{"investigation":{"slug":"rain","entity_name":"Rain","trust_score":38,"severity_base":null,"score_modifier":0,"confidence":0.78,"status":"published","content_type":"investigation","summary":"Rain (rain.com / Rain Financial) is a Bahrain-headquartered cryptocurrency exchange founded in 2017, holding licenses from the Central Bank of Bahrain and the Abu Dhabi Global Market's Financial Services Regulatory Authority. In April 2024, the exchange suffered a confirmed security breach of approximately $14.8 million in BTC, ETH, SOL, and XRP, which went undisclosed for approximately two weeks until blockchain investigator ZachXBT publicly exposed it. Rain subsequently confirmed the incident and stated that all customer funds were covered from company reserves.","sections":[{"content":"On April 29, 2024, Rain's exchange wallets experienced unauthorized outflows totaling approximately $14.8 million across Bitcoin, Ethereum, Solana, and XRP. The breach was not disclosed by Rain for approximately two weeks. On May 13, 2024, blockchain investigator ZachXBT published on-chain analysis identifying the suspicious movements and flagging the incident as a likely exploit. Stolen funds were routed through instant exchanges and converted into BTC and ETH to obscure their origin. On-chain analysis identified 137.9 BTC transferred to wallet bc1q53aawrkpt5lvk2e30z36unvmhqqdru7q4rprp2 and 1,881 ETH transferred to wallet 0x197bc094f990261fd6841342901c451858756c28. The attack vector involved unauthorized access to private key material controlling BitGo multisignature wallets, with no smart contract exploitation identified. Following ZachXBT's public disclosure, Rain acknowledged the incident and stated that Rain Group had covered all losses from its own reserves, asserting that customer funds were unaffected. Wikipedia's entry on Rain notes the Lazarus Group (North Korea) has been associated with the breach via LinkedIn-based social engineering, though this specific attribution has not been confirmed by a DOJ press release or court filing identified in public records searches as of the investigation date.","heading":"Security Breach (April 2024)","sources":[],"severity":"medium"},{"content":"Rain Management W.L.L. (Bahrain) entered the Central Bank of Bahrain's regulatory sandbox in 2017 and in 2019 became the first licensed crypto-asset service provider in the Middle East, holding a Category 3 Crypto-Asset Module license from the Central Bank of Bahrain. In January 2022, Rain received in-principle approval from Abu Dhabi Global Market's Financial Services Regulatory Authority (ADGM FSRA), with full Financial Services Permission granted in July 2023, permitting virtual asset brokerage and custody operations in the UAE. The exchange serves users in Bahrain, UAE, Saudi Arabia, Kuwait, Oman, Qatar, and Egypt. Rain's regulatory framework requires adherence to AML protocols, customer due diligence standards, and maintenance of a 1:1 asset-to-customer-funds ratio. No formal regulatory sanction or license revocation has been publicly reported by either the Central Bank of Bahrain or ADGM FSRA in connection with the 2024 security incident.","heading":"Regulatory Status and Licensing","sources":[],"severity":"medium"},{"content":"A significant concern identified in the 2024 incident is Rain's approximately two-week delay in disclosing the breach to the public and, by inference, to its customers. ZachXBT's public Telegram post on May 13, 2024, forced disclosure rather than Rain proactively informing users. Multiple security analysts characterized this silence as a failure of responsible vulnerability disclosure practices. Rain issued a statement only after ZachXBT's publication, stating: 'As soon as we became aware of the incident, we isolated the issue and put additional controls to strengthen our security.' The statement did not clarify the timeline of internal awareness versus public disclosure, nor did it provide technical details of the compromise.","heading":"Disclosure and Transparency Failures","sources":[],"severity":"medium"},{"content":"Rain Financial Inc. was founded in 2017 by Abdullah Almoaiqel, AJ Nelson, Joseph Dallago, and Yehia Badawy. The company raised $2.5 million in a 2017 seed round co-led by BitMEX Ventures, $6 million in a January 2021 Series A led by Middle East Venture Partners (MEVP) with participation from Coinbase Ventures, and $110 million in a January 2022 Series B co-led by Paradigm and