{"investigation":{"slug":"sunrayfinance","entity_name":"SUNRAY·FINANCE","trust_score":8,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"Sunray Finance was a perpetual-trading DEX protocol on Arbitrum that suffered a critical exploit on October 30, 2024, resulting in approximately $2.7–2.9 million in losses. An attacker — using what the team attributed to a compromised private key — upgraded the protocol's management contract and minted 200 sextillion SUN tokens, then swapped a portion for USDT before the token price collapsed to zero. The project website subsequently went offline with no confirmed fund recovery, and the protocol's pre-exploit marketing included unverified claims of SoftBank backing and unsustainable 299% annual yield promises.","sections":[{"content":"On October 30, 2024, an attacker exploited Sunray Finance's upgradeable contract architecture on the Arbitrum network. The attacker upgraded the protocol's management smart contract — exploited contract address: 0xb1bbe57f5c474996a84274f0078a2411e1a65b8a, transaction hash: 0x6bf01fc425d2591ac34d41b6a193580079e2506206405841f9cb38881fbb74b2 — and then minted approximately 200 sextillion (200,000,000,000 trillion) SUN tokens in a single transaction. The attacker then swapped half of these tokens through DEX liquidity pools for approximately $2.1 million worth of Tether (USDT). The attacker's initial wallet was funded via the Across bridge from Ethereum, indicating pre-planned operational steps. The SUN token price collapsed to near zero following the mass minting event. Total reported losses range from $2.7 million to $2.885 million depending on the source.","heading":"Exploit Overview","sources":[{"url":"https://cointelegraph.com/news/btc-scammers-sunray-finance-crypto-sec","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://www.cryptopolitan.com/malicious-smart-contract-causes-2-8m-in-sun-token-losses-on-arbitrum/","name":"cryptopolitan.com","type":"other","credibility":3},{"url":"https://olympixai.medium.com/sunray-finance-fire-token-and-onyxdao-drained-via-key-compromise-launch-time-burn-flaw-and-4a062046957d","name":"olympixai.medium.com","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/single/sunray-finance-hack","name":"web3isgoinggreat.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The attack is classified as an access control failure stemming from a compromised private key. Because Sunray Finance used an upgradeable proxy contract pattern, the entity controlling the admin private key had the ability to push a malicious upgrade and alter contract logic without a time-lock or multi-signature safeguard. Security researchers at Olympix categorized this as infrastructure compromise — specifically that the attacker obtained the admin private key through phishing, malware, a leaked seed phrase, or possible insider access. The Sunray Finance team publicly stated that the private key was compromised and denied insider involvement, though this claim has not been independently verified. The absence of on-chain time-lock protections, multi-signature requirements, or circuit breakers on treasury-level contract upgrades are cited as root-cause protocol design failures.","heading":"Attack Mechanism and Root Cause","sources":[{"url":"https://smartcontractshacking.com/hacks/sunray-finance-hack-2024","name":"smartcontractshacking.com","type":"other","credibility":3},{"url":"https://olympixai.medium.com/sunray-finance-fire-token-and-onyxdao-drained-via-key-compromise-launch-time-burn-flaw-and-4a062046957d","name":"olympixai.medium.com","type":"other","credibility":3},{"url":"https://www.quadrigainitiative.com/casestudy/sunrayfinancemaliciousupgradeandtokenminting.php","name":"quadrigainitiative.com","type":"other","credibility":3},{"url":"https://cryptorank.io/news/feed/9ce1e-malicious-smart-contract-causes-2-8m-in-sun-token-losses-on-arbitrum","name":"cryptorank.io","type":"other","credibility":3}],"severity":"medium"},{"content":"The attacker is alleged to have been unaware of a second liquidity pool for the SUN token. Immediately following the exploit, an arbitrage bot detected the price discrepancy between the two pools: it purchased approximately 90 sextillion SUN tokens from the pool the attacker had dumped into, then sold those tokens into the second, still-priced pool. The arbitrage bot operator realized a profit of approximately $560,000 worth of Ether (ETH). This secondary event contributed to the total reported loss figure for Sunray Finance users.","heading":"Secondary Arbitrage Event","sources":[{"url":"https://www.web3isgoinggreat.com/single/sunray-finance-hack","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/btc-scammers-sunray-finance-crypto-sec","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://www.quadrigainitiative.com/casestudy/sunrayfinancemaliciousupgradeandtokenminting.php","name":"quadrigainitiative.