{"investigation":{"slug":"jimbos-protocol","entity_name":"Jimbos Protocol","trust_score":18,"severity_base":null,"score_modifier":0,"confidence":0.88,"status":"published","content_type":"investigation","summary":"Jimbos Protocol was an Arbitrum-based DeFi liquidity protocol designed to provide a semi-stable floor price for its native JIMBO token. On May 28, 2023, just three days after launching its V2, the protocol was exploited via a flash loan attack that drained approximately 4,090 ETH (~$7.5 million) by exploiting a lack of slippage control in the JimboController contract. The attacker rejected a $800,000 bounty offer, laundered the full amount through Tornado Cash, and remains unidentified; no funds have been recovered.","sections":[{"content":"Jimbos Protocol is a decentralized finance (DeFi) application built on the Arbitrum blockchain. It was designed to address liquidity volatility through a concentrated liquidity mechanism that aimed to maintain a semi-stable floor price for its ERC-20 token, JIMBO, backed by a treasury of Ether (ETH). The protocol drew conceptual inspiration from Olympus DAO but marketed itself as a more sustainable model. Version 2 (V2) of the protocol was launched in late May 2023, roughly two weeks after the initial version. The protocol did not disclose a completed public security audit prior to launch.","heading":"Overview","sources":[{"url":"https://www.coindesk.com/tech/2023/05/29/arbitrum-based-jimbos-protocol-scurries-for-revival-after-7m-exploit","name":"Arbitrum Based Jimbos Protocol Scurries for Revival After $7M Exploit — CoinDesk","type":"news_article","credibility":2},{"url":"https://coinmarketcap.com/headlines/news/jimbos-protocol-exploited-for-7-5-million-three-days-after-v2-launch/","name":"Jimbos Protocol exploited for $7.5 million three days after V2 launch — CoinMarketCap","type":"news_article","credibility":2}],"severity":"medium"},{"content":"On May 28, 2023, an unidentified attacker exploited a critical logical flaw in the Jimbos Protocol smart contracts, draining approximately 4,090 ETH valued at roughly $7.5 million at the time. The vulnerability resided in the shift() function of the JimboController contract, which lacked adequate slippage controls on liquidity-shifting operations. The attacker borrowed approximately 10,000 ETH via a flash loan from AAVE, exchanged the borrowed ETH for JIMBO tokens to artificially inflate their price, then invoked the shift() function to force protocol-owned liquidity into the skewed, imbalanced price range. A reverse swap then extracted the ETH profit before repaying the flash loan. Stolen assets were bridged from Arbitrum to Ethereum mainnet via the Stargate bridge and Celer Network before laundering. The exploit occurred just three days after the V2 launch, which had not received a publicly disclosed security audit.","heading":"Flash Loan Exploit — May 2023","sources":[{"url":"https://www.theregister.com/2023/05/30/jimbos_protocol_defi_attack/","name":"Jimbos Protocol hit in $7.5m DeFi flash loan attack — The Register","type":"news_article","credibility":1},{"url":"https://www.halborn.com/blog/post/explained-the-jimbos-protocol-hack-may-2023","name":"Explained: The Jimbos Protocol Hack (May 2023) — Halborn","type":"research","credibility":2},{"url":"https://quillaudits.medium.com/decoding-jimbos-protocol-7-5m-exploit-quillaudits-772ad1db6c07","name":"Decoding Jimbo's Protocol $7.5M Exploit — QuillAudits","type":"research","credibility":2},{"url":"https://medium.com/numen-cyber-labs/a-detailed-analysis-of-arbitrum-based-jimbos-protocol-7-5-million-hack-36af84faee2","name":"A Detailed Analysis of Arbitrum-based Jimbos Protocol's $7.5M Hack — Numen Cyber