{"investigation":{"slug":"tmx-tribe","entity_name":"TMX TRIBE","trust_score":18,"severity_base":null,"score_modifier":0,"confidence":0.78,"status":"published","content_type":"investigation","summary":"TMX TRIBE (also marketed as Tribe DEX) is a decentralized perpetual futures exchange operating on Arbitrum and Optimism that launched its TMX token in mid-2025. On January 5-7, 2026, an attacker exploited a critical logic flaw in unverified, unaudited smart contracts to drain approximately $1.4 million in user funds over 36 hours, with stolen assets subsequently bridged to Ethereum and laundered via Tornado Cash. The team deployed no emergency pause during the attack, issued no public statement for days afterward, and produced no post-mortem or user compensation plan, raising serious concerns about operational competence and transparency. ZachXBT has flagged the entity.","sections":[{"content":"TMX TRIBE, operating under the brand Tribe DEX at tribe-dex.com, describes itself as a decentralized exchange for perpetual futures trading on Ethereum Layer 2 networks Arbitrum and Optimism. The platform explicitly markets itself as offering 'fully anonymous DeFi trading — with no KYC and no limits,' with up to 30x leverage, automated trading bots, staking rewards, and liquidity mining. The project's founding team is entirely anonymous; no individual names or verifiable credentials have been publicly disclosed. The Dubai, UAE address is listed in press releases but no regulatory filings or incorporation records have been located. A token generation event (TGE) for the TMX token was held on May 26, 2025, following a private raise of $871,000; the public allocation was capped at 485 ETH. TMX was subsequently listed on the WEEX exchange beginning September 22, 2025. As of the most recent data, the live TMX price was approximately $7.57 USD with a 24-hour trading volume of roughly $59,000.","heading":"Platform Overview","sources":[{"url":"https://x.com/TMXTribe/status/1920163256846479553","name":"x.com","type":"other","credibility":3},{"url":"https://www.globenewswire.com/news-release/2025/05/26/3088231/0/en/TRIBE-DEX-Brings-Real-DeFi-Utility-to-Life-with-TMX-TGE-Only-485-ETH-Available-After-871K-Raised.html","name":"globenewswire.com","type":"other","credibility":3},{"url":"https://www.weex.com/learn/articles/what-is-tribe-perpetual-tmx-coin-a-comprehensive-guide-983","name":"weex.com","type":"other","credibility":3},{"url":"https://coinmarketcap.com/currencies/tmx/","name":"coinmarketcap.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On January 5-7, 2026, TMX TRIBE suffered a critical security incident resulting in the loss of approximately $1.4 million in user funds. The attack targeted an unverified smart contract associated with the protocol's liquidity pool (LP) staking and swapping mechanics. The vulnerability was not the result of a complex flash loan or oracle manipulation; rather, it stemmed from fundamentally flawed contract logic that lacked proper state management controls, input validation, and circuit breakers. The attacker executed a methodical 'mint and stake loop' exploit: minting and staking TMX LP tokens using USDT, swapping deposited USDT for USDG (the protocol's internal stablecoin), unstaking the LP tokens, and draining the acquired USDG. This cycle was repeated systematically across 502 transactions over 36 hours. Two attacker addresses were identified on Arbitrum: a primary address (0x763a67E4418278f84c04383071fC00165C112661) executing the bulk of the transactions, and a secondary address (0x16Ed3AFf3255FDDB44dAa73B4dE06f0c2E15288d) running identical exploit patterns in parallel. Drained assets included USDT, wrapped SOL, and WETH. The stolen funds were subsequently converted to ETH on Arbitrum, bridged to Ethereum via the Across Protocol (approximately $1.2 million), and deposited into Tornado Cash for laundering. The incident was flagged by CertiK Alert and independently documented by QuillAudits and the Rekt News database.","heading":"January 2026 Smart Contract