{"investigation":{"slug":"valuedefi","entity_name":"ValueDefi","trust_score":8,"severity_base":null,"score_modifier":0,"confidence":0.88,"status":"published","content_type":"investigation","summary":"Value DeFi (formerly YFValue/YFV) was a DeFi yield aggregation and AMM protocol that suffered three documented security exploits between August 2020 and May 2021, resulting in combined losses of approximately $24 million. Beyond the technical failures, the project was found to have used a paid actress from Fiverr to impersonate a co-founder named 'Anna Tanaka,' raising severe concerns about team identity, transparency, and intent. The VALUE token is effectively defunct, trading at a fraction of a cent with a near-zero market cap.","sections":[{"content":"Value DeFi (ticker: VALUE) launched in 2020 as a rebranding of YFValue (YFV), positioning itself as a yield aggregation protocol and decentralized exchange on Ethereum, later expanding to Binance Smart Chain (BSC). The protocol offered products including vSafe (yield vaults), vSwap (an AMM supporting non-50/50 pool ratios using the Bancor formula), and multi-stablecoin vaults. The team operated anonymously. At peak activity in 2021, the project reported a market capitalization of approximately $850 million. The VALUE token currently trades near $0.02 with a market cap under $110,000, reflecting near-total collapse of investor confidence following a series of security failures and identity fraud discoveries.","heading":"Overview and Background","sources":[{"url":"https://www.coindesk.com/markets/2020/11/14/value-defi-suffers-6m-flash-loan-attack/","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.coingecko.com/en/coins/value-defi","name":"coingecko.com","type":"other","credibility":3},{"url":"https://coinmarketcap.com/currencies/value-defi/","name":"coinmarketcap.com","type":"other","credibility":3},{"url":"https://www.quadrigainitiative.com/hackfraudscam/valuedefionsaleagain.php","name":"quadrigainitiative.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On November 14, 2020 — the day after the launch of its MultiStables Vault — Value DeFi suffered a flash loan exploit resulting in a gross loss of approximately $7.4 million in DAI. The attack is particularly notable because Value DeFi had publicly boasted of having 'flash loan attack protection,' including a tweet the day before the hack claiming 'highest security.' The attacker borrowed 80,000 ETH from Aave and used it alongside a $116 million DAI flash loan from Uniswap to manipulate the Curve 3pool price oracle on which Value DeFi's MultiStables vault depended. By swapping approximately 90 million DAI for USDC and then 31 million USDT for additional USDC, the attacker artificially inflated the USDC price in the pool, then exploited the distorted price feed to redeem 33 million 3crv tokens instead of the legitimate ~24.9 million. The attacker returned 2 million DAI to the protocol and kept approximately $5.4 to $6 million, leaving a signed on-chain message reading: 'do you really know flashloan?' PeckShield published a root cause analysis attributing the vulnerability to the protocol's reliance on an AMM-based oracle without proper flash loan protections. Following the hack, Value DeFi announced a pivot to Chainlink price feeds. The VALUE token fell 27.9% from approximately $2.76 to $1.99 in the immediate aftermath.","heading":"Exploit 1: MultiStables Vault Flash Loan Attack (November 2020)","sources":[{"url":"https://www.coindesk.com/markets/2020/11/14/value-defi-suffers-6m-flash-loan-attack/","name":"coindesk.com","type":"other","credibility":3},{"url":"https://peckshield.medium.com/value-defi-incident-root-cause-analysis-fbab71faf373","name":"peckshield.medium.com","type":"other","credibility":3},{"url":"https://coingeek.com/7-4-million-stolen-in-value-defi-exploit/","name":"coingeek.com","type":"other","credibility":3},{"url":"https://news.bitcoin.com/defi-protocol-bragged-having-flash-loan-attack-prevention-hacked-6-million/","name":"news.bitcoin.com","type":"other","credibility":3},{"url":"https://decrypt.co/48892/value-defi-hacked-chainlink","name":"decrypt.co","type":"other","credibility":3},{"url":"https://cryptobriefing.com/value-defi-drained-millions-flash-loan-attack/","name":"cryptobriefing.