Fusion by IPOR
Summary
Fusion by IPOR is a modular on-chain vault infrastructure product developed by IPOR Labs AG (Zug, Switzerland), designed to automate DeFi yield strategies across multiple chains without requiring Solidity expertise. On January 6, 2026, a legacy Fusion Optimizer Vault on Arbitrum was exploited for $336,000 USDC via a combination of missing fuse validation in the instantWithdraw method and an EIP-7702 delegation vulnerability on an administrator account. The IPOR DAO committed to fully compensating all affected depositors from treasury reserves, and the incident was flagged by blockchain investigator ZachXBT.
Connected Entities
1 entitiesTimeline(6 events)
2021-06-14
IPOR Labs AG incorporated in Zug, Switzerland by co-founders Darren Camas and Dimitar Dinev.
2023-07-28
Ackee Blockchain completes 59 engineering-day security review of IPOR Protocol core, identifying 39 findings. Review concludes with high code quality rating.
2024-01-01
Legacy Fusion Optimizer Vault deployed on Arbitrum (approximately 490 days before the January 2026 exploit), predating stricter fuse validation requirements.
2025-05-09
Governance proposal IIP-35 snapshot taken at Ethereum block 22446433 for IPOR-to-FUSN token migration at 1:1 ratio, marking a strategic rebranding of the protocol.
2026-01-06
Legacy Fusion USDC Optimizer Vault on Arbitrum exploited for $336,000 USDC via missing instantWithdraw validation and EIP-7702 admin delegation flaw. Hexagate and Blockaid alert the IPOR team. Stolen funds (approx. $267K) bridged to Ethereum and deposited into Tornado Cash.
2026-01-07
IPOR DAO publicly confirms full compensation of all affected depositors from DAO treasury. Protocol engages SEAL for forensic recovery. Post-mortem publication committed. Incident widely covered by crypto media.
Decision Log
- hash: DMpqzWrDsohvL74YgnRXxSvkeA6T7T7bSZu7RYtBGtHk
- hash: 9EdtsYzoz74ERCDfZirGqnN8SZarXgCb8Xts8DFT24Ek
- hash: 4HDCJ3P6c4ydbvT25zYAhku36vZ5Qn3SEwEcQayjr7tU
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:14 AM
last updated: 6/10/2026, 12:33:10 AM
avoid.net — verified advice for a post-truth world