{"investigation":{"slug":"onyx-protocol","entity_name":"Onyx Protocol","trust_score":22,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"Onyx Protocol is a DeFi lending protocol forked from Compound Finance v2, operating on Ethereum and issuing the XCN (Onyxcoin) token. The protocol suffered two major exploits in under twelve months — $2.1 million in October/November 2023 and $3.8 million in September 2024 — both stemming from the same known precision vulnerability in the Compound v2 codebase that the team had been warned about by auditor CertiK in February 2023 and chose not to remediate. Following the second hack the Ethereum-based lending market was shut down and the protocol relaunched as Onyx Core.","sections":[{"content":"Onyx Protocol traces its lineage to Chain, a blockchain infrastructure company founded in 2014 by venture capitalist Adam Ludwin. Chain raised approximately $40 million from institutional backers including Nasdaq, Visa, Citigroup, and Capital One, and was subsequently acquired in 2018 by Lightyear Corp., a commercial subsidiary of the Stellar Development Foundation. By 2021 the entity re-emerged as a privately held corporation. In January 2023 a governance proposal (CIP-007) renamed Chain Protocol to Onyx Protocol and Chain DAO to Onyx DAO. The native token was rebranded from CHN to XCN in March 2022 at a 1:1,000 ratio, with 5 billion XCN burned and 15 billion XCN donated to a newly formed non-profit foundation. The DeFi lending arm — the component that suffered both exploits — is a Compound Finance v2 fork that additionally supports NFTs as collateral.","heading":"Background and Origins","sources":[{"url":"https://www.weex.com/questions/article/who-is-behind-onyxcoin-xcn-crypto-the-full-story-explained-67773","name":"weex.com","type":"other","credibility":3},{"url":"https://www.withtap.com/blog/what-is-chain-xcn","name":"withtap.com","type":"other","credibility":3},{"url":"https://www.gate.com/learn/articles/what-is-onyx-protocol-all-you-need-to-know-about-xcn/4336","name":"gate.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On November 1, 2023 (some sources cite the market creation and governance vote as October 2023), attackers drained approximately 1,164 ETH — valued at roughly $2.1 million at the time — from the Onyx Protocol lending contracts. The attack exploited a known 'empty pool' vulnerability in the Compound v2 codebase: when a new, unfunded market is created, an attacker can mint cTokens in the empty pool, inflate their apparent value through strategic token donations, and then borrow against the overvalued collateral. A Solidity rounding error allowed the attacker to redeem more tokens than they had actually deposited, effectively draining collateral pools. The specific target was Onyx's newly-created, unfunded PEPE token market. Primary attacker address: 0x085bdff2c522e8637d4154039db8746bb8642bff. The governance proposal that created the vulnerable PEPE market (Proposal 22) reportedly received only 11 votes, the majority from a single address, indicating minimal community oversight. CertiK had audited the protocol and published findings on February 27, 2023 — approximately eight months before the exploit — explicitly identifying this vulnerability class and recommending the team deploy a contract to mint and burn initial shares to prevent the pool from ever being empty. The Onyx team acknowledged the finding and elected to take no action. The protocol's TVL collapsed approximately 87%, from $2.9 million to $392,000, as users rushed to withdraw funds. Post-hack, Onyx leadership stated plans for compensating affected users.","heading":"First Exploit — October/November 2023 ($2.1 Million)","sources":[{"url":"https://hacken.io/discover/onyx-protocol-hack/","name":"hacken.io","type":"other","credibility":3},{"url":"https://www.certik.com/resources/blog/post-mortem-onyx-protocol","name":"certik.com","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-onyx-protocol-hack-october-2023","name":"halborn.com","type":"other","credibility":3},{"url":"https://www.merklescience.com/blog/onyx-protocol-hack-flow-of-funds-analysis","name":"merklescience.com","type":"other","credibility":3},{"url":"https://crypto.news/hackers-exploit-onyx-protocol-for-2-1m/","name":"crypto.news","type":"other","credibility":3},{"url":"https://www.cryptotimes.io/2023/11/01/onyx-protocol-lost-2-1-million-in-a-latest-exploit/","name":"cryptotimes.io","type":"other","credibility":3}],"severity":"medium"},{"content":"On September 26, 2024, Onyx Protocol was exploited a second time for approximately $3.8 million — using substantially the same Compound v2 precision vulnerability that had caused the first breach less than