{"investigation":{"slug":"myswap-cl-protocol-starknet","entity_name":"mySwap CL Protocol (Starknet)","trust_score":47,"severity_base":47,"score_modifier":0,"confidence":0.74,"status":"under_investigation","content_type":"investigation","summary":"mySwap launched in 2022 as the first automated market maker on Starknet and later introduced a Concentrated Liquidity (CL) product that reached a peak TVL of approximately $9.7 million in April 2024 before declining by over 99.9% to near-zero. On June 19, 2026, an attacker deployed a malicious token named EVIL to abuse the dormant protocol's CL pool accounting and shared-vault logic, draining approximately $305,000 in residual LP assets from more than 100,000 positions. The stolen funds were bridged cross-chain and routed through Railgun; the attacker remains unidentified, and no recovery, compensation plan or formal post-mortem has been reported.","sections":[{"content":"mySwap launched as the first automated market maker on Starknet, a ZK-rollup Layer 2 network. Reports differ on the launch month: March 2022 according to the Braavos blog, which says the AMM initially supported ETH, USDC, DAI and WBTC pools, and January 2022 according to the earlier mySwap page, which cites the mySwap X account and Starknet ecosystem records. In November 2023 mySwap announced a migration from its legacy constant-product AMM to mySwap Concentrated Liquidity (CL), offering a 14-day migration window with an incentive reward for users who migrated. mySwap CL was positioned as analogous to Uniswap v3 on Ethereum, enabling liquidity providers to deploy capital within specified price ranges for improved capital efficiency. By early 2024, mySwap was reportedly the second most active dApp on Starknet by number of active accounts. According to DefiLlama, mySwap CL reached a peak total value locked of approximately $9.7 million in April 2024; TVL began a sustained decline from around July 2024, falling to low single-digit millions and continuing downward through 2024, and eventually fell by over 99.9% to approximately $5,000. Reports differ on when that level was reached: mid-2025 (June 2025) according to one page, and early 2025 (January 2025) according to the other, both citing DefiLlama. The protocol's cumulative all-time DEX volume was reported at approximately $622 million prior to the June 2026 exploit. The protocol closed its interface to new liquidity deposits and was functionally dormant for more than six months prior to the exploit, while residual LP holdings remained distributed across more than 100,000 positions in the shared vault.","heading":"Protocol Background","sources":[{"url":"https://defillama.com/protocol/myswap-cl","name":"mySwap CL TVL and Volume - DefiLlama","type":"research","credibility":2},{"url":"https://braavos.app/myswap-starknet-amm/","name":"mySwap: Leading Starknet's AMM Arena with the Best Yields - Braavos","type":"other","credibility":3},{"url":"https://www.myswap.xyz/","name":"mySwap Concentrated Liquidity on Starknet - Official Site","type":"official","credibility":2},{"url":"https://x.com/mySwapxyz","name":"mySwap on X (@mySwapxyz)","type":"social_media","credibility":3}],"severity":"low"},{"content":"On June 19, 2026, at approximately 7:15 AM UTC, the mySwap CL protocol was exploited via a smart contract vulnerability in its shared-vault accounting layer. The attacker deployed a malicious ERC-20 token named EVIL and used it to manipulate how the CL pool system recognized balances and released assets from the shared vault. The mySwap CL design requires that pool balances, vault balances and liquidity-provider claims remain aligned through every deposit, swap and withdrawal; the attacker identified a failure in this alignment and used the EVIL token as an entry point into the accounting layer, triggering unauthorized asset releases. The core vulnerability lay in insufficient validation boundaries between token interactions and the vault accounting layer: by interacting with pool accounting through the EVIL token, the attacker distorted balance recognition, creating a pathway into the shared vault holding real assets across multiple pools. The exploit was permissionless and did not require any private-key compromise, admin-level access or oracle manipulation; no private key compromise or administrative failure was alleged as contributing to it. The protocol's dormant state, with no new deposits accepted for six months, did not prevent the attack, as residual locked LP positions remained vulnerable.","heading":"June 2026 Exploit: EVIL Token Attack","sources":[{"url":"https://cryptoadventure.com/myswap-loses-305k-on-starknet-after-fake-evil-token-abuses-cl-pool-accounting/","name":"mySwap Loses $305K On