{"investigation":{"slug":"ooki","entity_name":"Ooki Protocol","trust_score":48,"severity_base":48,"score_modifier":0,"confidence":0.95,"status":"published","content_type":"investigation","summary":"Ooki Protocol (formerly bZx Protocol) was an Ethereum-based decentralized margin trading and lending protocol founded by Tom Bean and Kyle Kistner. It suffered four security incidents in 2020 and 2021 totaling more than $64 million in losses, including a roughly $55 million phishing-based private key compromise that Kaspersky attributed to the North Korean state-linked BlueNoroff group. After bZeroX, LLC settled CFTC charges and handed control to a DAO, the successor Ooki DAO became the first DAO charged by a U.S. federal regulator and received a June 2023 default judgment with a $643,542 penalty, trading bans and a court-ordered website shutdown; the protocol is now defunct.","sections":[{"content":"bZx Protocol was conceived in August 2017 by Tom Bean and Kyle Kistner, both graduates of the Georgia Institute of Technology, after reading the 0x, Kyber and Bancor whitepapers. Bean, the CEO, previously worked at Nokia and HERE (a GPS consortium of German automakers); Kistner holds a Master of Science in Computational and Molecular Biology. The project published a whitepaper in February 2018, raised approximately $7.8 million in an ICO of BZRX governance tokens in December 2018, and launched on Ethereum mainnet in July 2019 after rebranding from the working name 'b0x'. Its two main products were Fulcrum, a margin lending and trading interface launched in June 2019, and Torque, a fixed-interest lending front end launched in October 2019, enabling leveraged margin trading and lending without a centralized counterparty. The BZRX token was distributed via a Uniswap IDO in July 2020.\n\nbZeroX, LLC, the legal entity behind the protocol, operated it from June 1, 2019 until approximately August 23, 2021, when the founders transferred control to the bZx DAO. According to the CFTC, the founders explicitly marketed this transfer to community members as making operations 'enforcement-proof.' In December 2021 the bZx DAO rebranded as Ooki DAO and BZRX was migrated to the new OOKI token at a 1:10 ratio. Ooki DAO continued to operate the same protocol infrastructure previously operated by bZeroX, LLC.","heading":"Background and History","sources":[{"url":"https://decrypt.co/resources/bzx-ethereum-defi-decentralized-finance-explained-guide","name":"What is bZx? A 3-minute guide to the defi trading platform — Decrypt","type":"news_article","credibility":2},{"url":"https://medium.com/bzxnetwork/b0x-rebrands-to-bzx-and-announces-mainnet-launch-date-ed4e0c4dd2df","name":"b0x Rebrands to bZx and Announces Mainnet Launch Date — bZx Team on Medium","type":"official","credibility":2},{"url":"https://www.cftc.gov/PressRoom/PressReleases/8590-22","name":"CFTC Press Release 8590-22 — CFTC Imposes $250,000 Penalty Against bZeroX, LLC and Its Founders and Charges Successor Ooki DAO","type":"regulatory","credibility":1},{"url":"https://www.coindesk.com/policy/2022/09/26/cftcs-ooki-dao-action-shatters-illusion-of-regulator-proof-protocol","name":"CFTC's Ooki DAO action shatters illusion of regulator-proof protocol — CoinDesk","type":"news_article","credibility":3},{"url":"https://www.binance.com/en/support/announcement/429180a14a2f40e9ba8bbd5f6b2b4dc1","name":"Binance support announcement","type":"official","credibility":3}],"severity":"low"},{"content":"In February 2020 bZx's Fulcrum platform was exploited twice within four days, in what became landmark early examples of flash loan attacks in DeFi. Combined losses are reported as approximately $954,000; the Quadriga Initiative case study gives approximately $918,000.\n\nIn the first attack, on February 15, 2020 (one account places it around February 14–15), the attacker borrowed roughly 10,000 ETH via a flash loan from dYdX, used about 5,500 ETH as collateral on Compound to borrow 112 WBTC, opened a large short ETH/WBTC position on Fulcrum, and dumped the WBTC on Uniswap's low-liquidity ETH/WBTC pool. A logic bug in bZx's contract, which failed to check for adequate collateralization after price slippage, allowed the position to remain open. Reports differ on the attacker's profit: approximately 1,193 ETH (about $318,000) according to the PeckShield and CoinDesk material cited on the Ooki page, and approximately $350,000 in ETH according to CoinDesk as cited on the bZx page.\n\nIn the second attack, on February 18, 2020, the attacker took a 7,500 ETH flash loan, used part of it to inflate the sUSD price on Kyber Network to about $2, posted the inflated sUSD as collateral, withdrew an oversized ETH loan and repaid the flash loan, netting approximately 2,378 ETH (about $633,000).\n\nThe bZx team used admin 'super-keys' to pause trading after both incidents, a centralization point that was itself criticized in the DeFi community. PeckShield published full technical disclosures of both attacks. The incidents were among the first high-profile demonstrations that oracle manipulation via flash loans was a viable attack vector and prompted wide debate about oracle security and atomic composability risks.","heading":"February 2020 Flash Loan Attacks","sources":[{"url":"https://www.coindesk.com/tech/2020/02/19/everything-you-ever-wanted-to-know-about-the-defi-flash-loan-attack","name":"Everything You Ever Wanted to Know About the DeFi 'Flash Loan' Attack — CoinDesk","type":"news_article","credibility":1},{"url":"https://www.coindesk.com/markets/2020/02/18/defi-project-bzx-exploited-for-second-time-in-a-week-loses-630k-in-ether","name":"DeFi Project bZx Exploited for Second Time in a Week, Loses $630K in Ether — CoinDesk","type":"news_article","credibility":1},{"url":"https://peckshield.medium.com/bzx-hack-full-disclosure-with-detailed-profit-analysis-e6b1fa9b18fc","name":"bZx