{"investigation":{"slug":"woofi-swap","entity_name":"WOOFi Swap","trust_score":28,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"WOOFi Swap is a decentralized exchange (DEX) built by WOO Network, operating on 12+ blockchain networks including Arbitrum, Avalanche, and Optimism, and using a proprietary synthetic Proactive Market Maker (sPMM) algorithm. On March 5, 2024, the protocol suffered a critical oracle manipulation exploit on Arbitrum in which an attacker used flash loans to manipulate WOO token pricing to near zero, stealing approximately $8.75 million; funds were not recovered. The parent platform WOO X also suffered a separate $14 million phishing-linked breach in July 2025 attributed to North Korean state-sponsored threat actors, compounding the ecosystem's security record.","sections":[{"content":"WOOFi Swap is the decentralized exchange product of WOO Network, founded as Wootrade in 2019 by Jack Tan and Mark Pimentel, co-founders of Kronos Research, a quantitative cryptocurrency trading firm established in 2018. The platform is deployed across 12+ networks including Arbitrum, Avalanche, Optimism, and zkSync. WOOFi's core mechanism is the synthetic Proactive Market Maker (sPMM) algorithm, which simulates the price, spread, and depth of centralized exchange order books to enable low-fee swaps. WOO Network raised a $30 million Series A with participation from Three Arrows Capital (which subsequently collapsed in 2022), PSP Soteria Ventures, Gate Ventures, QCP Capital, and Crypto.com Capital. The WOO token serves utility roles in both the centralized WOO X exchange and the decentralized WOOFi suite. WOOFi had maintained a clean security record from its launch in 2021 through early 2024, relying in part on conservative asset listing policies.","heading":"Background and Overview","sources":[{"url":"https://www.kraken.com/learn/what-is-woo-network","name":"kraken.com","type":"other","credibility":3},{"url":"https://www.blockchain-council.org/blockchain/woo-network/","name":"blockchain-council.org","type":"other","credibility":3},{"url":"https://learn.woo.org/woofi-the-all-in-one-defi-app","name":"learn.woo.org","type":"other","credibility":3},{"url":"https://woox.io/en/blog/new-names-new-logos-how-woo-network-is-changing-markets-as-we-know-them","name":"woox.io","type":"other","credibility":3}],"severity":"medium"},{"content":"On March 5, 2024, at approximately 15:49 UTC, WOOFi Swap on the Arbitrum network was exploited via flash loan-driven oracle manipulation, resulting in a confirmed loss of approximately $8.75 million. The attacker's address was 0x9961190b258897bca7a12b8f37f415e689d281c4; the primary attack transaction hash was 0x40e1b8c78083fc666cb7598efcecd0ae0af313fc41441386e4db716c2808ce07. The attacker deployed a malicious contract at 0xD4c633C9A765bC690E1FbA566981c1F4eab52dF0 and subsequently moved stolen funds to 0xb59d04d9957c9e266dff5c4173d4d2324eb029ad.\n\nThe attack exploited a mathematical flaw in the WooPPV2 pool contract's _calcQuoteAmountSellBase() function. The sPMM algorithm dynamically adjusts token prices based on trade volume to model slippage; an attacker could craft the baseAmount parameter to drive the computed new price toward zero. Specifically, the price calculation (newPrice = ((1e18 - (2 * coefficient * price * baseAmount)) * price) / 1e18) could be manipulated so the numerator approached 1e18, causing newPrice to collapse to approximately $0.00000009. A critical compounding factor was that the Chainlink oracle fallback was not configured for the WOO token on Arbitrum, meaning no external price validation could detect the extreme deviation.\n\nThe attacker executed the exploit in three repeated cycles within approximately 13 minutes: (1) borrow ~7.7 million WOO tokens via flash loan, (2) sell WOO into the pool to trigger sPMM price collapse, (3) swap ~10 million WOO back out at the near-zero price, and (4) repay the flash loan, netting profit each cycle. The attack was only viable on Arbitrum because of the combination of a WOO lending market (added shortly before the exploit) and relatively low WOO liquidity on that network.