{"investigation":{"slug":"zkfinance","entity_name":"zkFinance","trust_score":32,"severity_base":null,"score_modifier":0,"confidence":0.52,"status":"published","content_type":"investigation","summary":"zkFinance is a DeFi lending and borrowing protocol deployed on zkSync Era that also offers bridging, cross-chain swaps, and a concentrated-liquidity DEX. The protocol suffered a documented $200,000 protocol logic exploit attributed to an oracle misconfiguration in November 2024 and has since registered near-zero TVL ($24,990) with no active loans outstanding. The team is pseudonymous, no public founder identities have been verified, and the protocol's native ZGT token has attracted minimal exchange listing activity and negligible on-chain trading volume.","sections":[{"content":"zkFinance presents itself as an all-in-one DeFi platform built on zkSync Era, a Layer 2 zero-knowledge rollup on Ethereum. Its stated product suite includes lending and borrowing markets, a cross-chain bridge, cross-chain token swaps, and a concentrated-liquidity DEX. The protocol also operates a staking vault that claims to distribute more than 50% of protocol revenue to ZGT token stakers. As of mid-2026, DefiLlama records a TVL of approximately $24,990 against $0 in active loans, placing it in the extreme tail of the lending protocol market. Major DeFi lending protocols such as Aave V3 ($13+ billion TVL) and Venus Core Pool ($1+ billion TVL) dwarf zkFinance by several orders of magnitude. The protocol uses Chainlink and DIA as price oracles, with an advertised fallback mechanism, and claims a PeckShield smart contract audit. The official website is hosted at zkfinance.org and the protocol application is accessible at app.zkfinance.org. The project registered its Twitter/X handle as @zkFinance_ZGT and has accumulated approximately 12,000–13,600 followers. The domain was registered roughly three years ago and is organized under THORWallet in Switzerland according to WHOIS data reviewed by ScamAdviser.","heading":"Protocol Overview","sources":[{"url":"https://defillama.com/protocol/zkfinance","name":"defillama.com","type":"other","credibility":3},{"url":"https://www.zkfinance.org/","name":"zkfinance.org","type":"other","credibility":3},{"url":"https://faq.zkfinance.org/faqs/general/what-is-zkfinance","name":"faq.zkfinance.org","type":"other","credibility":3},{"url":"https://www.scamadviser.com/check-website/zkfinance.org","name":"scamadviser.com","type":"other","credibility":3}],"severity":"medium"},{"content":"According to data recorded by DefiLlama's hacks tracker, zkFinance experienced a security incident on November 11, 2024, in which approximately $200,000 was drained from the protocol on the zkSync Era chain. The exploit is classified as a protocol logic flaw rooted in an oracle misconfiguration — meaning the price feed mechanism embedded in the protocol's smart contracts was improperly configured in a way that an attacker was able to exploit to manipulate asset valuations and extract funds. This class of vulnerability is well-documented across DeFi: oracle price manipulation attacks have collectively siphoned over $200 million from DeFi protocols industry-wide, most commonly through flash-loan-assisted spot-price manipulation on single-source feeds. Despite deploying Chainlink and DIA as dual oracles and marketing an embedded fallback solution, the exploit indicates that the actual implementation of these price feeds contained a flaw the PeckShield audit either did not identify or that was introduced after the audit was completed. No independent post-mortem report from the zkFinance team has been publicly identified. The protocol's TVL, which was already modest, declined further following the incident. No bounty program or compensation fund for affected users has been publicly announced based on available evidence.","heading":"Security Incident — November 2024 Protocol Logic Exploit","sources":[{"url":"https://defillama.com/protocol/zkfinance","name":"defillama.com","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/what-are-price-oracle-manipulation-attacks-in-defi","name":"halborn.com","type":"other","credibility":3},{"url":"https://owasp.org/www-project-smart-contract-top-10/2025/en/src/SC02-price-oracle-manipulation.html","name":"owasp.org","type":"other","credibility":3}],"severity":"medium"},{"content":"No