Labs","type":"research","credibility":2},{"url":"https://cryptonews.com/news/jimbos-protocol-hacked-for-over-75-million-using-flash-loan-exploit/","name":"Jimbos Protocol hacked for over $7.5 million using flash loan exploit — CryptoNews","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Following the exploit, the attacker transferred the stolen ETH from Arbitrum to Ethereum mainnet using cross-chain bridges including Stargate and Celer Network. Blockchain analytics firm PeckShield subsequently reported that the full $7.5 million was laundered through Tornado Cash, a sanctioned cryptocurrency mixer. The attacker declined the Jimbos Protocol team's white hat bounty offer and the public $800,000 reward, instead opting to launder the entirety of the stolen funds. As of available records through 2024, no portion of the stolen assets has been recovered.","heading":"Funds Laundering via Tornado Cash","sources":[{"url":"https://coinpaper.com/2274/jimbos-protocol-s-attacker-launders-7-5-million-with-tornado-cash","name":"Jimbos Protocol's attacker washed loot with Tornado Cash — CoinPaper","type":"news_article","credibility":2},{"url":"https://coinmarketcap.com/community/articles/64fef90cc67b5c6867be4b78/","name":"Jimbos Protocol attacker launders $7.5 million with Tornado Cash — CoinMarketCap Community","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Within hours of the exploit, the Jimbos Protocol development team published an on-chain message and social media posts offering the exploiter a white hat arrangement: return 90% of funds and keep the remaining 10% (~$800,000) as a bounty, with the offer to be rescinded upon arrest. The team set a 24-hour deadline. When the attacker failed to respond, the team escalated by offering the $800,000 bounty publicly to any third party who could identify the attacker or facilitate return of the funds. The team stated they had opened a case with the New York branch of the U.S. Department of Homeland Security and subsequently expanded their engagement to additional law enforcement jurisdictions. Blockchain analyst Ogle publicly assisted with the recovery effort. Despite these measures, no identification of the attacker or recovery of funds was achieved.","heading":"Bounty Offer and Law Enforcement Engagement","sources":[{"url":"https://www.coindesk.com/tech/2023/05/31/jimbos-protocol-to-work-with-us-homeland-security-to-help-recover-75m-from-flash-loan-exploit","name":"Jimbos Protocol to Work With U.S. Homeland Security to Help Recover $7.5M — CoinDesk","type":"news_article","credibility":1},{"url":"https://beincrypto.com/jimbos-protocol-announced-800k-reward/","name":"Jimbos Protocol Announces $800K Reward to Catch Exploiter — BeInCrypto","type":"news_article","credibility":2},{"url":"https://cryptopotato.com/hacked-liquidity-protocol-jimbos-offers-deadline-to-exploiters-before-onboarding-law-enforcement/","name":"Jimbos Protocol Offers Deadline to Exploiters Before Onboarding Law Enforcement — CryptoPotato","type":"news_article","credibility":2},{"url":"https://cointelegraph.com/news/jimbos-protocol-offers-open-bounty-after-hacker-ignores-deal","name":"Jimbos Protocol offers $800K bounty to the public after hacker ignores deal — CoinTelegraph","type":"news_article","credibility":2}],"severity":"high"},{"content":"Multiple post-incident security analyses identified the root cause of the exploit as a logical flaw rather than a code-level bug: the shift() function in the JimboController contract allowed arbitrary price-range investment of protocol-owned liquidity without enforcing slippage limits. This permitted the attacker to force the protocol to invest into a highly imbalanced price range, which was then arbitraged for profit. Security researchers