Hack Full Disclosure (With Detailed Profit Analysis) — PeckShield","type":"research","credibility":3},{"url":"https://peckshield.medium.com/bzx-hack-ii-full-disclosure-with-detailed-profit-analysis-8126eecc1360","name":"bZx Hack II Full Disclosure (With Detailed Profit Analysis) — PeckShield","type":"research","credibility":3},{"url":"https://quantstamp.com/blog/market-dynamics-of-the-1st-bzx-hack-part-1","name":"Market Dynamics of the 1st bZx Hack — Quantstamp Blog","type":"research","credibility":2},{"url":"https://www.quadrigainitiative.com/casestudy/bzxdecentralizedlendingplatformattack.php","name":"Feb 2020 — bZx Fulcrum Flash Loan/Oracle Manipulation — $918k — Quadriga Initiative Case Study","type":"research","credibility":2}],"severity":"high"},{"content":"On September 14, 2020, bZx suffered its third exploit of the year. An order-of-operations error in the iToken contract's transferFrom() logic meant that when sender and recipient were the same address, the subtraction of the sender's balance was effectively bypassed, letting an attacker inflate their iToken balance without collateral. Losses totaled approximately $8.1 million: about 219,200 LINK (~$2.6 million), about 4,500 ETH (~$1.6–1.65 million; reported as 4,502 and 4,503 ETH), and roughly $3.8 million in stablecoins (1,756,351 USDT, 1,412,048 USDC and 667,989 DAI). The bZx team paused iToken minting and burning, stated that the losses were drawn from the protocol's insurance fund rather than directly from user deposits, and published a post-mortem. bZx subsequently recovered the majority of the stolen funds through negotiation with the attacker, citing the insurance fund to cover any shortfall. The BZRX token fell approximately 31% afterwards as the insurance fund backing was depleted, and the incident prompted a security-focused relaunch.","heading":"September 2020 iToken Duplication Exploit","sources":[{"url":"https://bzx.network/blog/incident","name":"iToken Duplication Incident Report — bZx Network Official Blog","type":"official","credibility":2},{"url":"https://www.financemagnates.com/cryptocurrency/news/defi-protocol-bzx-lost-8-1-million-in-a-third-attack/","name":"DeFi Protocol bZx Lost $8.1 Million in a Third Attack — Finance Magnates","type":"news_article","credibility":2},{"url":"https://immunebytes.com/blog/bzx-protocol-exploit-sep-14-2020-detailed-analysis/","name":"bZx Protocol Exploit — Sep 14, 2020 — Detailed Analysis — ImmuneBytes","type":"research","credibility":2},{"url":"https://cryptobriefing.com/bzxs-third-exploit-2020-ends-with-8-million-lost/","name":"bZx's third exploit of 2020 ends with $8 million lost — Crypto Briefing","type":"news_article","credibility":3},{"url":"https://coincodex.com/article/9473/bzx-defi-protocol-suffers-8-million-loss-as-attacker-exploits-token-duplication-vulnerability/","name":"bZx DeFi protocol suffers $8 million loss as attacker exploits token duplication vulnerability — CoinCodex","type":"news_article","credibility":3}],"severity":"high"},{"content":"On November 5, 2021, blockchain security firm SlowMist reported that bZx had suffered its largest breach, with approximately $55 million in tokens stolen from the protocol and its users. A bZx developer received a phishing email containing a Microsoft Word document with malicious macros; when opened, the macros ran a script on the developer's personal computer that exfiltrated the developer's personal mnemonic seed phrase and the private keys used to deploy the bZx protocol on Polygon and Binance Smart Chain (BSC). With the seed phrase the attacker drained the developer's personal wallet; with the deployment keys the attacker took control of the protocol's contracts on Polygon and BSC, drained protocol funds and swept the wallets of users who had granted unlimited token spend approvals to the protocol. bZx stated that about 25% of losses were 'personal losses from the team wallet that was compromised' and that the smart contract code itself was not directly exploited.\n\nOn November 12, 2021, Kaspersky attributed the attack to BlueNoroff, a financially motivated subgroup of North Korea's state-sponsored Lazarus Group (APT38), which the U.S. Treasury designates as a sanctioned entity. This would place the bZx hack within North Korea's alleged campaign to fund its weapons programs through cryptocurrency theft. The hack later became the basis of the Sarcuni class action, which alleges the loss resulted from 'simple negligence' in key management.","heading":"November 2021 Private Key Compromise (~$55 Million)","sources":[{"url":"https://www.coindesk.com/business/2021/11/05/defi-lender-bzx-suffers-hack-for-reported-55m","name":"DeFi Lender bZx Suffers Hack for Reported $55M — CoinDesk","type":"news_article","credibility":1},{"url":"https://decrypt.co/85360/ethereum-defi-project-bzx-hacked-again-reported-55-million","name":"Ethereum DeFi project bZx hacked again, reported $55 million — Decrypt","type":"news_article","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-bzx-hack-november-2021","name":"Explained: The bZx Hack (November 2021) — Halborn Security","type":"research","credibility":2},{"url":"https://therecord.media/hacker-steals-55-million-from-bzx-defi-platform","name":"Hacker Steals $55 Million from bZx DeFi Platform — The Record by Recorded Future","type":"news_article","credibility":1},{"url":"https://www.quadrigainitiative.com/casestudy/bzxprivatekeyleak.php","name":"Nov 2021 — bZx Private Key Leak — $55.04m — Quadriga Initiative Case Study","type":"research","credibility":2},{"url":"https://www.classaction.org/news/class-action-alleges-55m-bzx-crypto-hack-caused-by-simple-negligence","name":"Class Action Alleges $55M bZx Crypto Hack Caused by 'Simple Negligence' — ClassAction.org","type":"court_filing","credibility":2}],"severity":"critical"},{"content":"On