Defrost Finance
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·3tNLiF…xzcpSummary
Defrost Finance was an Avalanche-based CDP (Collateralized Debt Position) DeFi protocol that allowed users to collateralize yield-bearing tokens to mint an H2O USD-pegged stablecoin. In December 2022 the protocol suffered a two-stage exploit resulting in approximately $12 million in losses; multiple blockchain security firms — including CertiK, PeckShield, and De.Fi Security — alleged the attack constituted an insider rug pull enabled by admin key access, a conclusion the team denied. Funds were subsequently returned and a refund contract was deployed in January 2023, but the protocol has since effectively ceased meaningful operations with under $100,000 in TVL, and the MELT governance token has lost nearly all of its value.
Connected Entities
4 entities · 60 linked investigations- Defrost Finance→mentioned with→Avalanche(70%)
- Defrost Finance→mentioned with→Cointelegraph(60%)
Connected Through
2 shared actors · 96 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- ♦Cointelegraphtokenalso inMass Ethereum Address-Poisoning Wave (Dec 2025-Jan 2026)·0Blockstream Jade — Fake Firmware Phishing Campaign (August 2026)·0Crypto Dispensers / Virtual Assets LLC·0Holoworld AI — AVA Token Insider Bundling Scheme·0Hong Kong Insurance Agent Romance Scam — Fake Crypto App ($3.3M, July 2026)·0CATFI Memecoin / Eth Father (Park)·0fake Ledger Live app·0MiCA Post-Deadline Impersonation Scam Cluster — ESMA/AMF Warning August 2026·0Q2 2026 Bridge Exploit Wave·0Q2 2026 Record Crypto Hack Wave·0Vanilla Drainer (DaaS)·0MiningMax·0Q2 2026 DeFi Record Hack Wave·0Squid Game Token·0Rugproof (Solana Launchpad)·0HECO Bridge & HTX Exchange Hack·1MangoFarmSOL·2Mining Automatic / Zan Shaikh·2NFTMachine·2Squid Games (SQUID Token)·2Evita Pay (Iurii Gugnin)·2Evolved Apes·2Evita Investments (Iurii Gugnin)·2HashOcean·2Evolved Apes NFT·2StableMagnet·2TurtleDex·2Swaprum·2TurtleDex·2Sahil Arora·3ZKasino·3Pump.fun / Solana Memecoin Launchpad Ecosystem Fraud·4WallStreetBets·5Ooki Protocol·5SUNRAY·FINANCE·8Normie (NORMIE)·8Grim Finance·8pump.fun·8Allbridge Core — CCTP Base Chain Exploit (August 2026)·8Aztec Connect Deprecated Bridge Exploits (June 2026)·10Eminence Finance·10Step App (FITFI)·14Bitget VOXEL Futures Manipulation April 2025·14Bitget VOXEL Futures Manipulation April 2026·16MANTRA (OM Token)·18Penpie·20DAO Maker Vesting·22DAO Maker·24Coinsbuy·26JRNY Crypto·28Meter Passport Bridge·28Team Finance·28Moola Market·28Lendf.me·30Brevo (email marketing platform used by Trezor, BitBox, CoinTracking, Solana Mobile)·32LeetSwap·32Zircon Gamma·32CoinStats·35MONA (Monavale / DIGITALAX)·38CoinDCX·38Dogwifhat (WIF)·38Juicebox V3·40Brevo·42Hacken Token·42BTCPay Server — Lightning LND Macaroon Exploit (August 2026)·47Zabu Finance·52USDS·55Global Dollar (USDG)·56Synthetix·58Playsomo·60Cointelegraph·62Base·68Asymmetric Research·77Operation Atlantic Approval Phishing Network·92
- □Avalancheorganizationalso inFake GTA 6 Leak Wallet-Drainer Campaign·2Snowdog·5Wonderland Finance·8Blizz Finance·10Orbit Bridge·10AlphaPo·10Vee Finance·12ARA Finance·14ElasticSwap·22KyberSwap Classic·28Platypus Finance·28Stake.com·28Arena SocialFi·32Nexera·32Stars Arena·33Midnight Network / NIGHT Token·42Allbridge Core·42Granary Finance (GRAIN)·42Avalanche·52Zabu Finance·52Rain Financial (Crypto Card Infrastructure)·58Safe{Wallet}·68Edgevana·69
Timeline(10 events)
17 May 2021
FinNexus (Phoenix Finance), a DeFi options protocol allegedly operated by the same team, is exploited for approximately $7.6 million via a private key compromise and token minting attack.
September 2021
Defrost Finance launches on Avalanche. De.Fi Security later alleged that project deployment was partially funded by proceeds from the 2021 FinNexus exploit.
February 2022
Defrost Finance TVL peaks at approximately $95 million.
23 December 2022
First attack: Flash loan exploit on Defrost V2 drains approximately $173,000 by exploiting a reentrancy vulnerability in the flashloan/deposit functions.
24 December 2022
Second attack: Defrost V1 is exploited via admin owner key access; attacker inserts a fake collateral token and malicious price oracle, mints 100 million H2O, and liquidates user positions. Total losses reach approximately $12 million.
25 December 2022
CoinDesk and PeckShield report on the exploit. PeckShield states the attack 'may have been a rug pull.' Defrost TVL drops from $13 million to under $93,000.
26 December 2022
CertiK publicly labels Defrost Finance an 'exit scam,' citing inability to contact team members. Defrost Finance announces funds from V1 attack have been returned.
28 December 2022
Defrost Finance team breaks silence with a statement denying rug pull allegations, characterizing the event as an external private key compromise.
30 December 2022
De.Fi Security publishes on-chain analysis alleging the multisig wallet creator is the same address that initiated the malicious oracle replacement, and connecting Defrost team to the 2021 FinNexus exploit.
11 January 2023
Defrost Finance deploys refund smart contract. Affected V1 vault depositors and H2O holders become eligible to claim stablecoin reimbursements based on pre-exploit positions.
Decision Log
- hash: EsNHMBDrZnCPXjnfurpPQ7bsoxjGhe4LdvU3SSjCbWxN
This investigation is cryptographically anchored to the Solana blockchain (1 event). 9 of 17 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:45 AM
last updated: 9/15/2026, 4:12:54 PM
6 viewsavoid.net — verified advice for a post-truth world