{"investigation":{"slug":"paraspace-lending-v1","entity_name":"ParaSpace Lending V1","trust_score":28,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"ParaSpace Lending V1 was an Ethereum-based cross-margin NFT and fungible token lending protocol launched in December 2022. In March 2023, a price manipulation exploit targeting the AutoCompoundApe contract nearly drained $5 million (2,909 ETH) from the protocol; blockchain security firm BlockSec intervened in a white-hat operation to recover the funds. In May 2023, a separate internal governance crisis erupted when over 19 team members accused CEO Yubo Ruan of misappropriating approximately 1,454.5 ETH (~$2.7M) from the recovered funds, allegations Ruan denied. The protocol subsequently rebranded through a merger with Parallel Finance, forming ParaX in August 2023, while the original V1 contracts were wound down and remain at minimal TVL as of 2026.","sections":[{"content":"ParaSpace Lending V1 launched in December 2022 as a permissionless cross-margin NFT lending protocol on Ethereum, enabling users to collateralize both ERC-721 (NFT) and ERC-20 assets within a single account and borrow against a unified credit line. The protocol described itself as 'crypto's first cross-margin NFT Finance protocol.' It was founded by Yubo Ruan, who also founded Parallel Finance on the Polkadot ecosystem, and was backed by prominent venture investors including Sequoia Capital, Coinbase Ventures, Founders Fund, and Polychain Capital. At peak, the protocol reportedly reached a total value locked (TVL) of approximately $900 million. As of May 2026, ParaSpace Lending V1 shows a TVL of approximately $115,000 across Ethereum, ZKsync Era, Arbitrum, and Polygon — a near-total collapse from peak levels.","heading":"Protocol Overview","sources":[{"url":"https://www.prnewswire.com/news-releases/paraspace-launches-the-first-cross-margin-lending-protocol-for-nft-and-fungible-tokens-301699670.html","name":"prnewswire.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/paraspace-lending-v1","name":"defillama.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On March 17, 2023 at approximately 6:50 a.m. UTC, an attacker attempted to exploit a vulnerability in ParaSpace's AutoCompoundApe contract. The vulnerability involved the rebasingIndex calculation in the _getTotalPooledApeBalance() function. By depositing APE tokens directly into the cAPE position via ApeCoinStaking.depositApeCoin(), the attacker could artificially inflate the protocol's reported staked APE balance — inflating it by approximately 373% (from 851,662 to 3,183,876 APE) — and thereby borrow far more than permissible against the inflated collateral. The attack used a five-step flash loan structure borrowing approximately 47,352 wstETH. The exploit targeted the AutoCompoundApe contract, which was introduced after CertiK had completed its prior audit and was thus outside the original audit scope. The attacker's first execution failed due to insufficient gas fees. Blockchain security firm BlockSec detected the in-progress attack via its Phalcon real-time detection system and executed the same exploit as a white-hat actor, recovering 2,909 ETH (approximately $5 million at the time). Actual protocol losses from price slippage during the intervention were estimated at 50–150 ETH (under $270,000), which ParaSpace committed to cover. Following recovery, ParaSpace implemented time-locks on large withdrawals. The attacker subsequently sent an on-chain message requesting 0.7 ETH in gas reimbursement. Despite nine prior audits, the vulnerability persisted in code added post-audit.","heading":"March 2023 Price Manipulation Exploit","sources":[{"url":"https://blocksec.com/blog/paraspace-incident-a-race-against-time-to-thwart-the-industrys-most-critical-attack-yet","name":"blocksec.com","type":"other","credibility":3},{"url":"https://cryptoslate.com/paraspace-hack-in-retrospect-5m-rescued-large-withdrawals-time-locked-hacker-wants-fees-back/","name":"cryptoslate.com","type":"other","credibility":3},{"url":"https://www.theblock.co/amp/post/220761/blocksec-prevents-5-million-from-being-stolen-on-paraspace","name":"theblock.co","type":"other","credibility":3},{"url":"https://www.certik.com/resources/blog/aping-peril-the-price-manipulation-exploit-with-paraspace","name":"certik.com","type":"other","credibility":3}],"severity":"medium"},{"content":"In