September 22, 2022, the Commodity Futures Trading Commission (CFTC) filed and simultaneously settled charges against bZeroX, LLC and its founders Tom Bean and Kyle Kistner. The CFTC found that from June 1, 2019 to August 23, 2021 bZeroX (1) illegally offered leveraged and margined retail commodity transactions in digital assets outside a registered exchange; (2) operated as an unregistered Futures Commission Merchant (FCM); and (3) failed to adopt a customer identification program as required under the Bank Secrecy Act. It imposed a $250,000 civil monetary penalty. CFTC Chairman Rostin Behnam stated that 'The CFTC remains committed to pursuing individuals and operations evading oversight at customers' expense,' and Acting Enforcement Director Gretchen Lowe said that 'margined, leveraged, or financed digital asset trading offered to retail U.S. customers must occur on properly registered exchanges.'\n\nThe same day, the CFTC filed a separate civil enforcement complaint against Ooki DAO in the U.S. District Court for the Northern District of California, the first time a U.S. federal regulator had charged a decentralized autonomous organization. The CFTC alleged that Ooki DAO continued the same violations and argued that the DAO was an unincorporated association and a 'person' under the Commodity Exchange Act (CEA), and that BZRX token holders who voted with their tokens were members who could be held liable. One sitting CFTC commissioner publicly dissented on procedural grounds. Service of process was attempted via a chat box on the Ooki DAO website and a help desk ticket, a novel method the court later upheld.","heading":"CFTC Action Against bZeroX and Charges Against Ooki DAO (September 2022)","sources":[{"url":"https://www.cftc.gov/PressRoom/PressReleases/8590-22","name":"CFTC Press Release 8590-22 — CFTC Imposes $250,000 Penalty Against bZeroX, LLC and Its Founders and Charges Successor Ooki DAO","type":"regulatory","credibility":1},{"url":"https://www.skadden.com/insights/publications/2022/10/cftc-settles-claims","name":"CFTC Settles Claims Against Founders and Sues Ooki DAO — Skadden Insights","type":"research","credibility":2},{"url":"https://www.coindesk.com/policy/2022/09/26/cftcs-ooki-dao-action-shatters-illusion-of-regulator-proof-protocol","name":"CFTC's Ooki DAO action shatters illusion of regulator-proof protocol — CoinDesk","type":"news_article","credibility":3},{"url":"https://www.winston.com/en/crypto-law-corner/cftcs-charges-against-ooki-dao-could-have-significant-implications-for-daos","name":"CFTC's charges against Ooki DAO could have significant implications for DAOs — Winston & Strawn","type":"research","credibility":3},{"url":"https://www.sidley.com/en/insights/newsupdates/2022/10/doubts-about-daos-novel-cftc-enforcement-case-targets-decentralized-finance-community","name":"Doubts about DAOs: novel CFTC enforcement case targets decentralized finance community — Sidley","type":"research","credibility":3}],"severity":"critical"},{"content":"Ooki DAO did not respond to the CFTC complaint or appear at scheduled hearings, which the court's final order described as 'strategic nonparticipation.' U.S. District Judge William H. Orrick of the Northern District of California granted the CFTC's motion for default judgment; sources differ on the date, June 8, 2023 according to the Ooki page's account of the court order and June 9, 2023 according to CFTC Press Release 8715-23 as cited on the bZx page. The judgment held that Ooki DAO is a 'person' under the CEA and subject to federal commodity law; ordered it to pay a civil monetary penalty of $643,542; imposed permanent trading and registration bans; enjoined further CEA violations; and ordered Ooki DAO, and any third-party web-hosting or domain-registration services, to shut down the Ooki DAO website and remove its content from the internet. Following the filing of the complaint, Ooki DAO had geofenced U.S. IP addresses, which the court deemed insufficient.\n\nCFTC Division of Enforcement Director Ian McGinley said the ruling showed that 'DeFi is not a regulatory-free zone' and described the outcome as 'a wake-up call' that DAO structures cannot shield founders from regulatory accountability. CoinTelegraph reported that Ooki DAO then announced it would shut down. The penalty was relatively modest, but the case set the precedent that a DAO can be sued as a legal person under federal law.","heading":"Default Judgment and Court-Ordered Shutdown (June 2023)","sources":[{"url":"https://www.cftc.gov/PressRoom/PressReleases/8715-23","name":"CFTC Press Release 8715-23 — Statement of CFTC Division of Enforcement Director on the Ooki DAO Litigation Victory","type":"regulatory","credibility":1},{"url":"https://www.cftc.gov/media/8736/enfookidaoorder060923/download","name":"CFTC — Ooki DAO court order (June 2023)","type":"regulatory","credibility":3},{"url":"https://www.coindesk.com/policy/2023/06/09/cftc-wins-lawsuit-against-ooki-dao","name":"CFTC Wins Lawsuit Against Ooki DAO — CoinDesk","type":"news_article","credibility":1},{"url":"https://cointelegraph.com/news/ooki-dao-to-shut-down-after-precedent-setting-court-battle-with-cftc","name":"Ooki DAO to Shut Down After 'Precedent Setting' Court Battle with CFTC — CoinTelegraph","type":"news_article","credibility":2},{"url":"https://blockchain.bakermckenzie.com/2023/06/13/court-holds-dao-may-be-sued-as-person-and-orders-the-shutdown-of-ooki-dao-website/","name":"Court Holds DAO May Be Sued as 'Person' and Orders Shutdown of Ooki DAO Website — Baker McKenzie Blockchain Blog","type":"research","credibility":2},{"url":"https://beincrypto.com/ooki-dao-cftc-battle/","name":"Ooki DAO CFTC battle — BeInCrypto","type":"news_article","credibility":3}],"severity":"critical"},{"content":"A consistent