{"investigation":{"slug":"rubic","entity_name":"Rubic","trust_score":28,"severity_base":null,"score_modifier":0,"confidence":0.78,"status":"published","content_type":"investigation","summary":"Rubic is a cross-chain DEX aggregator founded in 2020 by Vladimir Tikhomirov and Alexandra Korneva, supporting swaps across 90+ blockchains. The protocol suffered two significant security incidents within two months in late 2022: a private key compromise in November that drained approximately $1.2 million in RBC tokens, followed by a smart contract exploit on December 25, 2022 that stole roughly $1.4 million in user USDC. Both events caused severe token price collapses, though the platform subsequently implemented new security architecture and remained operational into 2025.","sections":[{"content":"On November 2, 2022, an attacker compromised the private key of an administrator wallet that controlled the RBC/BRBC bridge and staking rewards. Approximately 34 million RBC and BRBC tokens were drained from this wallet and sold on Uniswap and PancakeSwap, causing the RBC token price to collapse by more than 98% in the hours following the attack. The team suspected malicious software was used to obtain the private key. Rubic stated that user staking funds were safe and that no smart contracts were exploited — the compromise was limited to the administrator wallet. The stolen tokens were valued at approximately $1.2 million at the time of reporting. The attacker's wallet was observed holding over 205 BNB and $205,000 in ether at the time, suggesting broader threat actor resources.","heading":"November 2022 Private Key Compromise","sources":[{"url":"https://www.coindesk.com/tech/2022/11/02/cross-chain-dex-rubic-loses-over-1m-in-funds-after-hackers-gain-access-to-private-keys","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/?id=rubic-exchange-private-key-compromised-token-plummets","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://cryptonews.com/news/decentralized-exchange-rubic-loses-1000000-exploit-involving-private-keys/","name":"cryptonews.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On December 25, 2022, Rubic suffered a second major incident — a smart contract exploit that resulted in approximately $1.4 million in user USDC being stolen. The root cause was a configuration error by the Rubic team: the USDC stablecoin contract address was mistakenly added to the protocol's Router whitelist. Combined with a lack of input validation in the routerCallNative function, this allowed an attacker to call the USDC contract through RubicProxy and execute transferFrom calls, draining USDC from any user who had granted token approvals to the RubicProxy contract. The attacker deployed a custom 337-line smart contract (attacker contract: 0x253dD81d642220267ccAc1d8202c0B96a92b299e; attacker wallet: 0x001B91c794dFEecf00124D3F9525DD32870B6ee9) to execute the exploit. Approximately 1,188 ETH (roughly $1.45 million) was then laundered through Tornado Cash. Rubic immediately paused all contracts upon discovery. The team stated they would 'strive to compensate for the losses' out of personal founder savings, with compensation capped at $5,000 per affected user in phases, covering approximately 49 affected users.","heading":"December 2022 Smart Contract Exploit","sources":[{"url":"https://quillaudits.medium.com/decoding-rubic-exchange-exploit-quillaudits-44828e71c417","name":"quillaudits.medium.com","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/?id=rubic-cross-chain-exchange-hacked","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://crypto.news/rubic-dex-aggregator-hack-leads-to-1-4m-of-user-funds-stolen/","name":"crypto.news","type":"other","credibility":3},{"url":"https://coincodecap.com/the-cross-chain-aggregator-rubic-has-been-exploited-for-nearly-1-4-million","name":"coincodecap.com","type":"other","credibility":3},{"url":"https://revoke.cash/exploits/rubic","name":"revoke.cash","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the two 2022 incidents, Rubic announced a comprehensive security overhaul. A Chief Information Security Officer (CISO) named Alex, with approximately 15 years of IT and security engineering experience including prior work at Yandex and QIWI, was hired. Key measures included: implementation of Gnosis Safe multisig requiring 3-of-6 private keys for critical transactions; two-factor authentication on all production servers; complete rewrite of smart contracts; and the launch of new audited contracts on April 3, 2023. The audit was conducted by MixBytes and identified 2 critical, 2 medium, and 1 low severity findings. After developer revisions, both critical findings and one medium finding were resolved. A bug bounty program was established through Immunefi accepting