\n\nWOOFi's internal monitoring systems detected the anomalous large swaps, and smart contract pools were paused by 16:02 UTC, approximately 13 minutes after the first attack transaction. Security partners Hypernative, Chainalysis, Wintermute, and SEAL911 were engaged immediately. WOOFi offered the attacker a 10% white-hat bounty and posted a separate information bounty on Arkham Intelligence. One day after the bounty announcement, blockchain security firm PeckShield observed that a wallet labeled 'Hack, WOOFi Exploiter' moved 199.52 ETH (approximately $713,000) to a new address, though it remained unclear whether this was related to the bounty offer. No public evidence of full or substantial fund recovery has been reported. The WOOFi Swap v2 contract remained paused for approximately two weeks while the team implemented fixes. A post-remediation audit was conducted by Zellic on the sPMM, oracle, and router contracts.","heading":"March 2024 Oracle Manipulation Exploit (Critical)","sources":[{"url":"https://woox.io/en/blog/woofi-spmm-exploit-post-mortem","name":"woox.io","type":"other","credibility":3},{"url":"https://www.theblock.co/post/280759/woofi-offers-bounty-after-8-75-million-exploit-on-arbitrum","name":"theblock.co","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-woofi-hack-march-2024","name":"halborn.com","type":"other","credibility":3},{"url":"https://www.cyfrin.io/blog/hack-analysis-into-woofi-exploit","name":"cyfrin.io","type":"other","credibility":3},{"url":"https://rekt.news/woo-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://blog.cube3.ai/2024/03/07/8-million-dollar-crypto-hack-woofi-exploit-postmortem-report-by-silur/","name":"blog.cube3.ai","type":"other","credibility":3},{"url":"https://olympixai.medium.com/unpacking-the-woofi-swap-exploit-ae6f172fe736","name":"olympixai.medium.com","type":"other","credibility":3},{"url":"https://cryptoslate.com/woofi-offers-10-bounty-in-race-to-recover-8-million-stolen-in-flash-loan-exploit/","name":"cryptoslate.com","type":"other","credibility":3},{"url":"https://www.ibtimes.com/woofi-exploiter-moves-over-700k-eth-after-defi-platform-offers-bounty-3726711","name":"ibtimes.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Prior to the March 2024 exploit, WOOFi had undergone multiple third-party security audits. CertiK conducted an audit in October 2022. PeckShield completed a second audit of WOOFi's Supercharger vault, reporting no critical or high-severity issues. Additional audits were performed by Verilog Solutions, Zellic, and Sherlock across various components of the protocol. WOOFi also maintained a bug bounty program on Immunefi. Despite these audits, the specific vulnerability in the WooPPV2 sPMM price calculation function — combined with the absence of a Chainlink oracle fallback for WOO on Arbitrum — went undetected until live exploitation. Security analysts noted that the vulnerability was introduced or became exploitable specifically with the launch of the WOO lending market on Arbitrum, a configuration change that was not reflected in prior audit scopes. Post-exploit, Zellic conducted an audit validating the patched contracts before the protocol resumed operations.","heading":"Audit History and Pre-Exploit Security Posture","sources":[{"url":"https://learn.woo.org/woofi-docs/woofi-dev-docs/references/audits-and-bounties","name":"learn.woo.org","type":"other","credibility":3},{"url":"https://rekt.news/woo-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-woofi-hack-march-2024","name":"halborn.com","type":"other","credibility":3},{"url":"https://immunefi.com/bug-bounty/woofi/","name":"immunefi.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Separately from the WOOFi Swap exploit, the centralized WOO X trading platform suffered a $14 million cybersecurity breach on July 24, 2025. The incident began when a WOO X developer was approached through an open-source software forum with a request to assist debugging a development tool. The developer downloaded and opened the file on a company-issued MacBook, which installed a hidden backdoor masquerading as a common backend process. Approximately two hours after the backdoor was installed, unauthorized withdrawals were detected across nine user accounts totaling $14 million. Withdrawals were immediately halted. Security analysts and WOO X's own investigation attributed the attack to UNC4899, a North Korean state-sponsored cyber espionage group aligned with the Reconnaissance General Bureau, publicly known as Lazarus Group, TraderTraitor, and Jade Sleet. All nine affected users were fully compensated from WOO's treasury. The platform engaged