Fact-check findings

The reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.

1. #7[disputed][awaiting moderator]in section: Broader Starknet Ecosystem Security Context

   “The Starknet ecosystem has seen parallel smart contract incidents, including an exploit of the Ekubo swap router in which attackers drained $1.4 million, indicating broader smart contract risk across Starknet-native DeFi protocols.”

   reviewerThe Ekubo swap router exploit drained $1.4M and is a parallel Starknet ecosystem incident.The figure is correct, but presenting it as a Starknet-native incident is contradicted by the source. It is an approval-based EVM router exploit.
   Proposed correction (not yet applied)

   The Starknet ecosystem has seen parallel smart contract incidents, including a May 2026 exploit of Ekubo's EVM swap router contracts in which attackers drained about $1.4 million (Ekubo stated its Starknet deployment was not affected), indicating broader smart contract risk across DeFi protocols.
   citedwww.theblock.co/post/400189/attackers-dr…al-based-exploit

No source the reviewer could reach confirms or contradicts the claim.

1. #3[unverifiable][awaiting moderator]in section: June 2026 Exploit: EVIL Token Attack

   “On June 19, 2026, at approximately 7:15 AM UTC, the mySwap CL protocol was exploited via a smart contract vulnerability in its shared-vault accounting layer.”

   reviewerExploit occurred on June 19, 2026 at about 7:15 AM UTC.The date is consistent with the articles' dates. The 7:15 AM UTC time is in neither fetched cited source. The CryptoTimes article returned 403.
   citedcryptoadventure.com/myswap-loses-305k-on…pool-accounting/
2. #8[unverifiable][awaiting moderator]in section: Broader Starknet Ecosystem Security Context

   “The attack vector, a permissionless malicious-token interaction manipulating shared-vault accounting, represents a class of vulnerability applicable to any CL AMM that does not enforce strict token allowlisting or balance-validation invariants.”

   reviewerThe attack vector class applies to any CL AMM without allowlisting, and Railgun use is common in DeFi incidents.This is analytical inference, not sourced reporting. The page also draws broader inferences, such as no security review after dormancy, without a source.
   citedcryptoadventure.com/myswap-loses-305k-on…pool-accounting/
3. #9[unverifiable][awaiting moderator]in section: Protocol Background

   “According to DefiLlama, mySwap CL reached a peak total value locked of approximately $9.7 million in April 2024”

   reviewermySwap CL peaked at about $9.7M TVL in April 2024 and fell over 99.9% to about $5,000, with post-exploit TVL about $5,215.DefiLlama is a JavaScript chart page and I did not fetch it. The figures are plausible but unchecked. The page says TVL fell to about $5,000 well before the exploit, yet the exploit drained about $305K from residual positions. That is inconsistent and unexplained: either the near-zero TVL was understated or the vault held assets DefiLlama did not count.
   citeddefillama.com/protocol/myswap-cl
4. #10[unverifiable][awaiting moderator]in the timeline

   “mySwap CL TVL falls to approximately $5,000, a decline of over 99.9% from its April 2024 peak; protocol effectively dormant with no new deposits accepted (date per one page; another gives January 2025).”

   reviewerThe page carries two timeline entries for the same TVL decline, with different dates (2025-01 and 2025-06).DefiLlama was not read, so I could not resolve the date. Phemex says only that the product was inactive for over six months before the June 2026 exploit, so the 'dormant since early 2025' framing is not supported. The duplicated entries are an editorial issue.
   citeddefillama.com/protocol/myswap-cl

The cited evidence supports part of the claim but not all of it.

1. #4[partially supported][awaiting moderator]in section: June 2026 Exploit: EVIL Token Attack

   “The attacker deployed a malicious ERC-20 token named EVIL and used it to manipulate how the CL pool system recognized balances and released assets from the shared vault.”

   reviewerAttacker deployed a malicious token EVIL to distort CL pool accounting and shared-vault logic.The core mechanism is supported. 'ERC-20' is the page's own wording, since Starknet tokens are not ERC-20 contracts in the Ethereum sense. The page's detail that no key compromise, admin access or oracle manipulation was involved is not stated in the sources I read.
   citedcryptoadventure.com/myswap-loses-305k-on…pool-accounting/
2. #5[partially supported][awaiting moderator]in section: Post-Exploit Fund Movement and Obfuscation

   “Following the drain, the attacker bridged the stolen funds cross-chain off Starknet and routed them through Railgun, a zero-knowledge privacy protocol designed to obscure transaction flows on EVM-compatible chains.”

   reviewerAttacker bridged funds cross-chain and routed them through Railgun.Only Phemex reports this, and it hedges with 'reportedly'. The page states it as fact. The CryptoAdventure citation does not support it.
   citedphemex.com/news/article/starknets-myswap…00-drained-90069

The cited evidence supports the claim as written.

1. #1[confirmed][no action needed]in section: Financial Impact and Stolen Assets

   “The stolen assets comprised 137.96 ETH, 45,000 USDC, 19,900 USDT and 230,000 STRK tokens.”

   reviewerThe stolen assets comprised 137.96 ETH, 45,000 USDC, 19,900 USDT and 230,000 STRK, about $305,000.Amounts match CryptoAdventure and the F12 figures surfaced in search.
   citedcryptoadventure.com/myswap-loses-305k-on…pool-accounting/
2. #2[confirmed][no action needed]in section: Protocol Background

   “The protocol closed its interface to new liquidity deposits and was functionally dormant for more than six months prior to the exploit, while residual LP holdings remained distributed across more than 100,000 positions in the shared vault.”

   reviewerMore than 100,000 LP positions were drained and the protocol had been closed to new deposits for over six months.Supported by Phemex. CryptoAdventure did not mention these figures. 'Functionally dormant' is a mild extension of 'no new liquidity'.
   citedphemex.com/news/article/starknets-myswap…00-drained-90069
3. #6[confirmed][no action needed]in section: Official Response and Transparency

   “As of June 20, 2026, mySwap had confirmed the incident and stated it was assessing the full impact of the exploit.”

   reviewermySwap confirmed the incident on June 20 and said it was assessing the impact; no post-mortem or compensation reported.Supported. My searches found no later post-mortem or compensation plan, but that does not rule out one on mySwap's own channels.
   citedphemex.com/news/article/starknets-myswap…00-drained-90069