Grim Finance
Last changed 2026-10-10 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 8 → 50. Problems weighed by who is responsible: incidents the subject suffered −9.6, concerns that are not fraud −3.2, problems around the subject, caused by others −1.6; legitimacy credit long-running +8; no longer operating, so capped at 50. Version history →
Why this score
| Every page starts at | 65 |
| Concerns that are not fraud | -3.2 |
| Incidents it suffered (e.g. hacks) | -9.6 |
| Problems around it, caused by others | -1.6 |
| Long-running | +8 |
| Sum | 59 |
- No longer operating, so capped at 50.
Score: 50/100 (kept between 0 and 100)
How scoring works →Summary
Grim Finance was a Fantom-based DeFi yield optimizer (fork of Beefy Finance) that suffered a devastating reentrancy exploit on December 19, 2021, resulting in approximately $30 million in user funds stolen. The vulnerability — a missing reentrancy guard in the depositFor() function — had existed in an audited codebase and was classified by security researchers as an entirely preventable, well-understood attack class. The protocol has since collapsed to a near-zero TVL of roughly $29,000 and its proposed compensation plan yielded no meaningful restitution for affected users.
Connected Entities
4 entities · 60 linked investigations- Grim Finance→mentioned with→Ethereum(75%)
- Grim Finance→mentioned with→Fantom (Sonic Labs)(80%)
- Grim Finance→mentioned with→Cointelegraph(60%)
- Cointelegraph→mentioned with→Ethereum(60%)
Timeline(11 events)
August 2021
Solidity Finance conducts a smart contract audit of Grim Finance, approximately four months before the exploit. A new analyst performs the review while the firm's CTO is on vacation; the reentrancy vulnerability in depositFor() is not flagged.
19 December 2021
Attacker (address: 0xdefc385d7038f391eb0063c2f7c238cfb55b206c) exploits the GrimBoostVault depositFor() reentrancy vulnerability using a flash loan and a malicious token contract, draining approximately $30 million from Grim Finance vaults on Fantom.
19 December 2021
Grim Finance team pauses all vaults approximately six hours after the attack begins. The team notifies Circle (USDC), MakerDAO (DAI), and AnySwap to freeze attacker-linked addresses. The attacker has already begun converting and bridging stolen assets.
19 December 2021
Grim Finance TVL collapses from approximately $98.9 million to $4.2 million. The GRIM token falls approximately 81%, from $0.80 to $0.15. Rugdoc.io and other security watchdogs publicly criticize the lack of a basic reentrancy guard.
20 December 2021
Solidity Finance issues a public statement acknowledging the missed vulnerability, attributing it to internal organizational stress and a new analyst performing the review. CoinDesk, CoinTelegraph, and Decrypt report on the breach.
20 December 2021
Attacker alleged to have deposited approximately $3.3 million of stolen funds into Tornado Cash mixer, with additional funds bridged from Fantom to Ethereum mainnet via stablecoin conversions.
31 December 2021
Grim Finance publishes post-mortem and compensation plan announcing a new token airdrop (50% of platform revenues), 0.2% insurance fund, and NFT airdrops from partner Pod Town. Affected users must submit claims by January 7, 2022.
7 January 2022
Claim submission deadline for hack victims passes. No public reporting confirms material restitution was subsequently delivered.
17 March 2022
DeFiSafety publishes a Process Quality Review rating Grim Finance at 24% with a FAIL designation, citing inadequate security processes.
8 August 2022
U.S. Treasury OFAC sanctions Tornado Cash, the mixer allegedly used to launder a portion of the Grim Finance stolen funds.
May 2026
Grim Finance TVL sits at approximately $28,759 across six chains per DeFiLlama, reflecting a functionally abandoned protocol. No meaningful development activity or community engagement has been identified since early 2022.
Decision Log
- slot 455359350 · hash HxD3TERKv8eyM97owkTcQRSBjtkV44ZunGSp6GMXJHGN
- slot 421119814 · hash 4XL42unt6FZb5A6FhVB29DQLzUoJHRBmcAhd1edqXcHH
This investigation is cryptographically anchored to the Solana blockchain (2 decisions). 12 of 13 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:52 AM
last updated: 10/10/2026, 6:40:43 PM
6 viewsavoid.net — verified advice for a post-truth world