{"investigation":{"slug":"zerion-wallet","entity_name":"Zerion Wallet","trust_score":43,"severity_base":null,"score_modifier":-12,"confidence":0.72,"status":"published","content_type":"investigation","summary":"Zerion is a non-custodial DeFi portfolio tracker and multi-chain wallet founded in 2016, supporting 50+ blockchains including Ethereum and Solana. The platform has experienced multiple security incidents over its history, including a 2026 social engineering attack attributed to North Korean threat actors that resulted in approximately $100,000 in company internal wallet losses, though user funds were unaffected in each incident. Zerion also shut down its ZERO Layer-2 network in May 2026 after 1.5 years due to low adoption, with assets bridgeable until July 31, 2026.","sections":[{"content":"Zerion was founded in 2016 by Evgeny Yurtaev (CEO) and Alexey Bashlykov as a non-custodial DeFi interface and portfolio tracker built on Ethereum. Headquartered in San Francisco with a globally remote team, Zerion describes itself as a gateway to decentralized finance, allowing users to store, trade, lend, and track crypto assets across more than 50 chains including Ethereum, Solana, Base, Polygon, and numerous EVM-compatible networks. Yurtaev previously founded CryptoTrader, an exchange aggregator with over 500,000 downloads, and held internships at Google on the Auth and Calendar iOS teams. The platform operates through a web app at app.zerion.io, iOS and Android mobile apps, and a browser extension wallet. As of 2026, Zerion claims integration with over 500 DeFi protocols and supports tracking of tokens, NFTs, LP positions, staking rewards, and DeFi debts.","heading":"Company Overview and Background","sources":[{"url":"https://www.gemini.com/cryptopedia/zerion-crypto-portfolio-tracker-zerion-wallet-app","name":"gemini.com","type":"other","credibility":3},{"url":"https://www.crunchbase.com/person/evgeny-yurtaev","name":"crunchbase.com","type":"other","credibility":3},{"url":"https://zerion.io/","name":"zerion.io","type":"other","credibility":3}],"severity":"medium"},{"content":"Zerion has raised a total of approximately $22.5 million across five funding rounds. The most recent and largest was a $12.3 million Series B closed in August 2022, announced publicly in October 2022, led by Wintermute Ventures. Additional Series B participants included Placeholder, Mosaic Ventures, Polymorphic Capital, Coinbase Ventures, and Alchemy Ventures, as well as individual participants from 1inch Network. The company has 29 known investors across all rounds. The Series B was intended to advance the development of Zerion's multi-chain wallet product. No regulatory filings or enforcement actions from the SEC, CFTC, or other financial regulators have been identified as of May 2026.","heading":"Funding and Investors","sources":[{"url":"https://www.crowdfundinsider.com/2022/10/197327-crypto-wallet-zerion-raises-12-3-million-series-b/","name":"crowdfundinsider.com","type":"other","credibility":3},{"url":"https://www.prnewswire.com/news-releases/zerion-closes-12m-series-b-fundraise-led-by-wintermute-ventures-301646731.html","name":"prnewswire.com","type":"other","credibility":3},{"url":"https://www.crunchbase.com/organization/zerion/investor_financials","name":"crunchbase.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On or around April 11-15, 2026, Zerion temporarily disabled its web application after detecting abnormal activity and launching an internal investigation. A team member's device was compromised through an AI-driven social engineering attack, exposing logged-in sessions, sensitive credentials, and private keys associated with company internal hot wallets used for testing and operational purposes. Approximately $100,000 in company funds were stolen. Multiple news outlets reported attribution to North Korean threat actors, with security researchers citing patterns consistent with the group tracked as UNC1069, which reportedly conducts multiweek campaigns via Telegram, LinkedIn, and Slack using AI-generated lures and fake audio/video to impersonate trusted contacts. Zerion stated that no user funds, mobile applications, browser extensions, backend infrastructure, or API services were impacted. In response, Zerion secured deployment infrastructure against unauthorized updates, rotated all potentially compromised credentials, reconfigured multi-signature accounts, instructed employees to scan devices for malware, and engaged Blockaid, ZeroShadow, and ChainPatrol to trace attacker wallets. Stolen funds were reported to law enforcement. The web app remained offline for approximately 48 hours as a precautionary measure.","heading":"April 2026 Social Engineering Attack (North Korean