Investigations

Asymmetric Research is a specialized blockchain security firm founded by Jonathan Claudius (formerly CSO at Jump Crypto) and Felix Wilhelm (formerly at Google Project Zero and Jump Crypto), with a team of 45+ researchers across North America, Europe, and Asia. The firm focuses on embedded, long-term security partnerships with L1/L2 blockchains and DeFi protocols, and has disclosed multiple high-severity vulnerabilities across Cosmos, Solana, Ethereum, and Circle infrastructure. No regulatory actions, fraud allegations, or client harm incidents have been identified in available sources.

Curve Finance is a major decentralized exchange (DEX) on Ethereum optimized for stablecoin and pegged-asset trading, operating since January 2020. On July 30, 2023, a latent vulnerability in the Vyper smart-contract compiler (versions 0.2.15, 0.2.16, and 0.3.0) was exploited across multiple Curve liquidity pools, draining approximately $70 million and triggering a near-systemic crisis when the resulting CRV price drop threatened to cascade-liquidate founder Michael Egorov's heavily collateralized on-chain loans. Roughly 73% of stolen funds were ultimately recovered or returned, and in December 2023 the Curve DAO voted to disburse approximately $49 million in compensation to affected liquidity providers.

Wormhole Bridge is a cross-chain messaging and token bridge protocol originally developed by Certus One, later owned by Jump Crypto, enabling asset transfers between Solana, Ethereum, and other blockchains. On February 2, 2022, an attacker exploited a signature verification flaw in the Solana-side smart contract to fraudulently mint 120,000 wrapped ETH (wETH) worth approximately $320–326 million without posting collateral, making it the second-largest DeFi exploit in history at the time. Jump Crypto replenished the stolen ETH within 24 hours to prevent ecosystem collapse, and a court-authorized counter-exploit in February 2023 recovered approximately $140 million of the remaining stolen funds.

Curve Finance is a major decentralized exchange and automated market maker (AMM) on Ethereum, optimized for low-slippage swaps of pegged assets such as stablecoins. On July 30, 2023, several of its liquidity pools were drained of approximately $70 million due to a reentrancy vulnerability in the Vyper smart contract compiler (versions 0.2.15, 0.2.16, and 0.3.0), one of the largest DeFi exploits of 2023. Separately, founder Michael Egorov's practice of using large CRV holdings as loan collateral across multiple DeFi protocols created systemic risk that culminated in a $140 million liquidation event in June 2024, generating over $10 million in bad debt across connected protocols.

Matcha (matcha.xyz) is a DEX aggregator built and operated by 0x Labs, launched in 2020, that routes trades across 130+ liquidity sources on 15+ blockchains using the 0x Protocol. The core Matcha platform has no history of direct exploits; however, Matcha Meta — a related but distinct meta-aggregator product launched later by the same team — suffered a $13.4M exploit in January 2026 via a third-party SwapNet contract, affecting users who had disabled the platform's default one-time approval security setting. 0x Labs is a well-funded, established entity whose protocol contracts have been audited by Trail of Bits, OpenZeppelin, and Ouroboros, and whose bug bounty program offers up to $1M via Immunefi.

Dialect (dialect.to) is a Solana-focused smart messaging and infrastructure company best known for co-developing the Blinks (Blockchain Links) and Actions standard with the Solana Foundation, launched in June 2024. Founded in 2021 by Chris Osborn, a named founder with a verifiable academic and professional background, the company raised a $4.1M seed round in March 2022 led by Multicoin Capital and Jump Crypto. No regulatory actions, fraud allegations, or confirmed security incidents specific to Dialect have been documented; the principal risk surface is the Blinks protocol itself, which introduces phishing and malicious-endpoint attack vectors that Dialect attempts to mitigate through a public registry of verified actions.

Deribit is a crypto options and futures exchange founded in 2016 in the Netherlands by John and Marius Jansen, historically operated through a Panama-registered entity and now licensed under Dubai's VARA framework as Deribit FZE. The exchange suffered a $28 million hot wallet compromise on November 1, 2022, covering the loss entirely from its own balance sheet. Coinbase completed the acquisition of Deribit for approximately $2.9 billion on August 14, 2025, making it a subsidiary of a publicly traded, NASDAQ-listed U.S. company.

1inch is a decentralized exchange (DEX) aggregator and liquidity protocol founded in 2019 by Sergej Kunz and Anton Bukov, operating across Ethereum and multiple EVM-compatible chains. The platform has experienced a series of security incidents between late 2024 and mid-2025, including a front-end supply chain attack, a private key compromise, a $5 million Fusion v1 resolver exploit, and a separate $5.87 million attack on a partner resolver — raising questions about operational security and smart contract lifecycle management. Additional concerns include alleged connections between co-founder Anton Bukov and the Russian FSS Academy, governance centralization risks, and sustained token value erosion since the 2021 peak.

ThalaSwap is the decentralized exchange component of Thala Labs, an Aptos-based DeFi protocol offering an AMM, the Move Dollar (MOD) overcollateralized stablecoin, liquid staking, and a launchpad. On November 15, 2024, an input-validation bug introduced in a two-line patch to the v1 farming contract allowed an attacker to drain $25.5 million in liquidity pool tokens; funds were fully recovered within hours after SEAL 911 identified the exploiter via on-chain evidence and the attacker returned assets in exchange for a $300,000 bounty.

Litecoin (LTC) is one of the oldest proof-of-work cryptocurrencies, created in October 2011 by former Google engineer Charlie Lee as a Bitcoin fork with faster block times and the Scrypt hashing algorithm. The protocol itself has a long operating history and has been formally classified as a digital commodity by U.S. regulators as of 2026. ZachXBT flagged Litecoin in connection with a January 2026 social engineering theft in which a single victim lost approximately $282 million in BTC and LTC — the largest individual crypto theft of that year — though the attack targeted a holder rather than representing any flaw in the Litecoin protocol or its development team.

Superteam is a community-run talent network and grant accelerator operating as the contributor layer of the Solana ecosystem, founded by Tanmay Bhat and Akshay BD and active across 23+ global chapters. The organization has been flagged for investigation by ZachXBT, though no published, verifiable ZachXBT post or report specifically naming Superteam as a fraudulent entity was located during this investigation; the exact nature and basis of that flag remains unconfirmed. Separately, Superteam Earn — the organization's public freelance bounty and job platform — operates within a segment of the Solana ecosystem that regulators, Google Cloud threat intelligence, and on-chain investigators have identified as systematically targeted by DPRK-linked IT workers using false identities.

