{"investigation":{"slug":"treasure","entity_name":"Treasure (TreasureDAO)","trust_score":32,"severity_base":null,"score_modifier":0,"confidence":0.72,"status":"published","content_type":"investigation","summary":"TreasureDAO is an Arbitrum-based NFT gaming ecosystem and marketplace powered by the MAGIC token. In March 2022 its marketplace suffered a critical smart contract exploit that allowed attackers to acquire NFTs for free, resulting in approximately $1.4 million in losses across 153 NFTs. Separately, blockchain investigator ZachXBT raised concerns in February 2022 about a core team engineer's alleged prior involvement in failed NFT projects. The project has since experienced severe financial distress, shut down its Treasure Chain layer-2 network in May 2025 after five months of operation, and executed major layoffs in a pivot to AI-agent products.","sections":[{"content":"On March 3, 2022, the Treasure NFT marketplace on Arbitrum suffered a critical smart contract vulnerability that allowed multiple attackers to acquire listed NFTs for zero MAGIC tokens. Security firm PeckShield identified the root cause as a bug in the buyItem() function: the contract failed to enforce that the quantity parameter for ERC-721 tokens be greater than zero. Because totalPrice was calculated as pricePerItem multiplied by quantity, passing a quantity of 0 yielded a total price of 0 regardless of listing price. The same bug also conflated ERC-721 and ERC-1155 token standards in a way that further undermined price validation. A total of 153 NFTs were stolen, including 112 Smol Brains and 41 Legions collection items. The stolen assets were valued at approximately 426,500 MAGIC tokens, worth roughly $1.4 million at the time. The MAGIC token fell over 40% in the immediate aftermath, dropping from $3.82 to $2.55 before partially recovering to approximately $3.30. TreasureDAO co-founder John Patten confirmed the exploit publicly and urged all users to immediately delist their NFTs from the marketplace, which was then frozen. Blockchain security firm CertiK published a post-mortem concluding: \"This hack once again highlights the million-dollar ramifications that a single line of code can have.\" The vulnerability was characterized by the development team as stemming from a prior attempted fix that was not properly validated. TreasureDAO announced that it would propose community-voted remediation options for affected users who did not recover their NFTs. Within hours of the exploit, attackers returned 114 of the 153 stolen NFTs to their rightful owners. The identities of the attackers were not publicly confirmed.","heading":"March 2022 Marketplace Exploit","sources":[{"url":"https://cryptopotato.com/hackes-exploit-arbitrum-based-marketplace-treasure-over-100-nfts-stolen/","name":"cryptopotato.com","type":"other","credibility":3},{"url":"https://medium.com/quillhash/hackers-exploit-arbitrum-based-marketplace-treasure-over-100-nfts-stolen-%EF%B8%8F-d8ff6015ac41","name":"medium.com","type":"other","credibility":3},{"url":"https://finance.yahoo.com/news/stolen-smol-brains-nfts-returned-071652272.html","name":"finance.yahoo.com","type":"other","credibility":3},{"url":"https://www.theblock.co/linked/136143/treasure-marketplace-tells-users-to-delist-nfts-after-exploit","name":"theblock.co","type":"other","credibility":3}],"severity":"medium"},{"content":"In February 2022, pseudonymous blockchain investigator ZachXBT published a Twitter thread alleging that TreasureDAO's front-end engineer, known by the handle 'Just Cheese' (JC), had prior involvement in several NFT/token projects that went quiet after launch. ZachXBT alleged he had traced 134.66 ETH in inflows into JC's wallet from several projects, including Mutant Cats, ZombieToadz, and Yuta/YYY. The thread alleged that JC shared his wallet address in the TreasureDAO Discord in November 2021, which enabled the on-chain tracing. TreasureDAO's community moderator Cryptopantone disputed the framing, arguing that JC had worked as a contract developer for those projects before joining Treasure and was paid for delivered UI/front-end work, and that the projects were abandoned by their founders long after JC had completed his engagement and moved on. The Mutant Cats project, one of the named projects, was subsequently characterized by its community as a soft rug pull, though that community later took over the project. TreasureDAO maintained that JC was a valuable contributor to the ecosystem and the allegations were disputed. No regulatory finding or court filing has confirmed wrongdoing by the engineer. Confidence in