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On May 5, 2021 at approximately 3:22 AM UTC, Value DeFi suffered a second major exploit targeting its vStake pool on Binance Smart Chain. The loss was approximately $10 million (reported as 10,839.16 vBSWAP/BUSD LP tokens). The vulnerability stemmed from a missing line of code — the `initialized = true;` statement was absent from the vStake pool's `initialize()` function, which allowed the attacker to re-initialize the pool and assign themselves as the owner. With owner privileges, the exploiter then called `governanceRecoverUnsupported()` to drain the pool's funds. The stolen assets were converted through multiple steps — vBSWAP and BUSD to BNB, then to renBTC — and ultimately laundered to a Bitcoin address. The protocol's post-incident response included a proposal to mint 4,540 vBSWAP tokens to partially compensate affected users. This incident was described by web3isgoinggreat.com as 'the second attack in six months.' Security firm Inspex published an in-depth analysis of the exploit mechanism.","heading":"Exploit 2: vStake Pool Re-Initialization Attack (May 5, 2021)","sources":[{"url":"https://web3isgoinggreat.com/?id=value-defi-hacked-for-second-time-in-six-months","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://www.quadrigainitiative.com/hackfraudscam/valuedefionsaleagain.php","name":"quadrigainitiative.com","type":"other","credibility":3},{"url":"https://inspexco.medium.com/value-defis-invalid-share-calculation-exploit-in-depth-analysis-1c8f97c1416e","name":"inspexco.medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Three days after the vStake exploit, on approximately May 8, 2021, Value DeFi's vSwap automated market maker on Binance Smart Chain was exploited for approximately $11 million. The vSwap AMM used the Bancor formula to support non-50/50 asset ratio pools — a feature not available on Uniswap — but the implementation was critically flawed. The vulnerability resided in the `ensureConstantValue` function: because the pool's `tokenWeight0` parameter was set to 70, a secondary validation algorithm was used that could be bypassed through specially crafted transactions. The attacker initiated a small swap (approximately 0.05 WBNB for vBSWAP tokens) alongside a flash loan, exploiting the gap between cached and real-time token amounts to drain pool liquidity. Nine of the 16 vSwap pools were ultimately exploited. Assets stolen included approximately 15,000 BNB, FARM tokens, BASv2 (totaling approximately $8.5 million of the total), BDO, BUSD, MDG, VBOND, and FIRO. SlowMist published a technical post-mortem of the attack. This exploit occurred within the same week as the vStake exploit, representing an unprecedented concentration of security failures.","heading":"Exploit 3: vSwap AMM Bancor Formula Exploit (May 8, 2021)","sources":[{"url":"https://coingape.com/bsc-based-valuedefi-exploited-for-11m-by-scammers/","name":"coingape.com","type":"other","credibility":3},{"url":"https://slowmist.medium.com/slowmist-value-defi-vswap-module-hack-analysis-64e8909ef6a2","name":"slowmist.medium.com","type":"other","credibility":3},{"url":"https://web3isgoinggreat.com/?id=value-defi-hacked-for-second-time-in-six-months","name":"web3isgoinggreat.com","type":"other","credibility":3}],"severity":"medium"},{"content":"In May 2021, a Twitter user identified as Crypto Bethany publicly exposed that Value DeFi had been presenting a paid actress as one of its co-founders. The individual, identified online as 'Anna Tanaka,' appeared in promotional videos for the project, discussing features such as reduced gas