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Prior to the exploit, Sunray Finance exhibited several marketing practices that security researchers have flagged as potential indicators of fraud or misrepresentation. First, the project claimed backing from Japanese investment giant SoftBank; however, SoftBank's official portfolio page did not list Sunray Finance, and SoftBank has not publicly acknowledged any relationship with the project. Second, the protocol offered an advertised annual passive income of 299% for SUN token holders alongside the ARC governance token, a figure consistent with unsustainable yield promises used in historical DeFi fraud schemes. Third, the SUN token launched around September 17, 2024, and grew from approximately $7 to $10 in value before the exploit approximately six weeks later. The team did not issue any public notifications of the exploit through their official channels — neither Sunray Finance nor Sunray Swap announced the hack through their social media or communications at the time it occurred.","heading":"Pre-Exploit Red Flags and Marketing Claims","sources":[{"url":"https://cryptorank.io/news/feed/9ce1e-malicious-smart-contract-causes-2-8m-in-sun-token-losses-on-arbitrum","name":"cryptorank.io","type":"other","credibility":3},{"url":"https://www.cryptopolitan.com/malicious-smart-contract-causes-2-8m-in-sun-token-losses-on-arbitrum/","name":"cryptopolitan.com","type":"other","credibility":3},{"url":"https://www.quadrigainitiative.com/casestudy/sunrayfinancemaliciousupgradeandtokenminting.php","name":"quadrigainitiative.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the exploit, Sunray Finance stated on social media that the team was 'working hard to restore it' and claimed that 'all user assets are available on the chain.' The team also reported contacting Binance and Binance's security team to assist with potential recovery efforts. The team confirmed that the exploit involved newly minted coins and stated that no individual user wallets were directly affected. As of early November 2024, there were no further updates from the team regarding recovery progress, and the project's website subsequently went offline. No recovery or user reimbursement has been publicly confirmed. The project's Twitter/X account remained accessible after the website went offline.","heading":"Team Response and Recovery Efforts","sources":[{"url":"https://www.quadrigainitiative.com/casestudy/sunrayfinancemaliciousupgradeandtokenminting.php","name":"quadrigainitiative.com","type":"other","credibility":3},{"url":"https://olympixai.medium.com/sunray-finance-fire-token-and-onyxdao-drained-via-key-compromise-launch-time-burn-flaw-and-4a062046957d","name":"olympixai.medium.com","type":"other","credibility":3},{"url":"https://cryptorank.io/news/feed/9ce1e-malicious-smart-contract-causes-2-8m-in-sun-token-losses-on-arbitrum","name":"cryptorank.io","type":"other","credibility":3}],"severity":"medium"},{"content":"ZachXBT, the pseudonymous on-chain investigator, is cited by AVOID.NET as having flagged Sunray Finance. Direct contemporaneous posts by ZachXBT specifically addressing Sunray Finance were not independently retrieved during this investigation; the original flag may have been issued via Telegram or X and has not been archived in a retrievable secondary source. The incident was covered by established crypto news outlets including CoinTelegraph, Cryptopolitan, and Web3 Is Going Great, all of which documented the exploit within days of its occurrence.","heading":"ZachXBT Flag and Community Reporting","sources":[{"url":"https://cointelegraph.com/news/btc-scammers-sunray-finance-crypto-sec","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/single/sunray-finance-hack","name":"web3isgoinggreat.com","type":"other","credibility":3}],"severity":"medium"},{"content":"No regulatory actions by the SEC, CFTC, DOJ, or any other governmental authority against Sunray Finance or its team members have been identified in publicly available records as of the time of this investigation. The project's anonymous team structure and the offshore nature of DeFi protocols make attribution and regulatory pursuit significantly more difficult. No criminal charges, civil enforcement actions, or asset freezes have been publicly reported.","heading":"Regulatory and Legal