{"investigation":{"slug":"subquery-network","entity_name":"SubQuery Network","trust_score":65,"severity_base":65,"score_modifier":0,"confidence":0.72,"status":"published","content_type":"investigation","summary":"SubQuery Network is a Web3 data indexing protocol originally built for the Polkadot ecosystem, founded by Sam Zou and James Bayly out of New Zealand-based OnFinality. The project raised $10.8M in seed and Series A funding, launched its mainnet and SQT token in February 2024, and suffered a significant smart-contract exploit on April 12, 2026 in which a missing access-control modifier allowed an attacker to drain approximately 382 million SQT tokens (~$134,000 USD) from staker and delegator wallets across five transactions. ZachXBT flagged the entity in connection with this incident; the team published a full disclosure report and executed on-chain compensation for all affected wallets.","sections":[{"content":"SubQuery Network is an open-source, decentralized data indexing protocol designed to allow Web3 developers to query, transform, and serve blockchain data through a GraphQL interface. Conceptually inspired by The Graph (which initially focused on Ethereum), SubQuery was built to serve Polkadot and Substrate-based ecosystems before expanding to over 300 supported blockchain networks as of 2024. The protocol connects three participant types: Consumers (application developers who request indexed data), Indexers (node operators who process and serve data), and Delegators (token holders who back Indexers in exchange for a share of rewards). The SubQuery token (SQT) functions as the network's utility token, used to pay for queries and to reward node operators, with a total genesis supply of 10 billion tokens and an annual inflation rate of 2%. SubQuery expressly disclaims that SQT confers no ownership, governance, or shareholder rights.","heading":"Protocol Overview","sources":[{"url":"https://subquery.network/","name":"subquery.network","type":"other","credibility":3},{"url":"https://subquery.network/doc/subquery_network/token/token.html","name":"subquery.network","type":"other","credibility":3},{"url":"https://subquery.network/doc/subquery_network/introduction/introduction.html","name":"subquery.network","type":"other","credibility":3}],"severity":"medium"},{"content":"SubQuery was founded by Sam Zou (CEO), Ian He (CTO), and James Bayly (COO). Sam Zou previously attended the University of Auckland and served as General Manager at Centrality, overseeing a $100 million ICO in 2017. Zou and Bayly co-founded OnFinality, a Polkadot/Substrate infrastructure SaaS platform, which served as the parent organization from which SubQuery was spun out. The company is headquartered in New Zealand. The team is publicly identified and has a documented track record in the Polkadot ecosystem, having supplied infrastructure to projects including Acala, Bifrost, and Moonbeam. No confirmed regulatory actions, criminal charges, or fraud allegations have been filed against any named founder as of May 2026.","heading":"Founding Team and Background","sources":[{"url":"https://www.crunchbase.com/person/sam-zou","name":"crunchbase.com","type":"other","credibility":3},{"url":"https://subquery.medium.com/leading-the-way-in-web3-meet-the-subquery-team-a49e40513b86","name":"subquery.medium.com","type":"other","credibility":3},{"url":"https://subquery.medium.com/series-a-1abed6c1c2af","name":"subquery.medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"SubQuery raised a $1.8 million seed round in early 2021, backed by DeFi Alliance, D1 Ventures, Hypersphere Ventures, Digital Finance Group (DFG), and The LAO. In September 2021, SubQuery announced a $9 million Series A round co-led by Arrington Capital, Digital Currency Group (DCG), and Stratos Technologies, with additional participation from Hypersphere Ventures, Neo Global Capital, Wintermute, gumi Cryptos Capital, and Skynet Trading, bringing total disclosed funding to approximately $10.8 million. Arrington Capital noted it was already an early investor in Moonbeam and Acala at the time of the Series A. No subsequent public funding rounds have been announced. The high proportion of institutional capital (approximately 34.8% of token supply allocated