USDGO is a USD-pegged enterprise stablecoin launched in February 2026, issued by Anchorage Digital Bank N.A. (the first federally chartered crypto bank in the United States) and branded and distributed by Hong Kong-listed OSL Group. As of July 2026 its circulating supply surpassed $1 billion, placing it among the top six regulated stablecoins globally. No fraud allegations, regulatory actions, or enforcement proceedings have been identified against the issuer or distributor in connection with USDGO.

On July 8, 2026, a compromised maintainer GitHub account was used to publish a backdoored version of @injectivelabs/sdk-ts and 17 related npm packages, disguising a wallet-key-stealing payload as SDK usage telemetry. The malicious code was live for approximately 49 minutes before being reverted; Injective Labs stated no funds on the network were at risk and no user losses were confirmed. This incident is a software supply-chain compromise affecting an official npm SDK maintained by Injective Labs — it did not involve a vulnerability or exploit of the Injective blockchain protocol itself.

PAX Gold (PAXG) is a regulated, gold-backed ERC-20 token issued by Paxos Trust Company, launched in September 2019, where each token represents one fine troy ounce of physical gold stored in Brink's vaults in London. Paxos holds a national trust charter from the U.S. Office of the Comptroller of the Currency (OCC) as of December 2025, and publishes monthly third-party attestation reports via KPMG. The issuing entity, Paxos Trust Company, entered a $48.5 million settlement with the New York Department of Financial Services (NYDFS) in August 2025 over anti-money laundering failures tied to its prior BUSD stablecoin business, which does not directly implicate PAXG but reflects compliance weaknesses at the parent firm.

USTB is a tokenized short-duration U.S. Treasury fund originally launched by Superstate in February 2024 and transitioned to Invesco Advisers, Inc. as investment manager in mid-2026. As of July 2026, the fund holds approximately $682 million in AUM, is deployed on Ethereum, Solana, and Plume, and is restricted to accredited investors and qualified purchasers. It operates as a private Section 3(c)(7) fund under a Regulation D Rule 506(c) exemption and has no record of regulatory enforcement actions, fraud allegations, or security incidents.

On July 21, 2026, the U.S. Attorney's Office for the District of Columbia filed five civil forfeiture complaints seeking to recover more than $25 million in USDT linked to pig butchering investment fraud and romance scams traced to networks operating out of Southeast Asia. The action was carried out by the Scam Center Strike Force, a multi-agency unit launched in November 2025 that has cumulatively recovered over $800 million in cryptocurrency from Chinese transnational criminal organizations running scam compound operations in Cambodia, Myanmar, and Laos. No individual defendants were named in the July 2026 complaints; the government proceeded in rem, suing the digital assets directly.

On June 18, 2025, the U.S. Attorney's Office for the District of Columbia filed a civil forfeiture complaint — case no. 25-cv-1907 — seeking $225,364,961 in USDT held across seven cryptocurrency wallet groups, representing the largest seizure of funds tied to cryptocurrency confidence fraud in U.S. Secret Service history. The assets were traced through blockchain analysis to a transnational pig-butchering network linked to a Manila-based scam compound, ITECHNO Specialist Inc., with 144 exchange accounts on OKX and more than 430 identified victims worldwide. The action was coordinated by the FBI and U.S. Secret Service San Francisco Field Office, with Tether providing proactive investigative assistance including freezing and burning the targeted USDT tokens.

Spiko EU T-Bills Money Market Fund (ticker: EUTBL) is a tokenized money market fund structured as a UCITS sub-fund of the Spiko SICAV, investing exclusively in short-term Eurozone sovereign Treasury Bills. It is regulated by the French Autorité des marchés financiers (AMF), managed by Twenty First Capital, and custodied by CACEIS Bank (a Credit Agricole subsidiary). As of July 2026 it ranks approximately #64 by market capitalization on CoinGecko with over $1 billion in assets under management, making it one of the largest tokenized real-world asset (RWA) products in Europe. No fraud, hack, or regulatory enforcement actions have been identified against Spiko or the fund.

Ripple USD (RLUSD) is a U.S. dollar-pegged stablecoin issued by Standard Custody & Trust Company, LLC, a wholly owned subsidiary of Ripple Labs, under a limited-purpose trust company charter granted by the New York Department of Financial Services (NYDFS). It launched on December 17, 2024, following formal regulatory approval, and had grown to approximately $1.5 billion in circulating supply as of July 2026. RLUSD carries standard centralization and counterparty risks inherent to issuer-controlled fiat-backed stablecoins, including administrative freeze and blacklist capabilities, but is backed by monthly Deloitte attestations, BNY Mellon custody of reserves, and a clear regulatory framework.

Bit.com was a cryptocurrency derivatives exchange operated by Matrixport, a Singapore-headquartered digital asset financial services firm founded by Bitmain co-founder Jihan Wu. The exchange launched in August 2020 and achieved a top-two global ranking in Bitcoin options volume before conducting an orderly, phased shutdown completed March 31, 2026, citing business restructuring. No fraud allegations, regulatory enforcement actions, or user fund losses have been identified against the exchange itself; the parent company Matrixport rebranded as BIT in March 2026 and continues operating under multiple licensed jurisdictions.

Canton Network (CC) is an enterprise-grade Layer-1 blockchain developed by Digital Asset Holdings, designed for tokenizing real-world assets with configurable privacy features and institutional-grade compliance. Ranked approximately #18 by market cap at roughly $5.9 billion as of May 2026, the network has attracted major institutional validators including DTCC, Goldman Sachs, Visa, and Euroclear, and its parent company Digital Asset is pursuing a reported $300 million fundraise at a $2 billion valuation led by a16z crypto. The network faces documented criticism from crypto-native observers over centralization trade-offs, data mutability departing from traditional blockchain immutability norms, and concentrated influence held by co-founder DRW Trading Group.

Thetanuts Finance is a multi-chain DeFi options protocol launched in August 2021, offering structured products (options vaults) across Ethereum, BNB Chain, Arbitrum, Polygon, and other networks. The protocol has raised $35 million across two funding rounds and has undergone seven smart-contract audits, but suffered a $2.1 million exploit in June 2026 targeting a deprecated legacy vault, with approximately $2 million subsequently recovered through whitehat efforts. TVL has declined substantially from a 2022 peak of roughly $50 million to under $1 million as of mid-2026.

