{"investigation":{"slug":"neutrl","entity_name":"Neutrl","trust_score":54,"severity_base":54,"score_modifier":0,"confidence":0.72,"status":"published","content_type":"investigation","summary":"Neutrl is a DeFi protocol issuing NUSD, a market-neutral synthetic dollar backed by OTC altcoin arbitrage and delta-neutral futures hedging strategies. The protocol raised $5 million in seed funding in April 2025 and grew to over $136 million in TVL. In March 2026 Neutrl suffered a DNS hijacking attack — part of a coordinated campaign targeting .fi domain protocols — that compromised its frontend interface, though the team maintained that smart contract reserves and user funds were not directly drained.","sections":[{"content":"Neutrl was founded by Behrin Naidoo, who serves as CEO, and is incorporated and headquartered in Panama City, Panama. Naidoo holds a master's degree in finance from London Business School, holds a CA(SA) designation, and previously worked at PwC (chartered accountancy articles in banking and capital markets), J.P. Morgan (sell-side equity analyst covering financials), RMI and RMH (investment professional in fintech), and was a co-founder of Fyde Treasury. Neutrl's primary product is NUSD, a synthetic dollar token that generates yield via two strategies: (1) OTC arbitrage, in which the protocol acquires locked altcoin allocations at discounts of 20-80% below public market prices in private markets, then opens short perpetual-futures positions to hedge directional exposure; and (2) funding rate capture and delta-neutral on-chain strategies. All yield is routed to holders of sNUSD, the protocol's staked yield-bearing token. NUSD minting is permissionless (accepting USDC, USDT, and USDe as collateral), but redemption is restricted to KYB/KYC-verified institutional counterparties. sNUSD carries a 10-day unstaking cooldown. Neutrl launched a public protocol in November 2025 following a private beta that reported 30% yields and a $52 million TVL.","heading":"Protocol Overview and Business Model","sources":[{"url":"https://www.coindesk.com/business/2025/04/16/neutrl-raises-usd5m-to-tokenize-a-popular-hedge-fund-altcoin-trade","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.globenewswire.com/news-release/2025/04/17/3063560/0/en/STIX-and-Accomplice-Lead-Neutrl-s-5-Million-Raise-to-Launch-NUSD-a-High-Yield-Synthetic-Dollar.html","name":"globenewswire.com","type":"other","credibility":3},{"url":"https://iq.wiki/wiki/neutrl","name":"iq.wiki","type":"other","credibility":3},{"url":"https://stabledash.com/news/2025-11-10-neutrl-launches-synthetic-dollar-nusd-for-otc-arbitrage-yield","name":"stabledash.com","type":"other","credibility":3}],"severity":"medium"},{"content":"In April 2025 Neutrl raised $5 million in seed funding in a round led by STIX, a digital-asset private marketplace, and Accomplice, a venture capital firm. Additional institutional backers included Amber Group, SCB Limited, Figment Capital, and Nascent. Notable angel investors included Guy Young, the founder of Ethena, and Joshua Lim of Arbelos Markets. The protocol subsequently grew its pre-deposit vault to $75 million before public launch. By early 2026 the protocol reported over $136 million in total value locked and, separately, a $50 million vault cap was reached within 20 minutes of opening. These TVL figures have not been independently audited in sources available to this investigation.","heading":"Funding and Investors","sources":[{"url":"https://www.coindesk.com/business/2025/04/16/neutrl-raises-usd5m-to-tokenize-a-popular-hedge-fund-altcoin-trade","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.globenewswire.com/news-release/2025/04/17/3063560/0/en/STIX-and-Accomplice-Lead-Neutrl-s-5-Million-Raise-to-Launch-NUSD-a-High-Yield-Synthetic-Dollar.html","name":"globenewswire.com","type":"other","credibility":3},{"url":"https://cryptorank.io/ico/neutrl","name":"cryptorank.io","type":"other","credibility":3}],"severity":"medium"},{"content":"On or around March 18-19, 2026, Neutrl experienced a DNS hijacking attack in which the protocol's domain registrar was allegedly compromised through social engineering. Attackers reportedly convinced a human agent at the registrar to alter nameserver settings, redirecting the neutrl.fi frontend to a malicious site without