security firms SEAL911 and Hypernative to track stolen assets and investigate the breach. The incident was disclosed via a public post-mortem.","heading":"WOO X Phishing Breach — July 2025 (High)","sources":[{"url":"https://www.ainvest.com/news/woo-pauses-withdrawals-14m-cybersecurity-breach-promises-reimbursement-2507/","name":"ainvest.com","type":"other","credibility":3},{"url":"https://woox.io/blog/july-24th-security-incident-post-mortem","name":"woox.io","type":"other","credibility":3},{"url":"https://cryptonews.com/news/crypto-exchange-woo-x-loses-14m-after-team-member-falls-for-phishing-attack/","name":"cryptonews.com","type":"other","credibility":3},{"url":"https://coincentral.com/woo-x-users-hit-by-14-million-crypto-exchange-hack/","name":"coincentral.com","type":"other","credibility":3}],"severity":"medium"},{"content":"WOO Network's Series A included participation from Three Arrows Capital (3AC). Three Arrows Capital collapsed in June 2022 following failure to meet margin calls, was subsequently placed into liquidation by a British Virgin Islands court, and became the subject of investigations by the U.S. Securities and Exchange Commission and the Commodity Futures Trading Commission. While 3AC's collapse did not directly implicate WOO Network in wrongdoing, the association represents a reputational and counterparty risk marker that has been noted in community due diligence discussions. WOO Network has not been named as a target of any regulatory action as of the time of this investigation.","heading":"Investor Risk Factors","sources":[{"url":"https://en.wikipedia.org/wiki/Three_Arrows_Capital","name":"en.wikipedia.org","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2022/10/17/sec-cftc-probing-bankrupt-crypto-hedge-fund-three-arrows-capital-report","name":"coindesk.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Independent of the on-chain exploits affecting WOOFi's own contracts, a fake WOOFi website known as the 'WOOFi Wallet Connection' scam has been identified and documented by cybersecurity researchers. This scam masquerades as the legitimate WOOFi platform and functions as a cryptocurrency wallet drainer. Users who connect wallets to the fraudulent site risk full drainage of digital assets. This scam is not associated with WOO Network or the official WOOFi protocol. Users should verify URLs carefully before connecting wallets to any site claiming to be WOOFi.","heading":"Phishing Scams Impersonating WOOFi","sources":[{"url":"https://www.pcrisk.com/removal-guides/31499-woofi-wallet-connection-scam","name":"pcrisk.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the March 2024 exploit, WOOFi implemented several security improvements. The WooPPV2 contract's price calculation logic was patched. Chainlink oracle fallback coverage was extended to include the WOO token. A post-remediation audit by Zellic validated the fixes before the protocol resumed operations after approximately two weeks of downtime. WOOFi's Earn vaults, staking, and Pro products were confirmed unaffected throughout the exploit period. The exploiter's wallet was tracked by PeckShield and blockchain analytics firms; as of reporting, the majority of stolen funds had not been returned. The stolen ETH was distributed across multiple externally owned accounts and bridged across chains, complicating recovery. FusionX Digital, a Web3 private equity fund, was announced as a new operator of WOO X in October 2025, signaling a transition in platform governance.","heading":"Post-Exploit Status and Remediation","sources":[{"url":"https://woox.io/en/blog/woofi-spmm-exploit-post-mortem","name":"woox.io","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-woofi-hack-march-2024","name":"halborn.com","type":"other","credibility":3},{"url":"https://www.globenewswire.com/news-release/2025/10/15/3167430/0/en/Web-3-Private-Equity-Fund-FusionX-Digital-to-become-the-new-operator-of-WOO-X-plans-to-scale-centralized-exchange-while-growing-token-utility.html","name":"globenewswire.