{"investigation":{"slug":"mm-finance-cronos","entity_name":"MM Finance Cronos","trust_score":28,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"MM Finance (also known as Mad Meerkat Finance) was the largest decentralized exchange on the Cronos blockchain. On May 4, 2022, the protocol suffered a frontend compromise in which an attacker injected a malicious router contract address, redirecting approximately $2 million in user funds to the attacker's wallet over roughly three hours. The stolen funds were laundered via Tornado Cash and routed through OKX; the team pledged reimbursement via trading fee airdrops, though full recovery of stolen assets was not confirmed. The MMF token subsequently lost approximately 99.9% of its value from its April 2022 all-time high.","sections":[{"content":"On May 4, 2022, at approximately 7:30 PM UTC, MM Finance's website frontend was compromised by an attacker who injected a malicious router contract address into the project's hosted frontend files. Any user who interacted with the protocol's three main functions — token swapping, adding liquidity, or removing liquidity — during the roughly three-hour window had their output funds redirected to the attacker's wallet at address 0xb3065fe2125c413e973829108f23e872e1db9a6b on the Cronos chain. The team detected the breach and took down the frontend, warning users via Discord and Twitter: 'We have verified and there's a frontend breach. Please do not perform any transactions or your funds will be sent to the exploiter wallet.' Total losses exceeded $2 million, making this the first major exploit on the Cronos chain and ranking it #76 on Rekt News's leaderboard. While MM Finance publicly characterized the attack as 'DNS hijacking,' security observers noted the actual vector was more likely credential phishing against their domain service provider, as the attacker appeared to have modified hosted frontend files rather than execute a network-level DNS attack.","heading":"The May 2022 Frontend Exploit","sources":[{"url":"https://rekt.news/madmeerkat-finance-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://www.coindesk.com/tech/2022/05/05/decentralized-exchange-mmfinance-suffers-2m-exploit","name":"coindesk.com","type":"other","credibility":3},{"url":"https://cryptobriefing.com/cronos-defi-project-mm-finance-suffers2m-exploit/","name":"cryptobriefing.com","type":"other","credibility":3},{"url":"https://web3isgoinggreat.com/single/mmfinance-suffers-apparent-frontend-breach","name":"web3isgoinggreat.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the exploit, the attacker bridged the stolen assets from Cronos to Ethereum using the Multichain bridge protocol. Funds totaling approximately 743 ETH were deposited into Tornado Cash, a privacy mixer on Ethereum, to obfuscate the trail. Subsequent on-chain tracing by the MM Finance team identified movement of funds to OKX exchange. MM Finance publicly named OKX in its statements, and OKX CEO Jay Hao indicated the exchange was cooperating with an investigation. MM Finance issued a public ultimatum demanding the attacker return 90% of stolen funds within 48 hours, threatening to contact the FBI if the deadline was not met. No public confirmation was made that the attacker complied or that any stolen funds were recovered from Tornado Cash or OKX.","heading":"Fund Movement and Laundering","sources":[{"url":"https://rekt.news/madmeerkat-finance-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://www.coindesk.com/tech/2022/05/05/decentralized-exchange-mmfinance-suffers-2m-exploit","name":"coindesk.com","type":"other","credibility":3},{"url":"https://therecord.media/more-than-2-million-stolen-from-defi-platform-mm-finance","name":"therecord.media","type":"other","credibility":3}],"severity":"medium"},{"content":"MM Finance confirmed it had collated all affected wallet addresses using on-chain data and committed to reimbursing over $2 million in user losses. The initial compensation plan required the development team to forfeit 45 days of trading fee revenue. After the protocol reported generating over $1,700,000 USD in trading fees in the week following the exploit, the team revised its plan to a two-stage airdrop model: approximately 63% of owed compensation would be distributed in the first airdrop and the remaining 37% in a second airdrop. No independent verification of full completion of both airdrop stages was found in available sources.","heading":"User Compensation and Reimbursement","sources":[{"url":"https://www.coindesk.com/tech/2022/05/05/decentralized-exchange-mmfinance-suffers-2m-exploit","name":"coindesk.