Crossmint is a New York-based web3 infrastructure company founded in 2022 by Alfonso Gómez-Jordana Mañas and Rodrigo Fernández Touza. It provides APIs and no-code tools for embedded wallets, NFT minting, stablecoin orchestration, and AI-agent payments, reporting over 40,000 enterprise and developer customers. The company raised $23.6 million in March 2025 led by Ribbit Capital, holds SOC 2 Type II certification, a VASP license, and received MiCA authorization in Spain in December 2025.

ZetaChain is a Layer-1 blockchain founded in 2021 that enables omnichain smart contracts and native cross-chain interoperability across Bitcoin, Ethereum, and other networks without bridges. The protocol launched its mainnet beta in January 2024, raised $27 million in a Series A in August 2023, and achieved EU MiCAR compliance and DFSA recognition. In April 2026, it suffered a $333,868 exploit of its GatewayEVM smart contract targeting internal team wallets; no user funds were lost, though the team acknowledged it had previously overlooked a bug bounty report flagging the same vulnerability.

Ekubo Protocol is a concentrated-liquidity AMM DEX launched on Starknet in mid-2023 and subsequently expanded to Ethereum and Arbitrum. Founded by Moody Salem, a former Uniswap Labs engineer, the protocol is governed by an on-chain DAO and has commanded roughly 60% of Starknet DEX TVL. In May 2026 the protocol's EVM V2 swap router contracts suffered an access-control exploit that drained approximately $1.4 million in WBTC from user wallets; the Starknet core deployment was unaffected, and the team funded an on-chain recovery fund for victims.

Triple-A (Triple-A Technologies Pte Ltd) is a Singapore-headquartered crypto payment gateway founded in 2017 by Eric Barbier, licensed by the Monetary Authority of Singapore as a Major Payment Institution and holding additional regulatory authorizations in the EU, US, and Canada. In July 2026, the company's own treasury hot wallets were drained of approximately $11.8 million across six blockchain networks in a security breach; Triple-A stated that customer funds were held separately in trust and were not affected. The incident raises operational security questions, but represents a suffered attack on company treasury rather than fraud perpetrated by the company.

Magpie Protocol is a cross-chain DEX aggregator and liquidity aggregation platform founded in Dubai in 2022, backed by Jump Crypto and others in a $3 million seed round. In April 2024 the protocol suffered a smart contract exploit in which approximately $129,000 was drained from 221 user wallets due to an unchecked calldata vulnerability; the team fully reimbursed all affected users within two weeks. The project subsequently rebranded to Fly in Q1 2025 and launched the FLY governance token on the Sonic blockchain in June 2025, reporting over $6.3 billion in cumulative trading volume and 260,000 unique on-chain users as of that date.

Orca is a concentrated-liquidity automated market maker (AMM) and decentralized exchange built on the Solana blockchain, launched in February 2021 by co-founders Grace "Ori" Kwan and Yutaro Mori. Its core product, Whirlpools, is an open-source CLMM protocol with six independent security audits, a verifiable on-chain build, and no confirmed exploits since inception. The protocol operates via a DAO governed by the ORCA token and has expanded to Eclipse mainnet; the primary documented risk factors are residual upgrade-authority centralization, the legacy Three Arrows Capital investor relationship (now defunct), and a 2023 decision to geo-block U.S. users from the web interface without a public regulatory explanation.

DODO is a decentralized exchange (DEX) and on-chain liquidity protocol launched in August 2020, built around a proprietary Proactive Market Maker (PMM) algorithm that sources external oracle prices to concentrate liquidity and reduce slippage. On March 8, 2021, attackers exploited a reinitialization vulnerability in the V2 Crowdpool smart contracts, draining approximately $3.8 million from four pools; roughly $3.1 million was subsequently returned by white-hat and front-running bots, with an estimated $700,000 remaining unrecovered from the original attacker. No regulatory actions by the SEC, CFTC, or other agencies have been reported against the project or its founders as of August 2026.

BCAP is the world's first tokenized venture capital fund interest, issued in April 2017 as a Regulation D security token. It represents a non-voting economic interest in Blockchain Capital's Fund III. The firm manages $2B+ AUM with portfolio companies including Coinbase, Kraken, and Circle. Key risks include a $6.3M SIM-swap attack on co-founder Bart Stephens, Brock Pierce founding controversy, Epstein/Coinbase periphery connections, and effectively zero secondary market liquidity despite the token wrapper. No SEC enforcement actions exist.

Lido Finance is the largest Ethereum liquid-staking protocol, launched in December 2020, enabling users to stake ETH and receive the liquid derivative token stETH without meeting the standard 32 ETH validator minimum. Governed by the Lido DAO via the LDO token, the protocol held approximately 24% of all staked ETH and roughly $19 billion in TVL as of early 2026. Lido carries no fraud or exit-scam history, but poses well-documented systemic centralization risk to Ethereum consensus, governance-concentration concerns among LDO token holders, and faces an active US federal securities lawsuit alleging that LDO is an unregistered security.

Kamino Finance is a Solana-based DeFi protocol that combines automated concentrated-liquidity vaults, a lending and borrowing market (K-Lend), and leveraged yield strategies. Launched in August 2022 as a spin-off from Hubble Protocol, it has grown to become the largest DeFi protocol by total value locked on Solana, with multi-billion-dollar deposits as of 2026. The protocol has maintained a zero-bad-debt record since launch, completed more than ten independent security audits, and operates a $1.5 million bug bounty program, though centralization risks around upgrade authority keys and token distribution remain publicly documented concerns.

Chainlink is a decentralized blockchain oracle network founded in 2017 by Sergey Nazarov and Steve Ellis, with Cornell University professor Ari Juels co-authoring the whitepaper. The protocol provides smart contracts with tamper-resistant access to off-chain data and computation, holding an estimated 69–70% share of the oracle market and enabling over $26 trillion in cumulative transaction value as of 2025. No regulatory actions have been filed against Chainlink or its parent entity, Chainlink Labs; the primary documented concerns center on token-supply centralization and a 2020 campaign by an anonymous entity publishing unverified fraud allegations that were subsequently discredited.

