Defrost Finance
Last changed 2026-10-10 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 18 → 26. Problems weighed by who is responsible: the subject's own conduct −40, problems around the subject, caused by others −1.6; legitimacy credit long-running +2; no established finding that it defrauded anyone, so it stays out of the red band. Version history →
Why this score
| Every page starts at | 65 |
| The subject's own conduct | -40 |
| Problems around it, caused by others | -1.6 |
| Long-running | +2 |
| Sum | 25 |
- No established finding that it defrauded anyone, so it stays out of the red band (26 or above).
Score: 26/100 (kept between 0 and 100)
How scoring works →Summary
Defrost Finance was an Avalanche-based CDP (Collateralized Debt Position) DeFi protocol that allowed users to collateralize yield-bearing tokens to mint an H2O USD-pegged stablecoin. In December 2022 the protocol suffered a two-stage exploit resulting in approximately $12 million in losses; multiple blockchain security firms — including CertiK, PeckShield, and De.Fi Security — alleged the attack constituted an insider rug pull enabled by admin key access, a conclusion the team denied. Funds were subsequently returned and a refund contract was deployed in January 2023, but the protocol has since effectively ceased meaningful operations with under $100,000 in TVL, and the MELT governance token has lost nearly all of its value.
Connected Entities
4 entities · 60 linked investigations- Defrost Finance→mentioned with→Avalanche(70%)
- Defrost Finance→mentioned with→Cointelegraph(60%)
Connected Through
2 shared actors · 94 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- ♦Cointelegraphtoken
- □Avalancheorganization
Timeline(10 events)
17 May 2021
FinNexus (Phoenix Finance), a DeFi options protocol allegedly operated by the same team, is exploited for approximately $7.6 million via a private key compromise and token minting attack.
September 2021
Defrost Finance launches on Avalanche. De.Fi Security later alleged that project deployment was partially funded by proceeds from the 2021 FinNexus exploit.
February 2022
Defrost Finance TVL peaks at approximately $95 million.
23 December 2022
First attack: Flash loan exploit on Defrost V2 drains approximately $173,000 by exploiting a reentrancy vulnerability in the flashloan/deposit functions.
24 December 2022
Second attack: Defrost V1 is exploited via admin owner key access; attacker inserts a fake collateral token and malicious price oracle, mints 100 million H2O, and liquidates user positions. Total losses reach approximately $12 million.
25 December 2022
CoinDesk and PeckShield report on the exploit. PeckShield states the attack 'may have been a rug pull.' Defrost TVL drops from $13 million to under $93,000.
26 December 2022
CertiK publicly labels Defrost Finance an 'exit scam,' citing inability to contact team members. Defrost Finance announces funds from V1 attack have been returned.
28 December 2022
Defrost Finance team breaks silence with a statement denying rug pull allegations, characterizing the event as an external private key compromise.
30 December 2022
De.Fi Security publishes on-chain analysis alleging the multisig wallet creator is the same address that initiated the malicious oracle replacement, and connecting Defrost team to the 2021 FinNexus exploit.
11 January 2023
Defrost Finance deploys refund smart contract. Affected V1 vault depositors and H2O holders become eligible to claim stablecoin reimbursements based on pre-exploit positions.
Decision Log
- slot 455363295 · hash FYbE8U6ovi9Jrvub6xKc9AS27tpYTZj2pk4J7U39CHBH
- slot 422755684 · hash EsNHMBDrZnCPXjnfurpPQ7bsoxjGhe4LdvU3SSjCbWxN
This investigation is cryptographically anchored to the Solana blockchain (2 decisions). 9 of 17 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:45 AM
last updated: 10/10/2026, 6:43:11 PM
6 viewsavoid.net — verified advice for a post-truth world