thread in the regulatory findings on bZeroX and Ooki DAO is the absence of anti-money-laundering (AML) and know-your-customer (KYC) controls. The CFTC's September 2022 order found that bZeroX never adopted the customer identification program required under the Bank Secrecy Act for entities that must register as FCMs, and the CFTC's complaint alleged that Ooki DAO continued these omissions after the handover. The failure to build basic compliance infrastructure while running a retail-facing leveraged trading product accessible to U.S. customers over several years was central to the CFTC's enforcement theory.","heading":"AML/KYC Failures and Regulatory Non-Compliance","sources":[{"url":"https://www.cftc.gov/PressRoom/PressReleases/8590-22","name":"CFTC Press Release 8590-22 — CFTC Imposes $250,000 Penalty Against bZeroX, LLC and Its Founders and Charges Successor Ooki DAO","type":"regulatory","credibility":1},{"url":"https://www.coindesk.com/policy/2023/06/09/cftc-wins-lawsuit-against-ooki-dao","name":"CFTC Wins Lawsuit Against Ooki DAO — CoinDesk","type":"news_article","credibility":1},{"url":"https://blockchaintipsheet.com/policy/cftc-enforcement-action-bzerox-bzx-ooki-decentralized-autonomous-organizations/","name":"CFTC enforcement action against bZeroX, bZx and Ooki DAO — Blockchain Tip Sheet","type":"research","credibility":3}],"severity":"medium"},{"content":"In May 2022, nineteen bZx users who collectively lost approximately $1.7 million in the November 2021 hack filed a class action in the U.S. District Court for the Southern District of California (Sarcuni et al. v. bZx DAO et al., 3:22-cv-00618). The suit alleges that the bZx DAO, its co-founders and all holders of BZRX governance tokens are jointly and severally liable for negligent security practices that caused the $55 million theft; individual plaintiff losses ranged from about $800 to $450,000.\n\nOn March 27, 2023, U.S. District Judge Gonzalo Curiel denied a motion to dismiss filed by DAO token holders, finding in a case of first impression that the bZx DAO and its successor Ooki DAO were 'plausibly alleged to be a general partnership' under California law and that BZRX/OOKI holders with governance rights were plausibly its partners, exposing them to joint and several liability. Legal commentators described the ruling as a landmark for DeFi governance token holders, who may not have known that holding tokens could create personal liability. Together with the CFTC action, the case was tracked as a dual test of DAO legal personhood and prompted wide discussion of corporate formation strategies for decentralized organizations.","heading":"DAO Liability Class Action (Sarcuni et al. v. bZx DAO)","sources":[{"url":"https://www.classaction.org/media/sarcuni-et-al-v-bzx-dao-et-al.pdf","name":"Sarcuni et al. v. bZx DAO et al. complaint — ClassAction.org","type":"court_filing","credibility":3},{"url":"https://www.classaction.org/news/class-action-alleges-55m-bzx-crypto-hack-caused-by-simple-negligence","name":"Class Action Alleges $55M bZx Crypto Hack Caused by 'Simple Negligence' — ClassAction.org","type":"court_filing","credibility":2},{"url":"https://www.theblock.co/post/223237/bzx-dao-liability-class-action","name":"DAO Token Holders Are Plausibly Liable, Judge Rules in bZx Class Action — The Block","type":"news_article","credibility":1},{"url":"https://www.ibanet.org/decentralised-autonomous-organisations-and-liability-in-litigation","name":"Decentralised autonomous organisations and liability in litigation — International Bar Association","type":"research","credibility":3},{"url":"https://www.proskauer.com/blog/dao-deemed-general-partnership-in-negligence-suit-over-crypto-hack-prompting-decentralized-orgs-to-rethink-corporate-formation","name":"DAO Deemed 'General Partnership' in Negligence Suit over Crypto Hack — Proskauer Rose LLP","type":"research","credibility":2},{"url":"https://www.blockchainandthelaw.com/2023/04/dao-deemed-general-partnership-in-negligence-suit-over-crypto-hack-prompting-decentralized-orgs-to-rethink-corporate-formation/","name":"DAO Deemed 'General Partnership' in Negligence Suit over Crypto Hack — Blockchain and the Law","type":"research","credibility":3},{"url":"https://www.skadden.com/insights/publications/2022/05/putative-class-action-lawsuit-alleges-dao-members","name":"Putative Class Action Lawsuit Alleges DAO Members Are Jointly and Severally Liable for a Cryptocurrency Hack — Skadden","type":"research","credibility":2},{"url":"https://www.dechert.com/knowledge/onpoint/2023/4/federal-court-holds-dao-members-can-be-treated-as-general-partne.html","name":"Federal Court Holds DAO Members Can Be Treated as General Partners Subject to Joint and Several Liability — Dechert LLP","type":"research","credibility":2}],"severity":"high"},{"content":"Following the June 2023 default judgment, Ooki DAO announced it would shut down and its website was ordered offline. The OOKI token, which traded at significant values during the 2021 DeFi bull market, deteriorated severely; CoinGecko and CoinMarketCap listings show it approaching near-zero valuation after the enforcement action and shutdown. The protocol is no longer operational and its total value locked collapsed to effectively zero. Across its four security incidents in 2020 and 2021, losses totaled more than $64 million. The case remains a landmark precedent: it established that DAOs can be sued as legal persons under the CEA, that token holders can face liability as general partners, and that geofencing U.S. users does not immunize a protocol from U.S. enforcement.","heading":"Current Status and Token Valuation","sources":[{"url":"https://cointelegraph.com/news/ooki-dao-to-shut-down-after-precedent-setting-court-battle-with-cftc","name":"Ooki DAO to Shut Down After 'Precedent Setting' Court Battle