May 2023, approximately two months after the exploit, a severe internal governance crisis became public. More than 19 team members publicly accused CEO Yubo Ruan of misappropriating approximately 1,454.5 ETH — roughly half of the 2,909 ETH recovered by BlockSec — worth an alleged $2.7 million at the time. The accusations centered on an externally owned account (EOA) wallet beginning with 0x909e36b512ed45250fdff513523119d825647695, which on-chain data showed was controlled by Ruan and owned ENS domains ruanyubo.eth and paraspaceinsurance.eth. Team members alleged over $1 million in outflows from this wallet to centralized exchanges, Circle redemptions, and unidentified wallets. Co-founders Jay Yao and Thomas Schmidt led the opposition, posting on-chain flow documentation. Yao and Schmidt also alleged they discovered the wallet was an EOA — not the multisig wallet the community was told held recovered funds. Ruan denied all wrongdoing, characterizing the 0x909 wallet as a daily operations and insurance wallet and asserting full repayment of the recovered funds on schedule. Ruan alleged that Yao and Schmidt had unlawfully seized control of the protocol's multisig and social media accounts through deception in a bid to remove him. The dispute became public on approximately May 10, 2023 when multiple prominent crypto commentators issued warnings for users to withdraw funds. On May 19, 2023, a resolution was announced: Yao and Schmidt resigned, issuing public apologies. Ruan remained as CEO and gained sole authority over the multisig wallet. No independent on-chain audit resolving the competing claims was publicly published.","heading":"Internal Governance Crisis and Alleged Fund Misappropriation","sources":[{"url":"https://beincrypto.com/paraspace-claims-ceo-went-rogue/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://www.bitdegree.org/crypto/news/paraspace-ceo-disagrees-with-allegations-of-recovered-fund-mismanagement","name":"bitdegree.org","type":"other","credibility":3},{"url":"https://thedefiant.io/news/nfts-and-web3/paraspace-team-alleges-ceo-embezzled-usd1-7m","name":"thedefiant.io","type":"other","credibility":3},{"url":"https://crypto.news/paraspace-nft-protocols-ceo-stays-firm-as-usurper-resigns/","name":"crypto.news","type":"other","credibility":3},{"url":"https://beincrypto.com/paraspace-co-founder-resigns/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://www.gate.com/news/detail/3728952","name":"gate.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Yubo Ruan, CEO and founder of ParaSpace, previously founded Parallel Finance in 2021, a DeFi lending protocol built on the Polkadot ecosystem that raised from Polychain Capital, Coinbase Ventures, Founders Fund, and Sequoia Capital. Prior to Parallel Finance, Ruan co-founded Skylight Investment backed by New Oriental and managed 8 Decimal Capital, a crypto fund with approximately $60 million AUM, after dropping out of Stanford University. Ruan was listed in Forbes China's 2022 Web3.0 Innovation Pioneer Selection. His prior history of multiple successful fundraises from Tier 1 VCs did not prevent the governance breakdown in 2023. Ruan survived the May 2023 internal dispute and continued leading the entity through its rebrand to ParaX and later Parallel Finance.","heading":"Founder Background","sources":[{"url":"https://gritdaily.com/how-yubo-ruan-built-parallel-finance/","name":"gritdaily.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/paraspace-continue-nft-lending-rebrands-parallel-finance","name":"cointelegraph.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the dual crises of the March 2023 exploit and the May 2023 internal dispute, ParaSpace announced in August 2023 a merger with Parallel Finance to form a new entity called ParaX, described as a 'Web3 super app powered by account abstraction and zkVM.' User migration from ParaSpace to ParaX began on September 4, 2023. In December 2023, the merged entity rebranded again to Parallel Finance, focusing on DeFi expansion beyond NFT lending. The legacy ParaSpace Lending V1 smart contracts remained on-chain but user activity effectively ceased. As of May 2026, the V1 contracts show a combined TVL of approximately $115,000 — representing near-total user departure. No known regulatory