Ethereum (ETH) is the second-largest cryptocurrency by market capitalization (~$278 billion as of May 2026) and the leading smart-contract platform, hosting the majority of decentralized finance (DeFi) and NFT activity. The protocol has a documented history of governance controversy stemming from the 2016 DAO hack hard fork, ongoing centralization concerns around liquid staking and MEV infrastructure, and persistent smart-contract and phishing-based fraud targeting end users, though Ethereum itself has not been the subject of any regulatory enforcement action and its spot ETFs have received SEC approval.

BlazeStake, operated by the pseudonymous SolBlaze team, is a non-custodial Solana liquid staking protocol that issues bSOL against SOL delegated across 200+ validators. It runs on Solana Labs' audited stake-pool program, discloses eight third-party audits of that shared program, and is described by its own documentation as governed by an ecosystem multisig overseen by the Solana Foundation, though the composition of that multisig and specifics of admin-key controls are not publicly itemized in available sources. No hacks, exploits, or regulatory actions against BlazeStake specifically have been found. The most material adverse event on record remains the April 2024 public dispute with MarginFi over reward-token distribution, which was reportedly resolved; a March 2026 joint SEC/CFTC statement classifying liquid staking as generally non-securities activity reduces regulatory tail risk for the category as a whole.

Marinade Finance is a non-custodial liquid staking protocol on Solana, launched on mainnet August 2, 2021. It operates two primary products — mSOL (liquid staking) and Marinade Native (non-liquid delegation) — and as of mid-2025 held approximately 10–11 million SOL in total staked value, making it one of Solana's largest staking providers. The protocol is governed by MNDE token holders via an on-chain DAO and has compiled a clean auditing track record with no confirmed exploits as of the investigation date.

USYC (US Yield Coin) is a tokenized money market fund representing shares in the Hashnote International Short Duration Yield Fund Ltd., a Cayman Islands-regulated fund investing primarily in short-duration U.S. Treasury securities and reverse repurchase agreements. Originally issued by Hashnote, USYC and its issuer were acquired by Circle Internet Group in January 2025; the token is now issued by Circle International Bermuda Limited, a Bermuda Monetary Authority-licensed entity, and has grown to become the largest tokenized U.S. Treasury product on-chain by assets under management. The product carries genuine institutional-grade structure and disclosure, but access is restricted to non-U.S. persons and KYC'd institutional entities, redemption ultimately depends on centralized allowlisting and issuer-controlled smart contracts, and the fund itself was not directly implicated in the January 2025 Usual/USD0++ depeg despite serving as collateral for that episode.

Ondo Finance is a real-world asset (RWA) tokenization protocol founded in 2021 by former Goldman Sachs executives Nathan Allman and Justin Schmidt. The platform offers tokenized exposure to U.S. Treasury securities (OUSG, USDY) and, since September 2025, a broader set of tokenized equities via Ondo Global Markets. The protocol held over $1.8 billion in TVL as of late 2025 and received formal notice in November 2025 that a two-year SEC investigation had been closed without charges.

Uniblock is a Canadian Web3 infrastructure company founded in 2022 that provides a unified, multi-chain API aggregation platform for blockchain developers, connecting over 300 blockchains and 55 data providers through a single interface with patented auto-routing technology. The company is venture-backed with C$7.5 million in total funding from institutional investors including SBI Ven Capital, AllianceDAO, NGC Ventures, Alchemy, and MoonPay. No regulatory actions, fraud allegations, or significant security incidents have been identified; risk factors are principally commercial and operational rather than conduct-related.

Edgevana is a Las Vegas-based bare-metal infrastructure and node-deployment platform founded in 2019, specializing in Solana validator onboarding, RPC node provisioning, and decentralized edge compute. The company operates a liquid staking product (edgeSOL) with approximately 839,000 SOL under management and has secured notable partnerships with the Solana Foundation, Avalanche, and StackPath. No regulatory actions, fraud allegations, or significant security incidents have been identified.

Raydium is an automated market maker (AMM) and decentralized exchange built on the Solana blockchain, launched in February 2021 and widely regarded as Solana's primary liquidity hub. On December 16, 2022, the protocol suffered a major security incident in which an attacker compromised an admin private key — suspected to be via a trojan on a team virtual machine — and drained approximately $4.4 million from eight constant product liquidity pools. Raydium responded with a patched program, a community-approved compensation plan funded by team-held RAY tokens, and has since migrated authority to a Squads multisig with hardware wallet and timelock protections.

Bitstamp is a Luxembourg-headquartered cryptocurrency exchange founded in 2011 by Nejc Kodric and Damijan Merlak, widely regarded as the world's longest-running active crypto exchange. It was acquired by Robinhood Markets for approximately $200 million in June 2025 and holds over 50 active licenses and registrations globally, including an EU MiCA CASP license and a MiFID MTF license. The exchange has maintained a strong regulatory compliance posture for most of its history, though it suffered a significant $5.3 million hack in 2015 and a 2025 French court found it civilly liable for a period of unregistered operation in France.

Clockwork was a Solana-based smart-contract automation protocol that allowed developers to schedule transactions and build event-driven on-chain programs without relying on centralized cloud infrastructure. Founded in 2021 as Cronos and rebranded in 2022, the project raised $4 million in seed funding from Multicoin Capital, Asymmetric, and Solana Ventures before its founder announced an orderly shutdown effective October 31, 2023, citing limited commercial upside. No fraud, security exploits, or regulatory actions have been identified; the shutdown is assessed as a voluntary wind-down of a legitimate infrastructure project.

Rocket Pool is a decentralized, non-custodial Ethereum liquid staking protocol founded in 2016 by David Rugendyke and launched on mainnet in November 2021. It issues two tokens: rETH (a liquid staking derivative) and RPL (a governance and collateral token). As of mid-2026, the protocol holds approximately $924 million in total value locked, making it the second-largest decentralized Ethereum staking provider by TVL, behind Lido Finance.

In May 2026, independent security researcher Taylor Hornby discovered a critical soundness vulnerability in the Zcash Orchard shielded pool's zero-knowledge proof circuit that had existed since the pool's launch in May 2022. The flaw — an under-constrained elliptic-curve multiplication gadget in the halo2_gadgets crate — could theoretically have allowed unlimited undetectable counterfeit ZEC creation within the Orchard pool, though it could not inflate total ZEC supply due to the turnstile mechanism. The Zcash Open Development Lab coordinated an emergency two-phase response within 50 hours: a soft fork on June 2 disabling Orchard transactions, followed by the NU6.2 hard fork on June 3 deploying the corrected circuit. No exploitation has been confirmed, though the privacy properties of the Orchard pool make definitive confirmation impossible. ZEC fell approximately 38% on public disclosure on June 5, 2026.

