{"investigation":{"slug":"nowswap","entity_name":"NowSwap","trust_score":22,"severity_base":null,"score_modifier":0,"confidence":0.78,"status":"published","content_type":"investigation","summary":"NowSwap is an Ethereum-based automated market maker (AMM) decentralized exchange that launched in July 2021, positioning itself as the first DEX optimized for small-size trades under $3,000. On September 15, 2021, the protocol suffered a smart contract exploit resulting in the loss of approximately $1.07 million in USDT and WETH, caused by an incomplete code update that left an invalid K-value check in the pair contract. Following the exploit, the protocol's total value locked effectively collapsed to near zero and has remained dormant, with no evidence of remediation, audit, or resumed operations.","sections":[{"content":"NowSwap is a decentralized exchange (DEX) protocol deployed on Ethereum mainnet, operating as an automated market maker (AMM). The project was publicly announced on July 8, 2021, via a Medium post, with the stated goal of being the first DEX tailored specifically for smaller trades under $3,000. The protocol claimed to save traders up to 50% in fees compared to leading AMMs for trades in this size range, with fees dynamically calculated based on total value locked (TVL) and trade size. NowSwap also announced plans for a companion product called 'NowSwap XL' targeting large-size trades. The project's team has not been publicly identified; no named founders, developers, or advisors have been disclosed on any official channel. The protocol's smart contracts were not open-sourced at the time of launch or at the time of the September 2021 exploit.","heading":"Overview","sources":[{"url":"https://nowswap.medium.com/","name":"nowswap.medium.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/nowswap","name":"defillama.com","type":"other","credibility":3},{"url":"https://halborn.com/explained-the-nowswap-protocol-hack-september-2021/","name":"halborn.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On September 15, 2021, NowSwap suffered a smart contract exploit that drained approximately $1,069,000 from its primary liquidity pool. The stolen assets comprised 535,706 USDT and 158.28 WETH, reducing the pool balance from $1,069,197 to approximately $24.15. The incident was first publicly identified by blockchain security researcher @PuPuThrashing on Twitter, and subsequently analyzed by security firms PeckShield and BlockSec. According to PeckShield's analysis, the exploit stemmed from an invalid K-value check in the protocol's pair contract: 'the current implementation only enforces 1/10 of K.' The attack mechanism involved the attacker deploying a malicious contract using 0.14723529 ETH and executing the exploit in block 13229001. By swapping token0 for token0 (i.e., the same token on both sides), the attacker caused amount1In and amount1Out to equal zero, which made part of the K-value check formula resolve to zero, thereby bypassing all subsequent safety checks. This allowed the attacker to drain approximately 98% of the contract's pooled value by swapping a negligible amount of 1 wei. Following the theft, the attacker converted the stolen USDT to ETH via the 1inch DEX aggregator and laundered the proceeds through Tornado Cash across four separate transactions. NowSwap's team stated they had 'launched an investigation' and pledged to work with law enforcement for fund recovery; no subsequent recovery or restitution has been publicly documented.","heading":"Incident Details — September 2021 Smart Contract Exploit","sources":[{"url":"https://halborn.com/explained-the-nowswap-protocol-hack-september-2021/","name":"halborn.com","type":"other","credibility":3},{"url":"https://coinchapter.com/over-1m-in-usdt-and-weth-stolen-following-nowswap-dex-hack/","name":"coinchapter.com","type":"other","credibility":3},{"url":"https://coingape.com/defi-hack-alert-nowswap-losses-over-1-million-in-cyber-attack/","name":"coingape.com","type":"other","credibility":3},{"url":"https://quadrigainitiative.com/casestudy/nowswapprotocollogicerror.php","name":"quadrigainitiative.