through Tornado Cash, which according to Halborn made it 'infeasible to identify the stolen assets once the attackers withdrew them.' Additional stolen tokens (MBTC and iBTC) were deployed to borrow further from Ironclad and Layerbank on the Move Protocol, where an estimated $3.7 million in loans remained outstanding. The use of Tornado Cash as a laundering vector is consistent with attacker intent to permanently obscure the stolen funds.","heading":"Fund Flow and Tornado Cash Laundering","sources":[{"url":"https://rekt.news/ionic-money-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-ionic-money-hack-february-2025","name":"halborn.com","type":"other","credibility":3},{"url":"https://quadrigainitiative.com/casestudy/ionicmoneyfakelbtccollateralsocialengineering.php","name":"quadrigainitiative.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021-11","event":"Midas Capital founded with a vision of multichain isolated-pool lending.","source":"","date_original":"2021-11-01"},{"date":"2023-01-15","event":"Midas Capital first exploit: approximately $660,000 drained via read-only reentrancy vulnerability in Curve LP collateral on Polygon.","source":"","source_url":"https://medium.com/midas-capital/midas-exploit-post-mortem-1ae266222994"},{"date":"2023-06-17","event":"Midas Capital second exploit: approximately $600,000 drained via rounding error in Compound V2-derived code on BNB Chain.","source":"","source_url":"https://immunebytes.com/blog/midas-capital-hack-june-17-2023-detailed-analysis/"},{"date":"2023","event":"Midas Capital sunsetted; team begins rebrand to Ionic Protocol on Mode Network.","source":"","date_original":"2023-01-01"},{"date":"2024-12-12","event":"Alleged attacker begins interacting with Ionic Protocol, impersonating Lombard Finance team in BD discussions.","source":"","source_url":"https://www.halborn.com/blog/post/explained-the-ionic-money-hack-february-2025"},{"date":"2025-01-09","event":"Attacker deploys counterfeit LBTC smart contract (0x964dd444e3192f636322229080a576077b06fba3).","source":"","source_url":"https://quadrigainitiative.com/casestudy/ionicmoneyfakelbtccollateralsocialengineering.php"},{"date":"2025-02-04","event":"Ionic Money exploit begins: attacker mints 250 fake LBTC, deposits as collateral, and borrows approximately $8.6–$12.3 million in real assets.","source":"","source_url":"https://rekt.news/ionic-money-rekt"},{"date":"2025-02-04","event":"Attacker bridges ~1,204 ETH ($3.2 million) from Mode Network to Ethereum and launders funds through Tornado Cash.","source":"","source_url":"https://www.halborn.com/blog/post/explained-the-ionic-money-hack-february-2025"},{"date":"2025-02-08","event":"Ionic team publishes official post-mortem; states the incident was not a code-based breach and pledges to work with law enforcement.","source":"","source_url":"https://postmortem.s3.us-east-1.amazonaws.com/postmortem.pdf"},{"date":"2025-02-04","event":"ZachXBT publicly flags the exploit and states 'Ionic is just Midas wearing a carnival mask,' referencing two prior 2023 hacks.","source":"","source_url":"https://x.com/zachxbt/status/1886792512917864953"}],"sources_used":[{"url":"https://medium.com/@ionicmoney/ionic-protocol-introduction-e6e0b748f538","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://doc.ionic.money/ionic-documentation/ionic-protocol/introduction","name":"doc.ionic.money","type":"other","archive_url":"http://web.archive.org/web/20260520063747/https://doc.ionic.money/ionic-documentation/ionic-protocol/introduction","credibility":3,"archive_timestamp":"2026-05-20T06:37:47+00:00"},{"url":"https://www.ionic.money/","name":"ionic.money","type":"other","archive_url":"http://web.archive.org/web/20250516042421/https://www.ionic.money/","credibility":3,"archive_timestamp":"2025-05-16T04:24:21+00:00"},{"url":"https://medium.com/midas-capital/midas-exploit-post-mortem-1ae266222994","name":"medium.com","type":"other","archive_url":"http://web.archive.org/web/20260610104509/https://medium.com/midas-capital/midas-exploit-post-mortem-1ae266222994","credibility":3,"archive_timestamp":"2026-06-10T10:45:09+00:00"},{"