Dual Finance is a Solana-based structured-products protocol offering Dual Investment Pools (DIPs) and Staking Options, products designed to provide yield to token holders and sustainable liquidity incentives to DAOs. Founded in 2022 by named individuals with verifiable TradFi and FAANG backgrounds, the protocol reached a peak TVL of approximately $35 million in 2023 but has since contracted sharply to under $500K as of mid-2025. No exploits, regulatory actions, or fraud allegations have been identified in public records; the primary concerns are low current TVL, limited publicly-verifiable audit documentation, and significant DUAL token price depreciation since its 2023 ATH.

On March 19, 2026, DeFi protocol Neutrl experienced a suspected DNS hijack of its frontend domain, in which attackers allegedly social-engineered the protocol's DNS provider to redirect user traffic to a malicious interface targeting Permit2 wallet approvals. Neutrl paused its smart contracts as a precaution, migrated to new infrastructure by March 21, and confirmed all user funds remained safe via the protocol's custodial isolation framework. This incident is considered the earliest confirmed event in a six-week cluster of DeFi frontend hijacks in early 2026 that also struck HypurrFi (April 3) and CoW Swap (April 14).

Firedancer is an independent, high-performance Solana validator client developed by Jump Crypto (Jump Trading Group), written from scratch in C primarily by a team led by Chief Science Officer Dr. Kevin Bowers and founding engineer Ritchie Patel. Released under the Apache 2.0 open-source license, it aims to increase Solana's throughput toward one million transactions per second while improving network resilience through client diversity. As of May 2026, the client is live on Solana mainnet with roughly 20% of validators running it, though full rollout remains cautious pending completion of comprehensive third-party security audits. The project carries a notable backer-risk signal: Jump Crypto's parent subsidiary Tai Mo Shan settled SEC charges for $123 million in December 2024 over TerraUSD manipulation, and a separate CFTC investigation was reported in 2024 with no publicly disclosed outcome as of this writing.

Anza (Anza Technology, Inc.) is a Delaware-incorporated software development firm founded in January 2024 by approximately 45 former Solana Labs engineers and executives, including Solana co-founder Stephen Akridge. The company serves as the primary maintainer of the Agave validator client — a fork of the original Solana Labs codebase and the majority client on the Solana network — and has proposed Alpenglow, a wholesale redesign of Solana's consensus mechanism approved by governance in September 2025. Anza has no token of its own; risk considerations center on its outsized influence over Solana's core protocol, the regulatory context of its formation, and a personal civil lawsuit involving co-founder Stephen Akridge.

NEAR Protocol is a layer-1 proof-of-stake blockchain founded in 2017 by Illia Polosukhin and Alexander Skidanov, featuring a sharded architecture (Nightshade) and human-readable account names, with mainnet launching in April 2020. The project has raised over $540 million from notable investors including Andreessen Horowitz and Tiger Global, and has maintained an active development roadmap pivoting toward AI agent infrastructure. No direct fraud or regulatory enforcement actions have been identified against the protocol itself, though ecosystem-level exploits, centralization concerns, and investor overlap with collapsed entities such as FTX Ventures and Three Arrows Capital have been noted.

Safe{Wallet}, operated by the Safe Ecosystem Foundation, is the dominant smart-contract multisig platform on Ethereum and EVM-compatible chains, securing approximately $35 billion in assets across 61 million accounts as of Q1 2026. In February 2025, a developer machine compromise by North Korea's Lazarus Group (TraderTraitor) allowed attackers to inject malicious JavaScript into the app.safe.global frontend, enabling the theft of approximately $1.5 billion in ETH from Bybit — the largest cryptocurrency heist in history. The Safe smart contracts themselves were not compromised; the attack was entirely at the infrastructure and frontend layer. Safe has since rebuilt its infrastructure and launched Safenet, a decentralized transaction-security network, as a structural response.

Helius (helius.dev) is a Toronto-founded, Solana-focused developer infrastructure company offering RPC nodes, enhanced APIs, webhooks, data streaming, and validator services. Founded in June 2022 by former Coinbase and AWS engineers, the company has raised $34.85 million across three rounds led by Founders Fund, Haun Ventures, and Foundation Capital, and operates as a key infrastructure layer for the Solana ecosystem. No regulatory actions or security breaches have been identified against Helius; the main risk signals are minor service reliability incidents and unresolved workplace conduct allegations against its CEO.

USD Coin (USDC) is a fiat-backed stablecoin issued by Circle Internet Group, pegged 1:1 to the US dollar and backed by cash and short-dated US Treasury instruments held in a regulated money market fund. First launched in September 2018 via the Centre Consortium (a joint venture with Coinbase), USDC is among the largest and most regulated stablecoins globally, with approximately $75.8 billion in circulation as of May 2026. The stablecoin has maintained a generally stable peg but experienced a significant temporary depeg to $0.87 in March 2023 following Circle's disclosure of $3.3 billion in deposits held at the failed Silicon Valley Bank.

Spark Protocol is a decentralized lending and capital allocation platform incubated within the MakerDAO (now Sky) ecosystem, built by the core contributor team Phoenix Labs. Launched on Ethereum in May 2023, it operates SparkLend (a money market), Spark Savings (sUSDS yield vault), and a cross-chain Spark Liquidity Layer, reaching over $8 billion in combined TVL by mid-2025. The protocol issued its SPK governance token via airdrop in June 2025 and has faced community criticism over geographic access restrictions, VPN blocking, centralization concerns inherited from Sky's governance structure, and post-airdrop token price volatility.

Kaspa is a proof-of-work cryptocurrency launched in November 2021 that implements the GHOSTDAG blockDAG protocol, developed from academic research by Yonatan Sompolinsky at the Hebrew University of Jerusalem. The project claims a fair launch with no premine, no ICO, and no venture capital allocation to insiders, though pre-launch R&D was funded by Polychain Capital through the now-dissolved DAGLabs entity. Kaspa has a credible technical foundation and transparent governance, but faces centralization concerns from institutional ASIC miners and carries unresolved questions about the erasure of early transaction history following a genesis reset in November 2021.