twelve months earlier, combined with an additional input validation flaw in the protocol's NFTLiquidation smart contract. The attacker (address: 0x680910cf5Fc9969A25Fd57e7896A14fF1E55F36B, attack contract: 0xAE7d68b140Ed075E382e0A01d6c67ac675AFa223) used a 2,000 ETH flash loan from Balancer to manipulate the exchange rate in the low-liquidity VUSD market via 56 cycles of micro-scale minting and redemption. Separately, the NFTLiquidation contract did not validate untrusted user input, allowing the attacker to inflate self-liquidation rewards and extract additional value. Assets stolen included 4.1 million VUSD, 7.35 million XCN, 0.23 WBTC, 5,000 DAI, and 50,000 USDT. Blockchain security firm PeckShield first reported the exploit publicly; Cyvers also flagged the anomaly. The Onyx team acknowledged unusual platform activity approximately four hours after detection. Blockchain security researchers at Halborn, Hacken, and BeInCrypto each characterized the hack as preventable, noting that established best practices for Compound v2 forks — specifically minting and burning initial cTokens at market launch to prevent zero-supply conditions — had been publicly documented and were not applied.","heading":"Second Exploit — September 2024 ($3.8 Million)","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-onyx-protocol-hack-september-2024","name":"halborn.com","type":"other","credibility":3},{"url":"https://rekt.news/onyx-protocol-rekt2","name":"rekt.news","type":"other","credibility":3},{"url":"https://beincrypto.com/onyx-protocol-preventable-hack/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://dailyhodl.com/2024/09/27/decentralized-web3-project-onyx-hacked-for-3800000-worth-of-crypto-peckshield/","name":"dailyhodl.com","type":"other","credibility":3},{"url":"https://www.quillaudits.com/blog/hack-analysis/onyx-dao-hack","name":"quillaudits.com","type":"other","credibility":3},{"url":"https://www.cryptopolitan.com/onyx-protocol-hacked-again-for-3-8m-through-exchange-rate-exploit/","name":"cryptopolitan.com","type":"other","credibility":3}],"severity":"medium"},{"content":"A central finding across multiple post-mortem analyses is that the first exploit was explicitly foreseeable. CertiK's audit report, published February 27, 2023, identified the empty-pool/precision vulnerability and recommended a concrete mitigation: deploy a contract that mints and burns initial shares upon market creation, ensuring the total supply never falls to zero. The Onyx team formally acknowledged this recommendation and documented a decision to take no action. When a new PEPE market was subsequently created via governance with zero initial liquidity in October 2023, the conditions for an exploit were reproduced and attackers acted within days. The same vulnerability class had already been exploited against other Compound v2 forks, including Hundred Finance and Midas Capital, before the first Onyx hack, contributing to an industry-wide cumulative loss exceeding $10 million. Despite the first successful attack in November 2023, the Onyx team still did not implement the documented fix, and the nearly identical vulnerability pathway was used again in September 2024. No regulatory enforcement action against the Onyx team has been publicly identified in connection with this negligence.","heading":"Security Audit Negligence","sources":[{"url":"https://www.certik.com/resources/blog/post-mortem-onyx-protocol","name":"certik.com","type":"other","credibility":3},{"url":"https://hacken.io/discover/onyx-protocol-hack/","name":"hacken.io","type":"other","credibility":3},{"url":"https://beincrypto.com/onyx-protocol-preventable-hack/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-onyx-protocol-hack-september-2024","name":"halborn.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the September 2024 exploit, the OnyxDAO put governance proposal OIP-46 to a vote; it passed with 100% community support. The proposal called for shutting down the Ethereum-based open lending market, fully reimbursing affected lenders at a 1:1 ratio, and relaunching the protocol as Onyx Core — a closed-ended lending setup incorporating real-world assets (RWA) and NFTs under stricter access controls. The relaunch was scheduled for October 1, 2024. In early 2025, the team announced development of the Onyx XCN Ledger, described as a Layer 3 blockchain using Arbitrum Orbit technology with Coinbase's Base network as its settlement layer, along with a planned new whitepaper. No independent verification of full lender reimbursement following the September 2024 hack has been confirmed in publicly available sources reviewed for this investigation.","heading":"Post-Hack Relaunch and Current