url":"https://immunebytes.com/blog/midas-capital-hack-june-17-2023-detailed-analysis/","name":"immunebytes.com","type":"other","archive_url":"http://web.archive.org/web/20251215232158/https://immunebytes.com/blog/midas-capital-hack-june-17-2023-detailed-analysis/","credibility":3,"archive_timestamp":"2025-12-15T23:21:58+00:00"},{"url":"https://beincrypto.com/midas-capital-releases-660000-exploit-post-mortem-defi-attacks-carry-into-2023/","name":"beincrypto.com","type":"other","archive_url":"http://web.archive.org/web/20260725134042/https://beincrypto.com/midas-capital-releases-660000-exploit-post-mortem-defi-attacks-carry-into-2023/","credibility":3,"archive_timestamp":"2026-07-25T13:40:42+00:00"},{"url":"https://beincrypto.com/midas-capital-pool-exploited/","name":"beincrypto.com","type":"other","archive_url":"http://web.archive.org/web/20260725134029/https://beincrypto.com/midas-capital-pool-exploited/","credibility":3,"archive_timestamp":"2026-07-25T13:40:29+00:00"},{"url":"https://x.com/zachxbt/status/1886792512917864953","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.bitget.com/news/detail/12560604547626","name":"bitget.com","type":"other","archive_url":"http://web.archive.org/web/20260725151704/https://www.bitget.com/news/detail/12560604547626","credibility":3,"archive_timestamp":"2026-07-25T15:17:04+00:00"},{"url":"https://rekt.news/ionic-money-rekt","name":"rekt.news","type":"other","archive_url":"http://web.archive.org/web/20260607083802/https://rekt.news/ionic-money-rekt","credibility":3,"archive_timestamp":"2026-06-07T08:38:02+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-ionic-money-hack-february-2025","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260609204953/https://www.halborn.com/blog/post/explained-the-ionic-money-hack-february-2025","credibility":3,"archive_timestamp":"2026-06-09T20:49:53+00:00"},{"url":"https://quadrigainitiative.com/casestudy/ionicmoneyfakelbtccollateralsocialengineering.php","name":"quadrigainitiative.com","type":"other","archive_url":"http://web.archive.org/web/20260511081717/https://quadrigainitiative.com/casestudy/ionicmoneyfakelbtccollateralsocialengineering.php","credibility":3,"archive_timestamp":"2026-05-11T08:17:17+00:00"},{"url":"https://www.chaincatcher.com/en/article/2165720","name":"chaincatcher.com","type":"other","archive_url":"http://web.archive.org/web/20260829045016/https://www.chaincatcher.com/en/article/2165720","credibility":3,"archive_timestamp":"2026-08-29T04:50:16+00:00"},{"url":"https://www.panewslab.com/en/articles/6d4lap4z","name":"panewslab.com","type":"other","archive_url":"http://web.archive.org/web/20251106030131/https://www.panewslab.com/en/articles/6d4lap4z","credibility":3,"archive_timestamp":"2025-11-06T03:01:31+00:00"},{"url":"https://postmortem.s3.us-east-1.amazonaws.com/postmortem.pdf","name":"postmortem.s3.us-east-1.amazonaws.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://followin.io/en/feed/16108999","name":"followin.io","type":"other","archive_url":null,"credibility":3,"archive_error":"error:unauthorized","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.coingecko.com/en/coins/ionic-protocol","name":"coingecko.com","type":"other","archive_url":"http://web.archive.org/web/20251013173518/https://www.coingecko.com/en/coins/ionic-protocol","credibility":3,"archive_timestamp":"2025-10-13T17:35:18+00:00"},{"url":"https://defillama.com/protocol/ionic-protocol","name":"defillama.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.gate.com/price/ionic-protocol-ion","name":"gate.com","type":"other","archive_url":"https://web.archive.org/web/20260829122314/https://www.gate.com/price/ionic-protocol-ion","credibility":3,"archive_timestamp":"2026-08-29T12:23:14+00:00"},{"url":"https://www.coincarp.com/currencies/ionic-protocol/","name":"coincarp.com","type":"other","archive_url":"https://web.archive.org/web/20260829121217/https://www.coincarp.com/currencies/ionic-protocol/","credibility":3,"archive_timestamp":"2026-08-29T12:12:17+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:25.740866+00:00","updated_at":"2026-09-12T10:51:24.16032+00:00"}}