accessing the underlying smart contracts. The malicious interface prompted users to authorize Permit2 token approvals, which grant external contracts authority over wallet assets without further verification. Two specific malicious contract addresses were flagged: 0x23f2741EaA0045038e9b52100CdcC890163dE53F and 0xa0Adf074056E41dfB892aFC69881E15073b384b9. Neutrl paused its smart contracts as a precautionary measure and enlisted security firm 0xGroomLake to investigate. The team advised all users who had interacted with the compromised domain to revoke approvals via revoke.cash. According to Neutrl's official communications, the protocol's net asset value and reserve assets were held in institutional custodial wallets isolated by an off-exchange settlement mechanism, and the team stated that all user funds remained secure. No publicly verified third-party accounting of potential individual user wallet losses has been identified in sources reviewed for this investigation.","heading":"March 2026 DNS Hijacking Incident","sources":[{"url":"https://www.cryptotimes.io/2026/03/19/neutrl-defi-pauses-smart-contracts-amid-suspected-dns-frontend-hijack/","name":"cryptotimes.io","type":"other","credibility":3},{"url":"https://www.cryptonewsz.com/neutrl-front-end-attack-update-urgent-security/","name":"cryptonewsz.com","type":"other","credibility":3},{"url":"https://phemex.com/news/article/neutrl-resumes-operations-after-dns-migration-posthijacking-68032","name":"phemex.com","type":"other","credibility":3},{"url":"https://smartcontractshacking.com/hacks/neutrl-hack-2026","name":"smartcontractshacking.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Web3 security researchers identified the Neutrl DNS hijack as one of four related incidents targeting .fi domain DeFi protocols within a compressed timeframe in early 2026. The other affected protocols were Cow.fi, Steakhouse, and HypurrFi. In each case the entry point was alleged to be social engineering of a human employee at a domain registrar, enabling attackers to change nameserver settings and redirect web traffic to malicious frontends. Fraudulent TLS certificates were reportedly issued for the hijacked domains. Researchers described this pattern as a coordinated infrastructure campaign rather than isolated incidents, noting that no smart contract vulnerabilities were exploited in any of the four cases. The shared attack vector highlighted a systemic vulnerability in DeFi's reliance on traditional Web2 domain infrastructure.","heading":"Coordinated .fi Domain Attack Campaign","sources":[{"url":"https://web3secnews.substack.com/p/the-fi-files-a-field-report-on-dns","name":"web3secnews.substack.com","type":"other","credibility":3},{"url":"https://www.cryptotimes.io/2026/03/19/neutrl-defi-pauses-smart-contracts-amid-suspected-dns-frontend-hijack/","name":"cryptotimes.io","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the DNS hijacking, Neutrl migrated its official domain from neutrl.fi to neutrl.finance and switched to a new DNS service provider. Smart contracts were unpaused once the investigation concluded that the on-chain protocol layer had not been compromised. The neutrl.fi domain was declared permanently unsafe and scheduled for phase-out. Neutrl subsequently partnered with Hypernative as a real-time security monitor and automated pause guardian. Under this arrangement, Hypernative holds a smart-contract pauser role; the team noted that false positives triggering unnecessary pauses were considered preferable to missing genuine exploits. Neutrl also adopted a deterministic on-chain settlement architecture to eliminate off-chain signing attack surfaces, and integrated Chainlink oracles queried directly at transaction execution time with price-range safeguards that cause transactions to revert if collateral prices fall outside defined thresholds. Reserve solvency is attested via zero-knowledge proof attestations through Accountable.","heading":"Post-Incident Remediation and Security Architecture","sources":[{"url":"https://www.weex.com/news/detail/neutrl-dns-migration-has-been-completed-and-operations-have-resumed-the-original-domain-will-be-gradually-phased-out-393585","name":"weex.com","type":"other","credibility":3},{"url":"https://phemex.com/news/article/neutrl-resumes-operations-after-dns-migration-posthijacking-68032","name":"phemex.com","type":"other","credibility":3},{"url":"https://www.hypernative.io/blog/how-neutrl-built-nusd-onchain-settlement-architecture-with-hypernative-as-real-time-monitor-and-pauser","name":"hypernative.io","type":"other","credibility":3},{"url":"https://www.panewslab.com/en/articles/019d0f98-33ac-76cd-9ed3-35fdc6ef1292","name":"panewslab.