{"investigation":{"slug":"kannagi","entity_name":"Kannagi Finance","trust_score":3,"severity_base":null,"score_modifier":0,"confidence":0.9,"status":"published","content_type":"investigation","summary":"Kannagi Finance was a decentralized yield aggregation protocol launched on zkSync Era in June 2023. On July 29, 2023, the project's anonymous team executed an exit scam, draining approximately $2.13 million in user funds and reducing TVL from $2.13 million to $0.17. The stolen funds were subsequently laundered through the Tornado Cash crypto mixer, and all project infrastructure — website, Twitter, and GitHub repositories — was deleted.","sections":[{"content":"Kannagi Finance was a yield aggregator protocol operating on the zkSync Era Layer 2 network. Approximately one month after launch, on July 29, 2023, the project's anonymous founders drained virtually all user deposits from the protocol's smart contracts. Total value locked (TVL), which had reached approximately $2.13 million, collapsed to $0.17 — a near-total loss for depositors. The incident is documented as the first major rug pull on the zkSync Era network. Following the drain, the team deleted the project's website, its Twitter account, and its GitHub repositories, removing all publicly accessible code and communications.","heading":"Rug Pull Overview","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-kannagi-finance-rug-pull-july-2023","name":"Explained: The Kannagi Finance Rug Pull (July 2023) — Halborn","type":"research","credibility":2},{"url":"https://www.web3isgoinggreat.com/?id=kannagi-finance-rug-pull","name":"Kannagi Finance rug pulls for over $2 million — Web3 Is Going Great","type":"news_article","credibility":2},{"url":"https://www.theblock.co/post/241997/kannagi-finance-rugpull","name":"Kannagi Finance TVL drops to $0.17 in apparent rug pull — The Block","type":"news_article","credibility":2},{"url":"https://crypto.news/zksync-eras-kannagi-finance-rug-pulls-and-steal-2-13m/","name":"zkSync Era's Kannagi Finance rug pulls and steal $2.13m — crypto.news","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Kannagi Finance's vault contract code was deployed in an unverified state on zkSync Era, meaning the source code was never made publicly readable on-chain. This is a significant red flag that is inconsistent with legitimate DeFi protocol practices. Although two separate security audits were conducted prior to the rug pull, neither covered the contracts actually used to execute the drain. SolidProof audited the ERC-20 token contract on June 6, 2023, and confirmed it was a standard token with no ownership privileges. SourceHat (formerly SolidityFinance) audited the ERC-4626 vault token contract, but neither firm audited the MainChef or Vault withdrawal contracts. The audit report had noted that the MainChef address retained the ability to initiate withdrawals on behalf of users — a centralization risk that was flagged but not treated as a critical vulnerability. The vault contracts, which held user deposits, were deleted from GitHub after the incident, preventing post-hoc forensic analysis of the exact mechanism used.","heading":"Technical Details and Exploit Mechanism","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-kannagi-finance-rug-pull-july-2023","name":"Explained: The Kannagi Finance Rug Pull (July 2023) — Halborn","type":"research","credibility":2},{"url":"https://rekt.news/kannagi-finance-rekt","name":"Kannagi Finance — REKT News","type":"news_article","credibility":2},{"url":"https://solidproof.io/blogposts/58","name":"SolidProof statement on Kannagi Finance audit","type":"official","credibility":2}],"severity":"critical"},{"content":"Following the exit scam, on-chain tracking firm MistTrack identified that 600 ETH — valued at approximately $1.1 million at the time — was transferred from the scammer's wallet to the Tornado Cash crypto mixer. The scammer's address is documented as 0x95ec03b821f164ce55cbb26f23f591a9bd40d6c1. The funds were bridged from zkSync Era to the Ethereum mainnet before being deposited into Tornado Cash for obfuscation. The total stolen amount across all sources is reported between $2.13 million and $2.4 million, with the discrepancy attributable to differing estimates by different tracking services at the time of incident.","heading":"Fund Laundering via Tornado Cash","sources":[{"url":"https://cryptonews.net/news/finance/21378539/","name":"Kannagi Finance's $2 Million User Losses Is Being Shifted To Tornado Cash — CryptoNews.net","type":"news_article","credibility":2},{"url":"https://coincu.com/207129-kannagi-finances-2-million-user-losses/","name":"Kannagi Finance's $2 Million User Losses — Coincu","type":"news_article","credibility":2},{"url":"https://rekt.news/kannagi-finance-rekt","name":"Kannagi Finance — REKT News","type":"news_article","credibility":2}],"severity":"critical"},{"content":"The Kannagi Finance team operated anonymously and did not complete a KYC process with SolidProof or any other verifiable identity service prior to launch. No founders or team members have been