critical-level vulnerability submissions.","heading":"Security Architecture Overhaul (2023)","sources":[{"url":"https://rubic.exchange/blog/rubics-new-security-architecture/","name":"rubic.exchange","type":"other","credibility":3},{"url":"https://docs.rubic.finance/rubic/security","name":"docs.rubic.finance","type":"other","credibility":3}],"severity":"medium"},{"content":"ZachXBT, the pseudonymous on-chain investigator, flagged Rubic as a concern. Additionally, Merkle Science's investigation into the DFintoch scam — a $31.6 million investment fraud that vanished in 2023 — noted that a swap contract used to launder DFintoch proceeds was also associated with funds from prior exploits including Rubic, Ankr, GDS, DKP, and NFTCloud. This does not necessarily implicate the Rubic protocol or team in the DFintoch fraud, but it indicates that proceeds from the December 2022 Rubic exploit passed through shared laundering infrastructure. The specific nature and basis of ZachXBT's flag beyond the hacks has not been further detailed in publicly available sources reviewed for this investigation.","heading":"ZachXBT Flag and DFintoch Laundering Connection","sources":[{"url":"https://www.merklescience.com/blog/the-dfintoch-scam-origins-and-operations","name":"merklescience.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The RBC token has a maximum supply of 124,000,000 tokens. The team holds approximately 9% of the total supply. The token's all-time high was approximately $0.7985 per token. Following the twin security incidents of late 2022, the token price entered a prolonged decline; as of available data, RBC traded at approximately $0.0036, approximately 99.66% below its all-time high. Rubic raised approximately $500,000 (1,800 ETH) in 2020. The project was founded by Vladimir Tikhomirov (CEO, PhD in Computer Science, serial entrepreneur) and Alexandra Korneva (CMO, marketing and PR background), both of whom previously co-founded MyWish, a smart contract generation platform launched in 2017.","heading":"Token Economics and Price History","sources":[{"url":"https://tokeninsight.com/en/coins/rubic/team","name":"tokeninsight.com","type":"other","credibility":3},{"url":"https://coinmarketcap.com/currencies/rubic/","name":"coinmarketcap.com","type":"other","credibility":3},{"url":"https://messari.io/report/understanding-rubic","name":"messari.io","type":"other","credibility":3}],"severity":"medium"},{"content":"Despite the severity of the 2022 incidents, Rubic continued operating as a cross-chain DEX aggregator. By 2024 the platform reported 828,000+ transactions processed (97% year-over-year growth), $391.5 million in total volume (82% growth), and over 369,000 unique wallets. In Q4 2024 the platform reported an all-time high volume of $226 million. In Q1 2025, Rubic processed $433 million in transaction volume. As of early 2025, the platform supported 93 blockchains including newer networks such as Sui, Berachain, Fraxtal, Soneium, and Unichain. These operational metrics are reported by Rubic itself and Messari; independent verification of these figures has not been confirmed for this investigation.","heading":"Ongoing Operations (2024-2025)","sources":[{"url":"https://rubic.exchange/blog/rubics-2024-yearly-report/","name":"rubic.exchange","type":"other","credibility":3},{"url":"https://messari.io/report/rubic-q4-2024-brief","name":"messari.io","type":"other","credibility":3},{"url":"https://messari.io/report/rubic-q1-2025-brief","name":"messari.io","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2017","event":"Founders Vladimir Tikhomirov and Alexandra Korneva launch MyWish, a smart contract platform, establishing the team's crypto background.","source":"","date_original":"2017-01-01"},{"date":"2020","event":"Rubic project founded; team raises approximately $500,000 (1,800 ETH) in initial funding.","source":"","date_original":"2020-01-01"},{"date":"2022-11-02","event":"Admin wallet private key compromised; attacker drains approximately 34 million RBC/BRBC tokens worth ~$1.2 million and sells on Uniswap and PancakeSwap. RBC price collapses over 98%.","source":""},{"date":"2022-12-25","event":"Smart contract exploit: attacker exploits USDC miswhitelisting and lack of input validation in routerCallNative to steal ~$1.4 million in USDC from 49 users. Funds laundered through Tornado Cash.","source":""},{"date":"2022-12-25","event":"Rubic pauses all contracts and advises users to revoke approvals via revoke.cash.","source":""},{"date":"2022-12-29","event":"Rubic publishes post-hack weekly report, announces compensation plan capped at $5,000 per affected user funded from founder personal savings.","source":""},{"date":"2023-04-03","event":"Rubic relaunches with new security architecture: MixBytes-audited