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2019","event":"WOO Network (originally Wootrade) founded by Jack Tan and Mark Pimentel, co-founders of Kronos Research.","source":"","date_original":"2019-01-01"},{"date":"2021","event":"WOOFi Swap launches as the DeFi product arm of WOO Network, operating with the sPMM algorithm. No security incidents reported for approximately three years.","source":"","date_original":"2021-01-01"},{"date":"2022-08","event":"PeckShield completes second audit of WOOFi Supercharger vault, reporting no critical or high-severity issues.","source":"","date_original":"2022-08-01"},{"date":"2022-06-27","event":"Three Arrows Capital (3AC), an early investor in WOO Network's Series A, is ordered into liquidation by a British Virgin Islands court after failing to meet margin calls.","source":""},{"date":"2024-03-05","event":"WOOFi Swap on Arbitrum is exploited via flash loan oracle manipulation. Attacker (0x9961190b...) manipulates WOO price to $0.00000009, draining approximately $8.75 million across three attack cycles in 13 minutes. Pools paused by 16:02 UTC.","source":""},{"date":"2024-03-06","event":"WOOFi offers 10% white-hat bounty to the attacker and posts an information bounty on Arkham Intelligence. Official post-mortem published.","source":""},{"date":"2024-03-07","event":"PeckShield reports that an address labeled 'Hack, WOOFi Exploiter' moved 199.52 ETH (~$713,000) to a new address; connection to bounty offer unclear.","source":""},{"date":"2024-03-19","event":"WOOFi Swap v2 contracts resume operation after approximately two weeks of downtime. Zellic completes post-remediation audit of sPMM, oracle, and router contracts.","source":""},{"date":"2025-07-24","event":"WOO X centralized exchange suffers $14 million breach. A developer downloads a malicious file via social engineering, installing a Lazarus Group (UNC4899) backdoor. Nine user accounts drained. Withdrawals halted. All affected users fully compensated from treasury.","source":""},{"date":"2025-10-15","event":"FusionX Digital announced as new operator of WOO X, signaling governance transition for the centralized exchange.","source":""}],"sources_used":[{"url":"https://www.kraken.com/learn/what-is-woo-network","name":"kraken.com","type":"other","archive_url":"http://web.archive.org/web/20260718183605/https://www.kraken.com/learn/what-is-woo-network","credibility":3,"archive_timestamp":"2026-07-18T18:36:05+00:00"},{"url":"https://www.blockchain-council.org/blockchain/woo-network/","name":"blockchain-council.org","type":"other","archive_url":"http://web.archive.org/web/20251014012647/https://www.blockchain-council.org/blockchain/woo-network/","credibility":3,"archive_timestamp":"2025-10-14T01:26:47+00:00"},{"url":"https://learn.woo.org/woofi-the-all-in-one-defi-app","name":"learn.woo.org","type":"other","archive_url":"http://web.archive.org/web/20260410130431/https://learn.woo.org/woofi-the-all-in-one-defi-app","credibility":3,"archive_timestamp":"2026-04-10T13:04:31+00:00"},{"url":"https://woox.io/en/blog/new-names-new-logos-how-woo-network-is-changing-markets-as-we-know-them","name":"woox.io","type":"other","archive_url":"https://web.archive.org/web/20260829143422/https://woox.io/en/blog/new-names-new-logos-how-woo-network-is-changing-markets-as-we-know-them","credibility":3,"archive_timestamp":"2026-08-29T14:34:22+00:00"},{"url":"https://woox.io/en/blog/woofi-spmm-exploit-post-mortem","name":"woox.io","type":"other","archive_url":"http://web.archive.org/web/20260606170019/https://woox.io/en/blog/woofi-spmm-exploit-post-mortem","credibility":3,"archive_timestamp":"2026-06-06T17:00:19+00:00"},{"url":"https://www.theblock.co/post/280759/woofi-offers-bounty-after-8-75-million-exploit-on-arbitrum","name":"theblock.co","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.halborn.com/blog/post/explained-the-woofi-hack-march-2024","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260415072434/https://www.halborn.com/blog/post/explained-the-woofi-hack-march-2024","credibility":3,"archive_timestamp":"2026-04-15T07:24:34+00:00"},{"url":"https://www.cyfrin.io/blog/hack-analysis-into-woofi-exploit","name":"cyfrin.io","type":"other","archive_url":"http://web.archive.org/web/20260124124027/https://www.cyfrin.io/blog/hack-analysis-into-woofi-exploit","credibility":3,"archive_timestamp":"2026-01-24T12:40:27+00:00"},{"url":"https://rekt.news/woo-rekt","name":"rekt.news","type":"other","archive_url":"http://web.archive.org/web/20260310091851/https://rekt.news/woo-rekt","credibility":3,"archive_timestamp":"2026-03-10T09:18:51+00:00"},{"url":"https://blog.cube3.ai/2024/03/07/8-million-dollar-crypto-hack-woofi-exploit-postmortem-report-by-silur/","name":"blog.cube3.ai","type":"other","archive_url":"http