founder names, LinkedIn profiles, or verifiable team identities have been disclosed on the zkFinance website, FAQ, or social channels. The official homepage contains no team section. Investigative searches across crypto aggregators including RootData, AlphaGrowth, DappRadar, and CoinRank returned no team member information for zkFinance. WHOIS privacy services conceal domain ownership details, though ScamAdviser's review noted the registration appears linked to THORWallet, a Swiss-incorporated DeFi wallet project. It is unclear whether THORWallet's Switzerland incorporation constitutes a legal relationship with zkFinance itself or whether zkFinance operates as a separate pseudonymous entity that listed THORWallet as a distribution partner. The absence of verified team identities is a known risk factor for DeFi protocols: in exploit or dispute scenarios, anonymous teams present no accountability surface for legal or regulatory recourse. ZachXBT, the pseudonymous on-chain investigator known for identifying fraudulent DeFi projects and wallets, has flagged zkFinance. The exact substance of the ZachXBT flag is not independently verifiable from publicly archived posts reviewed during this investigation; however, the flag is consistent with the pattern of concerns raised by the protocol logic exploit and team opacity.","heading":"Team Anonymity and Transparency Concerns","sources":[{"url":"https://www.zkfinance.org/","name":"zkfinance.org","type":"other","credibility":3},{"url":"https://www.rootdata.com/Projects/detail/zkFinance?k=NDQ5NA%3D%3D","name":"rootdata.com","type":"other","credibility":3},{"url":"https://www.scamadviser.com/check-website/zkfinance.org","name":"scamadviser.com","type":"other","credibility":3},{"url":"https://alphagrowth.io/zkfinance-are","name":"alphagrowth.io","type":"other","credibility":3}],"severity":"medium"},{"content":"The zkFinance governance and utility token is designated ZGT. The project announced a 20 million ZGT airdrop distributed over 100 days, with 200,000 ZGT released per day. Participation required supplying or borrowing at least $200 on the platform. Claimed utility includes governance voting, staking for a share of protocol revenue, fee discounts, and liquidity-provision incentives. An ERC-20 contract for a token using the ticker zkFI at Ethereum address 0x7790af1e31ad3c38914e136143e4fd5088930392 shows only 2 holders and zero recorded transfers as of the time of this investigation, suggesting either dormancy or that this is a separate deployment from the primary ZGT contract on zkSync Era. No major centralized exchange listing for ZGT has been confirmed. Promotional airdrop guides published in late 2024 by unaffiliated Medium accounts still describe the token as pending TGE (Token Generation Event), indicating the token has not yet been widely distributed or publicly traded on open markets. The combination of a near-zero TVL, no active loans, minimal verified on-chain activity, and no exchange listings raises concerns about the token's ability to achieve market liquidity.","heading":"ZGT Token — Distribution, Utility, and Market Concerns","sources":[{"url":"https://etherscan.io/token/0x7790af1e31ad3c38914e136143e4fd5088930392","name":"etherscan.io","type":"other","credibility":3},{"url":"https://dappradar.com/rewards/airdrop/zkfinance-zgt-token-airdrop","name":"dappradar.com","type":"other","credibility":3},{"url":"https://medium.com/@martin223565/how-to-join-zkfinance-airdrop-for-zgt-tokens-1999c185aa4e","name":"medium.com","type":"other","credibility":3},{"url":"https://alphagrowth.io/zkfinance-are","name":"alphagrowth.io","type":"other","credibility":3}],"severity":"medium"},{"content":"zkFinance claims a completed smart contract audit by PeckShield, a recognized blockchain security firm. A file matching the name PeckShield-Audit-Report-ZKFI-v1.0.pdf exists in PeckShield's public GitHub publications repository, confirming that an audit document was produced. The full contents of the audit report could not be parsed during this investigation; however, the existence of the audit does not preclude post-audit code changes that introduced vulnerabilities, nor does it guarantee coverage of all protocol logic flows including oracle integration. The November 2024 protocol logic exploit occurred