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The exploit was executed in Ethereum block 13229001 on September 15, 2021. According to the Quadriga Initiative case study, the attacker created a malicious contract funded with 0.14723529 ETH prior to executing the drain. Stolen funds — initially in USDT — were swapped to ETH through the 1inch aggregator to obfuscate the origin, then deposited into Tornado Cash across four separate transactions to further obscure the trail. Tornado Cash is a smart contract-based coin mixer on Ethereum that severs the on-chain link between source and destination addresses, complicating fund tracing. The use of multiple Tornado Cash deposits indicates a deliberate laundering strategy consistent with the techniques employed in other DeFi exploits of the same period. No recovery of funds has been publicly confirmed. The protocol's current TVL on DefiLlama and Stelareum stands at approximately $4–$5 USD, indicating the liquidity pool was never meaningfully replenished after the exploit. The contract code was not open-sourced, limiting independent on-chain verification by outside researchers.","heading":"On-Chain Evidence","sources":[{"url":"https://quadrigainitiative.com/casestudy/nowswapprotocollogicerror.php","name":"quadrigainitiative.com","type":"other","credibility":3},{"url":"https://coinchapter.com/over-1m-in-usdt-and-weth-stolen-following-nowswap-dex-hack/","name":"coinchapter.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/nowswap","name":"defillama.com","type":"other","credibility":3},{"url":"https://www.stelareum.io/en/defi-tvl/protocol/s_nowswap.html","name":"stelareum.io","type":"other","credibility":3}],"severity":"medium"},{"content":"NowSwap's team has never been publicly identified. No founder names, developer pseudonyms, advisory board members, or organizational disclosures appear on the project's official website, Medium blog, or social media channels. The project's Medium page lists only 5 followers and contains two posts from July and August 2021, with no posts after the September 2021 exploit. The Twitter account @nowswap_org has similarly shown no substantive activity since the incident. The protocol's smart contracts were not open-sourced, a practice that security researchers at Halborn explicitly identified as a contributing factor to the exploit — closed-source code prevents the broader security community from reviewing contracts for vulnerabilities. The anonymity of the team and the closed-source nature of the codebase made independent pre-launch security review impossible. There is no public record of any third-party security audit having been conducted prior to launch.","heading":"Team and Background","sources":[{"url":"https://nowswap.medium.com/","name":"nowswap.medium.com","type":"other","credibility":3},{"url":"https://halborn.com/explained-the-nowswap-protocol-hack-september-2021/","name":"halborn.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/nowswap","name":"defillama.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Security researchers at Halborn noted that the NowSwap exploit is technically identical to the Uranium Finance hack that occurred in April 2021, approximately five months earlier. In both cases, the vulnerability arose from an inconsistent code update: a constant value K set to 1,000 appeared in three locations in the pair contract, but an update modified it in only two places, leaving the third — a validation check — at 1/10 of the intended enforcement level. The Uranium Finance exploit had already been publicly documented and analyzed prior to the NowSwap launch and exploit. Halborn observed that had the NowSwap team been aware of prior DeFi security incidents, the identical vulnerability pattern could have been identified and remediated before deployment. This raises questions about whether the NowSwap team conducted any review of contemporaneous exploit disclosures before or after launching the protocol.","heading":"Connection to Prior Vulnerability — Uranium Finance","sources":[{"url":"https://halborn.com/explained-the-nowswap-protocol-hack-september-2021/","name":"halborn.com","type":"other","credibility":3},{"url":"https://medium.com/immunefi/building-a-poc-for-the-uranium-heist-ec83fbd83e9f","name":"medium.com","type":"other","credibility":3},{"url":"https://coingape.com/defi-hack-alert-nowswap-losses-over-1-million-in-cyber-attack/","name":"coingape.com","type":"other","credibility":3}],"severity":"medium"},{"content":"NowSwap presents multiple compounding risk factors. First, the protocol suffered a near-total loss of user funds in September 2021, with approximately $1.07 million drained from its liquidity pool through a smart contract logic error. No restitution or fund recovery has been publicly documented. Second, the smart contracts were not open-sourced and there is no evidence a third-party security audit was ever conducted — both practices that security researchers have identified as direct contributors to the exploit. Third, the team is entirely anonymous, with no named individuals accountable for the protocol's design, deployment, or post-incident response. Fourth, the protocol's TVL has remained at near-zero ($4–$5 USD as of 2024) since the exploit, indicating the protocol is effectively inactive and abandoned. Fifth, the vulnerability exploited in NowSwap was already publicly known from the Uranium