://web.archive.org/web/20260211125734/https://blog.cube3.ai/2024/03/07/8-million-dollar-crypto-hack-woofi-exploit-postmortem-report-by-silur/","credibility":3,"archive_timestamp":"2026-02-11T12:57:34+00:00"},{"url":"https://olympixai.medium.com/unpacking-the-woofi-swap-exploit-ae6f172fe736","name":"olympixai.medium.com","type":"other","archive_url":"http://web.archive.org/web/20251105034015/https://olympixai.medium.com/unpacking-the-woofi-swap-exploit-ae6f172fe736","credibility":3,"archive_timestamp":"2025-11-05T03:40:15+00:00"},{"url":"https://cryptoslate.com/woofi-offers-10-bounty-in-race-to-recover-8-million-stolen-in-flash-loan-exploit/","name":"cryptoslate.com","type":"other","archive_url":"http://web.archive.org/web/20250909141009/https://cryptoslate.com/woofi-offers-10-bounty-in-race-to-recover-8-million-stolen-in-flash-loan-exploit/","credibility":3,"archive_timestamp":"2025-09-09T14:10:09+00:00"},{"url":"https://www.ibtimes.com/woofi-exploiter-moves-over-700k-eth-after-defi-platform-offers-bounty-3726711","name":"ibtimes.com","type":"other","archive_url":"https://web.archive.org/web/20260830005539/https://www.ibtimes.com/woofi-exploiter-moves-over-700k-eth-after-defi-platform-offers-bounty-3726711","credibility":3,"archive_timestamp":"2026-08-30T00:55:39+00:00"},{"url":"https://learn.woo.org/woofi-docs/woofi-dev-docs/references/audits-and-bounties","name":"learn.woo.org","type":"other","archive_url":"http://web.archive.org/web/20260610061631/https://learn.woo.org/woofi-docs/woofi-dev-docs/references/audits-and-bounties","credibility":3,"archive_timestamp":"2026-06-10T06:16:31+00:00"},{"url":"https://immunefi.com/bug-bounty/woofi/","name":"immunefi.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.ainvest.com/news/woo-pauses-withdrawals-14m-cybersecurity-breach-promises-reimbursement-2507/","name":"ainvest.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://woox.io/blog/july-24th-security-incident-post-mortem","name":"woox.io","type":"other","archive_url":"http://web.archive.org/web/20260517184242/https://woox.io/blog/july-24th-security-incident-post-mortem","credibility":3,"archive_timestamp":"2026-05-17T18:42:42+00:00"},{"url":"https://cryptonews.com/news/crypto-exchange-woo-x-loses-14m-after-team-member-falls-for-phishing-attack/","name":"cryptonews.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://coincentral.com/woo-x-users-hit-by-14-million-crypto-exchange-hack/","name":"coincentral.com","type":"other","archive_url":"https://web.archive.org/web/20260829233609/https://coincentral.com/bitcoin-btc-price-market-correction-triggers-massive-liquidations-as-analysts-eye-200k-target/","credibility":3,"archive_timestamp":"2026-08-29T23:36:09+00:00"},{"url":"https://en.wikipedia.org/wiki/Three_Arrows_Capital","name":"en.wikipedia.org","type":"other","archive_url":"http://web.archive.org/web/20260817180829/https://en.wikipedia.org/wiki/Three_Arrows_Capital","credibility":3,"archive_timestamp":"2026-08-17T18:08:29+00:00"},{"url":"https://www.coindesk.com/business/2022/10/17/sec-cftc-probing-bankrupt-crypto-hedge-fund-three-arrows-capital-report","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20260724213536/https://www.coindesk.com/business/2022/10/17/sec-cftc-probing-bankrupt-crypto-hedge-fund-three-arrows-capital-report","credibility":3,"archive_timestamp":"2026-07-24T21:35:36+00:00"},{"url":"https://www.pcrisk.com/removal-guides/31499-woofi-wallet-connection-scam","name":"pcrisk.com","type":"other","archive_url":"http://web.archive.org/web/20260312225745/https://www.pcrisk.com/removal-guides/31499-woofi-wallet-connection-scam","credibility":3,"archive_timestamp":"2026-03-12T22:57:45+00:00"},{"url":"https://www.globenewswire.com/news-release/2025/10/15/3167430/0/en/Web-3-Private-Equity-Fund-FusionX-Digital-to-become-the-new-operator-of-WOO-X-plans-to-scale-centralized-exchange-while-growing-token-utility.html","name":"globenewswire.com","type":"other","archive_url":"http://web.archive.org/web/20251108120800/https://www.globenewswire.com/news-release/2025/10/15/3167430/0/en/Web-3-Private-Equity-Fund-FusionX-Digital-to-become-the-new-operator-of-WOO-X-plans-to-scale-centralized-exchange-while-growing-token-utility.html","credibility":3,"archive_timestamp":"2025-11-08T12:08:00+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:34.474839+00:00","updated_at":"2026-08-30T05:14:08.275096+00:00"}}