despite the claimed audit, raising questions about either audit scope, post-audit code modifications, or both. The FAQ page references the audit as being conducted for the zkSync ERA mainnet deployment. The protocol advertises destruction of admin keys as a security feature to prevent centralized interference after launch, but no verifiable on-chain proof of admin key destruction has been identified in public sources reviewed during this investigation. Security researchers have noted that ZK-adjacent DeFi protocols are twice as likely as non-ZK protocols to contain critical or high-severity vulnerabilities due to the complexity of ZK circuit and rollup integration.","heading":"Audit and Security Posture","sources":[{"url":"https://github.com/peckshield/publications/blob/master/audit_reports/PeckShield-Audit-Report-ZKFI-v1.0.pdf","name":"github.com","type":"other","credibility":3},{"url":"https://faq.zkfinance.org/faqs/general/what-is-zkfinance","name":"faq.zkfinance.org","type":"other","credibility":3},{"url":"https://www.zellic.io/blog/what-is-a-zk-audit/","name":"zellic.io","type":"other","credibility":3}],"severity":"medium"},{"content":"zkFinance operates in the zkSync Era ecosystem, which itself saw a sharp decline in user activity and TVL through 2024. Daily active addresses on zkSync fell 66% from their June 2024 peak following the ZK token airdrop controversy, and the 7-day moving average of active addresses dropped from over 200,000 in July 2024 to approximately 30,000 by December 2024. zkFinance's TVL of approximately $24,990 represents a negligible fraction of the $39.6 billion DeFi lending category TVL tracked by DefiLlama. $0 in active loans indicates the lending markets are not being used. Social metrics show approximately 12,000–13,600 Twitter/X followers and a declining trajectory (-1.21% over 7 days as of last measurement). The protocol's partnership with THORWallet, which has a reported 65,000+ application downloads, has not translated into measurable protocol TVL or loan volume. These metrics collectively indicate very limited real-world usage of the protocol beyond its initial promotional period.","heading":"Adoption Metrics and Competitive Position","sources":[{"url":"https://defillama.com/protocol/zkfinance","name":"defillama.com","type":"other","credibility":3},{"url":"https://alphagrowth.io/zkfinance-are","name":"alphagrowth.io","type":"other","credibility":3},{"url":"https://www.coinspeaker.com/zksync-zk-sharp-decline-tvl/","name":"coinspeaker.com","type":"other","credibility":3},{"url":"https://www.thorwallet.org/","name":"thorwallet.org","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2022","event":"zkFinance project founded, according to aggregator records. Exact founding date unverified.","source":"","date_original":"2022-01-01"},{"date":"2023-05-04","event":"zkFinance posts early promotional content on X/Twitter (@zkFinance_ZGT), describing the protocol as lending and borrowing on zkSync with ZGT token and airdrop plans.","source":""},{"date":"2023-06","event":"zkFinance mainnet deployment on zkSync Era. PeckShield smart contract audit claimed as completed prior to or concurrent with launch.","source":"","date_original":"2023-06-01"},{"date":"2024-06-27","event":"zkFinance posts on X about ZGT token distribution. Airdrop of 20 million ZGT tokens over 100 days announced, requiring $200 minimum supply or borrow activity.","source":""},{"date":"2024-10","event":"Multiple third-party Medium articles publish airdrop participation guides for zkFinance ZGT. Token described as pending TGE (Token Generation Event).","source":"","date_original":"2024-10-01"},{"date":"2024-11-11","event":"zkFinance suffers a $200,000 protocol logic exploit on zkSync Era. Root cause attributed to oracle misconfiguration. No public post-mortem issued by the team. Recorded by DefiLlama hacks tracker.","source":""},{"date":"2025","event":"zkFinance TVL declines to minimal levels following the November 2024 exploit. Active loans recorded at $0 on DefiLlama.","source":"","date_original":"2025-01-01"},{"date":"2025","event":"ZachXBT flags zkFinance. Exact nature and date of the flag are not independently verifiable from publicly archived ZachXBT posts reviewed during this investigation.","source":"","date_original":"2025-01-01"},{"date":"2026-05","event":"zkFinance