{"investigation":{"slug":"kokomo-finance","entity_name":"Kokomo Finance","trust_score":2,"severity_base":null,"score_modifier":0,"confidence":0.95,"status":"published","content_type":"investigation","summary":"Kokomo Finance was a purported non-custodial lending and borrowing protocol launched on the Optimism blockchain on March 25, 2023. Within approximately 24 hours of launch, its developers executed a deliberate exit scam, stealing approximately $4 to $4.5 million in user funds through smart contract manipulation. The project was subsequently linked by on-chain investigator ZachXBT to a serial scam ring responsible for over $20 million in losses across multiple DeFi protocols.","sections":[{"content":"Kokomo Finance presented itself as an open-source, non-custodial lending protocol built on Optimism, offering users the ability to borrow, lend, and trade assets including wrapped Bitcoin (WBTC), ETH, USDT, USDC, and DAI. The protocol launched on March 25, 2023, and issued a native token, KOKO, with a total supply of 100,000,000 tokens. The project was audited by 0xGuard shortly before launch; the audit identified typographical errors and noted that the contract owner held the ability to mint up to 45% of the maximum token supply to an arbitrary address — a critical centralization risk that was not remediated before deployment. Within roughly 24 hours of going live, the developers executed a premeditated exit scam and deleted all online presence.","heading":"Overview","sources":[{"url":"https://www.coindesk.com/tech/2023/03/27/crypto-lender-kokomos-developers-use-wrapped-bitcoin-for-4m-exit-scam","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.certik.com/resources/blog/kokomo-finance","name":"certik.com","type":"other","credibility":3},{"url":"https://cryptopotato.com/optimism-defi-protocol-kokomo-finance-rug-pulls-users-for-4-million/","name":"cryptopotato.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On March 26, 2023, the deployer address 0x41be327a34d5d2f0855ff7e4fb3f6f1748b3310f executed the exit scam using the following sequence. First, a malicious cBTC (wrapped Bitcoin derivative) contract was deployed at address 0x1e02E6A5b549eeAd726ebCce64a54215196760E2. The deployer then called the `_setRewardSpeed` function to alter reward mechanics, suspended borrowing for all users, and upgraded the protocol's implementation contract to the malicious version at 0x05b295. Address 0x5a2d0e3d6f862ee155f52ab65b6b22e1d80f5716, which had previously been granted unlimited approval over user-deposited Sonne Wrapped Bitcoin (soWBTC), approved the malicious cBTC contract to spend those tokens. The attacker then invoked the `0x804edaad()` method to transfer 7,010 soWBTC to address 0x5c8db6eea11896065ec7dcfc67f458c54ccf7bff, which redeemed them for approximately 141.7 WBTC worth roughly $4 million. Security firm CertiK described the technique as 'ice phishing' — a Web3-specific attack wherein users are tricked into signing token approvals that later allow a malicious actor to drain funds without ever accessing private keys. The protocol's total value locked (TVL) collapsed from approximately $2 million to just over $64,000 within 24 hours.","heading":"Exit Scam: Technical Mechanics","sources":[{"url":"https://www.certik.com/resources/blog/kokomo-finance","name":"certik.com","type":"other","credibility":3},{"url":"https://cryptopotato.com/optimism-defi-protocol-kokomo-finance-rug-pulls-users-for-4-million/","name":"cryptopotato.com","type":"other","credibility":3},{"url":"https://medium.com/coinmonks/decoding-kokomo-finance-4-million-rug-pull-quillaudits-d5d027522bf3","name":"medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Total losses from the Kokomo Finance exit scam are estimated at approximately $4 to $4.5 million in user funds, with an additional $109,272 removed from liquidity pools according to CertiK's post-mortem. Stolen funds were distributed across multiple chains: on Optimism, approximately $1,422,041 (802.21 ETH equivalent) was held in the malicious cBTC contract; on Arbitrum, approximately $562,182 (317.05 ETH) was moved to address 0x88340ff2292506d0d93934cbbfea5ed1804cda0d; on Binance Smart Chain, approximately $1,398,176 (4,255.88 BNB) and $1,118,094 (3,403.34 BNB) were spread across two separate addresses. The KOKO token crashed approximately 97–98% in price, from roughly $0.049 to $0.00065, immediately following the event. CertiK noted at the time that this was the largest rug pull observed on the Optimism network.","heading":"Financial Losses and Fund Distribution","sources":[{"url":"https://www.certik.com/resources/blog/kokomo-finance","name":"certik.