at Halborn, QuillAudits, Numen Cyber Labs, BlockApex, and Olympix all independently confirmed this vulnerability class. The exploit occurred just three days after the V2 launch, suggesting insufficient time was allocated for security review before redeployment. No public audit report for V2 has been cited in available sources.","heading":"Smart Contract Security and Design Risks","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-jimbos-protocol-hack-may-2023","name":"Explained: The Jimbos Protocol Hack (May 2023) — Halborn Security","type":"research","credibility":2},{"url":"https://blockapex.io/jimbos-protocol/","name":"Jimbo's Protocol Hack Analysis — BlockApex","type":"research","credibility":2},{"url":"https://www.auditone.io/blog-posts/the-7-5-million-flash-loan-unveiled-analyzing-jimbos-protocol-attack","name":"The $7.5 Million Flash Loan Unveiled: Analyzing Jimbo's Protocol Attack — AuditOne","type":"research","credibility":2},{"url":"https://olympix.security/blog/jimbos-7-5m-exploit-analyzed","name":"Jimbos' $7.5M Exploit Analyzed — Olympix","type":"research","credibility":2}],"severity":"high"},{"content":"Immediately following the exploit on May 28, 2023, the JIMBO token price declined approximately 40% as market participants responded to the loss of treasury funds. The protocol's treasury, which backed the JIMBO floor price, was substantially drained. The JIMBO token contract on Arbitrum One is recorded at address 0xCcb97Ae0C1bc4cE196B6460395Af7DF5eE1212BC. Available public records do not indicate a successful protocol revival or relaunch following the exploit. The project appears to be inactive as of available 2024 records.","heading":"Token Impact and Protocol Status","sources":[{"url":"https://www.bitcoininsider.org/article/215830/arbitrum-based-jimbos-protocol-hacked-75m-jimbo-price-drops-40","name":"Arbitrum-based Jimbos Protocol hacked for $7.5M, JIMBO price drops 40% — Bitcoin Insider","type":"news_article","credibility":2},{"url":"https://arbiscan.io/token/0xccb97ae0c1bc4ce196b6460395af7df5ee1212bc","name":"JIMBO Token Tracker — Arbiscan","type":"on_chain","credibility":1},{"url":"https://www.web3isgoinggreat.com/?id=jimbos-protocol-exploited","name":"Jimbos Protocol exploited — Web3 Is Going Great","type":"community_report","credibility":2}],"severity":"high"}],"timeline":[{"date":"2023-05","event":"Jimbos Protocol launches initial version on Arbitrum","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2023/05/29/arbitrum-based-jimbos-protocol-scurries-for-revival-after-7m-exploit","date_original":"2023-05-01"},{"date":"2023-05-25","event":"Jimbos Protocol V2 launches on Arbitrum","source":"The Block","source_url":"https://www.theblock.co/post/232419/jimbos-protocol-exploited-for-7-5-million-three-days-after-v2-launch"},{"date":"2023-05-28","event":"Attacker exploits lack of slippage control in JimboController shift() function via flash loan, draining 4,090 ETH (~$7.5M). JIMBO token drops ~40%.","source":"The Register","source_url":"https://www.theregister.com/2023/05/30/jimbos_protocol_defi_attack/"},{"date":"2023-05-28","event":"Stolen ETH bridged from Arbitrum to Ethereum mainnet via Stargate and Celer Network","source":"Halborn Security","source_url":"https://www.halborn.com/blog/post/explained-the-jimbos-protocol-hack-may-2023"},{"date":"2023-05-28","event":"Jimbos Protocol team sends on-chain message to attacker offering to let them keep 10% if 90% is returned","source":"CryptoPotato","source_url":"https://cryptopotato.com/hacked-liquidity-protocol-jimbos-offers-deadline-to-exploiters-before-onboarding-law-enforcement/"},{"date":"2023-05-31","event":"Jimbos Protocol opens case with U.S. Department of Homeland Security (New York