Status","sources":[{"url":"https://www.quadrigainitiative.com/casestudy/sunrayfinancemaliciousupgradeandtokenminting.php","name":"quadrigainitiative.com","type":"other","credibility":3}],"severity":"medium"},{"content":"As of available reporting through mid-2025, the Sunray Finance website (sunray.finance) is offline. The SUN token is effectively worthless following the mass-minting exploit. The ARC governance token is similarly without functional utility given the protocol's operational shutdown. The project's Twitter/X account (@SUNRAY_DEX) remained accessible but inactive. No new deployment, relaunch, or compensation plan has been publicly announced. The Quadriga Initiative Cryptocurrency Hacks, Scams, and Frauds Repository lists this incident as unresolved with no recovery reported.","heading":"Current Protocol Status","sources":[{"url":"https://www.quadrigainitiative.com/casestudy/sunrayfinancemaliciousupgradeandtokenminting.php","name":"quadrigainitiative.com","type":"other","credibility":3},{"url":"https://smartcontractshacking.com/hacks/sunray-finance-hack-2024","name":"smartcontractshacking.com","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/single/sunray-finance-hack","name":"web3isgoinggreat.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2024-09-17","event":"SUN token launches on Arbitrum at approximately $7, with trading beginning on the Sunray Finance DEX.","source":""},{"date":"2024-10","event":"SUN token price reaches approximately $10 as the protocol markets 299% annual yield and alleged SoftBank backing.","source":"","date_original":"2024-10-01"},{"date":"2024-10-30","event":"Attacker upgrades Sunray Finance management contract (0xb1bbe57f5c474996a84274f0078a2411e1a65b8a) and mints 200 sextillion SUN tokens, swapping approximately half for $2.1 million USDT. SUN token price collapses to zero. Separate arbitrage bot captures ~$560,000 ETH profit from a secondary liquidity pool.","source":""},{"date":"2024-10-31","event":"CoinTelegraph, Cryptopolitan, and other outlets report the exploit. Total losses confirmed at approximately $2.7–2.9 million. Sunray Finance team posts on social media claiming private key compromise and denying insider involvement.","source":""},{"date":"2024-11","event":"Sunray Finance team reports contacting Binance security team for recovery assistance. No further updates issued to the public afterward.","source":"","date_original":"2024-11-01"},{"date":"2024-11-30","event":"Sunray Finance website goes offline. No recovery or user reimbursement announced.","source":""}],"sources_used":[{"url":"https://cointelegraph.com/news/btc-scammers-sunray-finance-crypto-sec","name":"cointelegraph.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.cryptopolitan.com/malicious-smart-contract-causes-2-8m-in-sun-token-losses-on-arbitrum/","name":"cryptopolitan.com","type":"other","archive_url":"http://web.archive.org/web/20260125082932/https://www.cryptopolitan.com/malicious-smart-contract-causes-2-8m-in-sun-token-losses-on-arbitrum/","credibility":3,"archive_timestamp":"2026-01-25T08:29:32+00:00"},{"url":"https://olympixai.medium.com/sunray-finance-fire-token-and-onyxdao-drained-via-key-compromise-launch-time-burn-flaw-and-4a062046957d","name":"olympixai.medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.web3isgoinggreat.com/single/sunray-finance-hack","name":"web3isgoinggreat.com","type":"other","archive_url":"https://web.archive.org/web/20260829190630/https://www.web3isgoinggreat.com/single/sunray-finance-hack","credibility":3,"archive_timestamp":"2026-08-29T19:06:30+00:00"},{"url":"https://smartcontractshacking.com/hacks/sunray-finance-hack-2024","name":"smartcontractshacking.com","type":"other","archive_url":"https://web.archive.org/web/20260829141658/https://smartcontractshacking.com/hacks/sunray-finance-hack-2024","credibility":3,"archive_timestamp":"2026-08-29T14:16:58+00:00"},{"url":"https://www.quadrigainitiative.com/casestudy/sunrayfinancemaliciousupgradeandtokenminting.php","name":"quadrigainitiative.com","type":"other","archive_url":"http://web.archive.org/web/20251119083946/https://quadrigainitiative.com/casestudy/sunrayfinancemaliciousupgradeandtokenminting.php","credibility":3,"archive_timestamp":"2025-11-19T08:39:46+00:00"},{"url":"https://cryptorank.io/news/feed/9ce1e-malicious-smart-contract-causes-2-8m-in-sun-token-losses-on-arbitrum","name":"cryptorank.io","type":"other","archive_url":"https://web.archive.org/web/20260829183351/https://cryptorank.io/news/feed/9ce1e-malicious-smart-contract-causes-2-8m-in-sun-token-losses-on-arbitrum","credibility":3,"archive_timestamp":"2026-08-29T18:33:51+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:28.156212+00:00","updated_at":"2026-08-29T19:06:47.343401+00:00"}}