Attribution)","sources":[{"url":"https://coinedition.com/zerion-disables-web-app-after-100k-internal-wallet-breach/","name":"coinedition.com","type":"other","credibility":3},{"url":"https://www.cryptotimes.io/2026/04/15/north-korean-hackers-target-zerion-in-ai-driven-attack-steal-100k/","name":"cryptotimes.io","type":"other","credibility":3},{"url":"https://financefeeds.com/north-korean-hackers-behind-100k-zerion-exploit/","name":"financefeeds.com","type":"other","credibility":3},{"url":"https://cryptorank.io/news/feed/eaff7-zerion-disables-web-app-after-100k-internal-wallet-breach","name":"cryptorank.io","type":"other","credibility":3}],"severity":"medium"},{"content":"On June 14, 2023 at approximately 9:40 PM UTC, Zerion's official Twitter/X account was hijacked. The attacker posted multiple scam tweets promoting a fraudulent \"Zerion airdrop\" that directed users to a phishing website. According to Zerion's published post-mortem, the attack originated when an employee received a Telegram message from someone impersonating a Zerion colleague — the impersonator had inserted themselves into an earlier conversation thread to appear legitimate. The employee was tricked into clicking a phishing link and downloading a malicious file, which delivered malware that gave the attacker access to Twitter credentials and the employee's device. Funds stolen via the Twitter-amplified phishing scheme totaled $2,775.55 in ETH, $18,292.90 in ERC-20 tokens, and $3,756.93 in NFTs from affected users. On June 16, 2023, the compromised employee discovered their personal wallets were also being drained, including a Zerion POAP fees wallet, resulting in an additional $53,000 in company losses. Blockchain intelligence firm Scam Sniffer noted the attacker was the same individual responsible for over 170 phishing sites that stole approximately $2.58 million from 2,032 victims in the preceding month. Zerion's immediate response included deleting the fraudulent tweets, locking the attacker out of the Twitter account, terminating the employee's system access, transferring remaining hot wallet funds to multisig wallets, resetting passwords across affected services, and engaging Chainalysis and their cyber insurance provider.","heading":"June 2023 Twitter Account Compromise","sources":[{"url":"https://zerion.io/blog/twitter-account-compromised-post-mortem/","name":"zerion.io","type":"other","credibility":3},{"url":"https://x.com/realScamSniffer/status/1669152727073722373","name":"x.com","type":"other","credibility":3}],"severity":"medium"},{"content":"In February 2021, Zerion disclosed a platform-level phishing incident in which a single user lost approximately $30,000. An attacker deployed a malicious smart contract that mimicked the structure of a legitimate Balancer liquidity pool. The contract accepted deposits but blocked withdrawals (a one-way trap), held genuine underlying tokens, and emitted identical event logs to real Balancer pools. Zerion's backend interpreted the contract as a legitimate Balancer pool because it held assets verified on at least two token lists, automatically assigning it a blue tick verification indicator and listing it on the platform's Invest page. Zerion CEO Evgeny Yurtaev published a post-mortem acknowledging the failure was in Zerion's trust assumptions around derivative tokens. Remediation included: disabling automatic blue tick verification for all derivative tokens such as pools, indexes, strategies, and collateral tokens; adding protocol registry validation requiring assets to be confirmed in a protocol's on-chain registry rather than merely holding verified assets; and re-enabling verification only for protocols meeting the new standards. Zerion stated it resolved the affected user's losses directly.","heading":"February 2021 Asset Phishing Attack (Fake Balancer Pool)","sources":[{"url":"https://zerion.io/blog/post-mortem-on-zerions-asset-phishing-attack/","name":"zerion.io","type":"other","credibility":3},{"url":"https://www.quadrigainitiative.com/casestudy/zerionbalancerclonephishingattack.php","name":"quadrigainitiative.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On May 21, 2026, Zerion announced it would permanently shut down ZERO Network, its Ethereum Layer-2 rollup chain launched approximately 1.5 years prior. ZERO was marketed as the first fully gasless EVM-compatible rollup, employing a paymaster model under which Zerion directly subsidized all transaction fees. The company announced that bridging new assets into ZERO was disabled immediately upon announcement, with outbound bridging remaining available until July 31, 2026, after which block production ceases entirely. The stated reason for the closure was that maintaining a standalone chain was no longer the most efficient way to deliver on the company's vision; the economics proved unsustainable as the wallet ecosystem did not generate sufficient offsetting revenue to cover chain operation costs. All user assets — ETH, ERC-20 tokens, and NFTs — remain accessible and bridgeable to Ethereum