enforcement actions have been filed against the protocol, its contracts, or its founders by the SEC, CFTC, or other regulators as of the time of this investigation.","heading":"Rebrand and Current Status","sources":[{"url":"https://cointelegraph.com/news/paraspace-continue-nft-lending-rebrands-parallel-finance","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://medium.com/@ParallelFi/parallel-finance-and-paraspace-are-merging-to-create-parax-a-web3-super-app-powered-by-account-5a5f8ae2fc5f","name":"medium.com","type":"other","credibility":3},{"url":"https://medium.com/@ParallelFi/migrating-from-paraspace-to-parax-everything-you-need-to-know-c4a4964c5c41","name":"medium.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/paraspace-lending-v1","name":"defillama.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Prior to the March 2023 exploit, ParaSpace had undergone nine security audits from multiple firms. CertiK conducted audits of the protocol's core contracts. However, the vulnerable AutoCompoundApe contract was introduced after the audits were completed and was therefore not within scope of the published audit reports. CertiK's post-incident analysis confirmed the out-of-scope nature of the vulnerable code. This represents a known risk pattern in DeFi: contracts that are upgraded or extended after an initial audit introduce unreviewed code into production. The exploit was ultimately prevented not by the audit process but by BlockSec's real-time Phalcon monitoring system.","heading":"Security Audit History","sources":[{"url":"https://www.certik.com/resources/blog/aping-peril-the-price-manipulation-exploit-with-paraspace","name":"certik.com","type":"other","credibility":3},{"url":"https://cryptoslate.com/paraspace-hack-in-retrospect-5m-rescued-large-withdrawals-time-locked-hacker-wants-fees-back/","name":"cryptoslate.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2022-12-12","event":"ParaSpace officially launches as the first cross-margin NFT and fungible token lending protocol on Ethereum, backed by Sequoia Capital, Coinbase Ventures, Founders Fund, and Polychain Capital.","source":""},{"date":"2023-03-17","event":"Attacker exploits price manipulation vulnerability in the AutoCompoundApe contract, initiating a flash loan attack targeting 2,909 ETH. BlockSec's Phalcon system detects the attack in real time; BlockSec executes a white-hat version of the exploit and recovers the full 2,909 ETH. Protocol losses from slippage: 50–150 ETH (~$270,000 or less). ParaSpace pauses the protocol.","source":""},{"date":"2023-03-18","event":"ParaSpace confirms all user funds secured. Protocol remains paused pending additional security audits. Large-withdrawal time-locks implemented.","source":""},{"date":"2023-05-10","event":"Internal governance dispute becomes public. Over 19 team members publicly accuse CEO Yubo Ruan of misappropriating approximately 1,454.5 ETH (~$2.7M) of the recovered funds through EOA wallet 0x909. Co-founders Jay Yao and Thomas Schmidt lead the public accusation. Prominent commentators advise users to withdraw funds.","source":""},{"date":"2023-05-12","event":"Yubo Ruan publicly denies allegations, characterizes the 0x909 wallet as an operations and insurance wallet, and claims Yao and Schmidt unlawfully seized control of protocol multisig and social media accounts.","source":""},{"date":"2023-05-19","event":"Resolution announced. Jay Yao and Thomas Schmidt resign from ParaSpace. Both issue public apologies. Ruan remains CEO and gains sole authority over the protocol multisig wallet.","source":""},{"date":"2023-08","event":"ParaSpace announces merger with Parallel Finance to form ParaX, a 'Web3 super app.' Combined TVL at announcement exceeds $250 million.","source":"","date_original":"2023-08-01"},{"date":"2023-09-04","event":"User migration from ParaSpace to ParaX begins.","source":""},{"date":"2023-12","event":"Merged entity rebrands from ParaX to Parallel Finance, refocusing on DeFi expansion including liquid staking and Layer 2 solutions.","source":"","date_original":"2023-12-01"},{"date":"2026-05-27","event":"ParaSpace Lending V1 contracts remain deployed on Ethereum, ZKsync Era, Arbitrum, and Polygon with a combined TVL of approximately $115,000, indicating near-total user exodus from the legacy V1 contracts.","source":""}],"sources_used":[{"url":"https://www.prnewswire.com/news-releases/paraspace-launches-the-first-cross-margin-lending-protocol-for-nft-and-fungible-tokens-301699670.html","name":"prnewswire.com","type":"other","archive_url":"http://web.archive.org/web/20260708055934/https://www.prnewswire.com/news-releases/paraspace-launches-the-first-cross-margin-lending-protocol-for-nft-and-fungible-tokens-301699670.html","credibility":3,"archive_timestamp":"2026-07-08T05:59:34+00:00"},{"url":"https://defillama.com/protocol/paraspace-lending-v1","name":"defillama.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://blocksec.com/blog/paraspace-incident-a-race-against-time-to-thwart-the-industrys-most-critical-attack-yet","name":"blocksec.com","type":"other","archive_url":"http://web.archive.org/web/20260209113330/https://blocksec.com/blog/paraspace-incident-a-race-against-time-to-thwart-the-industrys-most-critical-attack-yet","credibility":3,"archive_timestamp":"2026-02-09T11:33:30+00:00"},{"url":"https://cryptoslate.com/paraspace-hack-in-retrospect-5m-rescued-large-withdrawals-time-locked-hacker-wants-fees-back/","name":"cryptoslate.com","type":"other","archive_url":"http://web.archive.org/web/20260613191712/https://cryptoslate.com/paraspace-hack-in-retrospect-5m-rescued-large-withdrawals-time-locked-hacker-wants-fees-back/","credibility":3,"archive_timestamp":"2026-06-13T19:17:12+00:00"},{"url":"https://www.theblock.co/amp/post/220761/blocksec-prevents-5-million-from-being-stolen-on-paraspace","name":"theblock.co","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.certik.com/resources/blog/aping-peril-the-price-manipulation-exploit-with-paraspace","name":"certik.com","type":"other","archive_url":"http://web.archive.org/web/20251017011828/https://www.certik.com/resources/blog/aping-peril-the-price-manipulation-exploit-with-paraspace","credibility":3,"archive_timestamp":"2025-10-17T01:18:28+00:00"},{"url":"https://beincrypto.com/paraspace-claims-ceo-went-rogue/","name":"beincrypto.com","type":"other","archive_url":"http://web.archive.org/web/20260212195249/https://beincrypto.com/paraspace-claims-ceo-went-rogue/","credibility":3,"archive_timestamp":"2026-02-12T19:52:49+00:00"},{"url":"https://www.bitdegree.org/crypto/news/paraspace-ceo-disagrees-with-allegations-of-recovered-fund-mismanagement","name":"bitdegree.org","type":"other","archive_url":"https://web.archive.org/web/20260830044916/https://www.bitdegree.org/crypto/news/paraspace-ceo-disagrees-with-allegations-of-recovered-fund-mismanagement","credibility":3,"archive_timestamp":"2026-08-30T04:49:16+00:00"},{"url":"https://thedefiant.io/news/nfts-and-web3/paraspace-team-alleges-ceo-embezzled-usd1-7m","name":"thedefiant.io","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://crypto.news/paraspace-nft-protocols-ceo-stays-firm-as-usurper-resigns/","name":"crypto.news","type":"other","archive_url":"http://web.archive.org/web/20251008191904/https://crypto.news/paraspace-nft-protocols-ceo-stays-firm-as-usurper-resigns/","credibility":3,"archive_timestamp":"2025-10-08T19:19:04+00:00"},{"url":"https://beincrypto.com/paraspace-co-founder-resigns/","name":"beincrypto.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.gate.com/news/detail/3728952","name":"gate.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://gritdaily.com/how-yubo-ruan-built-parallel-finance/","name":"gritdaily.com","type":"other","archive_url":"https://web.archive.org/web/20260830042750/https://gritdaily.com/how-yubo-ruan-built-parallel-finance/","credibility":3,"archive_timestamp":"2026-08-30T04:27:50+00:00"},{"url":"https://cointelegraph.com/news/paraspace-continue-nft-lending-rebrands-parallel-finance","name":"cointelegraph.com","type":"other","archive_url":"https://web.archive.org/web/20260829234347/https://cointelegraph.com/news/paraspace-continue-nft-lending-rebrands-parallel-finance","credibility":3,"archive_timestamp":"2026-08-29T23:43:47+00:00"},{"url":"https://medium.com/@ParallelFi/parallel-finance-and-paraspace-are-merging-to-create-parax-a-web3-super-app-powered-by-account-5a5f8ae2fc5f","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://medium.com/@ParallelFi/migrating-from-paraspace-to-parax-everything-you-need-to-know-c4a4964c5c41","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:43.473093+00:00","updated_at":"2026-08-30T05:14:11.584733+00:00"}}