← Odin.funreviewed 2026-09-06 · 50 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Odin.fun against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
unverifiable
6 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #28[unverifiable][awaiting moderator]in section: Security Practices and Audit Failures
“Industry analysts have noted that the platform lacked external price oracle validation in its AMM — a basic DeFi security primitive — and had no real-time transaction monitoring or deposit slippage limits to prevent manipulation.”
reviewerThe platform lacked external price oracle validation and had no real-time transaction monitoring or deposit slippage limitsThe oracle-absence portion is well supported; the specific claim about absent real-time monitoring/slippage limits could not be independently confirmed in any source consulted and appears to be the investigator's inference rather than a cited finding. - #34[unverifiable][awaiting moderator]in section: User Compensation and Treasury Shortfall
“No third-party insurance or formal compensation fund has been publicly announced.”
reviewerNo third-party insurance or formal compensation fund has been publicly announcedAn absence claim; consistent with everything found in research, but a negative cannot be conclusively confirmed via search. - #37[unverifiable][awaiting moderator]in section: Infrastructure and Custodial Risk
“Community members raised questions about the transparency of the platform's TVL accounting following the August 2025 hack, with some alleging the stated deposits were overstated; the team did not address these allegations publicly.”
reviewerCommunity members alleged the platform's stated deposits/TVL were overstated following the August 2025 hack, and the team did not address these allegations publiclyThe cited source does not support this specific sentence, and a targeted search found no independent reporting of TVL-overstatement allegations. This is not necessarily false, but it is unsupported by any source found or cited. - #39[unverifiable][awaiting moderator]in section: Team Background and Transparency
“no independent audit of the platform's tokenomics or treasury management has been published”
reviewerNo independent audit of the platform's tokenomics or treasury management has been publishedAbsence claim consistent with research findings but not conclusively provable via search. - #40[unverifiable][awaiting moderator]in section: Team Background and Transparency
“The platform has not published a formal security policy, bug bounty program, or insurance fund details.”
reviewerThe platform has not published a formal security policy, bug bounty program, or insurance fund detailsAbsence claim; no bug bounty program or security policy for Odin.fun was found in searches, consistent with the page, but this cannot be fully confirmed as a negative. - #46[unverifiable][awaiting moderator]in the timeline
“AstroX releases a patch for the SIWB vulnerability; Odin.fun deploys the patch and resumes operations.”
reviewerTimeline: On 2025-04-15, AstroX releases a patch and Odin.fun deploys it and resumes operationsThe general sequence of events (patch released, deployed, operations resumed) is plausible and consistent with reporting, but the specific April 15, 2025 date could not be independently verified in any source consulted, including the one cited.
link rot
1 claimA cited source no longer resolves or no longer says what the page attributes to it.
- #50[link rot][awaiting moderator]in the cited sources
“https://web.archive.org/web/20260725134700/https://coincentral.com/okx-announces-historic-65-million-okb-token-burn-price-jumps-170/”
reviewersources_used archive snapshot for the CoinCentral Odin.fun article actually points to a live/valid archive of that articleThe archive_url stored for this source is for an entirely unrelated CoinCentral article ('okx-announces-historic-65-million-okb-token-burn-price-jumps-170'), not an archived snapshot of the Odin.fun exploit article. The live URL itself works, but the archive record is mismatched and should be removed or replaced with a correct snapshot of the actual cited URL.
partially supported
4 claimsThe cited evidence supports part of the claim but not all of it.
- #7[partially supported][awaiting moderator]in section: Platform Overview
“Launched in January 2025, it is modeled on Solana's Pump.fun, allowing users to create and trade Runes-based meme tokens on a bonding curve that migrates to an internal automated market maker (AMM) once a one-Bitcoin market cap threshold is reached.”
reviewerOdin.fun launched in January 2025'January 2025' is imprecise: reporting indicates a limited beta began Jan 30, 2025, with the full public launch on Feb 3, 2025. Not a large error but the exact date is muddled between beta and full launch. - #25[partially supported][awaiting moderator]in section: April 2025 Authentication Vulnerability — Sign-In With Bitcoin Exploit
“The exploit also allegedly compromised co-founder Bob Bodily's own account.”