to early investors) has drawn community scrutiny regarding potential selling pressure post-vesting.","heading":"Funding and Investors","sources":[{"url":"https://subquery.medium.com/subquery-raises-1-8m-seed-round-for-future-expansion-3348c1f2a931","name":"subquery.medium.com","type":"other","credibility":3},{"url":"https://subquery.medium.com/series-a-1abed6c1c2af","name":"subquery.medium.com","type":"other","credibility":3},{"url":"https://cryptorank.io/price/subquery/vesting","name":"cryptorank.io","type":"other","credibility":3}],"severity":"medium"},{"content":"The SubQuery token (SQT) TGE and mainnet launch occurred on February 23, 2024 at 08:00 UTC, with the initial Bybit exchange listing (SQT/USDT pair) opening simultaneously. SQT deposits opened February 22 and withdrawals on February 24. The token subsequently listed on Gate.io and the Crypto.com App. The all-time high price was approximately $0.0855, reached shortly after launch; by end of 2024 the price had declined approximately 76% to around $0.005. Total genesis supply is 10 billion SQT with 2% annual inflation. The token allocation is: Foundation and Community ~31.8%, Team and Shareholders ~22.5%, Treasury ~18%, Community Airdrop ~12.8%, with early investor allocations making up approximately 34.8% in aggregate across private rounds. Team and shareholder tokens have a 24-month lock-up followed by a 24-month linear vesting period. A significant unlock event is scheduled for February 23, 2029. The high combined insider and investor allocation (~57% across team, shareholders, and private rounds) is a structural concern noted by community analysts.","heading":"Token Launch and Tokenomics","sources":[{"url":"https://subquery.medium.com/subquery-mainnet-and-sqt-launch-all-you-need-to-know-cd64186649f3","name":"subquery.medium.com","type":"other","credibility":3},{"url":"https://blog.subquery.network/subquery-token-to-launch-on-bybit-exchange/","name":"blog.subquery.network","type":"other","credibility":3},{"url":"https://cryptorank.io/price/subquery/vesting","name":"cryptorank.io","type":"other","credibility":3},{"url":"https://www.coingecko.com/en/coins/subquery-network","name":"coingecko.com","type":"other","credibility":3},{"url":"https://coinmarketcap.com/currencies/subquery-network/","name":"coinmarketcap.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On April 12, 2026, SubQuery Network suffered a smart contract exploit on the Base network in which an attacker executed five separate transactions to drain approximately 382,433,441 SQT tokens (valued at approximately $134,000 USD at the time of the incident). The root cause was a missing onlyOwner access control modifier on the setContractAddress() function (selector 0xc413e5be) of the Settings contract implementation, allowing any external caller to permissionlessly register themselves as a critical contract role. The five transactions operated as follows: TX1 (04:35 UTC) drained approximately 218 million SQT from the pooled Staking balance; TX2 (05:04 UTC) drained approximately 11.8 million SQT from additional pooled Staking balances; TX3 (06:51 UTC) drained approximately 129.5 million SQT from 272 individual staker and delegator wallets; TX4 (06:05 UTC) drained approximately 22.8 million SQT from the RewardsBooster contract; TX5 (04:35 UTC) withdrew a small Treasury amount via StateChannel impersonation. No user private keys were compromised. The vulnerability was not present in code reviewed during the original Hacken audit; it was inadvertently introduced during a subsequent code refactor. SubQuery published a full public disclosure and recovery plan. The team identified the incident on April 12-13, restored original contract addresses, deployed fixes adding onlyOwner modifiers, and completed on-chain compensation to all 272 affected staker and delegator wallets by April 15, 2026. ZachXBT flagged the entity in connection with this incident.","heading":"April 2026 Smart Contract Exploit","sources":[{"url":"https://subquery.ghost.io/subquery-network-security-incident-report/","name":"subquery.ghost.io","type":"other","credibility":3},{"url":"https://subquery.network/","name":"subquery.network","type":"other","credibility":3}],"severity":"medium"},{"content":"SubQuery