Starknet After Fake EVIL Token Abuses CL Pool Accounting - CryptoAdventure","type":"news_article","credibility":2},{"url":"https://phemex.com/news/article/starknets-myswap-protocol-exploited-300000-drained-90069","name":"Starknet's mySwap Protocol Exploited, $300,000 Drained - Phemex News","type":"news_article","credibility":2},{"url":"https://hacked.slowmist.io/","name":"SlowMist Hacked Database","type":"research","credibility":2}],"severity":"critical"},{"content":"The exploit drained approximately $305,000 in assets from the mySwap CL shared vault. The stolen assets comprised 137.96 ETH, 45,000 USDC, 19,900 USDT and 230,000 STRK tokens. These funds represented residual liquidity-provider positions that remained locked in the protocol despite it having been closed to new deposits. The attack drained funds from more than 100,000 LP positions, effectively depleting nearly all remaining liquidity in the protocol; the post-exploit TVL on DefiLlama stood at approximately $5,215. No recovery of funds has been confirmed.","heading":"Financial Impact and Stolen Assets","sources":[{"url":"https://cryptoadventure.com/myswap-loses-305k-on-starknet-after-fake-evil-token-abuses-cl-pool-accounting/","name":"mySwap Loses $305K On Starknet After Fake EVIL Token Abuses CL Pool Accounting - CryptoAdventure","type":"news_article","credibility":2},{"url":"https://phemex.com/news/article/starknets-myswap-protocol-exploited-300000-drained-90069","name":"Starknet's mySwap Protocol Exploited, $300,000 Drained - Phemex News","type":"news_article","credibility":2},{"url":"https://defillama.com/protocol/myswap-cl","name":"mySwap CL TVL and Volume - DefiLlama","type":"research","credibility":2}],"severity":"critical"},{"content":"Following the drain, the attacker bridged the stolen funds cross-chain off Starknet and routed them through Railgun, a zero-knowledge privacy protocol designed to obscure transaction flows on EVM-compatible chains. The use of Railgun is consistent with deliberate efforts to prevent on-chain tracing and impede asset recovery. As of available reporting, no attacker wallet address had been publicly identified by security researchers or the mySwap team, and the attacker remains unidentified. The cross-chain bridging combined with Railgun routing significantly reduces the probability of fund recovery through conventional on-chain forensics.","heading":"Post-Exploit Fund Movement and Obfuscation","sources":[{"url":"https://cryptoadventure.com/myswap-loses-305k-on-starknet-after-fake-evil-token-abuses-cl-pool-accounting/","name":"mySwap Loses $305K On Starknet After Fake EVIL Token Abuses CL Pool Accounting - CryptoAdventure","type":"news_article","credibility":2},{"url":"https://phemex.com/news/article/starknets-myswap-protocol-exploited-300000-drained-90069","name":"Starknet's mySwap Protocol Exploited, $300,000 Drained - Phemex News","type":"news_article","credibility":2}],"severity":"high"},{"content":"As of June 20, 2026, mySwap had confirmed the incident and stated it was assessing the full impact of the exploit. No detailed technical post-mortem, reimbursement plan, remediation roadmap or formal security advisory had been published by the protocol team at the time of available reporting, and the incident was described by reporters as remaining at the alert stage pending an official mySwap analysis. The absence of a post-mortem within the initial reporting window is a transparency concern given that more than 100,000 LP positions were affected. No bug bounty payment or white-hat negotiation has been reported. Given the protocol's pre-existing dormant status and near-zero TVL, the likelihood of a formal recovery or compensation program for affected liquidity providers is uncertain.","heading":"Official Response and Transparency","sources":[{"url":"https://phemex.com/news/article/starknets-myswap-protocol-exploited-300000-drained-90069","name":"Starknet's mySwap Protocol Exploited, $300,000 Drained - Phemex News","type":"news_article","credibility":2},{"url":"https://cryptoadventure.com/myswap-loses-305k-on-starknet-after-fake-evil-token-abuses-cl-pool-accounting/","name":"mySwap Loses $305K On Starknet After Fake EVIL Token Abuses CL Pool Accounting - CryptoAdventure","type":"news_article","credibility":2}],"severity":"high"},{"content":"The mySwap CL protocol had ceased accepting new liquidity deposits for more than six months before the exploit, indicating the product was in a winding-down or deprecated state, yet more than 100,000 LP positions holding real asset value remained locked in it. The attack succeeded against a system that was no longer under active development or receiving active security maintenance. The incident illustrates several