reviewerThe exploit also allegedly compromised co-founder Bob Bodily's own accountThe page's phrasing ('also allegedly compromised') frames Bodily's account breach as a secondary, unconfirmed detail appended after the main narrative of general 'user funds' theft. Independent reporting indicates the opposite structure: the confirmed $178K loss was specifically Bodily's own account/holdings being liquidated, and this was reported directly (not merely alleged) by Bodily and corroborated by on-chain analysis (PeckShield). - #43[partially supported][awaiting moderator]in the timeline
“2025”
reviewerTimeline: Odin.fun launches in 2025 as a Runes/BTC memecoin launchpad on Valhalla, founded by the Bioniq teamThe event text is accurate but the date field is an imprecise placeholder ('2025' / date_original '2025-01-01'); reporting points to Jan 30, 2025 (beta) or Feb 3, 2025 (full public launch). - #45[partially supported][awaiting moderator]in the timeline
“Odin.fun pauses all trading and withdrawals after attackers exploit a critical authentication vulnerability in the Sign-In With Bitcoin (SIWB) canister, allowing user impersonation. Estimated $178,000 in user funds stolen. Co-founder Bob Bodily's account is also allegedly compromised.”
reviewerTimeline: On 2025-04-14, Odin.fun pauses trading after the SIWB exploit; ~$178,000 stolen; Bodily's account allegedly compromisedSame underlying framing issue as the sections[2] finding: the timeline separates 'user funds stolen' from 'Bodily's account also allegedly compromised' when reporting indicates these are the same event and it was reported directly, not merely alleged.
confirmed
39 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in the summary
“Odin.fun is a Bitcoin-native memecoin launchpad built on the Runes protocol, using the Internet Computer (ICP) blockchain as a settlement layer for fast, low-cost trading.”
reviewerOdin.fun is a Bitcoin-native memecoin launchpad built on the Runes protocol, using ICP as a settlement layer for fast, low-cost tradingCore description matches independent reporting. - #2[confirmed][no action needed]in the summary
“attracted backing from the Taproot Wizards Ordinals project”
reviewerOdin.fun attracted backing from the Taproot Wizards Ordinals projectConfirmed by The Block. - #3[confirmed][no action needed]in the summary
“a $178,000 authentication vulnerability in April 2025”
reviewerA $178,000 authentication vulnerability occurred in April 2025Figure is a third-party estimate, not from DFINITY's own advisory, but is corroborated across multiple outlets. - #4[confirmed][no action needed]in the summary
“a $7 million liquidity manipulation attack in August 2025”
reviewerA $7 million liquidity manipulation attack occurred in August 2025Widely corroborated across outlets (Halborn, The Block, Decrypt, QuillAudits, OKX). - #5[confirmed][no action needed]in the summary
“with the latter draining user funds that the team has acknowledged it cannot fully repay from its own treasury”
reviewerThe team has acknowledged it cannot fully repay the August 2025 losses from its own treasuryConfirmed. - #6[confirmed][no action needed]in section: Platform Overview
“Odin.fun is a Runes marketplace and memecoin launchpad founded by Bob Bodily and the team behind the Bitcoin Ordinals marketplace Bioniq.”
reviewerOdin.fun was founded by Bob Bodily and the team behind BioniqConfirmed. - #8[confirmed][no action needed]in section: Platform Overview
“it is modeled on Solana's Pump.fun, allowing users to create and trade Runes-based meme tokens on a bonding curve that migrates to an internal automated market maker (AMM) once a one-Bitcoin market cap threshold is reached”
reviewerOdin.fun uses a bonding curve migrating to an AMM at a one-Bitcoin market cap threshold, modeled on Pump.funConfirmed verbatim by Decrypt. - #9[confirmed][no action needed]in section: Platform Overview
“The platform uses a custom application chain called Valhalla, built on the Dfinity Internet Computer (ICP) network, to achieve approximately two-second transaction finality and zero gas costs — a significant improvement over Bitcoin's native block times.”