Network engaged Hacken, a blockchain security auditing firm, to conduct a smart contract audit covering both code review and functional security review. The initial Hacken audit found no logic or access control issues and confirmed compliance with the Solidity Code Style Guide. The April 2026 exploit demonstrated that the critical vulnerability was not present in the code that underwent the original audit but was introduced during a subsequent refactor, representing a failure of post-audit change management processes rather than an audit deficiency per se. The incident disclosed that the missing access control on setContractAddress() had been present since the refactored deployment, suggesting the deployment lacked formal re-audit or re-verification. Following the exploit, SubQuery implemented onlyOwner modifiers on the affected functions and restored contract states. The incident raises questions about the adequacy of the project's ongoing security review process for contract changes after initial audit completion.","heading":"Audit History and Security Posture","sources":[{"url":"https://hacken.io/audits/subquery-network/","name":"hacken.io","type":"other","credibility":3},{"url":"https://medium.com/@subquery/subquery-network-passes-smart-contract-audit-by-hacken-876a276fddeb","name":"medium.com","type":"other","credibility":3},{"url":"https://subquery.ghost.io/subquery-network-security-incident-report/","name":"subquery.ghost.io","type":"other","credibility":3}],"severity":"medium"},{"content":"As of May 2026, no confirmed SEC, CFTC, DOJ, or other regulatory enforcement actions have been identified against SubQuery Network, its parent entity OnFinality, or any named executive. No court filings naming SubQuery Network as a defendant in a material civil or criminal proceeding have been identified through public records searches. The SQT token documentation explicitly states that SQT does not confer ownership, shareholder rights, or governance rights, language consistent with efforts to position the token as a utility asset rather than a security. The project's New Zealand domicile places it outside direct US regulatory jurisdiction absent a nexus, though US investors participated in private rounds via firms such as Arrington Capital, DCG, and DeFi Alliance. No sanctions designations (OFAC or equivalent) have been identified for the entity or its principals.","heading":"Regulatory and Legal Status","sources":[{"url":"https://subquery.network/doc/subquery_network/token/token.html","name":"subquery.network","type":"other","credibility":3},{"url":"https://subquery.medium.com/series-a-1abed6c1c2af","name":"subquery.medium.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021","event":"SubQuery raises $1.8 million seed round led by DeFi Alliance, D1 Ventures, Hypersphere Ventures, DFG, and The LAO.","source":"","date_original":"2021-01-01"},{"date":"2021-09-11","event":"SubQuery announces $9 million Series A round co-led by Arrington Capital, DCG, and Stratos Technologies.","source":""},{"date":"2022-04-12","event":"SubQuery Network passes Hacken smart contract security audit with no material findings.","source":""},{"date":"2024-02-22","event":"SQT token deposits open on Bybit exchange ahead of mainnet TGE.","source":""},{"date":"2024-02-23","event":"SubQuery mainnet launches and SQT token begins trading on Bybit at approximately $0.0144.","source":""},{"date":"2024-03-29","event":"SQT reaches all-time high price of approximately $0.0855.","source":""},{"date":"2024-12-31","event":"SQT price ends 2024 approximately 76% below its launch price, trading around $0.005.","source":""},{"date":"2026-04-12","event":"Smart contract exploit on Base network drains approximately 382 million SQT (~$134,000 USD) from staking contract, 272 individual wallets, RewardsBooster, and Treasury via missing onlyOwner access control on the Settings contract setContractAddress() function.","source":""},{"date":"2026-04-13","event":"SubQuery team identifies full attack vector, simulates exploit traces, and deploys fix restoring onlyOwner modifiers to affected contract functions.","source":""},{"date":"2026-04-14","event":"On-chain compensation distribution begins; SubQuery publishes full