Status","sources":[{"url":"https://cointelegraph.com/news/onyx-core-relaunch-after-3-8m-hack","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://www.coininsider.com/news/2024/09/onyx-shuts-ethereum-lending-market-relaunches-as-onyx-core/","name":"coininsider.com","type":"other","credibility":3},{"url":"https://financefeeds.com/defi-protocol-onyx-to-relaunch-after-3-8-million/","name":"financefeeds.com","type":"other","credibility":3},{"url":"https://www.bitget.com/news/detail/12560604240361","name":"bitget.com","type":"other","credibility":3}],"severity":"medium"},{"content":"AVOID.NET's intake data indicates ZachXBT flagged Onyx Protocol. No specific published thread or post from ZachXBT explicitly naming Onyx Protocol was independently located through web search for this investigation. The flag may relate to the protocol's two major exploits and the documented pattern of unpatched, known vulnerabilities. This section will be updated if a direct ZachXBT source is identified. The absence of a located primary source does not constitute a rebuttal of the flag.","heading":"ZachXBT Flag","sources":[],"severity":"medium"}],"timeline":[{"date":"2014","event":"Adam Ludwin founds Chain, the predecessor company to Onyx Protocol, raising approximately $40 million from institutional investors including Nasdaq, Visa, and Citigroup.","source":"","date_original":"2014-01-01"},{"date":"2018","event":"Chain is acquired by Lightyear Corp., a commercial subsidiary of the Stellar Development Foundation.","source":"","date_original":"2018-01-01"},{"date":"2022-03","event":"Token rebranded from CHN to XCN at a 1:1,000 ratio; 5 billion XCN burned and 15 billion XCN donated to a new foundation.","source":"","date_original":"2022-03-01"},{"date":"2023","event":"Governance proposal CIP-007 passes, officially renaming Chain Protocol to Onyx Protocol and Chain DAO to Onyx DAO.","source":"","date_original":"2023-01-01"},{"date":"2023-02-27","event":"CertiK publishes audit report identifying the empty-pool/precision vulnerability in the Compound v2 fork code and explicitly recommending remediation. The Onyx team acknowledges the finding and decides not to act.","source":""},{"date":"2023-10-23","event":"Governance proposal to support a PEPE token market on Onyx passes with approximately 11 votes, majority from a single address.","source":""},{"date":"2023-10-26","event":"PEPE market contract deployed on Onyx with zero initial liquidity, creating the conditions for an empty-pool exploit.","source":""},{"date":"2023-11","event":"First exploit: attackers drain approximately 1,164 ETH ($2.1 million) from Onyx Protocol via the empty PEPE pool. TVL collapses 87%. Attacker address: 0x085bdff2c522e8637d4154039db8746bb8642bff.","source":"","date_original":"2023-11-01"},{"date":"2024-09-26","event":"Second exploit: attacker (0x680910cf5Fc9969A25Fd57e7896A14fF1E55F36B) drains $3.8 million from Onyx Protocol using the same Compound v2 precision vulnerability plus an NFTLiquidation contract input-validation flaw. Assets stolen: 4.1M VUSD, 7.35M XCN, 0.23 WBTC, 5K DAI, 50K USDT.","source":""},{"date":"2024-09-29","event":"Governance proposal OIP-46 passes with 100% community support, approving shutdown of the Ethereum lending market, full lender reimbursement, and relaunch as Onyx Core.","source":""},{"date":"2024-10","event":"Onyx Core scheduled relaunch; Ethereum-based open lending market shut down.","source":"","date_original":"2024-10-01"},{"date":"2025-02","event":"Onyx team announces development of the Onyx XCN Ledger, a Layer 3 blockchain built on Arbitrum Orbit using Coinbase Base as settlement layer, alongside a new whitepaper.","source":"","date_original":"2025-02-01"}],"sources_used":[{"url":"https://www.weex.com/questions/article/who-is-behind-onyxcoin-xcn-crypto-the-full-story-explained-67773","name":"weex.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.withtap.com/blog/what-is-chain-xcn","name":"withtap.com","type":"other","archive_url":"http://web.archive.org/web/20260609183559/https://www.withtap.com/blog/what-is-chain-xcn","credibility":3,"archive_timestamp":"2026-06-09T18:35:59+00:00"},{"url":"https://www.gate.com/learn/articles/what-is-onyx-protocol-all-you-need-to-know-about-xcn/4336","name":"gate.com","type":"other","archive_url":"https://web.archive.org/web/20260829151915/https://www.gate.com/learn/articles/what-is-onyx-protocol-all-you-need-to-know-about-xcn/4336","credibility":3,"archive_timestamp":"2026-08-29T15:19:15+00:00"},{"url":"https://hacken.io/discover/onyx-protocol-hack/","name":"hacken.io","type":"other","archive_url":"http://web.archive.org/web/20260517185057/https://hacken.io/discover/onyx-protocol-hack/","credibility":3,"archive_timestamp