{"investigation":{"slug":"punk-protocol","entity_name":"Punk Protocol","trust_score":22,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"Punk Protocol was an Ethereum-based DeFi project that positioned itself as a decentralized annuity and pension service. On August 10, 2021, it suffered a critical smart contract exploit due to a missing access-control modifier in its CompoundModel contract, resulting in approximately $8.95 million in stablecoin losses; roughly $5 million was partially recovered via a white-hat frontrunner who retained a $1 million bounty. The project launched without a security audit, has published no meaningful updates since late 2021, and its PUNK token currently trades at effectively zero volume, indicating the project is dormant or abandoned.","sections":[{"content":"Punk Protocol launched in mid-2021 as a decentralized annuity protocol on Ethereum, branding itself as a DeFi 401(k) pension service. Users deposited stablecoins (USDC, USDT, DAI) into the protocol's Saver product, which deployed funds into yield strategies built on Compound Finance. The project issued a native PUNK token with a 21 million maximum supply and a four-year halving cycle. The team operated under pseudonymous handles including 0xJohnny (community lead and co-founder) and 0xMateo (core developer, previously associated with PancakeSwap and Wault Finance). The team described itself as comprising 17 global contributors and stated that pseudonymous handles were used for branding rather than true anonymity.","heading":"Overview","sources":[{"url":"https://medium.com/punkprotocol/introducing-punk-protocol-fair-launch-be46ccbc8700","name":"medium.com","type":"other","credibility":3},{"url":"https://defiprime.com/punk-protocol","name":"defiprime.com","type":"other","credibility":3},{"url":"https://medium.com/punkprotocol/punk-protocol-ama-recap-with-tehmoonwalker-ee360e72a2d6","name":"medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On August 10, 2021, an attacker exploited a critical access control vulnerability in the CompoundModel smart contract's initialize() function. The function lacked an 'initializer' modifier, which would have prevented it from being called after initial deployment. The attacker used Ethereum's delegateCall mechanism to invoke the initialize() function and replace the protocol's legitimate forgeAddress with a malicious contract address. Because numerous privileged functions — including withdrawTo and withdrawToForge — were only callable from the forgeAddress, the attacker gained unrestricted ability to drain the protocol's stablecoin reserves. Approximately 2,995,824 USDC, 3,000,022 USDT, and 2,954,191 DAI were extracted, totaling approximately $8.95 million. The stolen USDC was swapped to ETH via the 1inch aggregator and routed through Tornado Cash in batches of 100 ETH, rendering that portion effectively unrecoverable. A second actor — described by the protocol as a white-hat frontrunner using a bot — observed the attacker's transactions in the mempool and executed competing transactions first, intercepting approximately $6 million of the total drain. The project's post-mortem confirmed that the contracts were deployed without a prior security audit, and that the exploited vulnerability class is well-known and routinely caught in professional audits.","heading":"August 2021 Smart Contract Exploit","sources":[{"url":"https://rekt.news/punkprotocol-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-punk-protocol-hack-august-2021","name":"halborn.com","type":"other","credibility":3},{"url":"https://medium.com/punkprotocol/punk-finance-fair-launch-incident-report-984d9e340eb","name":"medium.com","type":"other","credibility":3},{"url":"https://www.quadrigainitiative.com/casestudy/punkprotocolreinitialized.php","name":"quadrigainitiative.com","type":"other","credibility":3}],"severity":"medium"},{"content":"After the exploit, the white-hat frontrunner who recovered approximately $6 million entered negotiations with the Punk Protocol team. The team attempted to negotiate the bounty amount downward; the frontrunner ultimately returned approximately $3,000,059 USDT and $1,954,191 DAI — retaining roughly $1 million DAI (approximately 16% of recovered funds) as a self-determined finder's fee. The net loss to the protocol after this partial recovery was approximately $4 million. The team published a compensation plan that addressed two categories of loss: 55% of damages (approximately $4,954,252) was to be distributed immediately and pro rata to the 73 affected wallet addresses (93 transactions); the remaining 45% (approximately $4,041,504) was addressed through the issuance of 4,041,504 peUSD ERC-20 tokens, each redeemable 1:1 for DAI once a Recovery Fund contract reached sufficient balance. The Recovery Fund was intended to be replenished through two mechanisms: sales of a planned 10,000-piece NFT collection (projected at approximately $1.2 million if sold