with CFTC — CoinTelegraph","type":"news_article","credibility":2},{"url":"https://www.coingecko.com/en/coins/ooki","name":"OOKI — CoinGecko","type":"other","credibility":3},{"url":"https://coinmarketcap.com/currencies/ooki-protocol/","name":"Ooki Protocol — CoinMarketCap","type":"other","credibility":3},{"url":"https://www.fintechanddigitalassets.com/2023/07/whats-next-for-daos-in-the-wake-of-the-ooki-decision/","name":"What's next for DAOs in the wake of the Ooki decision — Fintech and Digital Assets","type":"research","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2017-08","event":"Tom Bean and Kyle Kistner conceive bZx Protocol after reading the 0x, Kyber and Bancor whitepapers.","source":"Decrypt / bZx team interviews","source_url":"https://decrypt.co/resources/bzx-ethereum-defi-decentralized-finance-explained-guide"},{"date":"2018-02","event":"bZx whitepaper published.","source":"bZx Network Medium","source_url":"https://medium.com/bzxnetwork/b0x-rebrands-to-bzx-and-announces-mainnet-launch-date-ed4e0c4dd2df"},{"date":"2018-12","event":"bZx raises approximately $7.8 million in a BZRX token ICO.","source":"Decrypt","source_url":"https://decrypt.co/resources/bzx-ethereum-defi-decentralized-finance-explained-guide"},{"date":"2019-06","event":"bZeroX, LLC begins operating the bZx Protocol (from June 1, 2019, per the CFTC), offering leveraged margin trading and lending without registration.","source":"CFTC Press Release 8590-22","source_url":"https://www.cftc.gov/PressRoom/PressReleases/8590-22"},{"date":"2019-06","event":"Fulcrum margin trading interface launches on Ethereum mainnet.","source":"IQ.wiki / Ivan on Tech Academy","source_url":"https://iq.wiki/wiki/bzx"},{"date":"2019-07","event":"bZx Protocol mainnet launch following the rebrand from 'b0x'.","source":"bZx Network Medium","source_url":"https://medium.com/bzxnetwork/b0x-rebrands-to-bzx-and-announces-mainnet-launch-date-ed4e0c4dd2df"},{"date":"2019-10","event":"Torque fixed-interest lending front end launches.","source":"IQ.wiki","source_url":"https://iq.wiki/wiki/bzx"},{"date":"2020-02","event":"First flash loan attack on Fulcrum (February 15): attacker manipulates the WBTC price and exploits an undercollateralization bug; reported profit approximately 1,193 ETH (~$318,000) or approximately $350,000 in ETH.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2020/02/19/everything-you-ever-wanted-to-know-about-the-defi-flash-loan-attack"},{"date":"2020-02","event":"Second flash loan attack within four days (February 18): attacker manipulates the sUSD price oracle on Kyber Network, netting approximately $633,000 in ETH.","source":"CoinDesk","source_url":"https://www.coindesk.com/markets/2020/02/18/defi-project-bzx-exploited-for-second-time-in-a-week-loses-630k-in-ether"},{"date":"2020-07","event":"BZRX governance token launched via Uniswap IDO.","source":"IQ.wiki / Decrypt","source_url":"https://iq.wiki/wiki/bzx"},{"date":"2020-09","event":"Third exploit (September 14): iToken duplication bug lets an attacker mint about $8.1 million in LINK, ETH, USDT, USDC and DAI; the majority is later recovered.","source":"Finance Magnates / bZx Incident Report","source_url":"https://www.financemagnates.com/cryptocurrency/news/defi-protocol-bzx-lost-8-1-million-in-a-third-attack/"},{"date":"2021-08","event":"bZeroX, LLC transfers protocol control to the bZx DAO (August 23, per the CFTC); the founders describe the move as making operations 'enforcement-proof'.","source":"CFTC Press Release 8590-22","source_url":"https://www.cftc.gov/PressRoom/PressReleases/8590-22"},{"date":"2021-11","event":"Fourth and largest breach (November 5): a phishing email compromises a developer's private keys; about $55 million is drained from the Polygon and BSC deployments and affected user wallets.","source":"CoinDesk / The Record","source_url":"https://www.coindesk.com/business/2021/11/05/defi-lender-bzx-suffers-hack-for-reported-55m"},{"date":"2021-11","event":"Kaspersky attributes the November 2021 hack (on November 12) to BlueNoroff, a subgroup of North Korea's state-sponsored Lazarus Group (APT38).","source":"Halborn Security blog","source_url":"https://www.halborn.com/blog/post/explained-the-bzx-hack-november-2021"},{"date":"2021-12","event":"bZx DAO rebrands as Ooki DAO; BZRX migrated to OOKI at a 1:10 ratio.","source":""},{"date":"2022-05","event":"Class action Sarcuni et al. v. bZx DAO et al. filed in the Southern District of California, alleging negligence and joint and several liability of BZRX token holders for the $55 million hack.","source":"Skadden Insights","source_url":"https://www.skadden.com/insights/publications/2022/05/putative-class-action-lawsuit-alleges-dao-members"},{"date":"2022-09","event":"CFTC (September 22) settles charges against bZeroX LLC and founders Tom Bean and Kyle Kistner ($250,000 penalty) and files the first federal charges against a DAO, Ooki DAO, for CEA violations.","source":"CFTC Press Release 8590-22","source_url":"https://www.cftc.gov/PressRoom/PressReleases/8590-22"},{"date":"2023-03","event":"U.S. District Judge Gonzalo Curiel denies a motion to dismiss in the Sarcuni class action (March 27), finding bZx/Ooki DAO plausibly a general partnership and token holders plausibly liable as partners.","source":"The Block","source_url":"https://www.theblock.co/post/223237/bzx-dao-liability-class-action"},{"date":"2023-06","event":"Judge William H. Orrick grants the CFTC default judgment against Ooki DAO (dated June 8 or June 9, 2023, depending on the source): $643,542 penalty, permanent trading and registration bans, and an order to shut down the Ooki DAO website.","source":"CFTC Press Release 8715-23","source_url":"https://www.cftc.gov/PressRoom/PressReleases/8715-23"},{"date":"2023-06","event":"CFTC Enforcement Director Ian McGinley says the ruling shows 'DeFi