{"investigation":{"slug":"judao","entity_name":"JUDAO","trust_score":18,"severity_base":null,"score_modifier":0,"confidence":0.52,"status":"published","content_type":"investigation","summary":"JUDAO is a deflationary BEP-20 token deployed on BNB Smart Chain and trading primarily on PancakeSwap, with a self-described 'T3 JUDAO' iteration launched in January 2026 and a separate 'JUDAO 3.0' variant announced as part of the JuCoin ecosystem via NordCore Labs. On April 28, 2026, the token's liquidity pool was drained of approximately $228,000 through a flash loan exploit that exploited a double-reserve-sync vulnerability in its custom transfer logic. The project's parent exchange JuCoin was independently flagged by on-chain investigator ZachXBT as 'sketchy' in March 2025, and JUDAO 3.0 has no verifiable audit, no identified founding team, and no smart contract security review on record.","sections":[{"content":"JUDAO is a deflationary BEP-20 token operating on BNB Smart Chain (BSC). Multiple iterations of the token have been identified. The version tracked by DEXTools (contract: 0xf55DFF7898930a2D28cDbC39D615b1624ac86888) is labeled 'T3 JUDAO' and was deployed approximately January 15–16, 2026 according to Coinranking data, with a circulating supply of 330 million JUDAO and an all-time high of $0.00170 recorded on January 16, 2026. A separate liquidity pair (vulnerable contract: 0x5D7b61e91cB59E90f7fAE8d0FE2e73976161592F) was the target of the April 2026 exploit. A third variant, 'JUDAO 3.0,' was announced by JuCoin's official account on X as a 'decentralized autonomous protocol built on Polygon and AI tech,' with the collaboration initiated by NordCore Labs focusing on DAO node operations. No official project website, whitepaper, or publicly identified founding team has been located by this investigation for any of these iterations. The BSCScan deployer address for T3 JUDAO is 0xF254d25E1871e43bf2c8f76ae628cd4440Dc5576 and the source code is verified as Solidity v0.8.30 under an MIT license.","heading":"Project Overview and Token Versions","sources":[{"url":"https://www.dextools.io/app/bsc/pair-explorer/0x5d7b61e91cb59e90f7fae8d0fe2e73976161592f","name":"T3 JUDAO pair explorer — DEXTools","type":"other","credibility":2},{"url":"https://coinranking.com/coin/MyG95gTX0vaR+t3judao-judao","name":"T3 JUDAO price and supply — Coinranking","type":"other","credibility":2},{"url":"https://x.com/Jucoinex/status/1948741315409444926","name":"JuCoin announces JUDAO 3.0 ecosystem partnership — X (@Jucoinex)","type":"social_media","credibility":3},{"url":"https://www.geckoterminal.com/bsc/pools/0x628d9a4f8ed53b6e7725ee4647ece36ba44bdc20","name":"JUDAO/USDT pool on PancakeSwap V3 (BSC) — GeckoTerminal","type":"on_chain","credibility":2}],"severity":"medium"},{"content":"On April 28, 2026, the JUDAO liquidity pool on BNB Smart Chain was exploited via a flash loan attack, resulting in losses of approximately $205,259 USDT plus 36 BNB (total approximately $227,600–$228,000 at time of incident). Security monitoring firm ExVulSec issued the first public exploit alert on X, and blockchain security firm Verichains published a detailed post-mortem. The attacker (wallet: 0x5384B34C74024d6563B323351a4bBFA18432161B) deployed a malicious contract (0x3B9bc53Af5012b12B6886a665Bb22382211aE432) and flash-loaned 2,295,723 USDT from Lista DAO's Moolah protocol to purchase approximately 5.5 million JUDAO tokens against the PancakeSwap V2 BUSD-JUDAO pool. The exploit transaction hash is 0x956e38b8ddb40ba080c8042c685ae52ee5c1b096f1d7f0c4a6c59be3eb4265bd. According to Verichains, the root cause was that JUDAO's custom _update() function triggered reserve synchronization (sync()) twice before a second swap completed, artificially depressing the _reserve1 value and inflating the token's apparent price. This allowed the attacker to sell JUDAO back for substantially more USDT than was spent to acquire it. MEXC News independently reported the TVL of the JUDAO pool at the time of the attack at $22.3 million, suggesting significant investor capital was at risk.","heading":"April 2026 Flash Loan Exploit","sources":[{"url":"https://blog.verichains.io/p/judao-hack-analysic","name":"JUDAO Hack Analysis — Verichains (LCD)","type":"research","credibility":2},{"url":"https://x.com/exvulsec/status/2048947737568432328","name":"ExVulSec exploit alert on X — @exvulsec","type":"social_media","credibility":2},{"url":"https://www.mexc.com/news/1060124","name":"Wrong Fee Tier Set in January, $413K Gone by April (JUDAO section) — MEXC