contracts, Gnosis Safe multisig, new CISO hired, Immunefi bug bounty program launched.","source":""},{"date":"2023-05","event":"DFintoch collapse ($31.6M exit scam) investigated by ZachXBT; Merkle Science notes swap contracts used for DFintoch laundering were also associated with Rubic exploit proceeds.","source":"","date_original":"2023-05-01"},{"date":"2024-12-31","event":"Rubic reports 2024 full-year metrics: 828K+ transactions, $391.5M volume, 369K+ wallets.","source":""},{"date":"2025-03-31","event":"Rubic reports Q1 2025 record: $433 million in transaction volume across 93 supported blockchains.","source":""}],"sources_used":[{"url":"https://www.coindesk.com/tech/2022/11/02/cross-chain-dex-rubic-loses-over-1m-in-funds-after-hackers-gain-access-to-private-keys","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20260131223358/https://www.coindesk.com/tech/2022/11/02/cross-chain-dex-rubic-loses-over-1m-in-funds-after-hackers-gain-access-to-private-keys","credibility":3,"archive_timestamp":"2026-01-31T22:33:58+00:00"},{"url":"https://www.web3isgoinggreat.com/?id=rubic-exchange-private-key-compromised-token-plummets","name":"web3isgoinggreat.com","type":"other","archive_url":"http://web.archive.org/web/20260413115045/https://www.web3isgoinggreat.com/?id=rubic-exchange-private-key-compromised-token-plummets","credibility":3,"archive_timestamp":"2026-04-13T11:50:45+00:00"},{"url":"https://cryptonews.com/news/decentralized-exchange-rubic-loses-1000000-exploit-involving-private-keys/","name":"cryptonews.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://quillaudits.medium.com/decoding-rubic-exchange-exploit-quillaudits-44828e71c417","name":"quillaudits.medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.web3isgoinggreat.com/?id=rubic-cross-chain-exchange-hacked","name":"web3isgoinggreat.com","type":"other","archive_url":"http://web.archive.org/web/20260521071244/https://www.web3isgoinggreat.com/?id=rubic-cross-chain-exchange-hacked","credibility":3,"archive_timestamp":"2026-05-21T07:12:44+00:00"},{"url":"https://crypto.news/rubic-dex-aggregator-hack-leads-to-1-4m-of-user-funds-stolen/","name":"crypto.news","type":"other","archive_url":"http://web.archive.org/web/20260208114535/https://crypto.news/rubic-dex-aggregator-hack-leads-to-1-4m-of-user-funds-stolen/","credibility":3,"archive_timestamp":"2026-02-08T11:45:35+00:00"},{"url":"https://coincodecap.com/the-cross-chain-aggregator-rubic-has-been-exploited-for-nearly-1-4-million","name":"coincodecap.com","type":"other","archive_url":"http://web.archive.org/web/20260411023207/https://coincodecap.com/the-cross-chain-aggregator-rubic-has-been-exploited-for-nearly-1-4-million","credibility":3,"archive_timestamp":"2026-04-11T02:32:07+00:00"},{"url":"https://revoke.cash/exploits/rubic","name":"revoke.cash","type":"other","archive_url":"http://web.archive.org/web/20260609115752/https://revoke.cash/exploits/rubic","credibility":3,"archive_timestamp":"2026-06-09T11:57:52+00:00"},{"url":"https://rubic.exchange/blog/rubics-new-security-architecture/","name":"rubic.exchange","type":"other","archive_url":"http://web.archive.org/web/20260414175506/https://rubic.exchange/blog/rubics-new-security-architecture/","credibility":3,"archive_timestamp":"2026-04-14T17:55:06+00:00"},{"url":"https://docs.rubic.finance/rubic/security","name":"docs.rubic.finance","type":"other","archive_url":"http://web.archive.org/web/20260207004940/https://docs.rubic.finance/rubic/security","credibility":3,"archive_timestamp":"2026-02-07T00:49:40+00:00"},{"url":"https://www.merklescience.com/blog/the-dfintoch-scam-origins-and-operations","name":"merklescience.com","type":"other","archive_url":"http://web.archive.org/web/20260310042030/https://www.merklescience.com/blog/the-dfintoch-scam-origins-and-operations","credibility":3,"archive_timestamp":"2026-03-10T04:20:30+00:00"},{"url":"https://tokeninsight.com/en/coins/rubic/team","name":"tokeninsight.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://coinmarketcap.com/currencies/rubic/","name":"coinmarketcap.com","type":"other","archive_url":"http://web.archive.org/web/20251114004724/https://coinmarketcap.com/currencies/rubic/","credibility":3,"archive_timestamp":"2025-11-14T00:47:24+00:00"},{"url":"https://messari.io/report/understanding-rubic","name":"messari.io","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://rubic.exchange/blog/rubics-2024-yearly-report/","name":"rubic.exchange","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://messari.io/report/rubic-q4-2024-brief","name":"messari.io","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://messari.io/report/rubic-q1-2025-brief","name":"messari.io","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:45.613215+00:00","updated_at":"2026-08-30T05:14:11.924437+00:00"}}