is not a regulatory-free zone'; Ooki DAO announces it will shut down.","source":"CoinTelegraph","source_url":"https://cointelegraph.com/news/ooki-dao-to-shut-down-after-precedent-setting-court-battle-with-cftc"}],"sources_used":[{"url":"https://decrypt.co/resources/bzx-ethereum-defi-decentralized-finance-explained-guide","name":"What is bZx? A 3-minute guide to the defi trading platform — Decrypt","type":"news_article","archive_url":"http://web.archive.org/web/20260314123939/https://decrypt.co/resources/bzx-ethereum-defi-decentralized-finance-explained-guide","credibility":2,"archive_timestamp":"2026-03-14T12:39:39+00:00"},{"url":"https://medium.com/bzxnetwork/b0x-rebrands-to-bzx-and-announces-mainnet-launch-date-ed4e0c4dd2df","name":"b0x Rebrands to bZx and Announces Mainnet Launch Date — bZx Team on Medium","type":"official","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.cftc.gov/PressRoom/PressReleases/8590-22","name":"CFTC Press Release 8590-22 — CFTC Imposes $250,000 Penalty Against bZeroX, LLC and Its Founders and Charges Successor Ooki DAO","type":"regulatory","archive_url":"http://web.archive.org/web/20260419102647/https://www.cftc.gov/PressRoom/PressReleases/8590-22","credibility":1,"archive_timestamp":"2026-04-19T10:26:47+00:00"},{"url":"https://www.coindesk.com/policy/2022/09/26/cftcs-ooki-dao-action-shatters-illusion-of-regulator-proof-protocol","name":"CFTC's Ooki DAO action shatters illusion of regulator-proof protocol — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260306183228/https://www.coindesk.com/policy/2022/09/26/cftcs-ooki-dao-action-shatters-illusion-of-regulator-proof-protocol","credibility":3,"archive_timestamp":"2026-03-06T18:32:28+00:00"},{"url":"https://www.binance.com/en/support/announcement/429180a14a2f40e9ba8bbd5f6b2b4dc1","name":"Binance support announcement","type":"official","archive_url":"https://web.archive.org/web/20260830131611/https://www.binance.com/en/support/announcement/detail/429180a14a2f40e9ba8bbd5f6b2b4dc1","credibility":3,"archive_timestamp":"2026-08-30T13:16:11+00:00"},{"url":"https://www.coindesk.com/tech/2020/02/19/everything-you-ever-wanted-to-know-about-the-defi-flash-loan-attack","name":"Everything You Ever Wanted to Know About the DeFi 'Flash Loan' Attack — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20251124014239/https://www.coindesk.com/tech/2020/02/19/everything-you-ever-wanted-to-know-about-the-defi-flash-loan-attack","credibility":1,"archive_timestamp":"2025-11-24T01:42:39+00:00"},{"url":"https://www.coindesk.com/markets/2020/02/18/defi-project-bzx-exploited-for-second-time-in-a-week-loses-630k-in-ether","name":"DeFi Project bZx Exploited for Second Time in a Week, Loses $630K in Ether — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20251117090720/https://www.coindesk.com/markets/2020/02/18/defi-project-bzx-exploited-for-second-time-in-a-week-loses-630k-in-ether","credibility":1,"archive_timestamp":"2025-11-17T09:07:20+00:00"},{"url":"https://peckshield.medium.com/bzx-hack-full-disclosure-with-detailed-profit-analysis-e6b1fa9b18fc","name":"bZx Hack Full Disclosure (With Detailed Profit Analysis) — PeckShield","type":"research","archive_url":"http://web.archive.org/web/20260725011013/https://peckshield.medium.com/bzx-hack-full-disclosure-with-detailed-profit-analysis-e6b1fa9b18fc","credibility":3,"archive_timestamp":"2026-07-25T01:10:13+00:00"},{"url":"https://peckshield.medium.com/bzx-hack-ii-full-disclosure-with-detailed-profit-analysis-8126eecc1360","name":"bZx Hack II Full Disclosure (With Detailed Profit Analysis) — PeckShield","type":"research","archive_url":"http://web.archive.org/web/20251113161008/https://peckshield.medium.com/bzx-hack-ii-full-disclosure-with-detailed-profit-analysis-8126eecc1360","credibility":3,"archive_timestamp":"2025-11-13T16:10:08+00:00"},{"url":"https://quantstamp.com/blog/market-dynamics-of-the-1st-bzx-hack-part-1","name":"Market Dynamics of the 1st bZx Hack — Quantstamp Blog","type":"research","archive_url":"https://web.archive.org/web/20260911054352/https://quantstamp.com/blog/market-dynamics-of-the-1st-bzx-hack-part-1","credibility":2,"archive_timestamp":"2026-09-11T05:43:52+00:00"},{"url":"https://www.quadrigainitiative.com/casestudy/bzxdecentralizedlendingplatformattack.php","name":"Feb 2020 — bZx Fulcrum Flash Loan/Oracle Manipulation — $918k — Quadriga Initiative Case Study","type":"research","archive_url":"https://web.archive.org/web/20260725010958/https://www.quadrigainitiative.com/casestudy/bzxdecentralizedlendingplatformattack.php","credibility":2,"archive_timestamp":"2026-07-25T01:09:58+00:00"},{"url":"https://bzx.network/blog/incident","name":"iToken Duplication Incident Report — bZx Network Official Blog","type":"official","archive_url":null,"credibility":2,"archive_error":"error:no-job","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.financemagnates.com/cryptocurrency/news/defi-protocol-bzx-lost-8-1-million-in-a-third-attack/","name":"DeFi Protocol bZx Lost $8.1 Million in a Third Attack — Finance Magnates","type":"news_article","archive_url":"https://web.archive.org/web/20260725101122/https://www.financemagnates.com/cryptocurrency/news/defi-protocol-bzx-lost-8-1-million-in-a-third-attack/","credibility":2,"archive_timestamp":"2026-07-25T10:11:22+00:00"},{"url":"https://immunebytes.com/blog/bzx-protocol-exploit-sep-14-2020-detailed-analysis/","name":"bZx Protocol Exploit — Sep 14, 2020 — Detailed Analysis — ImmuneBytes","type":"research","archive_url":"http://web.archive.org/web/20260208130451/https://immunebytes.com/blog/bzx-protocol-exploit-sep-14-2020-detailed-analysis/","credibility":2,"archive_timestamp":"2026-02-08T13:04:51+00:00"},{"url":"https://cryptobriefing.com/bzxs-third-exploit-2020-ends-with-8-million-lost/","name":"bZx's third exploit of 2020 ends with $8 million lost — Crypto Briefing","type":"news_article","archive_url":"http://web.archive.org/web/20251014013840/https://cryptobriefing.com/bzxs-third-exploit-2020-ends-with-8-million-lost/","credibility":3,"archive_timestamp":"2025-10-14T01:38:40+00:00"},{"url":"https://coincodex.com/article/9473/bzx-defi-protocol-suffers-8-million-loss-as-attacker-exploits-token-duplication-vulnerability/","name":"bZx DeFi protocol suffers $8 million loss as attacker exploits token duplication vulnerability — CoinCodex","type":"news_article","archive_url":null,"credibility":3,"archive_error":"error:gone","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.coindesk.com/business/2021/11/05/defi-lender-bzx-suffers-hack-for-reported-55m","name":"DeFi Lender bZx Suffers Hack for Reported $55M — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20251026003045/https://www.coindesk.com/business/2021/11/05/defi-lender-bzx-suffers-hack-for-reported-55m","credibility":1,"archive_timestamp":"2025-10-26T00:30:45+00:00"},{"url":"https://decrypt.co/85360/ethereum-defi-project-bzx-hacked-again-reported-55-million","name":"Ethereum DeFi project bZx hacked again, reported $55 million — Decrypt","type":"news_article","archive_url":"http://web.archive.org/web/20260829192441/https://decrypt.co/85360/ethereum-defi-project-bzx-hacked-again-reported-55-million","credibility":3,"archive_timestamp":"2026-08-29T19:24:41+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-bzx-hack-november-2021","name":"Explained: The bZx Hack (November 2021) — Halborn Security","type":"research","archive_url":"http://web.archive.org/web/20260605221642/https://www.halborn.com/blog/post/explained-the-bzx-hack-november-2021","credibility":2,"archive_timestamp":"2026-06-05T22:16:42+00:00"},{"url":"https://therecord.media/hacker-steals-55-million-from-bzx-defi-platform","name":"Hacker Steals $55 Million from bZx DeFi Platform — The Record by Recorded Future","type":"news_article","archive_url":"http://web.archive.org/web/20260317065738/https://therecord.media/hacker-steals-55-million-from-bzx-defi-platform","credibility":1,"archive_timestamp":"2026-03-17T06:57:38+00:00"},{"url":"https://www.quadrigainitiative.com/casestudy/bzxprivatekeyleak.php","name":"Nov 2021 — bZx Private Key Leak — $55.04m — Quadriga Initiative Case Study","type":"research","archive_url":"http://web.archive.org/web/20260306112650/https://quadrigainitiative.com/casestudy/bzxprivatekeyleak.php","credibility":2,"archive_timestamp":"2026-03-06T11:26:50+00:00"},{"url":"https://www.classaction.org/news/class-action-alleges-55m-bzx-crypto-hack-caused-by-simple-negligence","name":"Class Action Alleges $55M bZx Crypto Hack Caused by 'Simple Negligence' — ClassAction.org","type":"court_filing","archive_url":"http://web.archive.org/web/20260520200841/https://www.classaction.org/news/class-action-alleges-55m-bzx-crypto-hack-caused-by-simple-negligence","credibility":2,"archive_timestamp":"2026-05-20T20:08:41+00:00"},{"url":"https://www.skadden.com/insights/publications/2022/10/cftc-settles-claims","name":"CFTC Settles Claims Against Founders and Sues Ooki DAO — Skadden Insights","type":"research","archive_url":"http://web.archive.org/web/20260517093550/https://www.skadden.com/insights/publications/2022/10/cftc-settles-claims","credibility":2,"archive_timestamp":"2026-05-17T09:35:50+00:00"},{"url":"https://www.winston.com/en/crypto-law-corner/cftcs-charges-against-ooki-dao-could-have-significant-implications-for-daos","name":"CFTC's charges against Ooki DAO could have significant implications for DAOs — Winston & Strawn","type":"research","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.sidley.com/en/insights/newsupdates/2022/10/doubts-about-daos-novel-cftc-enforcement-case-targets-decentralized-finance-community","name":"Doubts about DAOs: novel CFTC enforcement case targets decentralized finance community — Sidley","type":"research","archive_url":"http://web.archive.org/web/20260518145131/https://www.sidley.com/en/insights/newsupdates/2022/10/doubts-about-daos-novel-cftc-enforcement-case-targets-decentralized-finance-community","credibility":3,"archive_timestamp":"2026-05-18T14:51:31+00:00"},{"url":"https://www.cftc.gov/PressRoom/PressReleases/8715-23","name":"CFTC Press Release 8715-23 — Statement of CFTC Division of Enforcement Director on the Ooki DAO Litigation Victory","type":"regulatory","archive_url":"http://web.archive.org/web/20260813205043/https://www.cftc.gov/PressRoom/PressReleases/8715-23","credibility":1,"archive_timestamp":"2026-08-13T20:50:43+00:00"},{"url":"https://www.cftc.gov/media/8736/enfookidaoorder060923/download","name":"CFTC — Ooki DAO court order (June 2023)","type":"regulatory","archive_url":"http://web.archive.org/web/20260419185533/https://www.cftc.gov/media/8736/enfookidaoorder060923/download","credibility":3,"archive_timestamp":"2026-04-19T18:55:33+00:00"},{"url":"https://www.coindesk.com/policy/2023/06/09/cftc-wins-lawsuit-against-ooki-dao","name":"CFTC Wins Lawsuit Against Ooki DAO — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260114103515/https://www.coindesk.com/policy/2023/06/09/cftc-wins-lawsuit-against-ooki-dao","credibility":1,"archive_timestamp":"2026-01-14T10:35:15+00:00"},{"url":"https://cointelegraph.com/news/ooki-dao-to-shut-down-after-precedent-setting-court-battle-with-cftc","name":"Ooki DAO to Shut Down After 'Precedent Setting' Court Battle with CFTC — CoinTelegraph","type":"news_article","archive_url":"http://web.archive.org/web/20250906003732/https://cointelegraph.com/news/ooki-dao-to-shut-down-after-precedent-setting-court-battle-with-cftc","credibility":2,"archive_timestamp":"2025-09-06T00:37:32+00:00"},{"url":"https://blockchain.bakermckenzie.com/2023/06/13/court-holds-dao-may-be-sued-as-person-and-orders-the-shutdown-of-ooki-dao-website/","name":"Court Holds DAO May Be Sued as 