fees and new token products. Investigation revealed the actress was a Fiverr freelancer whose platform name was 'Shan,' not 'Anna.' When confronted by community members on Discord, a Value DeFi developer claimed that one of their developers used 'Anna Tanika' as an online alias and that they had hired the actress to represent this alias — an explanation communities widely rejected as implausible, noting that the Fiverr actor's name was not Anna. The story was published on May 8, 2021, and the project at the time held a reported market capitalization of approximately $850 million. This incident, coinciding with the two May 2021 exploits, constitutes a serious allegation of deliberate misrepresentation of team identity to attract investment.","heading":"Fraudulent Team Representation: Paid Actress Used as Co-Founder","sources":[{"url":"https://cryptocoindaddy.com/value-defi-co-founder-is-paid-actress-on-fiverr/","name":"cryptocoindaddy.com","type":"other","credibility":3},{"url":"https://web3isgoinggreat.com/?id=value-defi-hacked-for-second-time-in-six-months","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://wintoken.fun/potential-scam-value-defi-allegedly-lied-about-their-co-founder/","name":"wintoken.fun","type":"other","credibility":3}],"severity":"medium"},{"content":"Value DeFi underwent at least eight audits from multiple firms, including PeckShield and Certik. However, community analysis noted that most audits did not adequately address the complex financial mechanics the protocol employed — particularly the oracle-based pricing and the non-standard Bancor formula implementation in vSwap. The November 2020 exploit occurred the day after MultiStables Vault launched, before that component had been audited against flash loan manipulation vectors. The May 2021 vStake exploit was attributed to a 'human error' — a missing single line of code (`initialized = true;`) — that was not caught by auditing processes. The sequential nature of the exploits (three incidents over approximately nine months) indicates systemic deficiencies in both the security review process and the operational deployment procedures.","heading":"Audit History and Security Practices","sources":[{"url":"https://peckshield.medium.com/value-defi-incident-root-cause-analysis-fbab71faf373","name":"peckshield.medium.com","type":"other","credibility":3},{"url":"https://slowmist.medium.com/slowmist-value-defi-vswap-module-hack-analysis-64e8909ef6a2","name":"slowmist.medium.com","type":"other","credibility":3},{"url":"https://inspexco.medium.com/value-defis-invalid-share-calculation-exploit-in-depth-analysis-1c8f97c1416e","name":"inspexco.medium.com","type":"other","credibility":3},{"url":"https://decrypt.co/48892/value-defi-hacked-chainlink","name":"decrypt.co","type":"other","credibility":3}],"severity":"medium"},{"content":"The VALUE token (ERC-20) launched during 2020 and reached significant valuations during the DeFi bull market. Following the cascade of exploits and the fake co-founder revelation in May 2021, the token lost nearly all value. As of current data, VALUE trades at approximately $0.02 with a circulating market cap under $110,000 and a circulating supply of approximately 4.7 million tokens. The protocol's total value locked (TVL) has effectively collapsed. The token is still listed on CoinGecko and CoinMarketCap but shows no meaningful trading activity. The Telegram announcements channel and Medium blog remain accessible but have not published substantive updates in years. The project is widely considered abandoned.","heading":"Token and Protocol Status","sources":[{"url":"https://www.coingecko.com/en/coins/value-defi","name":"coingecko.com","type":"other","credibility":3},{"url":"https://coinmarketcap.com/currencies/value-defi/","name":"coinmarketcap.com","type":"other","credibility":3},{"url":"https://coinstats.app/coins/value-liquidity/","name":"coinstats.app","type":"other","credibility":3}],"severity":"medium"},{"content":"Value