mainnet or other chains before the deadline. Zerion announced a strategic pivot to focus resources on its core multi-chain wallet product and a data API service. The ZERO Network shutdown was part of a broader 2026 Layer-2 shakeout that also included Everclear and Syndicate Labs.","heading":"ZERO Network Layer-2 Shutdown","sources":[{"url":"https://www.cryptotimes.io/2026/05/22/zero-network-shutting-down-as-zerion-pivots-to-wallet-and-api/","name":"cryptotimes.io","type":"other","credibility":3},{"url":"https://en.cryptonomist.ch/2026/05/22/zero-network-shutdown-july-31-2026/","name":"en.cryptonomist.ch","type":"other","credibility":3},{"url":"https://en.coin-turk.com/zero-network-will-close-by-july-2026-users-must-withdraw-assets/","name":"en.coin-turk.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Zerion operates under a self-custodial model in which private keys are encrypted and stored locally on the user's device or browser. The company states that it never transmits private keys to external servers and that Zerion cannot access user funds without the user's consent. Zerion has commissioned security audits from Cube53, Secfault Security, PeckShield, and Trail of Bits, all of which it states are publicly available. The platform participates in a bug bounty program hosted on Immunefi. Zerion integrates with Blockaid for real-time transaction simulation and phishing detection. On mobile, Zerion offers an optional encrypted seed phrase backup to iCloud (iOS) or Google Drive (Android). The self-custodial model means that the three documented incidents — the 2021 phishing attack, the 2023 Twitter compromise, and the 2026 social engineering breach — did not result in loss of user private keys or user-custodied funds in any case. However, the recurring pattern of successful social engineering against Zerion employees and infrastructure represents a persistent operational security concern.","heading":"Security Architecture and Third-Party Audits","sources":[{"url":"https://zerion.io/security","name":"zerion.io","type":"other","credibility":3},{"url":"https://captainaltcoin.com/zerion-wallet-review/","name":"captainaltcoin.com","type":"other","credibility":3},{"url":"https://www.bitget.com/academy/zerion-wallet-review","name":"bitget.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2016","event":"Zerion founded by Evgeny Yurtaev and Alexey Bashlykov as a non-custodial DeFi interface and portfolio tracker.","source":"","date_original":"2016-01-01"},{"date":"2021-02","event":"Asset phishing attack via fake Balancer pool smart contract results in ~$30,000 loss for one user. Zerion publishes post-mortem and patches verification logic.","source":"","date_original":"2021-02-01"},{"date":"2022-08-17","event":"Zerion closes $12.3 million Series B funding round led by Wintermute Ventures, with participation from Coinbase Ventures, Placeholder, Alchemy Ventures, and others.","source":""},{"date":"2023-06-14","event":"Official Zerion Twitter/X account compromised via employee social engineering attack. Phishing tweets promote fake airdrop, resulting in ~$24,825 stolen from victims. Employee's internal wallet additionally drained for ~$53,000.","source":""},{"date":"2024-12","event":"ZERO Network Layer-2 mainnet active approximately 1.5 years after launch, marketed as first fully gasless EVM rollup.","source":"","date_original":"2024-12-01"},{"date":"2026-04-11","event":"Zerion detects abnormal activity and disables its web application. An employee device was compromised via an AI-driven social engineering campaign attributed to North Korean threat actors.","source":""},{"date":"2026-04-15","event":"Zerion publicly confirms approximately $100,000 in internal company hot wallet losses from the North Korean social engineering attack. States no user funds were affected. Web app taken offline for up to 48 hours.","source":""},{"date":"2026-05-21","event":"Zerion announces permanent shutdown of ZERO Network Layer-2. Bridging in disabled immediately; bridging out available until July 31, 2026.","source":""},{"date":"2026-07-31","event":"ZERO Network block production scheduled to cease. Users must bridge all assets off ZERO before this date.","source":""}],"sources_used":[{"url":"https://www.gemini.com/cryptopedia/zerion-crypto-portfolio-tracker-zerion-wallet-app","name":"gemini.com","type":"other","archive_url":"http://web.archive.org/web/20260610212220/https://www.gemini.com/cryptopedia/zerion-crypto-portfolio-tracker-zerion-wallet-app","credibility":3,"archive_timestamp":"2026-06-10T21:22:20+00:00"},{"url":"https://www.crunchbase.com/person/evgeny-yurtaev","name":"crunchbase.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://zerion.io/","name":"zerion.io","type":"other","archive_url":"http://web.archive.org/web/20260825110427/https://zerion.io/","credibility":3,"archive_timestamp":"2026-08-25T11:04:27+00:00"},{"url":"https://www.crowdfundinsider.com/2022/10/197327-crypto-wallet-zerion-raises-12-3-million-series-b/","name":"crowdfundinsider.