News","type":"news_article","credibility":2},{"url":"https://www.livebitcoinnews.com/wrong-fee-tier-set-in-january-413k-gone-by-april/","name":"Wrong Fee Tier Set in January, $413K Gone by April — Live Bitcoin News","type":"news_article","credibility":2}],"severity":"medium"},{"content":"The vulnerability exploited in the April 2026 attack was not a generic flash loan issue but a specific design flaw in JUDAO's customized _update() transfer function. The contract implements two tokenomics mechanisms that fire simultaneously on every sell: an 'isBurnPair' check that burns or redistributes JUDAO from the liquidity pair's reserves when price has not risen more than 5% from the prior day, and a sync() mining mechanism that drains approximately 2% of the pair's JUDAO reserves to a dead address on each sell transaction. Because both mechanisms call sync() to update pool reserves, the pool's reserve balances were updated twice before the attacker's second swap, creating a window in which reserve accounting was incorrect and price was temporarily inflated. No security audit has been submitted or verified for the JUDAO token on BSCScan; the BSCScan page for the contract shows 'No Contract Security Audit Submitted.' Verichains concludes that projects deploying custom token mechanics require comprehensive smart contract audits prior to launch to prevent edge-case reserve manipulation of this type. The absence of any publicly disclosed pre-launch audit for a token with an alleged TVL of $22.3 million represents a significant risk management failure.","heading":"Smart Contract Vulnerability and Absence of Audit","sources":[{"url":"https://blog.verichains.io/p/judao-hack-analysic","name":"JUDAO Hack Analysis — Verichains (LCD)","type":"research","credibility":2},{"url":"https://bscscan.com/address/0xf55DFF7898930a2D28cDbC39D615b1624ac86888","name":"JUDAO token contract on BSCScan (no audit submitted)","type":"on_chain","credibility":1}],"severity":"medium"},{"content":"On-chain investigator ZachXBT flagged JuCoin (the exchange that announced JUDAO 3.0 as part of its ecosystem) as 'sketchy' in March 2025, specifically in the context of JuCoin's role as a platinum sponsor of the Token2049 conference. ZachXBT stated that JuCoin, Bitunix, and WEEX all failed his verification test of whether the team is public and has a prior work history in the space. JuCoin, formerly known as Jubi, has a documented history of ownership changes and regulatory pivots; it is not licensed in the United States or European Union, and has only claimed a VASP license application in Taiwan and an exemption from Singapore's Monetary Authority. Separately, investigators have flagged JuCoin's historical ties to collapsed project JPEX as a reputational risk. ZachXBT's flag applies directly to JuCoin rather than to the JUDAO token itself; however, JuCoin's official X account announced JUDAO 3.0 as an official part of the JuCoin ecosystem, making the exchange's credibility directly relevant to the token's risk profile. No direct ZachXBT post specifically naming the JUDAO token has been located by this investigation; the ZachXBT connection is indirect, via the JuCoin ecosystem relationship.","heading":"ZachXBT Flag: JuCoin Ecosystem Connection","sources":[{"url":"https://www.mitrade.com/insights/news/live-news/article-3-724219-20250328","name":"ZachXBT raises red flags about Token2049 sponsors (JuCoin flagged as 'sketchy') — Mitrade","type":"news_article","credibility":2},{"url":"https://www.cryptopolitan.com/zachxbt-red-flags-token2049-sponsors/","name":"ZachXBT raises red flags about Token2049 sponsors — Cryptopolitan","type":"news_article","credibility":2},{"url":"https://cryptorank.io/news/feed/b4990-zachxbt-red-flags-token2049-sponsors","name":"ZachXBT raises red flags about Token2049 sponsors — CryptoRank","type":"news_article","credibility":2},{"url":"https://x.com/Jucoinex/status/1948741315409444926","name":"JuCoin announces JUDAO 3.0 partnership — X (@Jucoinex)","type":"social_media","credibility":3}],"severity":"medium"},{"content":"JuCoin, formerly known as Jubi, is a crypto exchange with a documented history of rebranding and regulatory ambiguity. The exchange's native token, JU, collapsed approximately 75% within hours in September 2025, falling from near $24 to $6 amid market panic and governance opacity. JuCoin provided vague explanations citing 'external liquidity factors' without addressing concerns about token issuance or treasury management. The South Korean Financial Intelligence Unit (FIU) is alleged to have investigated JuCoin's