structural risk factors: (1) protocols closed to new deposits are not inherently protected, since residual locked positions remain vulnerable if smart contract logic is unpatched; (2) permissionless pool creation, a design feature of concentrated liquidity AMMs, allows attackers to introduce malicious tokens without governance approval or an access-control bypass, lowering the barrier to accounting exploits; (3) a shared-vault architecture linking multiple pools through a single settlement layer can amplify a single accounting flaw across all pooled assets; and (4) deprecated protocols that retain user funds without continued security review present a persistent, unmitigated attack surface. The absence of publicly identified security audits covering the EVIL-token attack vector suggests the vulnerability may not have been reviewed after the protocol entered dormancy.","heading":"Protocol Dormancy and Systemic Risk Factors","sources":[{"url":"https://defillama.com/protocol/myswap-cl","name":"mySwap CL TVL and Volume - DefiLlama","type":"research","credibility":2},{"url":"https://cryptoadventure.com/myswap-loses-305k-on-starknet-after-fake-evil-token-abuses-cl-pool-accounting/","name":"mySwap Loses $305K On Starknet After Fake EVIL Token Abuses CL Pool Accounting - CryptoAdventure","type":"news_article","credibility":2},{"url":"https://phemex.com/news/article/starknets-myswap-protocol-exploited-300000-drained-90069","name":"Starknet's mySwap Protocol Exploited, $300,000 Drained - Phemex News","type":"news_article","credibility":2}],"severity":"high"},{"content":"The mySwap exploit occurred during a period of elevated DeFi security incidents in 2026. The Starknet ecosystem has seen parallel smart contract incidents, including an exploit of the Ekubo swap router in which attackers drained $1.4 million, indicating broader smart contract risk across Starknet-native DeFi protocols. The attack vector, a permissionless malicious-token interaction manipulating shared-vault accounting, represents a class of vulnerability applicable to any CL AMM that does not enforce strict token allowlisting or balance-validation invariants. The use of Railgun for post-exploit fund concealment has been observed in multiple DeFi security incidents and presents ongoing challenges for incident response and fund recovery.","heading":"Broader Starknet Ecosystem Security Context","sources":[{"url":"https://cryptoadventure.com/myswap-loses-305k-on-starknet-after-fake-evil-token-abuses-cl-pool-accounting/","name":"mySwap Loses $305K On Starknet After Fake EVIL Token Abuses CL Pool Accounting - CryptoAdventure","type":"news_article","credibility":2},{"url":"https://www.theblock.co/post/400189/attackers-drain-1-4m-in-wrapped-bitcoin-from-defi-protocol-ekubo-in-approval-based-exploit","name":"Attackers drain $1.4M in wrapped bitcoin from Ekubo DeFi protocol - The Block","type":"news_article","credibility":2},{"url":"https://hacked.slowmist.io/","name":"SlowMist Hacked Database","type":"research","credibility":2}],"severity":"medium"}],"timeline":[{"date":"2022-01","event":"mySwap launches on Starknet as the first AMM on the network (launch month per the mySwap X account and Starknet ecosystem records; the Braavos blog gives March 2022).","source":"mySwap on X (@mySwapxyz)","source_url":"https://x.com/mySwapxyz"},{"date":"2022-03","event":"mySwap launches as the first AMM on Starknet mainnet, initially supporting ETH, USDC, DAI and WBTC pools (launch month per Braavos; another record gives January 2022).","source":"Braavos Blog","source_url":"https://braavos.app/myswap-starknet-amm/"},{"date":"2023-11","event":"mySwap announces migration from the legacy constant-product AMM to mySwap Concentrated Liquidity (CL), offering a 14-day migration window with an incentive reward for users who migrate.","source":"mySwap on X (@mySwapxyz)","source_url":"https://x.com/mySwapxyz/status/1729807820365660315"},{"date":"2024-04","event":"mySwap CL reaches peak total value locked of approximately $9.7 million according to DefiLlama.","source":"DefiLlama - mySwap CL","source_url":"https://defillama.com/protocol/myswap-cl"},{"date":"2024-07","event":"TVL begins sustained decline from the $9.7M peak, falling to low single-digit millions and continuing downward through 2024.","source":"DefiLlama - mySwap CL","source_url":"https://defillama.com/protocol/myswap-cl"},{"date":"2025-01","event":"mySwap CL TVL reaches approximately $5,000, a decline of over 99.9% from peak; protocol effectively dormant with no new deposits accepted (date per one page; another gives June 2025).","source":"DefiLlama - mySwap CL","source_url":"https://defillama.com/protocol/myswap-cl"},{"date":"2025-06","event":"mySwap CL TVL falls to