publicly identified by name in any verified reporting. SolidProof's post-incident investigation assessed that 'the fraudster is most likely a person in the Chinese region,' based on wallet behavior and other on-chain signals, though this attribution is preliminary and unconfirmed. The deletion of all project infrastructure — website, Twitter, and GitHub — immediately following the drain is consistent with a premeditated exit scam rather than an opportunistic exploit by an external actor.","heading":"Team Identity and Attribution","sources":[{"url":"https://solidproof.io/blogposts/58","name":"SolidProof statement on Kannagi Finance audit","type":"official","credibility":2},{"url":"https://beincrypto.com/kannagi-finance-zksync-era-rug-pull/","name":"A Rocky Week for zkSync Era — BeInCrypto","type":"news_article","credibility":2}],"severity":"high"},{"content":"Several pre-incident red flags were publicly observable. The deployed vault contract code was closed-source and unverified on-chain at the time of launch, a significant departure from standard DeFi transparency norms. The project underwent two separate audits (SolidProof and SourceHat), but neither firm audited the specific contracts through which user funds were ultimately drained. SolidProof explicitly stated post-incident that it 'did not conduct an audit for Vault contracts related to the rug pull incident.' SourceHat's report stated 'No external vulnerabilities identified' — language that security researchers criticized as misleading given the scope limitations. The project launched in approximately June 2023 and accumulated $2.13 million in TVL within roughly one month, suggesting aggressive yield incentives designed to attract deposits quickly before exit.","heading":"Audit Failures and Due Diligence Red Flags","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-kannagi-finance-rug-pull-july-2023","name":"Explained: The Kannagi Finance Rug Pull (July 2023) — Halborn","type":"research","credibility":2},{"url":"https://solidproof.io/blogposts/58","name":"SolidProof statement on Kannagi Finance audit","type":"official","credibility":2},{"url":"https://rekt.news/kannagi-finance-rekt","name":"Kannagi Finance — REKT News","type":"news_article","credibility":2}],"severity":"high"},{"content":"The Kannagi Finance rug pull occurred in the same week as the EraLend security breach on July 25, 2023, in which $3.4 million was stolen from a lending protocol also built on zkSync Era. The two incidents together drew significant attention to security risks on the nascent Layer 2 network. Despite both incidents, zkSync Era's total value locked reportedly remained above $380 million by the end of the week, according to BeInCrypto. The Kannagi rug pull is documented as the first major rug pull on the zkSync Era network.","heading":"Broader zkSync Era Context","sources":[{"url":"https://beincrypto.com/kannagi-finance-zksync-era-rug-pull/","name":"A Rocky Week for zkSync Era — BeInCrypto","type":"news_article","credibility":2},{"url":"https://coinjournal.net/news/zksync-era-protocol-kannagi-finance-rugpulls-users-lose-millions/","name":"zkSync Era protocol Kannagi Finance latest crypto rugpull — CoinJournal","type":"news_article","credibility":2}],"severity":"medium"},{"content":"As of the date of this investigation, the Kannagi Finance website and Twitter account remain deleted. The KANA token contract address (0x26ac1d9945f65392b8e4e6b895969b5c01a7b414) is visible on the zkSync Era block explorer but the protocol is effectively defunct. DeFiLlama shows a residual TVL of approximately $72 — consistent with dust amounts left after a near-total drain. No legal proceedings, law enforcement actions, or recovery efforts have been publicly reported. No funds have been returned to affected users based on available reporting.","heading":"Current Status","sources":[{"url":"https://defillama.com/protocol/kannagi-finance","name":"Kannagi Finance — DeFiLlama","type":"on_chain","credibility":2},{"url":"https://era.zksync.network/token/0x26ac1d9945f65392b8e4e6b895969b5c01a7b414","name":"KANA Token on zkSync Era Block Explorer","type":"on_chain","credibility":1}],"severity":"high"}],"timeline":[{"date":"2023-06-06","event":"SolidProof completes audit of Kannagi Finance ERC-20 token contract, finding it to be a standard token with no ownership privileges. No KYC is conducted with the team.","source":"SolidProof Blog Post #58","source_url":"https://solidproof.io/blogposts/58"},{"date":"2023-06","event":"Kannagi Finance launches on zkSync Era as a yield aggregator. The vault contract code is deployed unverified and closed-source.","source":"Halborn Research / crypto.news","source_url":"https://www.halborn.com/blog/post/explained-the-kannagi-finance-rug-pull-july-2023","date_original":"2023-06-01"},{"date":"2023-07-24","event":"TVL in Kannagi Finance pools reaches approximately $2.13–$2.22 million across user deposits.","source":"CoinJournal","source_url":"https://coinjournal.net/news/zksync-era-protocol-kannagi-finance-rugpulls-users-lose-millions/"},{"date":"2023-07-25","event":"EraLend, a