Finance incident — its recurrence in NowSwap suggests either negligence or disregard for known security risks. ZachXBT, an on-chain investigator known for flagging DeFi exploits and fraudulent projects, is noted to have flagged this entity. The combination of anonymous team, no audit, closed-source contracts, a successful exploit with unrecovered funds, and apparent protocol abandonment places NowSwap in the high-risk category. Users who provided liquidity to NowSwap should assume those funds are unrecoverable.","heading":"Risk Assessment","sources":[{"url":"https://halborn.com/explained-the-nowswap-protocol-hack-september-2021/","name":"halborn.com","type":"other","credibility":3},{"url":"https://quadrigainitiative.com/casestudy/nowswapprotocollogicerror.php","name":"quadrigainitiative.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/nowswap","name":"defillama.com","type":"other","credibility":3},{"url":"https://coingape.com/defi-hack-alert-nowswap-losses-over-1-million-in-cyber-attack/","name":"coingape.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021","event":"NowSwap protocol reportedly launched on Ethereum mainnet (approximate, per Quadriga Initiative case study).","source":"","date_original":"2021-01-01"},{"date":"2021-07-08","event":"NowSwap publicly announced via Medium post as 'the 1st DEX focused on smaller trades,' targeting sub-$3,000 transactions on Ethereum.","source":""},{"date":"2021-08-04","event":"NowSwap published a second Medium post titled 'Broadening the Accessibility of Decentralized Finance to Retail Traders.'","source":""},{"date":"2021-09-15","event":"Smart contract exploit executed in Ethereum block 13229001. Attacker drained 535,706 USDT and 158.28 WETH (~$1.07 million) via an invalid K-value check in the pair contract. Stolen USDT converted to ETH via 1inch, then laundered through Tornado Cash across four transactions. Exploit first identified by @PuPuThrashing and analyzed by PeckShield and BlockSec.","source":""},{"date":"2021-09-15","event":"NowSwap team took the application offline for investigation and stated they would work with law enforcement for fund recovery.","source":""},{"date":"2021-09-17","event":"Halborn published a detailed post-mortem of the NowSwap hack, documenting the K-value vulnerability and its parallels to the April 2021 Uranium Finance exploit.","source":""},{"date":"2024","event":"NowSwap TVL on DefiLlama reported at approximately $4.77, effectively zero. No evidence of resumed operations, audit, or team activity since the 2021 exploit.","source":"","date_original":"2024-01-01"}],"sources_used":[{"url":"https://nowswap.medium.com/","name":"nowswap.medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://defillama.com/protocol/nowswap","name":"defillama.com","type":"other","archive_url":"http://web.archive.org/web/20250912102408/https://defillama.com/protocol/nowswap","credibility":3,"archive_timestamp":"2025-09-12T10:24:08+00:00"},{"url":"https://halborn.com/explained-the-nowswap-protocol-hack-september-2021/","name":"halborn.com","type":"other","archive_url":"https://web.archive.org/web/20260830085812/https://www.halborn.com/blog/post/explained-the-nowswap-protocol-hack-september-2021","credibility":3,"archive_timestamp":"2026-08-30T08:58:12+00:00"},{"url":"https://coinchapter.com/over-1m-in-usdt-and-weth-stolen-following-nowswap-dex-hack/","name":"coinchapter.com","type":"other","archive_url":"https://web.archive.org/web/20260830083123/https://coinchapter.com/over-1m-in-usdt-and-weth-stolen-following-nowswap-dex-hack/","credibility":3,"archive_timestamp":"2026-08-30T08:31:23+00:00"},{"url":"https://coingape.com/defi-hack-alert-nowswap-losses-over-1-million-in-cyber-attack/","name":"coingape.com","type":"other","archive_url":"https://web.archive.org/web/20260830083349/https://coingape.com/defi-hack-alert-nowswap-losses-over-1-million-in-cyber-attack/","credibility":3,"archive_timestamp":"2026-08-30T08:33:49+00:00"},{"url":"https://quadrigainitiative.com/casestudy/nowswapprotocollogicerror.php","name":"quadrigainitiative.com","type":"other","archive_url":"http://web.archive.org/web/20251207215409/https://quadrigainitiative.com/casestudy/nowswapprotocollogicerror.php","credibility":3,"archive_timestamp":"2025-12-07T21:54:09+00:00"},{"url":"https://www.stelareum.io/en/defi-tvl/protocol/s_nowswap.html","name":"stelareum.io","type":"other","archive_url":"https://web.archive.org/web/20260830133200/https://www.stelareum.io/en/defi-tvl/protocol/s_nowswap.html","credibility":3,"archive_timestamp":"2026-08-30T13:32:00+00:00"},{"url":"https://medium.com/immunefi/building-a-poc-for-the-uranium-heist-ec83fbd83e9f","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:54.30873+00:00","updated_at":"2026-08-30T13:44:39.90949+00:00"}}