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/mm-finance-cronos","name":"defillama.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The founding team behind MM Finance operates under pseudonymous identities and has not completed third-party KYC verification. CertiK's Skynet profile for the project lists no KYC documentation and notes a 'fundamental health score' of 10%, citing the absence of KYC as a significant governance risk. The protocol also has no active bug bounty program, which contributed to the undetected frontend vulnerability. CertiK identified five owner privilege risks in its December 2021 audit, including balance modifiability and creator concentration, meaning the team retains elevated control over protocol parameters. The team's anonymity limits accountability in the event of security incidents or governance disputes.","heading":"Team Anonymity and Governance Risks","sources":[{"url":"https://skynet.certik.com/projects/mmfinance","name":"skynet.certik.com","type":"other","credibility":3},{"url":"https://mmfinance.gitbook.io/docs/audit","name":"mmfinance.gitbook.io","type":"other","credibility":3}],"severity":"medium"},{"content":"MM Finance completed a CertiK smart contract audit on December 22, 2021, approximately five months before the exploit. The audit identified 35 findings in total: 3 minor logical issues and 32 informational items relating to gas optimization. No critical or major vulnerabilities were flagged. The team also engaged Paladin Security and SlowMist for additional contract reviews. CertiK's Skynet score for the project is 72.15 (BBB rating) as of the most recent available data. Notably, the May 2022 exploit involved the frontend infrastructure and not the audited smart contracts themselves, indicating the audit scope did not cover operational security practices such as domain and hosting credential management.","heading":"Security Audit History","sources":[{"url":"https://skynet.certik.com/projects/mmfinance","name":"skynet.certik.com","type":"other","credibility":3},{"url":"https://mmfinance.gitbook.io/docs/audit","name":"mmfinance.gitbook.io","type":"other","credibility":3}],"severity":"medium"},{"content":"The MMF token reached its all-time high of approximately $1.85 on April 7, 2022, about one month before the exploit. By the end of 2022 the token had declined approximately 95.88%, closing the year near $0.01. As of 2026 the token trades near $0.00009713 with a 24-hour volume of approximately $817 — a decline of roughly 99.9% from its peak. Current total value locked on the protocol stands at approximately $1.37 million, compared to peak TVL of approximately $800 million in early 2022. MM Finance Cronos remains a small and largely dormant protocol within the Cronos DeFi ecosystem; VVS Standard, the leading Cronos DEX, holds over $112 million in TVL by comparison. Social media activity on the project's official accounts has been minimal in recent years.","heading":"MMF Token Performance and Current Protocol Status","sources":[{"url":"https://www.coingecko.com/en/coins/mmfinance","name":"coingecko.com","type":"other","credibility":3},{"url":"https://coinmarketcap.com/currencies/mm-finance/","name":"coinmarketcap.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/mm-finance-cronos","name":"defillama.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On-chain investigator ZachXBT has flagged MM Finance Cronos as a high-risk entity. The specific basis for the flag in relation to MM Finance directly (as distinct from ZachXBT's separate allegations against Crypto.com and the CRO token) was not detailed in available public sources at time of investigation. The protocol's documented history — including a $2 million frontend exploit with laundered proceeds, an anonymous team, no KYC, minimal bug bounty, and near-total token value collapse — is consistent with the risk profile that has drawn investigator scrutiny.","heading":"ZachXBT Flag","sources":[{"url":"https://www.cryptopolitan.com/zachxbt-calls-cryptocoms-cro-token-a-scam/","name":"cryptopolitan.com","type":"other","credibility":3},{"url":"https://rekt.news/madmeerkat-finance-rekt","name":"rekt.news","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021-12-22","event":"CertiK completes smart contract audit of MM Finance. 