← Bent Financereviewed 2026-11-02 · 15 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Bent Finance against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
1 claimThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #2[disputed][awaiting moderator]in section: Insider Exploit — December 2021
“According to the Halborn post-mortem, the attacker then swapped stolen cvxCRV tokens into CRV and converted them to ETH.”
reviewerHalborn post-mortem says the attacker swapped stolen cvxCRV into CRV and then ETH, with Tornado Cash deposits on Dec 9 and 440 ETH laundered in two batches Dec 12-21The attribution to Halborn is not supported by the fetched Halborn page. The swap itself may appear in other sources (not verified), so only the attribution is removed.Proposed correction (not yet applied)The attacker then swapped stolen cvxCRV tokens into CRV and converted them to ETH.
unverifiable
4 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #4[unverifiable][awaiting moderator]in section: Insider Exploit — December 2021
“A secondary attacker address, 0x9e966a54082427d7ac56aeaee4baae7d11a6e468, was also identified as connected to the operation.”
reviewerSecond attacker address 0x9e966a54... connected to the operationNot found in the fetched cited sources (Halborn, Rekt, case study). - #7[unverifiable][awaiting moderator]in section: Access Control Failure and Root Cause
“No audit had flagged the access control gap prior to the exploit.”
reviewerNo audit had flagged the access control gapA negative claim with no source; not found in any fetched source. - #12[unverifiable][awaiting moderator]in section: Token and Protocol Status
“The protocol's total value locked (TVL) as tracked by DeFiLlama stands at approximately $15,553 as of 2026, with $97,186 in staked BENT tokens.”
reviewerTVL ~$15,553 and $97,186 staked per DeFiLlamaSource blocked; not scored. - #14[unverifiable][awaiting moderator]in the timeline
“Attacker begins executing withdrawals. First batch: 263,000 cvxCRV-f extracted from Bent Finance pools, converted to ETH, and sent to Tornado Cash.”
reviewerTimeline: Dec 9 deposits and Dec 12 first batch of 263,000 cvxCRV-fStart date Dec 12 is supported but the 263,000 amount was not found. Timeline entries all have empty source fields.
stale
1 claimThe claim was accurate when written but events since have overtaken it.
- #11[stale][awaiting moderator]in section: Token and Protocol Status
“As of available 2026 data, the token trades at approximately $0.012, representing a decline of more than 99.9% from its all-time high of $15.90.”
reviewerToken trades around $0.012, TVL ~$15,553 and $97,186 staked as of 2026$0.012 matches March 2026 only; later 2026 data shows about $0.02. Known only from search snippets, not fetched pages. DeFiLlama returned 403, so TVL figures could not be checked.Proposed correction (not yet applied)As of available 2026 data, the token trades at approximately $0.02, representing a decline of more than 99.8% from its all-time high of $15.90.
partially supported
3 claimsThe cited evidence supports part of the claim but not all of it.
- #3[partially supported][awaiting moderator]in section: Insider Exploit — December 2021
“the attacker's primary wallet received two deposits from Tornado Cash on December 9, 2021”
reviewerAttacker's primary wallet received two Tornado Cash deposits on December 9, 2021Dec 9 funding via Tornado Cash is supported by a single low-tier case study; the count of two deposits was not confirmed. - #9[partially supported][awaiting moderator]in section: Fund Recovery and User Reimbursement
“Two independent white hat developers were employed by the team to assist with patching the access control vulnerabilities.”
reviewerTwo independent white hat developers employed by the teamTwo white hats are mentioned; the 'employed' wording is unverified. - #15[partially supported][awaiting moderator]in the timeline
“Hacker agrees to return stolen funds to team multisig at 0xaBb8B277F49de499b902A1E09A2aCA727595b544. Full reimbursement of 512,696 cvxcrv-f tokens completed.”
reviewerHacker agreed to return funds ~Dec 24Facts supported; exact date is approximate.
confirmed
6 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in the summary
“resulting in the theft of approximately 440 ETH (~$1.75M)”
reviewerTheft of approximately 440 ETH (~$1.75M) via a backdoor inserted by a rogue developer holding the deployer keyRekt and the case study agree on roughly 440 ETH; the USD figure is $1.75M to $1.78M depending on source. - #5[confirmed][no action needed]in section: Insider Exploit — December 2021
“The Bent Finance team initially stated 'no funds had been lost' before reversing course after PeckShield's public identification of the deployer-originating transaction.”
reviewerTeam initially said no funds had been lost before reversingSupported by Rekt and the case study. - #6[confirmed][no action needed]in section: Access Control Failure and Root Cause
“an individual described as a rogue developer — employed by or contracted through the protocol's CTO — was shared the deployer private key in order to perform routine updates.”
reviewerCTO shared deployer key with a rogue developerConsistent with Halborn and the case study; the CTO detail rests on one secondary source. - #8[confirmed][no action needed]in section: Fund Recovery and User Reimbursement
“a full reimbursement of 512,696.06482288612 cvxcrv-f tokens was made to a team-controlled multisig at address 0xaBb8B277F49de499b902A1E09A2aCA727595b544”
reviewerFull reimbursement of 512,696.06482288612 cvxcrv-f to a team multisig; community contributed ~200,000 cvxCRV (~$1M)Matches CoinCodeCap exactly. - #10[confirmed][no action needed]in section: Fund Recovery and User Reimbursement
“The BENT token, which had reached an all-time high of $15.90 on December 19, 2021 — one day before the exploit was discovered — dropped approximately 73-74% upon disclosure.”
reviewerBENT ATH $15.90 on Dec 19, 2021 and 73-74% dropSupported by the case study. - #13[confirmed][no action needed]in section: Team Transparency and Accountability
“Core team members were publicly known only by their handles: swisshed, ape, santonicle, and conrad.”
reviewerTeam core members known only by handles swisshed, ape, santonicle, conradHandles match the case study.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.