Light Protocol is a Solana-native ZK compression infrastructure layer developed by Luminous Labs Lda, a Portugal-based company co-founded in 2021 by Swen Schäferjohann. The protocol reduces on-chain state storage costs by up to 99% using zero-knowledge proofs and has undergone multiple independent security audits including formal circuit verification. No fraud allegations, regulatory actions, or fund-loss incidents have been identified; primary risk signals are inherent ZK/smart-contract complexity, partially unaudited SDK tooling, and infrastructure scaling concerns raised by Solana node operators.

On February 4, 2021, an attacker exploited Yearn Finance's v1 yDAI vault using a multi-protocol flash loan to manipulate exchange rates in Curve Finance's 3pool, causing approximately $11 million in vault losses while the attacker personally profited roughly $2.8 million. Yearn Finance's security team contained the exploit within eleven minutes, preserving $24 million of the vault's $35 million under management. Yearn subsequently reimbursed affected depositors by minting 9.7 million DAI against YFI collateral in a MakerDAO vault, with the intent to repay the debt from ongoing protocol revenue.

Base is an Ethereum Layer-2 optimistic rollup incubated and operated by Coinbase, built on the OP Stack and launched on mainnet on August 9, 2023. As of mid-2026 it is the largest Layer-2 by DeFi TVL, holding approximately $4.6 billion locked and processing millions of daily transactions. It carries legitimate structural risks — most notably a single Coinbase-operated sequencer and Coinbase's regulatory exposure as operator — that are partially offset by the April 2025 move to Stage 1 decentralization and the May 2026 Azul upgrade introducing a multiproof system.

Wormhole is a cross-chain messaging and token bridge protocol enabling interoperability across more than 30 blockchain networks, originally developed by Certus One and later backed by Jump Crypto. On February 2, 2022, Wormhole suffered a $326 million exploit — the largest hack in Solana ecosystem history at the time — when an attacker exploited a deprecated Solana function to forge guardian signatures and mint 120,000 wETH without locking any collateral. Jump Crypto immediately replenished the stolen funds to keep users whole, and the project subsequently raised $225 million at a $2.5 billion valuation, separated from Jump Trading as an independent entity, and launched the W governance token in April 2024; as of 2026, the stolen funds remain substantially unrecovered despite a partial $140 million counter-exploit via English court order.

VeChain (VET) is an enterprise-focused Layer-1 blockchain founded by Sunny Lu (former CIO of Louis Vuitton China). Launched in 2015 as a subsidiary of Bitse, rebranded and mainnet launched in 2018. The VeChain Foundation's buyback wallet was hacked in December 2019 due to employee negligence, losing 1.1 billion VET (~$6.5M). The Foundation held 27.3% of total token supply as of September 2019. VeChain's official X account was compromised in January 2024 for a scam giveaway. The blockchain has built-in fund freezing capabilities. Enterprise partnerships include Walmart China, BMW, and UFC. VeChain was among the first to proactively comply with MiCAR regulations.

Raydium is a leading Solana-based automated market maker (AMM) and decentralized exchange (DEX) launched in February 2021 by a pseudonymous team. On December 16, 2022, a compromise of the protocol's admin private key enabled an attacker to drain approximately $4.4 million from eight liquidity pools; the stolen funds were subsequently laundered through Tornado Cash in January 2023. The team implemented a phased compensation plan and post-incident security upgrades, including migration of admin authority to a Squads multisig, but the incident exposed significant centralization risks that were not apparent prior to the exploit.

Glow Wallet is a non-custodial Solana wallet developed by Luma Labs, Inc., a San Francisco-based company co-founded by Danqing (Dan) Liu and Victor Pontis. Available as a browser extension and mobile app since early 2022, it is marketed as a design-forward wallet with transaction simulation, in-app staking, zero-fee swaps, and a decentralized identity system called Glow ID. No major security breaches specific to Glow have been publicly reported, and no regulatory actions have been identified against the project or its developer.

Starknet is a permissionless ZK-rollup Layer 2 network on Ethereum, developed by Israeli cryptography firm StarkWare Industries. It uses STARK-based validity proofs and the Cairo programming language to scale Ethereum throughput. The project launched its STRK token in February 2024 and reached L2Beat Stage 1 decentralization in May 2025, but has faced significant community criticism over its airdrop eligibility criteria and an early, aggressive token unlock schedule for investors and early contributors.

Convex Finance is a decentralized finance yield-optimization protocol launched in May 2021 on Ethereum, designed to boost rewards for Curve Finance liquidity providers and CRV stakers by aggregating veCRV voting power. The protocol rapidly became one of the largest DeFi platforms by total value locked, peaking near $21 billion in January 2022, and accumulated controlling influence over Curve governance by holding approximately 47–50% of all veCRV supply at peak. The team has remained anonymous since launch, and the protocol experienced a critical multi-signature vulnerability in December 2021 — discovered and disclosed by OpenZeppelin — which was patched without any loss of user funds.

Hivemapper is a decentralized physical infrastructure network (DePIN) built on Solana that incentivizes drivers to collect street-level imagery via dashcams and rewards them with the native HONEY token. The company, led by named founder Ariel Seidman, has raised over $50 million in total funding and counts Lyft, TomTom, and Volkswagen ADMT among its enterprise customers. While no fraud or regulatory action has been identified, the project carries moderate risks related to token price volatility, hardware shipping delays, a 2022 regulatory ambiguity around whether HONEY constitutes a security, and inherent privacy considerations from mass collection of street-level imagery.

Jito Labs is a San Francisco-based software company that builds MEV (maximal extractable value) and liquid staking infrastructure for the Solana blockchain, most notably the Jito-Solana validator client and the JitoSOL liquid staking protocol. The company was named as a defendant in a civil RICO class action (Aguilar v. Baton Corporation, S.D.N.Y., No. 1:25-cv-00880) alleging it enabled insider front-running on the Pump.fun memecoin platform; plaintiffs voluntarily dismissed all claims against Jito Labs on September 26, 2025, without settlement payment, though the court later granted leave to refile and the broader case against co-defendants continues. Jito Labs previously suspended its public mempool in March 2024 after sandwich-attack bots exploited the feature, and subsequently took enforcement action against validators conducting such attacks in 2025.