DeFi has been flagged by on-chain investigator ZachXBT. While specific details of ZachXBT's public statements regarding Value DeFi were not independently retrieved from a primary source during this investigation, the combination of multiple large-scale exploits (totaling approximately $24 million across three incidents), fraudulent team identity presentation using a paid actress, and a fully anonymous development team are consistent with the types of projects ZachXBT routinely flags as high-risk or fraudulent. This flag, combined with the documented evidence, contributes to the overall risk assessment.","heading":"ZachXBT Flag","sources":[{"url":"https://web3isgoinggreat.com/?id=value-defi-hacked-for-second-time-in-six-months","name":"web3isgoinggreat.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2020-08","event":"Value DeFi (then YFValue/YFV) launches. An initial security vulnerability is reported during August 2020, constituting the project's first security incident.","source":"","date_original":"2020-08-01"},{"date":"2020-11-13","event":"Value DeFi posts a tweet boasting of 'highest security' and claims to offer flash loan attack prevention.","source":""},{"date":"2020-11-14","event":"Flash loan exploit drains approximately $7.4 million from the MultiStables Vault the day after its launch. Attacker returns $2 million and leaves on-chain message: 'do you really know flashloan?' VALUE token drops 27.9%.","source":""},{"date":"2020-11-15","event":"PeckShield publishes root cause analysis. Value DeFi announces plans to integrate Chainlink price oracles to prevent future AMM oracle manipulation.","source":""},{"date":"2021-05-05","event":"Second major exploit: attacker re-initializes vStake pool on BSC due to missing `initialized = true;` line in smart contract code, draining approximately $10 million. Funds laundered via renBTC to Bitcoin.","source":""},{"date":"2021-05-08","event":"Third exploit: vSwap AMM on BSC is drained of approximately $11 million through exploitation of flawed Bancor formula implementation. Nine of 16 pools are affected.","source":""},{"date":"2021-05-08","event":"Community member Crypto Bethany publicly exposes that Value DeFi's co-founder 'Anna Tanaka' is a paid Fiverr actress named Shan. Value DeFi developer attempts to explain the use of a hired actress as representation for a developer alias.","source":""},{"date":"2021-05-09","event":"Value DeFi proposes minting 4,540 vBSWAP tokens to partially compensate vStake victims. Community response is largely negative.","source":""},{"date":"2021-06","event":"Protocol activity declines sharply. Development effectively ceases. VALUE token begins sustained collapse toward near-zero valuations.","source":"","date_original":"2021-06-01"}],"sources_used":[{"url":"https://www.coindesk.com/markets/2020/11/14/value-defi-suffers-6m-flash-loan-attack/","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20260727042224/https://www.coindesk.com/markets/2020/11/14/value-defi-suffers-6m-flash-loan-attack","credibility":3,"archive_timestamp":"2026-07-27T04:22:24+00:00"},{"url":"https://www.coingecko.com/en/coins/value-defi","name":"coingecko.com","type":"other","archive_url":"http://web.archive.org/web/20251012153249/https://www.coingecko.com/en/coins/value-defi","credibility":3,"archive_timestamp":"2025-10-12T15:32:49+00:00"},{"url":"https://coinmarketcap.com/currencies/value-defi/","name":"coinmarketcap.com","type":"other","archive_url":"https://web.archive.org/web/20260830125147/https://coinmarketcap.com/currencies/value-defi/","credibility":3,"archive_timestamp":"2026-08-30T12:51:47+00:00"},{"url":"https://www.quadrigainitiative.com/hackfraudscam/valuedefionsaleagain.php","name":"quadrigainitiative.com","type":"other","archive_url":"https://web.archive.org/web/20260830132911/https://www.quadrigainitiative.com/hackfraudscam/valuedefionsaleagain.php","credibility":3,"archive_timestamp":