Summary
Concentric (Concentric.fi) was an automated liquidity management protocol built on Camelot v3 on the Arbitrum network, offering vault-based yield optimization for concentrated liquidity positions. On January 22, 2024, the protocol suffered a critical security breach when a team member's deployer wallet was compromised through a targeted social engineering attack, resulting in approximately $1.85 million in losses and a 57% crash in the CONE token price. The protocol was subsequently halted entirely, and blockchain forensics firm CertiK linked the exploiter's wallets to prior incidents targeting OKX, UnoRe, and LunaFi, suggesting a sophisticated and recurring threat actor.
Connected Entities
1 entitiesTimeline(7 events)
2023-12-13
OKX DEX exploit occurs, resulting in approximately $2.7 million in losses. Wallet later connected to the Concentric attacker is involved in this incident.
2024-01-22
Concentric Finance exploited via social engineering attack on a team member's deployer wallet. Attacker upgrades vault contracts, mints LP tokens via adminMint(), drains vaults of approximately 715 ETH. A second phase sweeps 65.4 ETH from user approvals. Total losses approximately 780 ETH (~$1.85 million).
2024-01-22
Cyvers detects suspicious activity. CertiK publishes Skynet alert identifying the exploiter wallet as linked to the OKX exploit. Initial loss estimates cited as approximately $1.6 million, later revised upward.
2024-01-22
Concentric team confirms breach via official channels, urges all users to revoke approvals on vault contracts, halts the protocol entirely.
2024-01-22
CONE token price drops approximately 57% following public announcement of the exploit.
2024-01-22
CertiK publishes full incident analysis linking the exploiter to OKX, UnoRe, and LunaFi incidents, indicating a pattern of coordinated attacks.
2024-01-22
Protocol announced as halted indefinitely, with 8 ETH and residual USDC remaining in the treasury.
Decision Log
- hash: 3WVdEFFcXS8jfkkrwH8PcMNB2kkFihWAmT5DFKhmw3tc
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:35 AM
last updated: 5/27/2026, 6:12:42 PM
avoid.net — verified advice for a post-truth world