Dogecoin (DOGE) is a cryptocurrency created in December 2013 by Billy Markus and Jackson Palmer as a deliberate parody of Bitcoin. It has grown to a top-10 cryptocurrency by market cap (~$17B). While the protocol itself has no documented exploits, Dogecoin carries risks from Elon Musk's outsized price influence (an $258B class action was filed and dismissed), significant whale concentration (149 wallets hold ~108.5B DOGE), and documented illicit use including PlusToken seizures and darknet market acceptance.

Circle Internet Group (NYSE: CRCL) is the issuer of USDC, the second-largest stablecoin by market capitalization at approximately $78 billion in circulation as of May 2026. Circle operates under a strict court-order-only freeze policy that drew intense scrutiny following the April 2026 Drift Protocol hack, in which $232 million in USDC was bridged via Circle's own Cross-Chain Transfer Protocol (CCTP) over six hours without intervention, despite Circle being alerted within an hour. The resulting McCollum v. Circle class action, Drift's subsequent switch to USDT, on-chain analyst ZachXBT's documentation of $420 million in alleged prior missed freezes, and an AMLBot report showing Tether freezes assets at roughly 30 times Circle's rate have placed Circle's compliance posture at the center of a significant policy debate.

Aave is a decentralized, non-custodial liquidity protocol built on Ethereum and multiple other blockchains, enabling users to supply assets to earn interest or borrow against overcollateralized positions. Founded in 2017 as ETHLend by Finnish lawyer Stani Kulechov, it rebranded to Aave in 2020 and grew into the largest DeFi lending platform by total value locked, holding roughly 60% market share in DeFi lending. A multi-year SEC investigation into the AAVE token closed without enforcement in December 2025. In April 2026 Aave was a downstream victim of the $292 million Kelp DAO rsETH bridge exploit (attributed to North Korea's Lazarus Group): the attacker used now-unbacked rsETH as collateral to borrow roughly $190 million, leaving Aave with bad debt and triggering an $8.45 billion, 48-hour deposit run that cut TVL from ~$45.8B to ~$28.6B. Aave's own smart contracts were not exploited — the loss stemmed from accepting compromised external collateral. The protocol led the industry-wide 'DeFi United' restitution coalition (raising over $300 million in ETH), pursued recovery of roughly $71 million in frozen attacker funds in U.S. court, and restored rsETH operations by late May 2026. Residual concerns are the bad-debt overhang from the April incident and ongoing governance tensions between token holders and Aave Labs, but the protocol remains a fundamentally legitimate blue-chip lending platform.

Machine Hallucinations is a series of AI-generated NFT artworks created by Turkish-American media artist Refik Anadol, deployed on the Ethereum blockchain beginning in 2021. The project has generated over $30 million in total NFT sales across multiple collections auctioned through Sotheby's, Christie's, and secondary markets including OpenSea. The project is notable for its institutional legitimacy — MoMA acquired the related 'Unsupervised' work as its first NFT in its permanent collection — but has attracted criticism regarding conflicts of interest between museum endorsement and commercial NFT promotion.

Bitcoin (BTC) is the world's first decentralized cryptocurrency, introduced in a 2008 whitepaper by the pseudonymous Satoshi Nakamoto and launched in January 2009. As of May 2026, it is the largest cryptocurrency by market capitalization (~$1.6T), classified as a digital commodity by U.S. regulators, and backed by institutional infrastructure including 11 SEC-approved spot ETFs. Bitcoin's established protocol and regulatory clarity distinguish it from most crypto assets, though it carries material risks including market volatility, mining centralization, illicit-use association, and exchange counterparty exposure.

XDC Network is an enterprise-grade, EVM-compatible Layer-1 blockchain co-founded in 2017 by Atul Khekade and Ritesh Kakkad through XinFin, focused on trade finance, payments, and RWA tokenization. The mainnet has been operational since 2019 with 801M+ transactions processed and 178K+ smart contracts deployed. XDC 2.0 upgrade (Q4 2024) introduced Byzantine fault tolerance security. ISO 20022-aligned for institutional interoperability. Co-founders operate a $125M XVC Tech investment fund. No major security incidents or regulatory actions found. Limited independent media coverage and relatively low public scrutiny for its market cap.

Mad Lads is a Solana-based NFT collection launched in April 2023 by Coral, the development company behind Backpack wallet. Created by former Alameda Research and FTX employees Armani Ferrante and Tristan Yver, the project gained significant attention for its innovative mint process that used honeypot tactics to deter bots and for being the first major xNFT collection.

Jupiter Exchange (jup.ag) is the dominant DEX aggregator on Solana, founded in October 2021 by pseudonymous co-founder Meow and Siong Ong. It handles an estimated 95% of Solana aggregator volume and has expanded into perpetuals trading, lending, liquid staking, and a native stablecoin, positioning itself as a 'DeFi superapp.' While the platform is legitimate and widely used with over $2.2 trillion in cumulative swap volume, it has accumulated a series of documented controversies including a co-founder racial slur incident, misleading lending risk disclosures, a governance crisis over team voting power, an X account hack that caused user losses, and community concerns about ecosystem monopolization through acquisitions.

Amazon Web Services is a leading cloud computing platform that controls 38% of the cloud infrastructure market. While generally reliable and secure, AWS has experienced multiple significant outages and faces ongoing privacy lawsuits, though no major regulatory sanctions have been identified in recent searches.

Solana is a high-performance blockchain platform that has experienced significant technical instability, ecosystem fraud, and regulatory challenges since its 2020 launch. While positioned as an "Ethereum killer," the network has suffered from multiple outages, massive meme coin scams, and legal scrutiny regarding its centralization and potential securities classification.

Kraken (operated by Payward, Inc.) is one of the largest and longest-running cryptocurrency exchanges in the world, founded in 2011 and publicly launched in 2013 in San Francisco. The exchange holds a Wyoming special purpose depository institution bank charter and serves approximately 15 million users across 190+ countries. While Kraken is a legitimate, operating business and has not been the subject of exit-scam or market-manipulation allegations, it has accumulated a substantial regulatory enforcement record across multiple jurisdictions, experienced a zero-day security exploit in 2024, and faced an active extortion attempt in April 2026 tied to insider-related data access incidents.