approximately $5,000, a decline of over 99.9% from its April 2024 peak; protocol effectively dormant with no new deposits accepted (date per one page; another gives January 2025).","source":"DefiLlama - mySwap CL","source_url":"https://defillama.com/protocol/myswap-cl"},{"date":"2026-06","event":"On June 19 at approximately 7:15 AM UTC, an attacker deploys a malicious token named EVIL on Starknet and uses it to abuse mySwap CL pool accounting and shared-vault logic, draining 137.96 ETH, 45,000 USDC, 19,900 USDT and 230,000 STRK (approximately $305,000) from more than 100,000 LP positions.","source":"CryptoAdventure","source_url":"https://cryptoadventure.com/myswap-loses-305k-on-starknet-after-fake-evil-token-abuses-cl-pool-accounting/"},{"date":"2026-06","event":"The attacker bridges the stolen assets off Starknet and routes them through the Railgun privacy protocol to obscure transaction flows; protocol liquidity is nearly entirely depleted.","source":"CryptoAdventure","source_url":"https://cryptoadventure.com/myswap-loses-305k-on-starknet-after-fake-evil-token-abuses-cl-pool-accounting/"},{"date":"2026-06","event":"On June 20, mySwap confirms the incident publicly, stating it is assessing the full impact. No post-mortem, recovery plan or reimbursement announcement is issued as of this date.","source":"Phemex News","source_url":"https://phemex.com/news/article/starknets-myswap-protocol-exploited-300000-drained-90069"}],"sources_used":[{"url":"https://cryptoadventure.com/myswap-loses-305k-on-starknet-after-fake-evil-token-abuses-cl-pool-accounting/","name":"mySwap Loses $305K On Starknet After Fake EVIL Token Abuses CL Pool Accounting - CryptoAdventure","type":"news_article","archive_url":"https://web.archive.org/web/20260727094409/https://cryptoadventure.com/myswap-loses-305k-on-starknet-after-fake-evil-token-abuses-cl-pool-accounting/","credibility":2,"archive_timestamp":"2026-07-27T09:44:09+00:00"},{"url":"https://phemex.com/news/article/starknets-myswap-protocol-exploited-300000-drained-90069","name":"Starknet's mySwap Protocol Exploited, $300,000 Drained - Phemex News","type":"news_article","archive_url":"https://web.archive.org/web/20260727003238/https://phemex.com/news/article/starknets-myswap-protocol-exploited-300000-drained-90069","credibility":2,"archive_timestamp":"2026-07-27T00:32:38+00:00"},{"url":"https://defillama.com/protocol/myswap-cl","name":"mySwap CL TVL and Volume - DefiLlama","type":"research","archive_url":"http://web.archive.org/web/20260312060727/https://defillama.com/protocol/myswap-cl","credibility":2,"archive_timestamp":"2026-03-12T06:07:27+00:00"},{"url":"https://defillama.com/protocol/myswap","name":"mySwap TVL and Volume - DefiLlama","type":"research","archive_url":"http://web.archive.org/web/20250809040220/https://defillama.com/protocol/myswap","credibility":2,"archive_timestamp":"2025-08-09T04:02:20+00:00"},{"url":"https://hacked.slowmist.io/","name":"SlowMist Hacked Database","type":"research","archive_url":"http://web.archive.org/web/20260709063802/https://hacked.slowmist.io/","credibility":2,"archive_timestamp":"2026-07-09T06:38:02+00:00"},{"url":"https://www.myswap.xyz/","name":"mySwap Concentrated Liquidity on Starknet - Official Site","type":"official","archive_url":"http://web.archive.org/web/20260410151013/https://www.myswap.xyz/","credibility":2,"archive_timestamp":"2026-04-10T15:10:13+00:00"},{"url":"https://braavos.app/myswap-starknet-amm/","name":"mySwap: Leading Starknet's AMM Arena with the Best Yields - Braavos","type":"other","archive_url":"http://web.archive.org/web/20260418194707/https://braavos.app/myswap-starknet-amm/","credibility":3,"archive_timestamp":"2026-04-18T19:47:07+00:00"},{"url":"https://x.com/mySwapxyz","name":"mySwap on X (@mySwapxyz)","type":"social_media","credibility":3},{"url":"https://www.theblock.co/post/400189/attackers-drain-1-4m-in-wrapped-bitcoin-from-defi-protocol-ekubo-in-approval-based-exploit","name":"Attackers drain $1.4M in wrapped bitcoin from Ekubo DeFi protocol - The Block","type":"news_article","archive_url":"http://web.archive.org/web/20260507035343/https://www.theblock.co/post/400189/attackers-drain-1-4m-in-wrapped-bitcoin-from-defi-protocol-ekubo-in-approval-based-exploit","credibility":2,"archive_timestamp":"2026-05-07T03:53:43+00:00"}],"source_tags":[],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-code-merge-writer","created_at":"2026-06-25T23:27:19.432645+00:00","updated_at":"2026-11-02T00:31:25.311+00:00"},"source_quality":{"total":9,"tier1":0,"tier2":1,"tier3":1,"unrated":7},"follower_count":null,"content_updated_at":"2026-11-02T00:31:26.869Z","last_fact_checked_at":"2026-11-02T00:31:25.558Z","fact_check_next_allowed_at":null,"update_next_allowed_at":null}