Kleiner Perkins, with participation from Coinbase Ventures, Global Founders Capital, JIMCO, Cadenza Ventures, and CMT Digital. The company introduced zero-percent trading fees in April 2022 and subsequently made workforce reductions in mid-2022 following broader crypto market decline. Rain presented itself publicly as the first regulated crypto exchange in the Middle East. The Shariyah Review Bureau certified Rain's operations as Sharia-compliant.","heading":"Funding and Corporate Background","sources":[],"severity":"medium"},{"content":"ZachXBT's on-chain investigation identified multiple transactions originating from BitGo multisignature wallets associated with Rain, directed to addresses not consistent with known Rain operational wallets. A key Ethereum address (0x197bc094f990261fd6841342901c451858756c28) received 26 separate transactions involving ETH, Shiba Inu, Chainlink, USDT, and USDC, which were then swapped for ETH via Uniswap. The corresponding BTC address (bc1q53aawrkpt5lvk2e30z36unvmhqqdru7q4rprp2) received 137.9 BTC. Both destination addresses remained inactive following the initial movement. The use of instant exchanges and DEX swaps to convert stolen assets is consistent with operational security patterns observed in sophisticated state-sponsored or organized cybercrime attacks.","heading":"On-Chain Evidence","sources":[],"severity":"medium"}],"timeline":[{"date":"2017","event":"Rain Financial founded by Abdullah Almoaiqel, AJ Nelson, Joseph Dallago, and Yehia Badawy; entered Central Bank of Bahrain regulatory sandbox.","source":"","source_url":"https://en.wikipedia.org/wiki/Rain_(cryptocurrency_exchange)","date_original":"2017-01-01"},{"date":"2019","event":"Rain receives Category 3 Crypto-Asset Module license from Central Bank of Bahrain, becoming the first licensed crypto exchange in the Middle East.","source":"","source_url":"https://www.fintechfutures.com/blockchain-crypto-digital-assets/middle-east-s-first-licenced-crypto-exchange-rain-is-live","date_original":"2019-01-01"},{"date":"2021","event":"Rain raises $6 million Series A led by MEVP and Coinbase Ventures.","source":"","source_url":"https://www.mevp.com/news/rain-financial-rain-raises-usd-110-million-in-series-b-funding-co-led-by-paradigm-and-kleiner-perkins","date_original":"2021-01-01"},{"date":"2022-01-18","event":"Rain raises $110 million Series B co-led by Paradigm and Kleiner Perkins.","source":"","source_url":"https://www.coindesk.com/business/2022/01/18/paradigm-leads-110m-investment-in-bahrains-first-licensed-crypto-brokerage"},{"date":"2022-01-25","event":"ADGM grants Rain in-principle approval for Financial Services Permission in the UAE.","source":"","source_url":"https://www.adgm.com/media/announcements/rain-receives-in-principle-approval-for-a-financial-services-permission-from-abu-dhabi-global-market"},{"date":"2023-07-25","event":"Rain Trading Limited granted full Financial Services Permission by ADGM FSRA, permitting virtual asset brokerage and custody in the UAE.","source":"","source_url":"https://www.coindesk.com/policy/2023/07/25/crypto-exchange-rain-obtains-license-to-operate-virtual-asset-brokerage-custody-service-in-uae"},{"date":"2024-04-29","event":"Rain exchange wallets experience approximately $14.8 million in unauthorized outflows across BTC, ETH, SOL, and XRP. Rain does not publicly disclose the incident.","source":"","source_url":"https://www.halborn.com/blog/post/explained-the-rain-exchange-hack-may-2024"},{"date":"2024-05-13","event":"ZachXBT publishes on-chain analysis on Telegram identifying the Rain exploit and reporting approximately $14.8 million in suspicious outflows, prompting public awareness of the breach.","source":"","source_url":"https://www.theblock.co/post/294036/crypto-exchange-rain-likely-exploited-for-14-8-million-zachxbt"},{"date":"2024-05-13","event":"Rain issues official statement acknowledging the security incident, stating that Rain Group has covered all losses and that customer funds are safe.","source":"","source_url":"https://www.cryptopolitan.com/mena-regulated-rain-crypto-exchange-admits-to-breach-noting-all-customer-funds-are-safe/"}],"sources_used":[],"source_tags":["zachxbt","defillama"],"addresses":[{"chain":"solana","label":"Rainmaker (RAIN)","address":"3iC63FgnB7EhcPaiSaC51UkVweeBDkqu17SaRyy2pump"}],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet","created_at":"2026-05-04T02:54:33.10742+00:00","updated_at":"2026-08-29T01:32:43.556+00:00"}}