":"2026-05-17T18:50:57+00:00"},{"url":"https://www.certik.com/resources/blog/post-mortem-onyx-protocol","name":"certik.com","type":"other","archive_url":"http://web.archive.org/web/20251017015902/https://www.certik.com/resources/blog/post-mortem-onyx-protocol","credibility":3,"archive_timestamp":"2025-10-17T01:59:02+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-onyx-protocol-hack-october-2023","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260526030213/https://www.halborn.com/blog/post/explained-the-onyx-protocol-hack-october-2023","credibility":3,"archive_timestamp":"2026-05-26T03:02:13+00:00"},{"url":"https://www.merklescience.com/blog/onyx-protocol-hack-flow-of-funds-analysis","name":"merklescience.com","type":"other","archive_url":"http://web.archive.org/web/20260308042541/https://www.merklescience.com/blog/onyx-protocol-hack-flow-of-funds-analysis","credibility":3,"archive_timestamp":"2026-03-08T04:25:41+00:00"},{"url":"https://crypto.news/hackers-exploit-onyx-protocol-for-2-1m/","name":"crypto.news","type":"other","archive_url":"http://web.archive.org/web/20250911031232/https://crypto.news/hackers-exploit-onyx-protocol-for-2-1m/","credibility":3,"archive_timestamp":"2025-09-11T03:12:32+00:00"},{"url":"https://www.cryptotimes.io/2023/11/01/onyx-protocol-lost-2-1-million-in-a-latest-exploit/","name":"cryptotimes.io","type":"other","archive_url":"https://web.archive.org/web/20260829150904/https://www.cryptotimes.io/2023/11/01/onyx-protocol-lost-2-1-million-in-a-latest-exploit/","credibility":3,"archive_timestamp":"2026-08-29T15:09:04+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-onyx-protocol-hack-september-2024","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260415063653/https://www.halborn.com/blog/post/explained-the-onyx-protocol-hack-september-2024","credibility":3,"archive_timestamp":"2026-04-15T06:36:53+00:00"},{"url":"https://rekt.news/onyx-protocol-rekt2","name":"rekt.news","type":"other","archive_url":"http://web.archive.org/web/20260414190051/https://rekt.news/onyx-protocol-rekt2","credibility":3,"archive_timestamp":"2026-04-14T19:00:51+00:00"},{"url":"https://beincrypto.com/onyx-protocol-preventable-hack/","name":"beincrypto.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://dailyhodl.com/2024/09/27/decentralized-web3-project-onyx-hacked-for-3800000-worth-of-crypto-peckshield/","name":"dailyhodl.com","type":"other","archive_url":"https://web.archive.org/web/20260829132707/https://dailyhodl.com/2024/09/27/analyst-jamie-coutts-says-fourth-quarter-could-get-wild-for-crypto-updates-outlook-on-solana-rival-sui/autoload/?exclude=[303415]&lang=en_US","credibility":3,"archive_timestamp":"2026-08-29T13:27:07+00:00"},{"url":"https://www.quillaudits.com/blog/hack-analysis/onyx-dao-hack","name":"quillaudits.com","type":"other","archive_url":"http://web.archive.org/web/20260417054241/https://www.quillaudits.com/blog/hack-analysis/onyx-dao-hack","credibility":3,"archive_timestamp":"2026-04-17T05:42:41+00:00"},{"url":"https://www.cryptopolitan.com/onyx-protocol-hacked-again-for-3-8m-through-exchange-rate-exploit/","name":"cryptopolitan.com","type":"other","archive_url":"https://web.archive.org/web/20260830004939/https://www.cryptopolitan.com/onyx-protocol-hacked-again-for-3-8m-through-exchange-rate-exploit/","credibility":3,"archive_timestamp":"2026-08-30T00:49:39+00:00"},{"url":"https://cointelegraph.com/news/onyx-core-relaunch-after-3-8m-hack","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20260214133740/https://cointelegraph.com/news/onyx-core-relaunch-after-3-8m-hack","credibility":3,"archive_timestamp":"2026-02-14T13:37:40+00:00"},{"url":"https://www.coininsider.com/news/2024/09/onyx-shuts-ethereum-lending-market-relaunches-as-onyx-core/","name":"coininsider.com","type":"other","archive_url":"http://web.archive.org/web/20260313072152/https://www.coininsider.com/news/2024/09/onyx-shuts-ethereum-lending-market-relaunches-as-onyx-core/","credibility":3,"archive_timestamp":"2026-03-13T07:21:52+00:00"},{"url":"https://financefeeds.com/defi-protocol-onyx-to-relaunch-after-3-8-million/","name":"financefeeds.com","type":"other","archive_url":"https://web.archive.org/web/20260830000816/https://financefeeds.com/defi-protocol-onyx-to-relaunch-after-3-8-million/","credibility":3,"archive_timestamp":"2026-08-30T00:08:16+00:00"},{"url":"https://www.bitget.com/news/detail/12560604240361","name":"bitget.com","type":"other","archive_url":"https://web.archive.org/web/20260830003604/https://www.bitget.com/news/detail/12560604240361","credibility":3,"archive_timestamp":"2026-08-30T00:36:04+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:37.420693+00:00","updated_at":"2026-08-30T01:16:29.570404+00:00"}}