reviewerThe Valhalla chain on ICP achieves ~2-second finality and zero gas costsConfirmed across two independent descriptions of the architecture. - #10[confirmed][no action needed]in section: Platform Overview
“By March 2025 the platform had recorded $30 million in trading volumes and roughly 20,000 users across nearly 4,000 created tokens.”
reviewerBy March 2025 the platform had $30M in trading volume, ~20,000 users, and ~4,000 tokens createdMatches cited source verbatim. - #11[confirmed][no action needed]in section: Platform Overview
“The platform received a strategic investment from Taproot Wizards in March 2025; deal terms were not publicly disclosed.”
reviewerTaproot Wizards led a strategic investment in March 2025 with undisclosed deal termsConfirmed. - #12[confirmed][no action needed]in section: August 2025 AMM Exploit — $7 Million Lost
“On August 12, 2025, Odin.fun suffered a critical liquidity manipulation exploit resulting in the theft of 58.2 BTC, valued at approximately $7 million.”
reviewerOn August 12, 2025, Odin.fun suffered a 58.2 BTC (~$7M) liquidity manipulation exploitConfirmed across all outlets consulted. - #13[confirmed][no action needed]in section: August 2025 AMM Exploit — $7 Million Lost
“Attackers exploited a fundamental design flaw in the platform's AMM, which used its own internal token-price logic rather than any external price oracle. By depositing worthless Runes tokens — specifically SATOSHI and ODINPEPE — alongside BTC, and then conducting self-trades to artificially inflate the perceived value of those tokens within the AMM, attackers were able to withdraw a disproportionately large amount of BTC.”
reviewerAttackers exploited an AMM using internal token-price logic with no external oracle, depositing worthless SATOSHI/ODINPEPE tokens and self-trading to inflate valueConfirmed by multiple independent security write-ups. - #14[confirmed][no action needed]in section: August 2025 AMM Exploit — $7 Million Lost
“The platform's total BTC deposits fell from 291 BTC to approximately 232.8 BTC in under two hours.”
reviewerTotal BTC deposits fell from 291 BTC to approximately 232.8 BTC in under two hoursConfirmed by on-chain-derived reporting. - #15[confirmed][no action needed]in section: August 2025 AMM Exploit — $7 Million Lost
“Security firm Halborn noted that the vulnerable AMM code was introduced in a recent protocol update and showed 'no sign that the code was audited before release,' describing the flaws as 'trivial, well-known vulnerabilities.'”
reviewerHalborn said the vulnerable AMM code showed 'no sign that the code was audited before release' and called the flaws 'trivial, well-known vulnerabilities'Quote matches the source language closely; direct live fetch was rate-limited but the text is corroborated via indexed excerpt of the same URL. - #16[confirmed][no action needed]in section: August 2025 AMM Exploit — $7 Million Lost
“Co-founder Bob Bodily publicly acknowledged that the platform's treasury was insufficient to cover the full losses.”
reviewerBob Bodily publicly acknowledged the platform's treasury was insufficient to cover the full lossesConfirmed. - #17[confirmed][no action needed]in section: August 2025 AMM Exploit — $7 Million Lost
“The incident involved multiple threat actors, reportedly with ties to Chinese groups operating in coordination.”
reviewerThe incident involved multiple threat actors reportedly tied to Chinese groupsAttribution is the platform's own claim, appropriately hedged with 'reportedly' in the page text. - #18[confirmed][no action needed]in section: August 2025 AMM Exploit — $7 Million Lost
“Odin.fun halted all trading and withdrawals and stated it was working with U.S. law enforcement, Chinese regulators, and major exchanges OKX and Binance to trace stolen funds.”
reviewerOdin.fun halted trading/withdrawals and worked with U.S. law enforcement, Chinese regulators, and OKX/Binance to trace fundsConfirmed. - #19[confirmed][no action needed]in section: August 2025 AMM Exploit — $7 Million Lost
“As of late August 2025, the platform had not committed to a timeline for resuming trading.”
reviewerAs of late August 2025, the platform had not committed to a timeline for resuming tradingConfirmed. - #20[confirmed][no action needed]in section: April 2025 Authentication Vulnerability — Sign-In With Bitcoin Exploit
“On April 14, 2025, Odin.fun paused trading and withdrawals after an attacker exploited a critical vulnerability in the Sign-In With Bitcoin (SIWB) authentication canister, developed by AstroX and deployed by Odin.fun on the Internet Computer.”