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/4m-exit-scam-suspected-as-kokomo-finance-flies-off-radar-token-plunges","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/tech/2023/03/27/crypto-lender-kokomos-developers-use-wrapped-bitcoin-for-4m-exit-scam","name":"coindesk.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On-chain investigator ZachXBT subsequently linked Kokomo Finance to a broader serial scam ring operating across multiple blockchain networks. According to ZachXBT's analysis, the same group of actors was responsible for exit scams at Magnate Finance ($6.5 million lost, Base network), Solfire ($4.8 million), Kokomo Finance ($4 million, Optimism), and Lendora Protocol (Scroll network). The ring was also connected to Hash DAO, Glori Finance, and ZebraDAO. In April 2024, ZachXBT disclosed that the group had returned under a new project, Leaper Finance, on the Blast network, seeding it with nearly $1 million in laundered proceeds from prior scams to manufacture artificial liquidity and attract new victims. The group's pattern involved deploying Compound V2 forks, using falsified KYC documents, engaging low-credibility audit firms (such as Vital Block for Magnate and Lendora), allowing TVL to reach seven figures before executing the exit, and then laundering proceeds across chains including Base, Solana, Scroll, Optimism, Ethereum, Arbitrum, and Avalanche. Total cumulative losses attributed to the ring exceed $20 million. Following ZachXBT's April 2024 public disclosure, the Leaper Finance and Glori Finance X accounts were deactivated and their websites taken offline. The scammers responded to ZachXBT's allegations with taunting messages on X, comparing themselves to the Lazarus Group; no confirmed connection to Lazarus was established.","heading":"Serial Scam Ring — ZachXBT Investigation","sources":[{"url":"https://www.cryptometer.io/news/zachxbt-exposes-scam-ring-behind-multiple-defi-rug-pulls/","name":"cryptometer.io","type":"other","credibility":3},{"url":"https://cryptopotato.com/warning-malicious-group-threatening-layer-2-networks-exposed/","name":"cryptopotato.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/scam-crypto-projects-liquidity-disappear","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/crypto-sleuth-warns-scammers-defi-protocol","name":"cointelegraph.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Kokomo Finance was audited by 0xGuard prior to its March 25, 2023 launch. The audit passed most evaluated criteria but flagged at least two notable issues: typographical errors in the codebase, and the fact that the contract owner retained the ability to mint up to 45% of the maximum KOKO token supply to any arbitrary address — a severe centralization risk. Despite these findings being documented in the audit report, the protocol launched without remediation. CertiK, which was not the pre-launch auditor, detected and analyzed the exit scam after it occurred, citing centralization risk from upgradeable contracts and concentrated token distribution as the primary enabling factors. The pre-launch audit's failure to block deployment despite identifying owner-privilege risks illustrates a systemic weakness in the DeFi audit process for projects with malicious intent.","heading":"Pre-Launch Audit and Security Failures","sources":[{"url":"https://www.certik.com/resources/blog/kokomo-finance","name":"certik.com","type":"other","credibility":3},{"url":"https://cryptopotato.com/optimism-defi-protocol-kokomo-finance-rug-pulls-users-for-4-million/","name":"cryptopotato.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Kokomo Finance's website, Twitter, GitHub, and Medium accounts were deleted immediately following the March 26, 2023 exit scam and remain inactive as of the date of this investigation. No team members have been publicly identified by name. No regulatory charges or law enforcement actions have been publicly announced in connection with this specific incident. The KOKO token retains no known utility or market value. Funds stolen in the scam have not been recovered or returned to affected users.","heading":"Current Status","sources":[{"url":"https://www.coindesk.com/tech/2023/03/27/crypto-lender-kokomos-developers-use-wrapped-bitcoin-for-4m-exit-scam","name":"coindesk.com","type":"other","credibility":3},{"url":"https://coingeek.com/kokomo-finance-developers-pull-off-4m-exit-scam-days-after-launch-report/","name":"coingeek.