branch) and additional jurisdictions","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2023/05/31/jimbos-protocol-to-work-with-us-homeland-security-to-help-recover-75m-from-flash-loan-exploit"},{"date":"2023-06","event":"Jimbos Protocol announces $800,000 public bounty for information identifying the exploiter after hacker ignores private deal","source":"CoinTelegraph","source_url":"https://cointelegraph.com/news/jimbos-protocol-offers-open-bounty-after-hacker-ignores-deal","date_original":"2023-06-01"},{"date":"2023-09","event":"PeckShield reports that all $7.5M in stolen funds has been laundered through Tornado Cash; attacker remains unidentified","source":"CoinPaper","source_url":"https://coinpaper.com/2274/jimbos-protocol-s-attacker-launders-7-5-million-with-tornado-cash","date_original":"2023-09-01"}],"sources_used":[{"url":"https://www.coindesk.com/tech/2023/05/29/arbitrum-based-jimbos-protocol-scurries-for-revival-after-7m-exploit","name":"Arbitrum Based Jimbos Protocol Scurries for Revival After $7M Exploit — CoinDesk","type":"news_article","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://coinmarketcap.com/headlines/news/jimbos-protocol-exploited-for-7-5-million-three-days-after-v2-launch/","name":"Jimbos Protocol exploited for $7.5 million three days after V2 launch — CoinMarketCap","type":"news_article","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://www.theregister.com/2023/05/30/jimbos_protocol_defi_attack/","name":"Jimbos Protocol hit in $7.5m DeFi flash loan attack — The Register","type":"news_article","archive_url":"http://web.archive.org/web/20260313204910/https://www.theregister.com/2023/05/30/jimbos_protocol_defi_attack/","credibility":1,"archive_timestamp":"2026-03-13T20:49:10+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-jimbos-protocol-hack-may-2023","name":"Explained: The Jimbos Protocol Hack (May 2023) — Halborn","type":"research","archive_url":"http://web.archive.org/web/20260516231048/https://www.halborn.com/blog/post/explained-the-jimbos-protocol-hack-may-2023","credibility":2,"archive_timestamp":"2026-05-16T23:10:48+00:00"},{"url":"https://quillaudits.medium.com/decoding-jimbos-protocol-7-5m-exploit-quillaudits-772ad1db6c07","name":"Decoding Jimbo's Protocol $7.5M Exploit — QuillAudits","type":"research","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://medium.com/numen-cyber-labs/a-detailed-analysis-of-arbitrum-based-jimbos-protocol-7-5-million-hack-36af84faee2","name":"A Detailed Analysis of Arbitrum-based Jimbos Protocol's $7.5M Hack — Numen Cyber Labs","type":"research","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://cryptonews.com/news/jimbos-protocol-hacked-for-over-75-million-using-flash-loan-exploit/","name":"Jimbos Protocol hacked for over $7.5 million using flash loan exploit — CryptoNews","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://coinpaper.com/2274/jimbos-protocol-s-attacker-launders-7-5-million-with-tornado-cash","name":"Jimbos Protocol's attacker washed loot with Tornado Cash — CoinPaper","type":"news_article","archive_url":"http://web.archive.org/web/20260121181731/https://coinpaper.com/2274/jimbos-protocol-s-attacker-launders-7-5-million-with-tornado-cash","credibility":2,"archive_timestamp":"2026-01-21T18:17:31+00:00"},{"url":"https://coinmarketcap.com/community/articles/64fef90cc67b5c6867be4b78/","name":"Jimbos Protocol attacker launders $7.5 million with Tornado Cash — CoinMarketCap Community","type":"news_article","archive_url":"https://web.archive.org/web/20260829125703/https://coinmarketcap.com/community/articles/64fef90cc67b5c6867be4b78/","credibility":2,"archive_timestamp":"2026-08-29T12:57:03+00:00"},{"url":"https://www.coindesk.com/tech/2023/05/31/jimbos-protocol-to-work-with-us-homeland-security-to-help-recover-75m-from-flash-loan-exploit","name":"Jimbos