reviewerOn April 14, 2025, an attacker exploited the SIWB canister (developed by AstroX, deployed by Odin.fun on ICP), pausing trading and withdrawalsConfirmed. - #21[confirmed][no action needed]in section: April 2025 Authentication Vulnerability — Sign-In With Bitcoin Exploit
“The flaw allowed attackers to impersonate users by providing a signed message with a victim's Bitcoin address but signed using an attacker-generated key, because the canister failed to validate that the public key used to verify the signature was actually associated with the stated wallet address.”
reviewerThe flaw allowed impersonation because the canister failed to validate that the verifying public key was associated with the stated wallet addressTechnical description matches source. - #22[confirmed][no action needed]in section: April 2025 Authentication Vulnerability — Sign-In With Bitcoin Exploit
“DFINITY's security team investigated and developed a proof-of-concept demonstrating the vulnerability.”
reviewerDFINITY's security team investigated and developed a proof-of-concept demonstrating the vulnerabilityConfirmed verbatim. - #23[confirmed][no action needed]in section: April 2025 Authentication Vulnerability — Sign-In With Bitcoin Exploit
“User funds were confirmed stolen, though the specific amount was not publicly disclosed in DFINITY's security advisory; third-party reporting estimated losses of approximately $178,000.”
reviewerUser funds were confirmed stolen though the amount wasn't disclosed in DFINITY's advisory; third-party reporting put losses at ~$178,000Confirmed, with the caveat noted below that the $178K figure is specifically tied to Bodily's own account, not a broader pool of 'user funds.' - #24[confirmed][no action needed]in section: April 2025 Authentication Vulnerability — Sign-In With Bitcoin Exploit
“The AstroX team quickly developed and released a patch, which Odin.fun deployed.”
reviewerAstroX quickly developed and released a patch, which Odin.fun deployedConfirmed. - #26[confirmed][no action needed]in section: April 2025 Authentication Vulnerability — Sign-In With Bitcoin Exploit
“The incident was notable for originating in a third-party authentication library rather than Odin.fun's own code.”
reviewerThe April incident was notable for originating in a third-party authentication library rather than Odin.fun's own codeConfirmed. - #27[confirmed][no action needed]in section: Security Practices and Audit Failures
“Independent security analysis of the August 2025 exploit found that the vulnerable AMM code had not been audited prior to deployment.”
reviewerThe vulnerable AMM code had not been audited prior to deploymentConfirmed. - #29[confirmed][no action needed]in section: Security Practices and Audit Failures
“The April 2025 SIWB exploit also arose from a third-party library that had not been independently reviewed by the Odin.fun team before deployment.”
reviewerThe SIWB exploit arose from a third-party library not independently reviewed by the Odin.fun team before deploymentConfirmed. - #30[confirmed][no action needed]in section: Security Practices and Audit Failures
“Following the August 2025 hack, the team engaged a third-party security firm for a full code audit. As of late August 2025, the team reported being 'really close to finishing audit fixes' before resubmission.”
reviewerFollowing the August 2025 hack, the team engaged a third-party security firm and reported being 'really close to finishing audit fixes'Confirmed. - #31[confirmed][no action needed]in section: User Compensation and Treasury Shortfall
“Bodily acknowledged the situation and called on the attackers to return funds, warning that they had 'a short window to return the funds before it is too late.'”
reviewerBodily called on attackers to return funds, warning they had 'a short window to return the funds before it is too late'Confirmed. - #32[confirmed][no action needed]in section: User Compensation and Treasury Shortfall
“The team stated it was working on a 'concrete plan' to compensate affected users, but as of late August 2025 had not committed to a specific timeline or compensation structure.”
reviewerThe team stated it was working on a 'concrete plan' but had not committed to a specific timeline or compensation structure as of late August 2025Confirmed. - #33[confirmed][no action needed]in section: User Compensation and Treasury Shortfall
“The team noted it had succeeded in having some funds frozen at centralized exchanges.”