35 findings identified (3 minor, 32 informational); no critical vulnerabilities flagged.","source":""},{"date":"2022-04-07","event":"MMF token reaches all-time high of approximately $1.85.","source":""},{"date":"2022-05","event":"MM Finance publishes a blog post addressing community concerns about the project structure.","source":"","date_original":"2022-05-01"},{"date":"2022-05-04","event":"Frontend exploit begins at approximately 7:30 PM UTC. Attacker injects malicious router contract address, redirecting user funds for approximately three hours. Over $2 million stolen. Team takes down frontend and warns users via Discord and Twitter.","source":""},{"date":"2022-05-05","event":"MM Finance identifies stolen funds routed through Tornado Cash (743 ETH) and onward to OKX. Team issues 48-hour ultimatum to attacker demanding return of 90% of funds, threatening FBI involvement.","source":""},{"date":"2022-05-05","event":"MM Finance announces reimbursement plan: team to forfeit 45 days of trading fee revenue to compensate affected users. CoinDesk and Crypto Briefing report on the exploit.","source":""},{"date":"2022-05-11","event":"MM Finance revises compensation plan to a two-stage airdrop (63% in first airdrop, 37% in second) after generating over $1.7 million in trading fees in the days following the exploit.","source":""},{"date":"2022-12-31","event":"MMF token closes 2022 at approximately $0.01, a decline of 95.88% for the year.","source":""},{"date":"2026-05","event":"Protocol remains operational but largely dormant. TVL at approximately $1.37 million. MMF token trades at approximately $0.00009713, down 99.9% from all-time high.","source":"","date_original":"2026-05-01"}],"sources_used":[{"url":"https://rekt.news/madmeerkat-finance-rekt","name":"rekt.news","type":"other","archive_url":"http://web.archive.org/web/20260513161515/https://rekt.news/madmeerkat-finance-rekt","credibility":3,"archive_timestamp":"2026-05-13T16:15:15+00:00"},{"url":"https://www.coindesk.com/tech/2022/05/05/decentralized-exchange-mmfinance-suffers-2m-exploit","name":"coindesk.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://cryptobriefing.com/cronos-defi-project-mm-finance-suffers2m-exploit/","name":"cryptobriefing.com","type":"other","archive_url":"http://web.archive.org/web/20260219085841/https://cryptobriefing.com/cronos-defi-project-mm-finance-suffers2m-exploit/","credibility":3,"archive_timestamp":"2026-02-19T08:58:41+00:00"},{"url":"https://web3isgoinggreat.com/single/mmfinance-suffers-apparent-frontend-breach","name":"web3isgoinggreat.com","type":"other","archive_url":"https://web.archive.org/web/20260829143304/https://www.web3isgoinggreat.com/single/mmfinance-suffers-apparent-frontend-breach","credibility":3,"archive_timestamp":"2026-08-29T14:33:04+00:00"},{"url":"https://therecord.media/more-than-2-million-stolen-from-defi-platform-mm-finance","name":"therecord.media","type":"other","archive_url":"http://web.archive.org/web/20260124170849/https://therecord.media/more-than-2-million-stolen-from-defi-platform-mm-finance","credibility":3,"archive_timestamp":"2026-01-24T17:08:49+00:00"},{"url":"https://defillama.com/protocol/mm-finance-cronos","name":"defillama.com","type":"other","archive_url":"http://web.archive.org/web/20250915033330/https://defillama.com/protocol/mm-finance-cronos","credibility":3,"archive_timestamp":"2025-09-15T03:33:30+00:00"},{"url":"https://skynet.certik.com/projects/mmfinance","name":"skynet.certik.com","type":"other","archive_url":"http://web.archive.org/web/20260416111114/https://skynet.certik.com/projects/mmfinance","credibility":3,"archive_timestamp":"2026-04-16T11:11:14+00:00"},{"url":"https://mmfinance.gitbook.io/docs/audit","name":"mmfinance.gitbook.io","type":"other","archive_url":"http://web.archive.org/web/20251210152243/https://mmfinance.gitbook.io/docs/audit","credibility":3,"archive_timestamp":"2025-12-10T15:22:43+00:00"},{"url":"https://www.coingecko.com/en/coins/mmfinance","name":"coingecko.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://coinmarketcap.com/currencies/mm-finance/","name":"coinmarketcap.com","type":"other","archive_url":"https://web.archive.org/web/20260829125853/https://coinmarketcap.com/currencies/mm-finance/","credibility":3,"archive_timestamp":"2026-08-29T12:58:53+00:00"},{"url":"https://www.cryptopolitan.com/zachxbt-calls-cryptocoms-cro-token-a-scam/","name":"cryptopolitan.com","type":"other","archive_url":"http://web.archive.org/web/20260209205220/https://www.cryptopolitan.com/zachxbt-calls-cryptocoms-cro-token-a-scam/","credibility":3,"archive_timestamp":"2026-02-09T20:52:20+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:49.61533+00:00","updated_at":"2026-08-30T01:16:33.843571+00:00"}}