Protocol to Work With U.S. Homeland Security to Help Recover $7.5M — CoinDesk","type":"news_article","archive_url":null,"credibility":1,"archive_timestamp":null},{"url":"https://beincrypto.com/jimbos-protocol-announced-800k-reward/","name":"Jimbos Protocol Announces $800K Reward to Catch Exploiter — BeInCrypto","type":"news_article","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://cryptopotato.com/hacked-liquidity-protocol-jimbos-offers-deadline-to-exploiters-before-onboarding-law-enforcement/","name":"Jimbos Protocol Offers Deadline to Exploiters Before Onboarding Law Enforcement — CryptoPotato","type":"news_article","archive_url":"https://web.archive.org/web/20260829131827/https://cryptopotato.com/hacked-liquidity-protocol-jimbos-offers-deadline-to-exploiters-before-onboarding-law-enforcement/","credibility":2,"archive_timestamp":"2026-08-29T13:18:27+00:00"},{"url":"https://cointelegraph.com/news/jimbos-protocol-offers-open-bounty-after-hacker-ignores-deal","name":"Jimbos Protocol offers $800K bounty to the public after hacker ignores deal — CoinTelegraph","type":"news_article","archive_url":"http://web.archive.org/web/20260415005040/https://cointelegraph.com/news/jimbos-protocol-offers-open-bounty-after-hacker-ignores-deal","credibility":2,"archive_timestamp":"2026-04-15T00:50:40+00:00"},{"url":"https://blockapex.io/jimbos-protocol/","name":"Jimbo's Protocol Hack Analysis — BlockApex","type":"research","archive_url":"http://web.archive.org/web/20260414001210/https://blockapex.io/jimbos-protocol/","credibility":2,"archive_timestamp":"2026-04-14T00:12:10+00:00"},{"url":"https://www.auditone.io/blog-posts/the-7-5-million-flash-loan-unveiled-analyzing-jimbos-protocol-attack","name":"The $7.5 Million Flash Loan Unveiled: Analyzing Jimbo's Protocol Attack — AuditOne","type":"research","archive_url":"http://web.archive.org/web/20260414054748/https://www.auditone.io/blog-posts/the-7-5-million-flash-loan-unveiled-analyzing-jimbos-protocol-attack","credibility":2,"archive_timestamp":"2026-04-14T05:47:48+00:00"},{"url":"https://olympix.security/blog/jimbos-7-5m-exploit-analyzed","name":"Jimbos' $7.5M Exploit Analyzed — Olympix","type":"research","archive_url":"http://web.archive.org/web/20260206182905/https://olympix.security/blog/jimbos-7-5m-exploit-analyzed","credibility":2,"archive_timestamp":"2026-02-06T18:29:05+00:00"},{"url":"https://www.bitcoininsider.org/article/215830/arbitrum-based-jimbos-protocol-hacked-75m-jimbo-price-drops-40","name":"Arbitrum-based Jimbos Protocol hacked for $7.5M, JIMBO price drops 40% — Bitcoin Insider","type":"news_article","archive_url":"https://web.archive.org/web/20260830044818/https://www.bitcoininsider.org/article/215830/arbitrum-based-jimbos-protocol-hacked-75m-jimbo-price-drops-40","credibility":2,"archive_timestamp":"2026-08-30T04:48:18+00:00"},{"url":"https://arbiscan.io/token/0xccb97ae0c1bc4ce196b6460395af7df5ee1212bc","name":"JIMBO Token Tracker — Arbiscan","type":"on_chain","archive_url":"https://web.archive.org/web/20260829123909/https://arbiscan.io/token/0xccb97ae0c1bc4ce196b6460395af7df5ee1212bc#transactions","credibility":1,"archive_timestamp":"2026-08-29T12:39:09+00:00"},{"url":"https://www.web3isgoinggreat.com/?id=jimbos-protocol-exploited","name":"Jimbos Protocol exploited — Web3 Is Going Great","type":"community_report","archive_url":"http://web.archive.org/web/20260412094540/https://www.web3isgoinggreat.com/?id=jimbos-protocol-exploited","credibility":2,"archive_timestamp":"2026-04-12T09:45:40+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:41.987591+00:00","updated_at":"2026-08-30T05:14:11.146844+00:00"}}