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.prnewswire.com/news-releases/zerion-closes-12m-series-b-fundraise-led-by-wintermute-ventures-301646731.html","name":"prnewswire.com","type":"other","archive_url":"http://web.archive.org/web/20260826114731/https://www.prnewswire.com/news-releases/zerion-closes-12m-series-b-fundraise-led-by-wintermute-ventures-301646731.html","credibility":3,"archive_timestamp":"2026-08-26T11:47:31+00:00"},{"url":"https://www.crunchbase.com/organization/zerion/investor_financials","name":"crunchbase.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://coinedition.com/zerion-disables-web-app-after-100k-internal-wallet-breach/","name":"coinedition.com","type":"other","archive_url":"https://web.archive.org/web/20260829175222/https://coinedition.com/zerion-disables-web-app-after-100k-internal-wallet-breach/","credibility":3,"archive_timestamp":"2026-08-29T17:52:22+00:00"},{"url":"https://www.cryptotimes.io/2026/04/15/north-korean-hackers-target-zerion-in-ai-driven-attack-steal-100k/","name":"cryptotimes.io","type":"other","archive_url":"https://web.archive.org/web/20260830034824/https://www.cryptotimes.io/2026/04/15/north-korean-hackers-target-zerion-in-ai-driven-attack-steal-100k/","credibility":3,"archive_timestamp":"2026-08-30T03:48:24+00:00"},{"url":"https://financefeeds.com/north-korean-hackers-behind-100k-zerion-exploit/","name":"financefeeds.com","type":"other","archive_url":"https://web.archive.org/web/20260829230035/https://financefeeds.com/north-korean-hackers-behind-100k-zerion-exploit/","credibility":3,"archive_timestamp":"2026-08-29T23:00:35+00:00"},{"url":"https://cryptorank.io/news/feed/eaff7-zerion-disables-web-app-after-100k-internal-wallet-breach","name":"cryptorank.io","type":"other","archive_url":"https://web.archive.org/web/20260829114308/https://cryptorank.io/news/feed/eaff7-zerion-disables-web-app-after-100k-internal-wallet-breach","credibility":3,"archive_timestamp":"2026-08-29T11:43:08+00:00"},{"url":"https://zerion.io/blog/twitter-account-compromised-post-mortem/","name":"zerion.io","type":"other","archive_url":"https://web.archive.org/web/20260829232517/https://zerion.io/blog/twitter-account-compromised-post-mortem/","credibility":3,"archive_timestamp":"2026-08-29T23:25:17+00:00"},{"url":"https://x.com/realScamSniffer/status/1669152727073722373","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://zerion.io/blog/post-mortem-on-zerions-asset-phishing-attack/","name":"zerion.io","type":"other","archive_url":"http://web.archive.org/web/20260309062555/https://zerion.io/blog/post-mortem-on-zerions-asset-phishing-attack/","credibility":3,"archive_timestamp":"2026-03-09T06:25:55+00:00"},{"url":"https://www.quadrigainitiative.com/casestudy/zerionbalancerclonephishingattack.php","name":"quadrigainitiative.com","type":"other","archive_url":"https://web.archive.org/web/20260830035157/https://www.quadrigainitiative.com/casestudy/zerionbalancerclonephishingattack.php","credibility":3,"archive_timestamp":"2026-08-30T03:51:57+00:00"},{"url":"https://www.cryptotimes.io/2026/05/22/zero-network-shutting-down-as-zerion-pivots-to-wallet-and-api/","name":"cryptotimes.io","type":"other","archive_url":"http://web.archive.org/web/20260727103619/https://www.cryptotimes.io/2026/05/22/zero-network-shutting-down-as-zerion-pivots-to-wallet-and-api/","credibility":3,"archive_timestamp":"2026-07-27T10:36:19+00:00"},{"url":"https://en.cryptonomist.ch/2026/05/22/zero-network-shutdown-july-31-2026/","name":"en.cryptonomist.ch","type":"other","archive_url":"http://web.archive.org/web/20260726235904/https://en.cryptonomist.ch/2026/05/22/zero-network-shutdown-july-31-2026/","credibility":3,"archive_timestamp":"2026-07-26T23:59:04+00:00"},{"url":"https://en.coin-turk.com/zero-network-will-close-by-july-2026-users-must-withdraw-assets/","name":"en.coin-turk.com","type":"other","archive_url":"http://web.archive.org/web/20260613025842/https://en.coin-turk.com/zero-network-will-close-by-july-2026-users-must-withdraw-assets/","credibility":3,"archive_timestamp":"2026-06-13T02:58:42+00:00"},{"url":"https://zerion.io/security","name":"zerion.io","type":"other","archive_url":"http://web.archive.org/web/20260414094301/https://www.zerion.io/security","credibility":3,"archive_timestamp":"2026-04-14T09:43:01+00:00"},{"url":"https://captainaltcoin.com/zerion-wallet-review/","name":"captainaltcoin.com","type":"other","archive_url":"http://web.archive.org/web/20260607232736/https://captainaltcoin.com/zerion-wallet-review/","credibility":3,"archive_timestamp":"2026-06-07T23:27:36+00:00"},{"url":"https://www.bitget.com/academy/zerion-wallet-review","name":"bitget.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:12.132948+00:00","updated_at":"2026-08-30T03:54:56.64075+00:00"}}