'Person' and Orders Shutdown of Ooki DAO Website — Baker McKenzie Blockchain Blog","type":"research","archive_url":"http://web.archive.org/web/20260515085726/https://blockchain.bakermckenzie.com/2023/06/13/court-holds-dao-may-be-sued-as-person-and-orders-the-shutdown-of-ooki-dao-website/","credibility":2,"archive_timestamp":"2026-05-15T08:57:26+00:00"},{"url":"https://beincrypto.com/ooki-dao-cftc-battle/","name":"Ooki DAO CFTC battle — BeInCrypto","type":"news_article","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://blockchaintipsheet.com/policy/cftc-enforcement-action-bzerox-bzx-ooki-decentralized-autonomous-organizations/","name":"CFTC enforcement action against bZeroX, bZx and Ooki DAO — Blockchain Tip Sheet","type":"research","archive_url":"http://web.archive.org/web/20251008195022/https://blockchaintipsheet.com/policy/cftc-enforcement-action-bzerox-bzx-ooki-decentralized-autonomous-organizations/","credibility":3,"archive_timestamp":"2025-10-08T19:50:22+00:00"},{"url":"https://www.classaction.org/media/sarcuni-et-al-v-bzx-dao-et-al.pdf","name":"Sarcuni et al. v. bZx DAO et al. complaint — ClassAction.org","type":"court_filing","archive_url":"https://web.archive.org/web/20260830092535/https://www.classaction.org/media/sarcuni-et-al-v-bzx-dao-et-al.pdf","credibility":3,"archive_timestamp":"2026-08-30T09:25:35+00:00"},{"url":"https://www.theblock.co/post/223237/bzx-dao-liability-class-action","name":"DAO Token Holders Are Plausibly Liable, Judge Rules in bZx Class Action — The Block","type":"news_article","archive_url":null,"credibility":1,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.ibanet.org/decentralised-autonomous-organisations-and-liability-in-litigation","name":"Decentralised autonomous organisations and liability in litigation — International Bar Association","type":"research","archive_url":"http://web.archive.org/web/20260606164155/https://www.ibanet.org/decentralised-autonomous-organisations-and-liability-in-litigation","credibility":3,"archive_timestamp":"2026-06-06T16:41:55+00:00"},{"url":"https://www.proskauer.com/blog/dao-deemed-general-partnership-in-negligence-suit-over-crypto-hack-prompting-decentralized-orgs-to-rethink-corporate-formation","name":"DAO Deemed 'General Partnership' in Negligence Suit over Crypto Hack — Proskauer Rose LLP","type":"research","archive_url":"http://web.archive.org/web/20260514042721/https://www.proskauer.com/blog/dao-deemed-general-partnership-in-negligence-suit-over-crypto-hack-prompting-decentralized-orgs-to-rethink-corporate-formation/","credibility":2,"archive_timestamp":"2026-05-14T04:27:21+00:00"},{"url":"https://www.blockchainandthelaw.com/2023/04/dao-deemed-general-partnership-in-negligence-suit-over-crypto-hack-prompting-decentralized-orgs-to-rethink-corporate-formation/","name":"DAO Deemed 'General Partnership' in Negligence Suit over Crypto Hack — Blockchain and the Law","type":"research","archive_url":"http://web.archive.org/web/20260710170139/https://www.blockchainandthelaw.com/2023/04/dao-deemed-general-partnership-in-negligence-suit-over-crypto-hack-prompting-decentralized-orgs-to-rethink-corporate-formation/","credibility":3,"archive_timestamp":"2026-07-10T17:01:39+00:00"},{"url":"https://www.skadden.com/insights/publications/2022/05/putative-class-action-lawsuit-alleges-dao-members","name":"Putative Class Action Lawsuit Alleges DAO Members Are Jointly and Severally Liable for a Cryptocurrency Hack — Skadden","type":"research","archive_url":"http://web.archive.org/web/20260511211556/https://www.skadden.com/insights/publications/2022/05/putative-class-action-lawsuit-alleges-dao-members","credibility":2,"archive_timestamp":"2026-05-11T21:15:56+00:00"},{"url":"https://www.dechert.com/knowledge/onpoint/2023/4/federal-court-holds-dao-members-can-be-treated-as-general-partne.html","name":"Federal Court Holds DAO Members Can Be Treated as General Partners Subject to Joint and Several Liability — Dechert LLP","type":"research","archive_url":"http://web.archive.org/web/20261007113443/https://www.dechert.com/knowledge/onpoint/2023/4/federal-court-holds-dao-members-can-be-treated-as-general-partne.html","credibility":2,"archive_timestamp":"2026-10-07T11:34:43+00:00"},{"url":"https://www.coingecko.com/en/coins/ooki","name":"OOKI — CoinGecko","type":"other","archive_url":"http://web.archive.org/web/20251009060609/https://www.coingecko.com/en/coins/ooki","credibility":3,"archive_timestamp":"2025-10-09T06:06:09+00:00"},{"url":"https://coinmarketcap.com/currencies/ooki-protocol/","name":"Ooki Protocol — CoinMarketCap","type":"other","archive_url":"http://web.archive.org/web/20260511152301/https://coinmarketcap.com/currencies/ooki-protocol/","credibility":3,"archive_timestamp":"2026-05-11T15:23:01+00:00"},{"url":"https://www.fintechanddigitalassets.com/2023/07/whats-next-for-daos-in-the-wake-of-the-ooki-decision/","name":"What's next for DAOs in the wake of the Ooki decision — Fintech and Digital Assets","type":"research","archive_url":"http://web.archive.org/web/20260410094906/https://www.fintechanddigitalassets.com/2023/07/whats-next-for-daos-in-the-wake-of-the-ooki-decision/","credibility":3,"archive_timestamp":"2026-04-10T09:49:06+00:00"},{"url":"https://iq.wiki/wiki/bzx","name":"bZx — IQ.wiki","type":"other","archive_url":"http://web.archive.org/web/20261007113739/https://iq.wiki/wiki/bzx","credibility":3,"archive_timestamp":"2026-10-07T11:37:39+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-code-merge-writer","created_at":"2026-05-04T02:55:01.173703+00:00","updated_at":"2026-10-30T21:21:31.661035+00:00"},"source_quality":{"total":43,"tier1":3,"tier2":9,"tier3":0,"unrated":31},"follower_count":null,"content_updated_at":"2026-10-28T00:52:39.880Z","last_fact_checked_at":"2026-10-28T00:52:39.526Z","fact_check_next_allowed_at":null,"update_next_allowed_at":null}