out at 0.04 ETH each) and ongoing protocol service fee revenue. Additionally, 3,150,000 PUNK tokens (15% of total supply), previously allocated to contributors, were frozen pending full recovery. No publicly verifiable confirmation that the Recovery Fund reached its $4 million target has been found.","heading":"Recovery and Compensation Plan","sources":[{"url":"https://medium.com/punkprotocol/punk-compensation-plan-and-the-path-forward-c86b6143c01e","name":"medium.com","type":"other","credibility":3},{"url":"https://medium.com/punkprotocol/punk-finance-fair-launch-incident-report-984d9e340eb","name":"medium.com","type":"other","credibility":3},{"url":"https://www.quadrigainitiative.com/hackfraudscam/punkprotocolreinitialized.php","name":"quadrigainitiative.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Punk Protocol deployed its CompoundModel smart contracts to Ethereum mainnet without having completed a professional security audit. The project's own documentation at launch reportedly stated 'Contract will be audited soon,' indicating the team was aware audits were pending but chose to deploy with user funds prior to completion. Security researchers at Halborn noted that the vulnerability class exploited — unprotected initializer functions susceptible to delegateCall abuse — is a well-documented attack vector that standard audit practices routinely detect. Following the exploit, the team committed to fixing the missing modifier, conducting expanded testing, completing a formal smart contract audit, and integrating with Immunefi's bug bounty platform for ongoing vulnerability discovery. Whether these post-incident commitments were fulfilled before the project went dormant is not confirmed in available sources.","heading":"Security Failures and Absence of Audit","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-punk-protocol-hack-august-2021","name":"halborn.com","type":"other","credibility":3},{"url":"https://docs.punk.finance/security/contract-audit","name":"docs.punk.finance","type":"other","credibility":3},{"url":"https://medium.com/punkprotocol/punk-compensation-plan-and-the-path-forward-c86b6143c01e","name":"medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"As of mid-2026, the PUNK token trades at effectively $0 with zero reported 24-hour volume on CoinMarketCap, which notes the token is inactive. The protocol's Binance listing page indicates it is not available for purchase or trade on that exchange. The Punk Protocol GitHub organization (PunkFinance) repository shows no recent development activity. The project's Medium publication shows no substantive posts beyond late 2021 and early 2022. There is no verifiable evidence that the peUSD Recovery Fund reached its compensation target or that the planned NFT collection generated the projected $1.2 million. The evidence available indicates the project is dormant and the recovery obligations to affected users have not been conclusively fulfilled.","heading":"Current Status and Token","sources":[{"url":"https://coinmarketcap.com/currencies/punk-protocol/","name":"coinmarketcap.com","type":"other","credibility":3},{"url":"https://www.binance.com/en/price/punk-protocol","name":"binance.com","type":"other","credibility":3},{"url":"https://github.com/PunkFinance/punk.protocol","name":"github.com","type":"other","credibility":3}],"severity":"medium"},{"content":"No regulatory actions by the SEC, CFTC, DOJ, or equivalent authorities against Punk Protocol or its identified team members have been found in available sources. No court filings referencing the protocol have been identified. The project has no known OFAC designation. The attacker's use of Tornado Cash to launder the unrecovered USDC portion is notable in the context of the U.S. Treasury's August 2022 sanctioning of Tornado Cash, though that sanction post-dated the exploit and no enforcement action specifically naming Punk Protocol has been identified.","heading":"Regulatory and Legal Actions","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-punk-protocol-hack-august-2021","name":"halborn.com","type":"other","credibility":3},{"url":"https://rekt.news/punkprotocol-rekt","name":"rekt.news","type":"other","credibility":3}],"severity":"medium"},{"content":"ZachXBT, the pseudonymous on-chain investigator known for documenting DeFi exploits and scams, is reported to have flagged Punk Protocol. The specific nature and date of the flag are not documented in independently verifiable public sources reviewed for this investigation. Given the protocol's documented exploit history, the absence of a completed security audit at launch, partial and uncertain compensation fulfillment, and apparent abandonment, the flag is contextually consistent with ZachXBT's documented focus on DeFi protocols that caused user losses.","heading":"ZachXBT Flag","sources":[{"url":"https://rekt.news/punkprotocol-rekt","name":"rekt.news","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021-06","event":"Punk