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Neutrl's OTC arbitrage model exposes the protocol to several structural risks documented in its own materials. Counterparty risk arises from the possibility that sellers of locked tokens may fail to deliver assets due to insolvency, fraud, or operational failure. Neutrl states it mitigates this through KYC/KYB checks, enforceable legal agreements, and use of institutional custodians (BitGo and Coinbase Custody) as escrow agents. Delta-neutral strategies carry basis risk: in a sharp market dislocation, auto-deleveraging on perpetual futures platforms could leave the protocol with an unhedged long position. Centralized exchange dependence introduces counterparty and liquidity risk, as hedging is typically executed on major CEXs such as Binance or OKX. Scalability of yields is uncertain as TVL grows, since the OTC deal pipeline is capacity-constrained. The broader synthetic stablecoin sector experienced a stress event in November 2025 when USDX, a comparable delta-neutral synthetic dollar with $683 million TVL, collapsed from $1 to as low as $0.09. Neutrl was not implicated in that event. The protocol has not published a public smart contract audit report in sources available to this investigation. Redemption restrictions to KYB/KYC-verified counterparties only may limit retail users' ability to exit in a stress scenario.","heading":"Protocol Risk Factors","sources":[{"url":"https://docs.neutrl.fi/risks/counterparty-risks","name":"docs.neutrl.fi","type":"other","credibility":3},{"url":"https://messari.io/report/neutrl-otc-and-delta-neutral-strategies","name":"messari.io","type":"other","credibility":3},{"url":"https://www.blocmates.com/articles/neutrl-unlocking-crypto-s-private-markets","name":"blocmates.com","type":"other","credibility":3},{"url":"https://alearesearch.substack.com/p/neutrl-altcoin-otc","name":"alearesearch.substack.com","type":"other","credibility":3},{"url":"https://blofin.com/en/academy/blofin-courses/what-s-behind-the-recent-stablecoin-defi-turmoil","name":"blofin.com","type":"other","credibility":3}],"severity":"medium"},{"content":"In 2026 Neutrl announced a partnership with LayerZero, adopting the OFT (Omnichain Fungible Token) standard for both NUSD and sNUSD. This integration enables transfers of Neutrl tokens across more than 150 blockchains connected by LayerZero's interoperability protocol. The protocol also partnered with prediction market platforms. Separately, Neutrl was added to DefiLlama's tracking registry, providing publicly accessible TVL data. As of May 2026 no regulatory actions, law enforcement inquiries, or SEC/CFTC proceedings involving Neutrl have been identified in public records. The ZachXBT flag associated with this entity appears to relate to the DNS hijack infrastructure incident; no specific public post by ZachXBT directly attributing fraud or fund misappropriation to Neutrl's team has been identified in sources reviewed for this investigation.","heading":"Cross-Chain Expansion and Regulatory Status","sources":[{"url":"https://www.mexc.co/en-PH/news/163368","name":"mexc.co","type":"other","credibility":3},{"url":"https://blockchainreporter.net/neutrl-partners-with-layerzero-for-oft-standard-unlocks-nusd-snusd-stablecoins-defi-cross-chain-interoperability/","name":"blockchainreporter.net","type":"other","credibility":3},{"url":"https://blockworks.co/news/prediction-markets-neutrl","name":"blockworks.co","type":"other","credibility":3},{"url":"https://x.com/DefiLlama/status/1922045423495074012","name":"x.