separate zkSync Era protocol, is hacked for $3.4 million in a read-only reentrancy exploit.","source":"BeInCrypto","source_url":"https://beincrypto.com/kannagi-finance-zksync-era-rug-pull/"},{"date":"2023-07-29","event":"Kannagi Finance team drains approximately $2.13 million in user deposits from the protocol's vault contracts, reducing TVL to $0.17. Website, Twitter account, and GitHub repositories are deleted.","source":"The Block / Web3 Is Going Great","source_url":"https://www.web3isgoinggreat.com/?id=kannagi-finance-rug-pull"},{"date":"2023-07-30","event":"MistTrack identifies 600 ETH (~$1.1 million) transferred from the scammer wallet (0x95ec03b821f164ce55cbb26f23f591a9bd40d6c1) to Tornado Cash for laundering. PeckShield issues a public alert.","source":"Coincu / REKT News / crypto.news","source_url":"https://coincu.com/207129-kannagi-finances-2-million-user-losses/"},{"date":"2023-07-30","event":"SolidProof publishes a statement clarifying the scope of their audit and stating the fraudster is 'most likely a person in the Chinese region.' No KYC had been completed.","source":"SolidProof Blog Post #58","source_url":"https://solidproof.io/blogposts/58"}],"sources_used":[{"url":"https://www.halborn.com/blog/post/explained-the-kannagi-finance-rug-pull-july-2023","name":"Explained: The Kannagi Finance Rug Pull (July 2023) — Halborn","type":"research","archive_url":"http://web.archive.org/web/20260414135155/https://www.halborn.com/blog/post/explained-the-kannagi-finance-rug-pull-july-2023","credibility":2,"archive_timestamp":"2026-04-14T13:51:55+00:00"},{"url":"https://www.web3isgoinggreat.com/?id=kannagi-finance-rug-pull","name":"Kannagi Finance rug pulls for over $2 million — Web3 Is Going Great","type":"news_article","archive_url":"http://web.archive.org/web/20260307060954/https://www.web3isgoinggreat.com/?id=kannagi-finance-rug-pull","credibility":2,"archive_timestamp":"2026-03-07T06:09:54+00:00"},{"url":"https://www.theblock.co/post/241997/kannagi-finance-rugpull","name":"Kannagi Finance TVL drops to $0.17 in apparent rug pull — The Block","type":"news_article","archive_url":"http://web.archive.org/web/20260330132906/https://www.theblock.co/post/241997/kannagi-finance-rugpull","credibility":2,"archive_timestamp":"2026-03-30T13:29:06+00:00"},{"url":"https://crypto.news/zksync-eras-kannagi-finance-rug-pulls-and-steal-2-13m/","name":"zkSync Era's Kannagi Finance rug pulls and steal $2.13m — crypto.news","type":"news_article","archive_url":"http://web.archive.org/web/20260725135836/https://crypto.news/zksync-eras-kannagi-finance-rug-pulls-and-steal-2-13m/","credibility":2,"archive_timestamp":"2026-07-25T13:58:36+00:00"},{"url":"https://rekt.news/kannagi-finance-rekt","name":"Kannagi Finance — REKT News","type":"news_article","archive_url":"http://web.archive.org/web/20250907212237/https://rekt.news/kannagi-finance-rekt","credibility":2,"archive_timestamp":"2025-09-07T21:22:37+00:00"},{"url":"https://solidproof.io/blogposts/58","name":"SolidProof statement on Kannagi Finance audit","type":"official","archive_url":"https://web.archive.org/web/20260829141733/https://solidproof.io/blogposts/58","credibility":2,"archive_timestamp":"2026-08-29T14:17:33+00:00"},{"url":"https://cryptonews.net/news/finance/21378539/","name":"Kannagi Finance's $2 Million User Losses Is Being Shifted To Tornado Cash — CryptoNews.net","type":"news_article","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://coincu.com/207129-kannagi-finances-2-million-user-losses/","name":"Kannagi Finance's $2 Million User Losses — Coincu","type":"news_article","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://beincrypto.com/kannagi-finance-zksync-era-rug-pull/","name":"A Rocky Week for zkSync Era — BeInCrypto","type":"news_article","archive_url":"http://web.archive.org/web/20250831094220/https://beincrypto.com/kannagi-finance-zksync-era-rug-pull//","credibility":2,"archive_timestamp":"2025-08-31T09:42:20+00:00"},{"url":"https://coinjournal.net/news/zksync-era-protocol-kannagi-finance-rugpulls-users-lose-millions/","name":"zkSync Era protocol Kannagi Finance latest crypto rugpull — CoinJournal","type":"news_article","archive_url":"https://web.archive.org/web/20260829233906/https://coinjournal.net/news/solanas-aurory-goes-cross-platform-with-expansion-to-arbitrum/?dynamic","credibility":2,"archive_timestamp":"2026-08-29T23:39:06+00:00"},{"url":"https://defillama.com/protocol/kannagi-finance","name":"Kannagi Finance — DeFiLlama","type":"on_chain","archive_url":"http://web.archive.org/web/20250913164021/https://defillama.com/protocol/kannagi-finance","credibility":2,"archive_timestamp":"2025-09-13T16:40:21+00:00"},{"url":"https://era.zksync.network/token/0x26ac1d9945f65392b8e4e6b895969b5c01a7b414","name":"KANA Token on zkSync Era Block Explorer","type":"on_chain","archive_url":"https://web.archive.org/web/20260830000749/https://explorer.zksync.io/","credibility":1,"archive_timestamp":"2026-08-30T00:07:49+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:39.797729+00:00","updated_at":"2026-08-30T01:16:30.696236+00:00"}}