"2026-08-30T13:29:11+00:00"},{"url":"https://peckshield.medium.com/value-defi-incident-root-cause-analysis-fbab71faf373","name":"peckshield.medium.com","type":"other","archive_url":"http://web.archive.org/web/20251026014204/https://peckshield.medium.com/value-defi-incident-root-cause-analysis-fbab71faf373","credibility":3,"archive_timestamp":"2025-10-26T01:42:04+00:00"},{"url":"https://coingeek.com/7-4-million-stolen-in-value-defi-exploit/","name":"coingeek.com","type":"other","archive_url":"http://web.archive.org/web/20260420000740/https://coingeek.com/7-4-million-stolen-in-value-defi-exploit/","credibility":3,"archive_timestamp":"2026-04-20T00:07:40+00:00"},{"url":"https://news.bitcoin.com/defi-protocol-bragged-having-flash-loan-attack-prevention-hacked-6-million/","name":"news.bitcoin.com","type":"other","archive_url":"http://web.archive.org/web/20260101124347/https://news.bitcoin.com/defi-protocol-bragged-having-flash-loan-attack-prevention-hacked-6-million/","credibility":3,"archive_timestamp":"2026-01-01T12:43:47+00:00"},{"url":"https://decrypt.co/48892/value-defi-hacked-chainlink","name":"decrypt.co","type":"other","archive_url":"http://web.archive.org/web/20260610060726/https://decrypt.co/48892/value-defi-hacked-chainlink","credibility":3,"archive_timestamp":"2026-06-10T06:07:26+00:00"},{"url":"https://cryptobriefing.com/value-defi-drained-millions-flash-loan-attack/","name":"cryptobriefing.com","type":"other","archive_url":"http://web.archive.org/web/20251017014924/https://cryptobriefing.com/value-defi-drained-millions-flash-loan-attack/","credibility":3,"archive_timestamp":"2025-10-17T01:49:24+00:00"},{"url":"https://web3isgoinggreat.com/?id=value-defi-hacked-for-second-time-in-six-months","name":"web3isgoinggreat.com","type":"other","archive_url":"http://web.archive.org/web/20260307030432/https://www.web3isgoinggreat.com/?id=value-defi-hacked-for-second-time-in-six-months","credibility":3,"archive_timestamp":"2026-03-07T03:04:32+00:00"},{"url":"https://inspexco.medium.com/value-defis-invalid-share-calculation-exploit-in-depth-analysis-1c8f97c1416e","name":"inspexco.medium.com","type":"other","archive_url":"http://web.archive.org/web/20250917045440/https://inspexco.medium.com/value-defis-invalid-share-calculation-exploit-in-depth-analysis-1c8f97c1416e","credibility":3,"archive_timestamp":"2025-09-17T04:54:40+00:00"},{"url":"https://coingape.com/bsc-based-valuedefi-exploited-for-11m-by-scammers/","name":"coingape.com","type":"other","archive_url":"https://web.archive.org/web/20260830203216/https://coingape.com/bsc-based-valuedefi-exploited-for-11m-by-scammers/","credibility":3,"archive_timestamp":"2026-08-30T20:32:16+00:00"},{"url":"https://slowmist.medium.com/slowmist-value-defi-vswap-module-hack-analysis-64e8909ef6a2","name":"slowmist.medium.com","type":"other","archive_url":"http://web.archive.org/web/20260725145050/https://slowmist.medium.com/slowmist-value-defi-vswap-module-hack-analysis-64e8909ef6a2","credibility":3,"archive_timestamp":"2026-07-25T14:50:50+00:00"},{"url":"https://cryptocoindaddy.com/value-defi-co-founder-is-paid-actress-on-fiverr/","name":"cryptocoindaddy.com","type":"other","archive_url":"http://web.archive.org/web/20260419045027/https://cryptocoindaddy.com/value-defi-co-founder-is-paid-actress-on-fiverr/","credibility":3,"archive_timestamp":"2026-04-19T04:50:27+00:00"},{"url":"https://wintoken.fun/potential-scam-value-defi-allegedly-lied-about-their-co-founder/","name":"wintoken.fun","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-job","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://coinstats.app/coins/value-liquidity/","name":"coinstats.app","type":"other","archive_url":"https://web.archive.org/web/20260830083436/https://coinstats.app/coins/value-liquidity/","credibility":3,"archive_timestamp":"2026-08-30T08:34:36+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:55:00.392099+00:00","updated_at":"2026-08-30T20:47:34.964164+00:00"}}