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2023-03-25","event":"Kokomo Finance launches on Optimism, offering non-custodial lending and borrowing of WBTC, ETH, USDT, USDC, DAI, and native KOKO token.","source":""},{"date":"2023-03-26","event":"Developers execute exit scam: deployer address 0x41be deploys malicious cBTC contract, manipulates reward functions, drains approximately $4–4.5 million in user funds across Optimism, Arbitrum, and BSC. KOKO token crashes ~97%. Website and all social media accounts deleted.","source":""},{"date":"2023-03-26","event":"CertiK publicly flags the incident via its alert system, identifying the attack as an exit scam and the largest rug pull observed on Optimism at that time.","source":""},{"date":"2023-03-31","event":"CertiK publishes full post-mortem analysis, documenting technical attack flow, wallet addresses, and fund distribution across chains.","source":""},{"date":"2023-11","event":"ZachXBT issues warning about Lendora Protocol on Scroll network, connecting it to the same scam group behind Kokomo Finance, Magnate, and Solfire.","source":"","date_original":"2023-11-01"},{"date":"2024-04-14","event":"ZachXBT publicly exposes Leaper Finance on Blast as the scam ring's latest operation, seeded with ~$1 million laundered from prior scams. Total ring losses identified exceed $20 million. Scammers taunt ZachXBT on X before deactivating accounts.","source":""}],"sources_used":[{"url":"https://www.coindesk.com/tech/2023/03/27/crypto-lender-kokomos-developers-use-wrapped-bitcoin-for-4m-exit-scam","name":"coindesk.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.certik.com/resources/blog/kokomo-finance","name":"certik.com","type":"other","archive_url":"http://web.archive.org/web/20260201133351/https://www.certik.com/resources/blog/kokomo-finance","credibility":3,"archive_timestamp":"2026-02-01T13:33:51+00:00"},{"url":"https://cryptopotato.com/optimism-defi-protocol-kokomo-finance-rug-pulls-users-for-4-million/","name":"cryptopotato.com","type":"other","archive_url":"http://web.archive.org/web/20260218190933/https://cryptopotato.com/optimism-defi-protocol-kokomo-finance-rug-pulls-users-for-4-million/","credibility":3,"archive_timestamp":"2026-02-18T19:09:33+00:00"},{"url":"https://medium.com/coinmonks/decoding-kokomo-finance-4-million-rug-pull-quillaudits-d5d027522bf3","name":"medium.com","type":"other","archive_url":"http://web.archive.org/web/20251126143155/https://medium.com/coinmonks/decoding-kokomo-finance-4-million-rug-pull-quillaudits-d5d027522bf3","credibility":3,"archive_timestamp":"2025-11-26T14:31:55+00:00"},{"url":"https://cointelegraph.com/news/4m-exit-scam-suspected-as-kokomo-finance-flies-off-radar-token-plunges","name":"cointelegraph.com","type":"other","archive_url":"https://web.archive.org/web/20260830201247/https://cointelegraph.com/news/4m-exit-scam-suspected-as-kokomo-finance-flies-off-radar-token-plunges","credibility":3,"archive_timestamp":"2026-08-30T20:12:47+00:00"},{"url":"https://www.cryptometer.io/news/zachxbt-exposes-scam-ring-behind-multiple-defi-rug-pulls/","name":"cryptometer.io","type":"other","archive_url":"http://web.archive.org/web/20251116062204/https://www.cryptometer.io/news/zachxbt-exposes-scam-ring-behind-multiple-defi-rug-pulls/","credibility":3,"archive_timestamp":"2025-11-16T06:22:04+00:00"},{"url":"https://cryptopotato.com/warning-malicious-group-threatening-layer-2-networks-exposed/","name":"cryptopotato.com","type":"other","archive_url":"http://web.archive.org/web/20260605230938/https://cryptopotato.com/warning-malicious-group-threatening-layer-2-networks-exposed/","credibility":3,"archive_timestamp":"2026-06-05T23:09:38+00:00"},{"url":"https://cointelegraph.com/news/scam-crypto-projects-liquidity-disappear","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20260306052002/https://cointelegraph.com/news/scam-crypto-projects-liquidity-disappear","credibility":3,"archive_timestamp":"2026-03-06T05:20:02+00:00"},{"url":"https://cointelegraph.com/news/crypto-sleuth-warns-scammers-defi-protocol","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20260316111337/https://cointelegraph.com/news/crypto-sleuth-warns-scammers-defi-protocol","credibility":3,"archive_timestamp":"2026-03-16T11:13:37+00:00"},{"url":"https://coingeek.com/kokomo-finance-developers-pull-off-4m-exit-scam-days-after-launch-report/","name":"coingeek.com","type":"other","archive_url":"http://web.archive.org/web/20251014041351/https://coingeek.com/kokomo-finance-developers-pull-off-4m-exit-scam-days-after-launch-report/","credibility":3,"archive_timestamp":"2025-10-14T04:13:51+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:43.272017+00:00","updated_at":"2026-08-30T20:30:08.477258+00:00"}}