Exploit ($1.4 Million)","sources":[{"url":"https://rekt.news/tmztribe-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://nulltx.com/certik-flags-1-4m-exploit-linked-to-tmx-tribe-on-arbitrum/","name":"nulltx.com","type":"other","credibility":3},{"url":"https://bitcoinethereumnews.com/finance/certik-flags-1-4m-exploit-linked-to-tmx-tribe-on-arbitrum/","name":"bitcoinethereumnews.com","type":"other","credibility":3},{"url":"https://x.com/QuillAudits_AI/status/2008459614711386457","name":"x.com","type":"other","credibility":3},{"url":"https://smartcontractshacking.com/hacks/tmx-tribe-hack-2026","name":"smartcontractshacking.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The TMX TRIBE development team's behavior during and after the January 2026 exploit raised significant concerns. According to on-chain analysis documented by Rekt News, the team was active on-chain throughout the 36-hour exploitation window, deploying multiple contract upgrades, yet never triggered the protocol's emergency pause function. Rather than halting the drain, the team sent an on-chain bounty message from wallet address 0x33392e39325013e81874ca7b76326858ec179543 to the exploiter, offering the attacker permission to retain 20% of stolen funds in exchange for returning 80%. This offer was made while funds were already being bridged to Ethereum and laundered via Tornado Cash. The exploiter did not respond. As of at least four days after the incident, TMX TRIBE had issued no public statement on its social media accounts, published no post-mortem, and announced no user compensation plan. The absence of any public acknowledgment of a $1.4 million loss from user funds is consistent with behavior documented in exit scam or gross negligence scenarios, though the precise characterization remains alleged.","heading":"Team Conduct During and After the Exploit","sources":[{"url":"https://rekt.news/tmztribe-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://nulltx.com/certik-flags-1-4m-exploit-linked-to-tmx-tribe-on-arbitrum/","name":"nulltx.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Blockchain security analysts noted several pre-existing security deficiencies that enabled the January 2026 exploit. The exploited contracts were deployed without public verification on Arbiscan, meaning their source code was not available for public inspection prior to the incident. No third-party security audit of the protocol's smart contracts has been identified by any reporting outlet. TMX TRIBE is characterized by Rekt News as a GMX fork, meaning it leveraged another protocol's architecture but allegedly inherited none of GMX's documented security rigor, which includes multiple independent audits. The combination of anonymous team, unverified contracts, no audit trail, and a no-KYC operational mandate reflects a risk profile materially higher than comparable DeFi perpetuals platforms.","heading":"Security Posture and Due Diligence Failures","sources":[{"url":"https://rekt.news/tmztribe-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://nulltx.com/certik-flags-1-4m-exploit-linked-to-tmx-tribe-on-arbitrum/","name":"nulltx.com","type":"other","credibility":3},{"url":"https://bitcoinethereumnews.com/finance/certik-flags-1-4m-exploit-linked-to-tmx-tribe-on-arbitrum/","name":"bitcoinethereumnews.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Prior to the exploit, Tribe DEX conducted a private token sale raising $871,000 and launched a public TGE on May 26, 2025, capped at 485 ETH. Marketing materials distributed via GlobeNewswire referenced a forthcoming listing on an unnamed 'Top 10 CEX' without identifying the exchange or providing a timeline. The platform's press releases do not disclose audit status, regulatory standing, or team identities. The token was ultimately listed on WEEX, a mid-tier centralized exchange. These promotional practices — anonymous team, vague partnership claims, aggressive leverage marketing (up to 30x), and an explicit no-KYC positioning — are patterns commonly associated