public disclosure and recovery plan.","source":""},{"date":"2026-04-15","event":"On-chain compensation to all 272 affected staker and delegator wallets completed.","source":""}],"sources_used":[{"url":"https://subquery.network/","name":"subquery.network","type":"other","archive_url":"http://web.archive.org/web/20260829033859/https://subquery.network/","credibility":3,"archive_timestamp":"2026-08-29T03:38:59+00:00"},{"url":"https://subquery.network/doc/subquery_network/token/token.html","name":"subquery.network","type":"other","archive_url":"http://web.archive.org/web/20260515023334/https://subquery.network/doc/subquery_network/token/token.html","credibility":3,"archive_timestamp":"2026-05-15T02:33:34+00:00"},{"url":"https://subquery.network/doc/subquery_network/introduction/introduction.html","name":"subquery.network","type":"other","archive_url":"http://web.archive.org/web/20260731183015/https://subquery.network/doc/subquery_network/introduction/introduction.html","credibility":3,"archive_timestamp":"2026-07-31T18:30:15+00:00"},{"url":"https://www.crunchbase.com/person/sam-zou","name":"crunchbase.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://subquery.medium.com/leading-the-way-in-web3-meet-the-subquery-team-a49e40513b86","name":"subquery.medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://subquery.medium.com/series-a-1abed6c1c2af","name":"subquery.medium.com","type":"other","archive_url":"http://web.archive.org/web/20250911215445/https://subquery.medium.com/series-a-1abed6c1c2af","credibility":3,"archive_timestamp":"2025-09-11T21:54:45+00:00"},{"url":"https://subquery.medium.com/subquery-raises-1-8m-seed-round-for-future-expansion-3348c1f2a931","name":"subquery.medium.com","type":"other","archive_url":"http://web.archive.org/web/20251112235348/https://subquery.medium.com/subquery-raises-1-8m-seed-round-for-future-expansion-3348c1f2a931","credibility":3,"archive_timestamp":"2025-11-12T23:53:48+00:00"},{"url":"https://cryptorank.io/price/subquery/vesting","name":"cryptorank.io","type":"other","archive_url":"https://web.archive.org/web/20260829114446/https://cryptorank.io/price/subquery/vesting","credibility":3,"archive_timestamp":"2026-08-29T11:44:46+00:00"},{"url":"https://subquery.medium.com/subquery-mainnet-and-sqt-launch-all-you-need-to-know-cd64186649f3","name":"subquery.medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://blog.subquery.network/subquery-token-to-launch-on-bybit-exchange/","name":"blog.subquery.network","type":"other","archive_url":"https://web.archive.org/web/20260829224903/https://subquery.network/blog","credibility":3,"archive_timestamp":"2026-08-29T22:49:03+00:00"},{"url":"https://www.coingecko.com/en/coins/subquery-network","name":"coingecko.com","type":"other","archive_url":"http://web.archive.org/web/20260731183000/https://www.coingecko.com/en/coins/subquery-network","credibility":3,"archive_timestamp":"2026-07-31T18:30:00+00:00"},{"url":"https://coinmarketcap.com/currencies/subquery-network/","name":"coinmarketcap.com","type":"other","archive_url":"http://web.archive.org/web/20260809042808/https://coinmarketcap.com/currencies/subquery-network/","credibility":3,"archive_timestamp":"2026-08-09T04:28:08+00:00"},{"url":"https://subquery.ghost.io/subquery-network-security-incident-report/","name":"subquery.ghost.io","type":"other","archive_url":"http://web.archive.org/web/20260731182937/https://subquery.ghost.io/subquery-network-security-incident-report/","credibility":3,"archive_timestamp":"2026-07-31T18:29:37+00:00"},{"url":"https://hacken.io/audits/subquery-network/","name":"hacken.io","type":"other","archive_url":"http://web.archive.org/web/20260731183009/https://hacken.io/audits/subquery-network/","credibility":3,"archive_timestamp":"2026-07-31T18:30:09+00:00"},{"url":"https://medium.com/@subquery/subquery-network-passes-smart-contract-audit-by-hacken-876a276fddeb","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:17.43091+00:00","updated_at":"2026-10-10T18:44:23.688+00:00"},"source_quality":{"total":15,"tier1":0,"tier2":0,"tier3":0,"unrated":15},"follower_count":null,"content_updated_at":"2026-10-10T18:44:23.965Z","last_fact_checked_at":"2026-08-27T10:25:12.922Z","fact_check_next_allowed_at":null,"update_next_allowed_at":null}