reviewerThe team noted it had succeeded in having some funds frozen at centralized exchangesConfirmed, though this fact is not supported by the CoinCentral source also cited in this section — it comes specifically from the Cryptopolitan Aug 19 article. - #35[confirmed][no action needed]in section: Infrastructure and Custodial Risk
“User funds are held in ckBTC — a wrapped, ICRC-standard Bitcoin twin on ICP — rather than in direct self-custody on the Bitcoin base layer.”
reviewerUser funds are held in ckBTC, an ICRC-standard wrapped Bitcoin, rather than direct self-custody on Bitcoin's base layerConfirmed via general architecture description consistent with ICP/ckBTC documentation and forum discussion. - #36[confirmed][no action needed]in section: Infrastructure and Custodial Risk
“The April 2025 SIWB exploit directly abused this session-key delegation model.”
reviewerThe April 2025 SIWB exploit directly abused the session-key delegation modelConfirmed. - #38[confirmed][no action needed]in section: Team Background and Transparency
“Odin.fun is led by Bob Bodily, who also co-founded Bioniq, a Bitcoin Ordinals marketplace, and has prior involvement with Toniq Labs, the studio behind the Entrepot NFT marketplace and Stoic Wallet on the Internet Computer. Bodily holds a doctoral degree and maintains a public LinkedIn and professional presence.”
reviewerBob Bodily co-founded Bioniq and previously worked at Toniq Labs (Entrepot, Stoic Wallet); he holds a doctoral degreeConfirmed in full. - #41[confirmed][no action needed]in section: Regulatory and Legal Considerations
“No regulatory actions by the SEC, CFTC, DOJ, or equivalent bodies against Odin.fun or its operators have been identified in publicly available records as of the date of this investigation.”
reviewerNo regulatory actions by the SEC, CFTC, DOJ, or equivalent bodies against Odin.fun have been identifiedNo contradicting evidence found; consistent with the state of public records at time of review. - #42[confirmed][no action needed]in section: Regulatory and Legal Considerations
“The use of the ICP blockchain and ckBTC introduces cross-jurisdictional considerations given Dfinity's Swiss-based foundation.”
reviewerThe use of ICP/ckBTC introduces cross-jurisdictional considerations given Dfinity's Swiss-based foundationThe DFINITY Foundation is publicly documented as being based in Zurich, Switzerland; this is uncontroversial background fact, not separately cited on the page. - #44[confirmed][no action needed]in the timeline
“Taproot Wizards leads a strategic investment round in Odin.fun; financial terms are not disclosed. Platform reports $30M in trading volume and 20,000 users.”
reviewerTimeline: On 2025-03-14, Taproot Wizards leads a strategic investment round; platform reports $30M volume and 20,000 usersDate matches source publication date. - #47[confirmed][no action needed]in the timeline
“Odin.fun suffers a $7 million liquidity manipulation exploit. Attackers deposit worthless Runes tokens (SATOSHI, ODINPEPE) alongside BTC into the AMM, conduct self-trades to inflate token prices, then withdraw disproportionately large BTC amounts. 58.2 BTC drained in under two hours. Trading and withdrawals halted immediately.”
reviewerTimeline: On 2025-08-12, Odin.fun suffers the $7M liquidity exploit as describedConfirmed. - #48[confirmed][no action needed]in the timeline
“Bob Bodily publicly acknowledges the treasury is insufficient to cover losses and issues an on-chain message calling on attackers to return funds. Platform engages U.S. law enforcement and Chinese regulators via OKX and Binance.”
reviewerTimeline: On 2025-08-13, Bodily acknowledges insufficient treasury and issues on-chain message; platform engages US law enforcement and Chinese regulators via OKX/BinanceConfirmed, including exact publication date match. - #49[confirmed][no action needed]in the timeline
“Bodily posts update stating 'really good' progress: some stolen funds frozen at CEXs, external audit ongoing, no trading resumption date committed.”
reviewerTimeline: On 2025-08-19, Bodily posts an update citing 'really good' progress: funds frozen at CEXs, external audit ongoing, no trading resumption dateConfirmed in full, matching the cited article's content and date.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.