with higher-risk DeFi launches. The August 2025 token launch press release was titled 'TMX DEX Announces Token Launch, Empowering Global Traders with 100x Opportunity,' language that some analysts have flagged as indicative of speculative or misleading marketing.","heading":"Token Sale and Marketing Practices","sources":[{"url":"https://www.globenewswire.com/news-release/2025/05/26/3088231/0/en/TRIBE-DEX-Brings-Real-DeFi-Utility-to-Life-with-TMX-TGE-Only-485-ETH-Available-After-871K-Raised.html","name":"globenewswire.com","type":"other","credibility":3},{"url":"https://www.globenewswire.com/news-release/2025/08/26/3139061/0/en/TMX-DEX-Announces-Token-Launch-Empowering-Global-Traders-with-100x-Opportunity.html","name":"globenewswire.com","type":"other","credibility":3},{"url":"https://finance.yahoo.com/news/tribe-dex-brings-real-defi-161200483.html","name":"finance.yahoo.com","type":"other","credibility":3}],"severity":"medium"},{"content":"No regulatory actions by the SEC, CFTC, DOJ, or equivalent bodies against TMX TRIBE or Tribe DEX have been identified in public records as of the time of this investigation. The platform's explicit no-KYC policy and provision of leveraged derivatives trading to anonymous users globally may expose it to scrutiny under securities and derivatives regulations in multiple jurisdictions, but no formal enforcement proceedings have been documented. The protocol's Dubai association has not been substantiated by any verifiable corporate filing.","heading":"Regulatory Status","sources":[{"url":"https://tribe-dex.com/","name":"tribe-dex.com","type":"other","credibility":3},{"url":"https://x.com/TMXTribe","name":"x.com","type":"other","credibility":3}],"severity":"medium"},{"content":"ZachXBT, the pseudonymous blockchain investigator who joined Paradigm as an incident response advisor in February 2025, has flagged TMX TRIBE. The specific nature and content of ZachXBT's flag have not been independently located in publicly searchable records at the time of this investigation. ZachXBT's flags have historically been associated with scams, rug pulls, stolen funds, and insider misconduct in the crypto space. The flag is treated as a relevant risk signal consistent with the other documented concerns about this entity.","heading":"ZachXBT Flag","sources":[{"url":"https://en.wikipedia.org/wiki/ZachXBT","name":"en.wikipedia.org","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2025-05-26","event":"Tribe DEX announces public TGE for TMX token, with 485 ETH allocated after $871,000 raised in a private sale.","source":""},{"date":"2025-08-26","event":"TMX DEX announces token launch via GlobeNewswire, marketing '100x Opportunity' and referencing an unspecified 'Top 10 CEX' listing.","source":""},{"date":"2025-09-22","event":"TMX token listed on WEEX exchange as a spot trading pair (TMX/USDT).","source":""},{"date":"2026-01-05","event":"Attack begins on TMX TRIBE's Arbitrum contracts. Primary attacker address 0x763a67E4418278f84c04383071fC00165C112661 begins executing the mint-and-stake loop exploit against unverified LP contracts.","source":""},{"date":"2026-01-05","event":"CertiK Alert flags the exploit in progress. DefimonAlerts also detects anomalous activity.","source":""},{"date":"2026-01-06","event":"Exploitation continues for a second day. Team deploys contract upgrades on-chain but does not trigger an emergency pause. Approximately $1.2 million bridged to Ethereum via Across Protocol.","source":""},{"date":"2026-01-06","event":"TMX TRIBE team sends on-chain bounty message to exploiter from wallet 0x33392e39325013e81874ca7b76326858ec179543, offering 20% retention in exchange for 80% return. Exploiter does not respond.","source":""},{"date":"2026-01-07","event":"Exploitation concludes. Total loss approximately $1.4 million. Stolen funds deposited into Tornado Cash.","source":""},{"date":"2026-01-10","event":"As of at least four days post-exploit, TMX TRIBE has issued no public statement, post-mortem, or compensation plan. Rekt News publishes full incident