this section is limited to the available Tier 2 reporting; no Tier 1 primary source has independently corroborated the on-chain claims.","heading":"ZachXBT Allegations Against Core Team Engineer","sources":[{"url":"https://cointelegraph.com/news/treasuredao-engineer-alleged-to-have-past-involvement-in-questionable-nft-projects","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://twitter.com/zachxbt/status/1509565586874851330","name":"twitter.com","type":"other","credibility":3}],"severity":"medium"},{"content":"By late 2024 and into 2025, TreasureDAO entered severe financial distress. Co-founder John Patten disclosed that the DAO faced quarterly expenses of over $11.3 million in Q4 2024, against only approximately $40,000 in quarterly revenue. Annual labor costs totaled $6.1 million and infrastructure costs $800,000. By April 2025, only $2.4 million in stablecoins and approximately $1.56 million in MAGIC tokens remained in the treasury. Patten warned publicly that without drastic action, Treasure as a game publisher would only survive until July 2025 and the treasury's liquid assets would be depleted by September 2025. The DAO reduced its workforce by approximately 15 employees. Co-founder Karel Vuong departed during this period. The Treasure Chain, a zkSync-based layer-2 gaming network launched in December 2024, was shut down on May 30, 2025, less than five months after its launch, following passage of governance Proposal TIP-52 which granted the core team emergency powers to execute the shutdown. Annual operating costs for maintaining Treasure Chain were approximately $450,000. The MAGIC token fell 18% on news of the restructuring. Quarterly expenses were slashed from $11.3 million to $1.2 million as part of the restructuring. Partner game The Beacon announced its departure from the Treasure ecosystem, citing misalignment with the new strategic direction. The DAO pivoted to AI-agent products, including an AI Agent Marketplace and tools for autonomous NFT agents.","heading":"Financial Distress and Operational Collapse (2024-2025)","sources":[{"url":"https://blockworks.co/news/treasure-dao-gaming-closes-cuts-layoffs","name":"blockworks.co","type":"other","credibility":3},{"url":"https://www.blockchaingamer.biz/news/38095/treasure-downsizes-pivot-ai-agents-ditch-game-publishing-shut-treasure-chain/","name":"blockchaingamer.biz","type":"other","credibility":3},{"url":"https://crypto.news/gaming-ecosystem-treasure-chain-shuts-down-mainnet-nearly-five-months-after-its-launch/","name":"crypto.news","type":"other","credibility":3},{"url":"https://cryptopotato.com/treasure-dao-shutdown-sends-magic-token-down-18/","name":"cryptopotato.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The MAGIC token is TreasureDAO's native ERC-20 governance and utility token with a maximum supply of 347,714,007 tokens. At the time of the March 2022 exploit, MAGIC traded at approximately $3.82 and fell to $2.55 before recovering. MAGIC reached an all-time high of approximately $6.30 in early 2022 during the height of NFT and GameFi enthusiasm. By 2023 MAGIC traded up to $1.96 at its peak before declining. In 2024 the token reached a maximum of $1.34. As of May 2026, MAGIC trades at approximately $0.06, representing a decline of over 98% from its all-time high. The token is listed on major centralized exchanges including Binance, Coinbase, OKX, and Bybit. At its peak, TreasureDAO's marketplace generated over $260 million in cumulative volume and held approximately 95% of all NFT trading activity on Arbitrum.","heading":"MAGIC Token: Price Trajectory and Market Status","sources":[{"url":"https://coinmarketcap.com/currencies/magic-token/","name":"coinmarketcap.com","type":"other","credibility":3},{"url":"https://messari.io/project/treasure-dao","name":"messari.io","type":"other","credibility":3},{"url":"https://www.bitrue.com/blog/treasure-rebrand-magic-price-surge","name":"bitrue.com","type":"other","credibility":3}],"severity":"medium"},{"content":"TreasureDAO operates as a decentralized autonomous organization. Governance occurs through MAGIC token holder votes on Treasure Improvement Proposals (TIPs). Following the March 2022 exploit, the team proposed but did not immediately execute community-voted compensation for affected users, citing the need to compile a full list of impacted parties first. The project has not published a publicly available third-party security audit of its core marketplace contracts as of this investigation. Post-exploit, CertiK analyzed the vulnerability and published a public report. TreasureDAO's co-founder acknowledged the