TVL recorded at approximately $24,990 with $0 active loans. Twitter/X following at approximately 12,000–13,600 with declining trend. ZGT token has no confirmed major exchange listings.","source":"","date_original":"2026-05-01"}],"sources_used":[{"url":"https://defillama.com/protocol/zkfinance","name":"defillama.com","type":"other","archive_url":"http://web.archive.org/web/20250913070548/https://defillama.com/protocol/zkfinance","credibility":3,"archive_timestamp":"2025-09-13T07:05:48+00:00"},{"url":"https://www.zkfinance.org/","name":"zkfinance.org","type":"other","archive_url":"http://web.archive.org/web/20260610061708/https://www.zkfinance.org/","credibility":3,"archive_timestamp":"2026-06-10T06:17:08+00:00"},{"url":"https://faq.zkfinance.org/faqs/general/what-is-zkfinance","name":"faq.zkfinance.org","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.scamadviser.com/check-website/zkfinance.org","name":"scamadviser.com","type":"other","archive_url":"https://web.archive.org/web/20260901033752/https://www.scamadviser.com/check-website/zkfinance.org","credibility":3,"archive_timestamp":"2026-09-01T03:37:52+00:00"},{"url":"https://www.halborn.com/blog/post/what-are-price-oracle-manipulation-attacks-in-defi","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260414125119/https://www.halborn.com/blog/post/what-are-price-oracle-manipulation-attacks-in-defi","credibility":3,"archive_timestamp":"2026-04-14T12:51:19+00:00"},{"url":"https://owasp.org/www-project-smart-contract-top-10/2025/en/src/SC02-price-oracle-manipulation.html","name":"owasp.org","type":"other","archive_url":"http://web.archive.org/web/20260610203555/https://owasp.org/www-project-smart-contract-top-10/2025/en/src/SC02-price-oracle-manipulation.html","credibility":3,"archive_timestamp":"2026-06-10T20:35:55+00:00"},{"url":"https://www.rootdata.com/Projects/detail/zkFinance?k=NDQ5NA%3D%3D","name":"rootdata.com","type":"other","archive_url":"https://web.archive.org/web/20260829052001/https://www.rootdata.com/Projects/detail/zkFinance?k=NDQ5NA%3D%3D","credibility":3,"archive_timestamp":"2026-08-29T05:20:01+00:00"},{"url":"https://alphagrowth.io/zkfinance-are","name":"alphagrowth.io","type":"other","archive_url":"http://web.archive.org/web/20260829112244/https://alphagrowth.io/zkfinance-are","credibility":3,"archive_timestamp":"2026-08-29T11:22:44+00:00"},{"url":"https://etherscan.io/token/0x7790af1e31ad3c38914e136143e4fd5088930392","name":"etherscan.io","type":"other","archive_url":"https://web.archive.org/web/20260829032834/https://etherscan.io/token/0x7790af1e31ad3c38914e136143e4fd5088930392","credibility":3,"archive_timestamp":"2026-08-29T03:28:34+00:00"},{"url":"https://dappradar.com/rewards/airdrop/zkfinance-zgt-token-airdrop","name":"dappradar.com","type":"other","archive_url":"https://web.archive.org/web/20260901033104/https://dappradar.com/rewards","credibility":3,"archive_timestamp":"2026-09-01T03:31:04+00:00"},{"url":"https://medium.com/@martin223565/how-to-join-zkfinance-airdrop-for-zgt-tokens-1999c185aa4e","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://github.com/peckshield/publications/blob/master/audit_reports/PeckShield-Audit-Report-ZKFI-v1.0.pdf","name":"github.com","type":"other","archive_url":"http://web.archive.org/web/20251125203157/https://github.com/peckshield/publications/blob/master/audit_reports/PeckShield-Audit-Report-ZKFI-v1.0.pdf","credibility":3,"archive_timestamp":"2025-11-25T20:31:57+00:00"},{"url":"https://www.zellic.io/blog/what-is-a-zk-audit/","name":"zellic.io","type":"other","archive_url":"http://web.archive.org/web/20260610034834/https://www.zellic.io/blog/what-is-a-zk-audit/","credibility":3,"archive_timestamp":"2026-06-10T03:48:34+00:00"},{"url":"https://www.coinspeaker.com/zksync-zk-sharp-decline-tvl/","name":"coinspeaker.com","type":"other","archive_url":"http://web.archive.org/web/20260520103935/https://www.coinspeaker.com/zksync-zk-sharp-decline-tvl/","credibility":3,"archive_timestamp":"2026-05-20T10:39:35+00:00"},{"url":"https://www.thorwallet.org/","name":"thorwallet.org","type":"other","archive_url":"http://web.archive.org/web/20260616080944/https://www.thorwallet.org/","credibility":3,"archive_timestamp":"2026-06-16T08:09:44+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:27.856864+00:00","updated_at":"2026-09-01T03:39:50.331714+00:00"}}