historical ties to the collapsed JPEX project. JuCoin is not licensed or regulated in the United States, the European Union, or other major markets with stringent oversight standards, though it has claimed a VASP license application in Taiwan. JuCoin's announcement of JUDAO 3.0 as a partner project, described as a 'decentralized autonomous protocol' with 'no app, no backend, and no custodian,' raises concerns about accountability and recourse for users who engage with the protocol through the exchange's ecosystem.","heading":"JuCoin Background and Regulatory Concerns","sources":[{"url":"https://www.ainvest.com/news/jucoin-token-crash-case-study-defi-systemic-risk-future-capital-allocation-2509/","name":"JuCoin Token Crash: Case Study in DeFi Systemic Risk — AiInvest","type":"news_article","credibility":2},{"url":"https://www.ainvest.com/news/jucoin-ju-token-sustained-web3-winner-regulatory-driven-frenzy-2508/","name":"Is JuCoin's JU Token a Sustained Web3 Winner? — AiInvest","type":"news_article","credibility":2},{"url":"https://www.mitrade.com/insights/news/live-news/article-3-724219-20250328","name":"ZachXBT raises red flags about Token2049 sponsors — Mitrade","type":"news_article","credibility":2}],"severity":"medium"},{"content":"Multiple on-chain risk indicators are associated with the JUDAO token. The project launched with no publicly disclosed smart contract audit, despite implementing complex custom tokenomics logic in its transfer function. At the time of the April 2026 exploit, the token had an alleged TVL of $22.3 million and was not listed on CoinGecko, suggesting it operated primarily in the long tail of BSC DeFi without mainstream transparency standards. The post-exploit token price according to DEXTools was approximately $0.176, while the all-time high was $0.00170 (January 16, 2026 per Coinranking) — a discrepancy that suggests either data inconsistency between tracking platforms or price manipulation at various points in the token's history. Multiple contract addresses have been associated with the JUDAO name across tracking platforms (0xf55DFF7898930a2D28cDbC39D615b1624ac86888 and 0xbde84e3dd4e48a056e9546a100e8ff605109a888 per Coinranking), raising the possibility of token migration or multiple incompatible deployments that could confuse investors. The deployer address (0xF254d25E1871e43bf2c8f76ae628cd4440Dc5576) has no public identity attribution.","heading":"On-Chain Risk Indicators","sources":[{"url":"https://www.dextools.io/app/bsc/pair-explorer/0x5d7b61e91cb59e90f7fae8d0fe2e73976161592f","name":"JUDAO token pair — DEXTools (price data)","type":"on_chain","credibility":2},{"url":"https://coinranking.com/coin/MyG95gTX0vaR+t3judao-judao","name":"T3 JUDAO price history — Coinranking","type":"on_chain","credibility":2},{"url":"https://blog.verichains.io/p/judao-hack-analysic","name":"JUDAO Hack Analysis — Verichains","type":"research","credibility":2},{"url":"https://bscscan.com/address/0xf55DFF7898930a2D28cDbC39D615b1624ac86888","name":"JUDAO contract on BSCScan","type":"on_chain","credibility":1}],"severity":"medium"}],"timeline":[{"date":"2025-03-28","event":"ZachXBT flags JuCoin as 'sketchy' in a public warning about Token2049 platinum sponsors, citing ownership changes, regulatory pivots, and lack of team transparency. JuCoin subsequently announced JUDAO 3.0 as part of its ecosystem.","source":"Mitrade / ZachXBT on X","source_url":"https://www.mitrade.com/insights/news/live-news/article-3-724219-20250328"},{"date":"2025-09-17","event":"JuCoin's native JU token collapses approximately 75% within hours, falling from ~$24 to ~$6. JuCoin cites 'external liquidity factors' without providing substantive transparency.","source":"AiInvest","source_url":"https://www.ainvest.com/news/jucoin-token-crash-case-study-defi-systemic-risk-future-capital-allocation-2509/"},{"date":"2026-01-15","event":"T3 JUDAO (contract: 0xf55DFF7898930a2D28cDbC39D615b1624ac86888) deploys on BNB Smart Chain. The token reaches its all-time high of $0.00170 the following day.","source":"Coinranking","source_url":"https://coinranking.com/coin/MyG95gTX0vaR+t3judao-judao"},{"date":"2026-04-28","event":"Flash loan exploit drains the JUDAO liquidity pool. Attacker (0x5384B34C74024d6563B323351a4bBFA18432161B) flash-loans 2,295,723 USDT from Lista DAO: Moolah, exploits a double-sync vulnerability in JUDAO's _update() function, and extracts approximately $205,259 USDT plus 36 BNB (~$227,600 total). ExVulSec issues the first public alert on X.","source":"ExVulSec on X / Verichains","source_url":"https://blog.verichains.io/p/judao-hack-analysic"},{"date":"2026-04-28","event":"Verichains security firm publishes a technical post-mortem identifying the root cause as incorrect reserve accounting from a double sync() call in JUDAO's transfer function.","source":"Verichains","source_url":"https://blog.verichains.io/p/judao-hack-analysic"},{"date":"2026-04-28","event":"MEXC News reports on the JUDAO exploit, noting the pool had an alleged TVL of $22.3 million at the time of the attack.","source":"MEXC News","source_url":"https://www.mexc.com/news/1060124"}],"sources_used":[{"url":"https://blog.verichains.io/p/judao-hack-analysic","name":"JUDAO Hack Analysis — Verichains (LCD)","type":"research","archive_url":"http://web.archive.org/web/20260724165644/https://blog.verichains.io/p/judao-hack-analysic","credibility":2,"archive_timestamp":"2026-07-24T16:56:44+00:00"},{"url":"https://x.com/exvulsec/status/2048947737568432328","name":"ExVulSec exploit alert — X (@exvulsec)","type":"social_media","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://www.mexc.com/news/1060124","name":"Wrong Fee Tier Set in January, $413K Gone by April — MEXC News","type":"news_article","archive_url":"https://web.archive.org/web/20260724170014/https://www.mexc.com/news/1060124","credibility":2,"archive_timestamp":"2026-07-24T17:00:14+00:00"},{"url":"https://www.livebitcoinnews.com/wrong-fee-tier-set-in-january-413k-gone-by-april/","name":"Wrong Fee Tier Set in January, $413K Gone by April — Live Bitcoin News","type":"news_article","archive_url":"https://web.archive.org/web/20260724160636/https://www.livebitcoinnews.com/wrong-fee-tier-set-in-january-413k-gone-by-april/","credibility":2,"archive_timestamp":"2026-07-24T16:06:36+00:00"},{"url":"https://www.dextools.io/app/bsc/pair-explorer/0x5d7b61e91cb59e90f7fae8d0fe2e73976161592f","name":"T3 JUDAO pair explorer — DEXTools","type":"other","archive_url":"https://web.archive.org/web/20260724160516/https://www.dextools.io/app/bsc/pair-explorer/0x5d7b61e91cb59e90f7fae8d0fe2e73976161592f","credibility":2,"archive_timestamp":"2026-07-24T16:05:16+00:00"},{"url":"https://www.geckoterminal.com/bsc/pools/0x628d9a4f8ed53b6e7725ee4647ece36ba44bdc20","name":"JUDAO/USDT pool — GeckoTerminal","type":"on_chain","archive_url":"https://web.archive.org/web/20260724165907/https://www.geckoterminal.com/bsc/pools/0x628d9a4f8ed53b6e7725ee4647ece36ba44bdc20","credibility":2,"archive_timestamp":"2026-07-24T16:59:07+00:00"},{"url":"https://coinranking.com/coin/MyG95gTX0vaR+t3judao-judao","name":"T3 JUDAO price and supply — Coinranking","type":"other","archive_url":"http://web.archive.org/web/20260602170319/https://coinranking.com/coin/MyG95gTX0vaR+t3judao-judao","credibility":2,"archive_timestamp":"2026-06-02T17:03:19+00:00"},{"url":"https://bscscan.com/address/0xf55DFF7898930a2D28cDbC39D615b1624ac86888","name":"JUDAO token contract — BSCScan","type":"on_chain","archive_url":"https://web.archive.org/web/20260724160420/https://bscscan.com/address/0xf55DFF7898930a2D28cDbC39D615b1624ac86888","credibility":1,"archive_timestamp":"2026-07-24T16:04:20+00:00"},{"url":"https://www.mitrade.com/insights/news/live-news/article-3-724219-20250328","name":"ZachXBT raises red flags about Token2049 sponsors — Mitrade","type":"news_article","archive_url":"https://web.archive.org/web/20260724160542/https://www.mitrade.com/insights/news/live-news/article-3-724219-20250328","credibility":2,"archive_timestamp":"2026-07-24T16:05:42+00:00"},{"url":"https://www.cryptopolitan.com/zachxbt-red-flags-token2049-sponsors/","name":"ZachXBT raises red flags about Token2049 sponsors — Cryptopolitan","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://x.com/Jucoinex/status/1948741315409444926","name":"JuCoin announces JUDAO 3.0 ecosystem partnership — X (@Jucoinex)","type":"social_media","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.ainvest.com/news/jucoin-token-crash-case-study-defi-systemic-risk-future-capital-allocation-2509/","name":"JuCoin Token Crash Case Study — AiInvest","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.ainvest.com/news/jucoin-ju-token-sustained-web3-winner-regulatory-driven-frenzy-2508/","name":"Is JuCoin's JU Token a Sustained Web3 Winner? — AiInvest","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://x.com/JUDAOGlobal","name":"JUDAO 3.0 project X account (@JUDAOGlobal)","type":"social_media","archive_url":null,"credibility":3,"archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-5","created_at":"2026-05-04T01:51:10.155381+00:00","updated_at":"2026-08-29T01:32:47.49+00:00"}}