vulnerability arose from a prior fix that was inadequately reviewed before deployment, indicating a gap in pre-deployment security procedures. In 2025, TIP-52 granted the core team emergency powers to shut down Treasure Chain without requiring further community votes, a governance action that was controversial but passed. The DAO's governance docs are publicly available at docs.treasure.lol.","heading":"Governance and Security Posture","sources":[{"url":"https://docs.treasure.lol/about-treasure/governance","name":"docs.treasure.lol","type":"other","credibility":3},{"url":"https://x.com/Treasure_DAO/status/1919578338924101870","name":"x.com","type":"other","credibility":3},{"url":"https://www.ccn.com/news/crypto/web3-gaming-treasuredao-shuts-chain/","name":"ccn.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Searches for 'Treasure NFT' surface a separate, unrelated platform known as Treasure NFT or TNFT, which has been widely identified as a fraudulent investment scheme promising daily returns of 4.3% to 6.8% with referral-based earnings. That platform uses a fake Arizona address, has frozen user withdrawal requests, and targets economically vulnerable communities. This investigation concerns TreasureDAO (treasure.lol), the Arbitrum-based NFT gaming ecosystem, which is a distinct and separate entity. Users searching for TreasureDAO should take care not to conflate it with the TNFT scam platform.","heading":"Distinction from Treasure NFT (TNFT) Scam Platform","sources":[{"url":"https://www.gate.com/news/detail/15980985","name":"gate.com","type":"other","credibility":3},{"url":"https://www.bitrue.com/blog/treasure-nft-tnft-is-a-scam","name":"bitrue.com","type":"other","credibility":3},{"url":"https://mudrex.com/learn/treasurenft-exposed-scam-or-legit/","name":"mudrex.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021-11","event":"TreasureDAO launches on Arbitrum as an NFT gaming ecosystem powered by the MAGIC token.","source":"","date_original":"2021-11-01"},{"date":"2022-02","event":"ZachXBT publishes a Twitter thread alleging TreasureDAO front-end engineer 'Just Cheese' (JC) had prior involvement in several failed or abandoned NFT projects, tracing 134.66 ETH of inflows to his wallet from projects including Mutant Cats and ZombieToadz. TreasureDAO disputes the characterization.","source":"","date_original":"2022-02-01"},{"date":"2022-03-03","event":"TreasureDAO's Arbitrum NFT marketplace is exploited via a zero-quantity bug in the buyItem() smart contract function. Attackers acquire 153 NFTs — including 112 Smol Brains and 41 Legions — for zero MAGIC. Losses estimated at approximately $1.4 million. MAGIC token drops over 40%.","source":""},{"date":"2022-03-03","event":"TreasureDAO co-founder John Patten confirms exploit, urges all users to delist NFTs. Marketplace is frozen.","source":""},{"date":"2022-03-03","event":"Within hours of the exploit, attackers return 114 of 153 stolen NFTs to original owners.","source":""},{"date":"2022-03-04","event":"TreasureDAO announces it will propose community-voted remediation for users who did not receive NFTs back. CertiK publishes exploit post-mortem.","source":""},{"date":"2024-12","event":"TreasureDAO launches Treasure Chain, a zkSync-based layer-2 gaming network.","source":"","date_original":"2024-12-01"},{"date":"2025-04","event":"Co-founder John Patten publicly discloses severe financial distress: over $11.3 million in Q4 2024 expenses, only $2.4 million in stablecoins remaining in treasury. Announces pivot to AI agents and plan to shut down Treasure Chain.","source":"","date_original":"2025-04-01"},{"date":"2025-04","event":"TreasureDAO announces layoffs of approximately 15 employees. Co-founder Karel Vuong departs.","source":"","date_original":"2025-04-01"},{"date":"2025-05-06","event":"TIP-52 passed; grants core team emergency powers to shut down Treasure Chain without further community votes. Users urged to bridge all assets out before May 30, 2025.","source":""},{"date":"2025-05-30","event":"Treasure Chain mainnet shut down, five months after launch. MAGIC token falls 18% on the