Phantom Wallet is a self-custody, non-custodial cryptocurrency wallet developed by Phantom Technologies, Inc., headquartered in San Francisco. Originally launched in 2021 as a Solana-focused browser extension, it has expanded to support Ethereum, Bitcoin, Polygon, Base, and Sui across browser extensions and mobile apps, with approximately 15 million monthly active users and $25 billion in self-custodied assets as of early 2025. The company is well-funded and has engaged constructively with US regulators, though it faces an active civil lawsuit alleging a browser-extension security flaw, and its users have been materially targeted by phishing impersonators and fake app-store clones.

Amazon is a major e-commerce and technology company that has faced significant regulatory challenges and consumer protection issues. While not itself a scam, Amazon's scale has made it a frequent target for impersonation scams and has led to multiple regulatory actions including a $2.5 billion FTC settlement for deceptive Prime subscription practices.

Hyperliquid suffered a documented ecosystem incident with reported losses of $37K on Arbitrum. This page tracks DeFiLlama's record of the event.

Bottled water contains significantly more micro- and nanoplastics than previously thought. Each time you screw a plastic bottle cap on and off, it generates 553 microplastic par…

Tesla, Inc. is a publicly traded electric vehicle and clean energy company led by CEO Elon Musk. While the company has achieved significant market success and technological advances, it faces ongoing regulatory scrutiny regarding securities disclosures, workplace safety allegations, and autonomous driving claims.

Cointelegraph is a major legitimate cryptocurrency news outlet that has been a victim of two distinct infrastructure compromises. In January 2024, attackers breached its email service provider MailerLite and sent phishing emails to subscribers using Angel Drainer malware, resulting in estimated losses of $580,000 to over $700,000 across affected platforms. In June 2025, attackers separately compromised Cointelegraph's banner advertising system to serve Inferno Drainer-linked pop-ups promoting a fake CTG token airdrop to site visitors.

Circle Internet Group is the issuer of USDC, the second-largest USD-pegged stablecoin by market capitalization. Circle has faced sustained criticism from blockchain investigator ZachXBT and others for its policy of refusing to freeze USDC linked to hacks or scams without a formal court order or law enforcement mandate, which critics allege has allowed over $420 million in illicit funds to flow freely since 2022. The company went public on the NYSE in June 2025 under the ticker CRCL and received conditional OCC approval for a national trust bank charter in December 2025.

Coinbase (NASDAQ: COIN) is the largest publicly listed cryptocurrency exchange in the United States, founded in 2012 and regulated across multiple jurisdictions. Despite its regulated status, the platform has been the subject of significant documented concerns: a May 2025 insider-enabled data breach affecting approximately 70,000 users with estimated remediation costs of $180–400 million, ongoing documented losses exceeding $300 million per year from social engineering scams targeting Coinbase users (as reported by blockchain investigator ZachXBT), a $100 million AML compliance settlement with the NYDFS in 2023, and controversies surrounding its Base Layer-2 blockchain including a disputed token launch and a contentious departure from the Optimism OP Stack ecosystem.

CoinsPaid (operating legal entity Dream Finance OÜ, headquartered in Tallinn, Estonia) is a business-to-business crypto payment processing platform founded in 2014 by Max Krupyshev and Pavel Kashuba. The company suffered two confirmed external cyberattacks — a $37.3 million theft in July 2023 and a $7.5 million breach in January 2024 — both attributed to third-party attackers with the first definitively linked to North Korea's Lazarus Group by blockchain analysts and the FBI; client funds were reported unaffected in both incidents. The company is currently navigating significant regulatory uncertainty under the EU's MiCA framework after losing its legacy Estonian FIU licence and suspending operations through its Lithuanian entity, while its CASP application in Estonia remains pending as of mid-2026.

Porkbun LLC is a legitimate ICANN-accredited domain registrar founded circa 2014-2015, headquartered in Sherwood, Oregon, and managing over 3.45 million domains. While the company is not itself a scam operation, it has attracted scrutiny from the crypto security community — including on-chain investigator ZachXBT — for hosting phishing infrastructure linked to Angel Drainer and Inferno Drainer wallet-draining services, including fake Ledger sites. Third-party tracking platforms document hundreds of flagged phishing domains registered through Porkbun and allege that the company's abuse-response enforcement has been inadequate, with a majority of reported domains remaining active after formal abuse reports.

Hypurr NFTs are a 4,600-piece cat-themed NFT collection airdropped by the Hyper Foundation on September 28, 2025, to early Hyperliquid users who participated in the November 2024 Genesis Event. On the day of launch, blockchain investigator ZachXBT flagged the theft of eight Hypurr NFTs from compromised HyperEVM wallets, yielding approximately $400,000 in profit for the attacker. The collection itself is a legitimate product of the Hyper Foundation, but the incident exposed wallet security vulnerabilities in the HyperEVM ecosystem and coincided with a broader pattern of exploits across Hyperliquid-based protocols in late September 2025.

Ninamo is a purported crypto entity whose name was submitted for investigation on AVOID.NET. Exhaustive searches across regulatory databases, blockchain explorers, crypto news outlets, scam trackers, social media platforms, domain registries, and the Wayback Machine returned no verifiable information about any crypto project, exchange, token, or DeFi protocol operating under the name Ninamo. No wallet addresses, enforcement actions, community reports, or archived web presence could be located.

Cardano (ADA) holders face a persistent and multi-vector threat landscape that includes deepfake giveaway scams impersonating founder Charles Hoskinson, social media account hijackings used to promote fraudulent tokens, phishing campaigns distributing credential-stealing malware disguised as wallet software, and NFT-based wallet drainers. The Cardano Foundation's own X account was compromised in December 2024, resulting in the promotion of a fake token and false regulatory claims. State-sponsored actors including the North Korean Lazarus Group have also targeted ADA holders through the Atomic Wallet supply chain attack.

Bybit is a Dubai-headquartered cryptocurrency derivatives and spot exchange founded in 2018 by Ben Zhou, serving over 80 million registered users globally. On February 21, 2025, the exchange suffered the largest cryptocurrency theft in recorded history when North Korean state-sponsored hackers attributed to the Lazarus Group (TraderTraitor) stole approximately $1.46 billion in Ethereum via a supply chain compromise of Safe{Wallet}'s frontend infrastructure. Separately, Bybit accounts have been cited in the ICIJ's 2025 Coin Laundry investigation into crypto exchanges facilitating international criminal money flows.