documentation.","source":""}],"sources_used":[{"url":"https://x.com/TMXTribe/status/1920163256846479553","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.globenewswire.com/news-release/2025/05/26/3088231/0/en/TRIBE-DEX-Brings-Real-DeFi-Utility-to-Life-with-TMX-TGE-Only-485-ETH-Available-After-871K-Raised.html","name":"globenewswire.com","type":"other","archive_url":"https://web.archive.org/web/20260829122422/https://www.globenewswire.com/news-release/2025/05/26/3088231/0/en/TRIBE-DEX-Brings-Real-DeFi-Utility-to-Life-with-TMX-TGE-Only-485-ETH-Available-After-871K-Raised.html","credibility":3,"archive_timestamp":"2026-08-29T12:24:22+00:00"},{"url":"https://www.weex.com/learn/articles/what-is-tribe-perpetual-tmx-coin-a-comprehensive-guide-983","name":"weex.com","type":"other","archive_url":"https://web.archive.org/web/20260829232303/https://www.weex.com/learn/articles/what-is-tribe-perpetual-tmx-coin-a-comprehensive-guide-983","credibility":3,"archive_timestamp":"2026-08-29T23:23:03+00:00"},{"url":"https://coinmarketcap.com/currencies/tmx/","name":"coinmarketcap.com","type":"other","archive_url":"http://web.archive.org/web/20251230124543/https://coinmarketcap.com/currencies/tmx/","credibility":3,"archive_timestamp":"2025-12-30T12:45:43+00:00"},{"url":"https://rekt.news/tmztribe-rekt","name":"rekt.news","type":"other","archive_url":"http://web.archive.org/web/20260513164805/https://rekt.news/tmztribe-rekt","credibility":3,"archive_timestamp":"2026-05-13T16:48:05+00:00"},{"url":"https://nulltx.com/certik-flags-1-4m-exploit-linked-to-tmx-tribe-on-arbitrum/","name":"nulltx.com","type":"other","archive_url":"http://web.archive.org/web/20260412195548/https://nulltx.com/certik-flags-1-4m-exploit-linked-to-tmx-tribe-on-arbitrum/","credibility":3,"archive_timestamp":"2026-04-12T19:55:48+00:00"},{"url":"https://bitcoinethereumnews.com/finance/certik-flags-1-4m-exploit-linked-to-tmx-tribe-on-arbitrum/","name":"bitcoinethereumnews.com","type":"other","archive_url":"http://web.archive.org/web/20260829023520/https://bitcoinethereumnews.com/finance/certik-flags-1-4m-exploit-linked-to-tmx-tribe-on-arbitrum/","credibility":3,"archive_timestamp":"2026-08-29T02:35:20+00:00"},{"url":"https://x.com/QuillAudits_AI/status/2008459614711386457","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://smartcontractshacking.com/hacks/tmx-tribe-hack-2026","name":"smartcontractshacking.com","type":"other","archive_url":"https://web.archive.org/web/20260829041328/https://smartcontractshacking.com/hacks/tmx-tribe-hack-2026","credibility":3,"archive_timestamp":"2026-08-29T04:13:28+00:00"},{"url":"https://www.globenewswire.com/news-release/2025/08/26/3139061/0/en/TMX-DEX-Announces-Token-Launch-Empowering-Global-Traders-with-100x-Opportunity.html","name":"globenewswire.com","type":"other","archive_url":"http://web.archive.org/web/20250917045854/https://www.globenewswire.com/news-release/2025/08/26/3139061/0/en/TMX-DEX-Announces-Token-Launch-Empowering-Global-Traders-with-100x-Opportunity.html","credibility":3,"archive_timestamp":"2025-09-17T04:58:54+00:00"},{"url":"https://finance.yahoo.com/news/tribe-dex-brings-real-defi-161200483.html","name":"finance.yahoo.com","type":"other","archive_url":"https://web.archive.org/web/20260829225629/https://finance.yahoo.com/news/tribe-dex-brings-real-defi-161200483.html","credibility":3,"archive_timestamp":"2026-08-29T22:56:29+00:00"},{"url":"https://tribe-dex.com/","name":"tribe-dex.com","type":"other","archive_url":"http://web.archive.org/web/20260607105209/http://tribe-dex.com/","credibility":3,"archive_timestamp":"2026-06-07T10:52:09+00:00"},{"url":"https://x.com/TMXTribe","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://en.wikipedia.org/wiki/ZachXBT","name":"en.wikipedia.org","type":"other","archive_url":"http://web.archive.org/web/20260711020137/https://en.wikipedia.org/wiki/ZachXBT","credibility":3,"archive_timestamp":"2026-07-11T02:01:37+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:19.403865+00:00","updated_at":"2026-08-29T23:26:11.697967+00:00"}}