announcement.","source":""}],"sources_used":[{"url":"https://cryptopotato.com/hackes-exploit-arbitrum-based-marketplace-treasure-over-100-nfts-stolen/","name":"cryptopotato.com","type":"other","archive_url":"http://web.archive.org/web/20260420192431/https://cryptopotato.com/hackes-exploit-arbitrum-based-marketplace-treasure-over-100-nfts-stolen/","credibility":3,"archive_timestamp":"2026-04-20T19:24:31+00:00"},{"url":"https://medium.com/quillhash/hackers-exploit-arbitrum-based-marketplace-treasure-over-100-nfts-stolen-%EF%B8%8F-d8ff6015ac41","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://finance.yahoo.com/news/stolen-smol-brains-nfts-returned-071652272.html","name":"finance.yahoo.com","type":"other","archive_url":"https://web.archive.org/web/20260829192951/https://finance.yahoo.com/news/stolen-smol-brains-nfts-returned-071652272.html","credibility":3,"archive_timestamp":"2026-08-29T19:29:51+00:00"},{"url":"https://www.theblock.co/linked/136143/treasure-marketplace-tells-users-to-delist-nfts-after-exploit","name":"theblock.co","type":"other","archive_url":"http://web.archive.org/web/20251205113312/https://www.theblock.co/linked/136143/treasure-marketplace-tells-users-to-delist-nfts-after-exploit","credibility":3,"archive_timestamp":"2025-12-05T11:33:12+00:00"},{"url":"https://cointelegraph.com/news/treasuredao-engineer-alleged-to-have-past-involvement-in-questionable-nft-projects","name":"cointelegraph.com","type":"other","archive_url":"https://web.archive.org/web/20260830084332/https://cointelegraph.com/news/treasuredao-engineer-alleged-to-have-past-involvement-in-questionable-nft-projects","credibility":3,"archive_timestamp":"2026-08-30T08:43:32+00:00"},{"url":"https://twitter.com/zachxbt/status/1509565586874851330","name":"twitter.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://blockworks.co/news/treasure-dao-gaming-closes-cuts-layoffs","name":"blockworks.co","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.blockchaingamer.biz/news/38095/treasure-downsizes-pivot-ai-agents-ditch-game-publishing-shut-treasure-chain/","name":"blockchaingamer.biz","type":"other","archive_url":"http://web.archive.org/web/20250917234629/https://www.blockchaingamer.biz/news/38095/treasure-downsizes-pivot-ai-agents-ditch-game-publishing-shut-treasure-chain/","credibility":3,"archive_timestamp":"2025-09-17T23:46:29+00:00"},{"url":"https://crypto.news/gaming-ecosystem-treasure-chain-shuts-down-mainnet-nearly-five-months-after-its-launch/","name":"crypto.news","type":"other","archive_url":"http://web.archive.org/web/20251014232837/https://crypto.news/gaming-ecosystem-treasure-chain-shuts-down-mainnet-nearly-five-months-after-its-launch/","credibility":3,"archive_timestamp":"2025-10-14T23:28:37+00:00"},{"url":"https://cryptopotato.com/treasure-dao-shutdown-sends-magic-token-down-18/","name":"cryptopotato.com","type":"other","archive_url":"http://web.archive.org/web/20260216205937/https://cryptopotato.com/treasure-dao-shutdown-sends-magic-token-down-18/","credibility":3,"archive_timestamp":"2026-02-16T20:59:37+00:00"},{"url":"https://coinmarketcap.com/currencies/magic-token/","name":"coinmarketcap.com","type":"other","archive_url":"http://web.archive.org/web/20260812100341/https://coinmarketcap.com/currencies/magic-token/","credibility":3,"archive_timestamp":"2026-08-12T10:03:41+00:00"},{"url":"https://messari.io/project/treasure-dao","name":"messari.io","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.bitrue.com/blog/treasure-rebrand-magic-price-surge","name":"bitrue.com","type":"other","archive_url":"https://web.archive.org/web/20260830131832/https://www.bitrue.com/blog","credibility":3,"archive_timestamp":"2026-08-30T13:18:32+00:00"},{"url":"https://docs.treasure.lol/about-treasure/governance","name":"docs.treasure.lol","type":"other","archive_url":"https://web.archive.org/web/20260830125753/https://docs.treasure.lol/governance","credibility":3,"archive_timestamp":"2026-08-30T12:57:53+00:00"},{"url":"https://x.com/Treasure_DAO/status/1919578338924101870","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.ccn.com/news/crypto/web3-gaming-treasuredao-shuts-chain/","name":"ccn.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.gate.com/news/detail/15980985","name":"gate.com","type":"other","archive_url":"https://web.archive.org/web/20260901041331/https://www.gate.com/news/detail/15980985","credibility":3,"archive_timestamp":"2026-09-01T04:13:31+00:00"},{"url":"https://www.bitrue.com/blog/treasure-nft-tnft-is-a-scam","name":"bitrue.com","type":"other","archive_url":"http://web.archive.org/web/20260413204747/https://www.bitrue.com/blog/treasure-nft-tnft-is-a-scam","credibility":3,"archive_timestamp":"2026-04-13T20:47:47+00:00"},{"url":"https://mudrex.com/learn/treasurenft-exposed-scam-or-legit/","name":"mudrex.com","type":"other","archive_url":"https://web.archive.org/web/20260829194707/https://mudrex.com/learn/treasurenft-exposed-scam-or-legit/","credibility":3,"archive_timestamp":"2026-08-29T19:47:07+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:51.181104+00:00","updated_at":"2026-09-01T04:16:56.216056+00:00"}}