Protocol announces fair launch; team led by pseudonymous contributors 0xJohnny and 0xMateo; contracts described as pending audit","source":"","date_original":"2021-06-01"},{"date":"2021-08-10","event":"Smart contract exploit occurs; attacker uses delegateCall to exploit unprotected initialize() function in CompoundModel, draining approximately $8.95 million in USDC, USDT, and DAI","source":""},{"date":"2021-08-10","event":"White-hat frontrunner bot intercepts approximately $6 million of the drain before the attacker can secure it; stolen USDC routed through 1inch and Tornado Cash","source":""},{"date":"2021-08-11","event":"Punk Protocol publishes incident report; suspends deposits and withdrawals; commits to unconditional compensation of all affected users","source":""},{"date":"2021-08-13","event":"White-hat actor returns approximately $4,954,250 in USDT and DAI after retaining approximately $1 million DAI as a finder's fee","source":""},{"date":"2021-09","event":"Punk Protocol publishes compensation plan; issues 4,041,504 peUSD tokens to affected users; freezes 3,150,000 PUNK contributor tokens pending full recovery; announces NFT drop and protocol revenue as funding mechanisms","source":"","date_original":"2021-09-01"},{"date":"2022","event":"Last known substantive public communications from Punk Protocol; Medium blog activity ceases","source":"","date_original":"2022-01-01"},{"date":"2026-05-27","event":"PUNK token reports $0 price and zero trading volume; project appears dormant; Recovery Fund completion status unconfirmed","source":""}],"sources_used":[{"url":"https://medium.com/punkprotocol/introducing-punk-protocol-fair-launch-be46ccbc8700","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://defiprime.com/punk-protocol","name":"defiprime.com","type":"other","archive_url":"http://web.archive.org/web/20260718155843/https://defiprime.com/punk-protocol","credibility":3,"archive_timestamp":"2026-07-18T15:58:43+00:00"},{"url":"https://medium.com/punkprotocol/punk-protocol-ama-recap-with-tehmoonwalker-ee360e72a2d6","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://rekt.news/punkprotocol-rekt","name":"rekt.news","type":"other","archive_url":"http://web.archive.org/web/20260513160047/https://rekt.news/punkprotocol-rekt","credibility":3,"archive_timestamp":"2026-05-13T16:00:47+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-punk-protocol-hack-august-2021","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260513000338/https://www.halborn.com/blog/post/explained-the-punk-protocol-hack-august-2021","credibility":3,"archive_timestamp":"2026-05-13T00:03:38+00:00"},{"url":"https://medium.com/punkprotocol/punk-finance-fair-launch-incident-report-984d9e340eb","name":"medium.com","type":"other","archive_url":"http://web.archive.org/web/20260322055925/https://medium.com/punkprotocol/punk-finance-fair-launch-incident-report-984d9e340eb","credibility":3,"archive_timestamp":"2026-03-22T05:59:25+00:00"},{"url":"https://www.quadrigainitiative.com/casestudy/punkprotocolreinitialized.php","name":"quadrigainitiative.com","type":"other","archive_url":"https://web.archive.org/web/20260830132808/https://www.quadrigainitiative.com/casestudy/punkprotocolreinitialized.php","credibility":3,"archive_timestamp":"2026-08-30T13:28:08+00:00"},{"url":"https://medium.com/punkprotocol/punk-compensation-plan-and-the-path-forward-c86b6143c01e","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.quadrigainitiative.com/hackfraudscam/punkprotocolreinitialized.php","name":"quadrigainitiative.com","type":"other","archive_url":"https://web.archive.org/web/20260830133025/https://www.quadrigainitiative.com/hackfraudscam/punkprotocolreinitialized.php","credibility":3,"archive_timestamp":"2026-08-30T13:30:25+00:00"},{"url":"https://docs.punk.finance/security/contract-audit","name":"docs.punk.finance","type":"other","archive_url":"http://web.archive.org/web/20251010215653/https://docs.punk.finance/security/contract-audit","credibility":3,"archive_timestamp":"2025-10-10T21:56:53+00:00"},{"url":"https://coinmarketcap.com/currencies/punk-protocol/","name":"coinmarketcap.com","type":"other","archive_url":"http://web.archive.org/web/20260830083305/https://coinmarketcap.com/currencies/punk-protocol/","credibility":3,"archive_timestamp":"2026-08-30T08:33:05+00:00"},{"url":"https://www.binance.com/en/price/punk-protocol","name":"binance.com","type":"other","archive_url":"https://web.archive.org/web/20260829200625/https://www.binance.com/en/price/punk-protocol","credibility":3,"archive_timestamp":"2026-08-29T20:06:25+00:00"},{"url":"https://github.com/PunkFinance/punk.protocol","name":"github.com","type":"other","archive_url":"http://web.archive.org/web/20260221214441/https://github.com/PunkFinance/punk.protocol","credibility":3,"archive_timestamp":"2026-02-21T21:44:41+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:55.237259+00:00","updated_at":"2026-08-30T20:47:34.373918+00:00"}}