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2025-04-16","event":"Neutrl raises $5 million in seed funding led by STIX and Accomplice, with participation from Amber Group, SCB Limited, Figment Capital, Nascent, and angel investors including Ethena founder Guy Young.","source":""},{"date":"2025-11-10","event":"Neutrl launches its public DeFi protocol, issuing NUSD and sNUSD. The protocol reports $75 million raised in a pre-deposit vault campaign and early yields of approximately 30%.","source":""},{"date":"2025-11","event":"USDX, a competing delta-neutral synthetic dollar with $683 million TVL, collapses from $1 to $0.09 — a sector stress event that increased scrutiny of all synthetic stablecoin protocols.","source":"","date_original":"2025-11-01"},{"date":"2026-03-18","event":"Neutrl's neutrl.fi domain is hijacked via social engineering of the domain registrar. Users redirected to a malicious frontend prompting unauthorized Permit2 approvals. Smart contracts paused. Security firm 0xGroomLake engaged.","source":""},{"date":"2026-03-19","event":"Neutrl publicly warns users to cease all interaction with neutrl.fi, provides malicious contract addresses to revoke, and advises use of revoke.cash. Incident identified as part of coordinated campaign also targeting Cow.fi, Steakhouse, and HypurrFi.","source":""},{"date":"2026-03-21","event":"Neutrl completes DNS migration to neutrl.finance and switches DNS providers. Smart contracts unpaused. Team states all reserve assets and NAV remain secure in custodial wallets.","source":""},{"date":"2026-05","event":"Neutrl announces LayerZero OFT standard integration, enabling NUSD and sNUSD transfers across 150+ blockchains.","source":"","date_original":"2026-05-01"}],"sources_used":[{"url":"https://www.coindesk.com/business/2025/04/16/neutrl-raises-usd5m-to-tokenize-a-popular-hedge-fund-altcoin-trade","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20260311065416/https://www.coindesk.com/business/2025/04/16/neutrl-raises-usd5m-to-tokenize-a-popular-hedge-fund-altcoin-trade","credibility":3,"archive_timestamp":"2026-03-11T06:54:16+00:00"},{"url":"https://www.globenewswire.com/news-release/2025/04/17/3063560/0/en/STIX-and-Accomplice-Lead-Neutrl-s-5-Million-Raise-to-Launch-NUSD-a-High-Yield-Synthetic-Dollar.html","name":"globenewswire.com","type":"other","archive_url":"https://web.archive.org/web/20260829090358/https://www.globenewswire.com/news-release/2025/04/17/3063560/0/en/STIX-and-Accomplice-Lead-Neutrl-s-5-Million-Raise-to-Launch-NUSD-a-High-Yield-Synthetic-Dollar.html","credibility":3,"archive_timestamp":"2026-08-29T09:03:58+00:00"},{"url":"https://iq.wiki/wiki/neutrl","name":"iq.wiki","type":"other","archive_url":"http://web.archive.org/web/20260313021739/https://iq.wiki/wiki/neutrl","credibility":3,"archive_timestamp":"2026-03-13T02:17:39+00:00"},{"url":"https://stabledash.com/news/2025-11-10-neutrl-launches-synthetic-dollar-nusd-for-otc-arbitrage-yield","name":"stabledash.com","type":"other","archive_url":"http://web.archive.org/web/20260310102857/https://stabledash.com/news/2025-11-10-neutrl-launches-synthetic-dollar-nusd-for-otc-arbitrage-yield","credibility":3,"archive_timestamp":"2026-03-10T10:28:57+00:00"},{"url":"https://cryptorank.io/ico/neutrl","name":"cryptorank.io","type":"other","archive_url":"http://web.archive.org/web/20260513011043/https://cryptorank.io/ico/neutrl","credibility":3,"archive_timestamp":"2026-05-13T01:10:43+00:00"},{"url":"https://www.cryptotimes.io/2026/03/19/neutrl-defi-pauses-smart-contracts-amid-suspected-dns-frontend-hijack/","name":"cryptotimes.io","type":"other","archive_url":"http://web.archive.org/web/20260726153227/https://www.cryptotimes.io/2026/03/19/neutrl-defi-pauses-smart-contracts-amid-suspected-dns-frontend-hijack/","credibility":3,"archive_timestamp":"2026-07-26T15:32:27+00:00"},{"url":"https://www.cryptonewsz.com/neutrl-front-end-attack-update-urgent-security/","name":"cryptonewsz.com","type":"other","archive_url":"http://web.archive.org/web/20260415223914/https://www.cryptonewsz.com/neutrl-front-end-attack-update-urgent-security/","credibility":3,"archive_timestamp":"2026-04-15T22:39:14+00:00"},{"url":"https://phemex.com/news/article/neutrl-resumes-operations-after-dns-migration-posthijacking-68032","name":"phemex.com","type":"other","archive_url":"http://web.archive.org/web/20260726192551/https://phemex.com/news/article/neutrl-resumes-operations-after-dns-migration-posthijacking-68032","credibility":3,"archive_timestamp":"2026-07-26T19:25:51+00:00"},{"url":"https://smartcontractshacking.com/hacks/neutrl-hack-2026","name":"smartcontractshacking.com","type":"other","archive_url":"http://web.archive.org/web/20260726145443/https://smartcontractshacking.com/hacks/neutrl-hack-2026","credibility":3,"archive_timestamp":"2026-07-26T14:54:43+00:00"},{"url":"https://web3secnews.substack.com/p/the-fi-files-a-field-report-on-dns","name":"web3secnews.substack.com","type":"other","archive_url":"http://web.archive.org/web/20260726094923/https://web3secnews.substack.com/p/the-fi-files-a-field-report-on-dns","credibility":3,"archive_timestamp":"2026-07-26T09:49:23+00:00"},{"url":"https://www.weex.com/news/detail/neutrl-dns-migration-has-been-completed-and-operations-have-resumed-the-original-domain-will-be-gradually-phased-out-393585","name":"weex.com","type":"other","archive_url":"http://web.archive.org/web/20260726112736/https://www.weex.com/news/detail/neutrl-dns-migration-has-been-completed-and-operations-have-resumed-the-original-domain-will-be-gradually-phased-out-393585","credibility":3,"archive_timestamp":"2026-07-26T11:27:36+00:00"},{"url":"https://www.hypernative.io/blog/how-neutrl-built-nusd-onchain-settlement-architecture-with-hypernative-as-real-time-monitor-and-pauser","name":"hypernative.io","type":"other","archive_url":"http://web.archive.org/web/20260515141739/https://www.hypernative.io/blog/how-neutrl-built-nusd-onchain-settlement-architecture-with-hypernative-as-real-time-monitor-and-pauser","credibility":3,"archive_timestamp":"2026-05-15T14:17:39+00:00"},{"url":"https://www.panewslab.com/en/articles/019d0f98-33ac-76cd-9ed3-35fdc6ef1292","name":"panewslab.com","type":"other","archive_url":"https://web.archive.org/web/20260829091231/https://panews.io/articles/019d0f98-33ac-76cd-9ed3-35fdc6ef1292","credibility":3,"archive_timestamp":"2026-08-29T09:12:31+00:00"},{"url":"https://docs.neutrl.fi/risks/counterparty-risks","name":"docs.neutrl.fi","type":"other","archive_url":"http://web.archive.org/web/20260117002659/https://docs.neutrl.fi/risks/counterparty-risks","credibility":3,"archive_timestamp":"2026-01-17T00:26:59+00:00"},{"url":"https://messari.io/report/neutrl-otc-and-delta-neutral-strategies","name":"messari.io","type":"other","archive_url":null,"credibility":3,"archive_error":"error:unauthorized","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.blocmates.com/articles/neutrl-unlocking-crypto-s-private-markets","name":"blocmates.com","type":"other","archive_url":"http://web.archive.org/web/20260714153755/https://www.blocmates.com/articles/neutrl-unlocking-crypto-s-private-markets","credibility":3,"archive_timestamp":"2026-07-14T15:37:55+00:00"},{"url":"https://alearesearch.substack.com/p/neutrl-altcoin-otc","name":"alearesearch.substack.com","type":"other","archive_url":"http://web.archive.org/web/20260108195112/https://alearesearch.substack.com/p/neutrl-altcoin-otc","credibility":3,"archive_timestamp":"2026-01-08T19:51:12+00:00"},{"url":"https://blofin.com/en/academy/blofin-courses/what-s-behind-the-recent-stablecoin-defi-turmoil","name":"blofin.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.mexc.co/en-PH/news/163368","name":"mexc.co","type":"other","archive_url":null,"credibility":3,"archive_error":"error:gone","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://blockchainreporter.net/neutrl-partners-with-layerzero-for-oft-standard-unlocks-nusd-snusd-stablecoins-defi-cross-chain-interoperability/","name":"blockchainreporter.net","type":"other","archive_url":"https://web.archive.org/web/20260830154505/https://blockchainreporter.net/neutrl-partners-with-layerzero-for-oft-standard-unlocks-nusd-snusd-stablecoins-defi-cross-chain-interoperability/","credibility":3,"archive_timestamp":"2026-08-30T15:45:05+00:00"},{"url":"https://blockworks.co/news/prediction-markets-neutrl","name":"blockworks.co","type":"other","archive_url":"http://web.archive.org/web/20251229104016/https://blockworks.co/news/prediction-markets-neutrl","credibility":3,"archive_timestamp":"2025-12-29T10:40:16+00:00"},{"url":"https://x.com/DefiLlama/status/1922045423495074012","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:12.668829+00:00","updated_at":"2026-10-10T18:46:36.57+00:00"},"source_quality":{"total":22,"tier1":0,"tier2":1,"tier3":1,"unrated":20},"follower_count":null,"content_updated_at":"2026-10-10T18:46:36.820Z","last_fact_checked_at":"2026-08-27T11:06:12.996Z","fact_check_next_allowed_at":null,"update_next_allowed_at":null}