Skip to main content
AVOID.NET
Sign in

Orange Finance

avoid.net/orange-finance→28/100·82% conf.
[AI-DRAFTED · AWAITING VERIFICATION][src:defillama]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·5rrj3n…qaZ2

Summary

Orange Finance is an Arbitrum-based automated liquidity management protocol designed for LPDfi (liquidity provider DeFi), enabling users to earn swap fees and options premiums via concentrated AMM vaults. On January 8, 2025, the protocol suffered a critical security breach in which an attacker compromised the admin private key, exploited a misconfigured multi-signature wallet that required only a single signature to execute, and drained approximately $843,556 across all active vaults. The protocol was flagged by ZachXBT and has not resumed normal operations since the incident.

Connected Entities

7 entities · 60 linked investigations
Organizations
□Safe{Wallet}68□Ethereum64□Arbitrum□ZachXBT
Protocols
⌂Orange Finance⌂SushiSwap⌂Uniswap
Relationships
  • Orange Finance→mentioned with→ZachXBT(70%)
  • Orange Finance→mentioned with→Uniswap(70%)
  • Orange Finance→mentioned with→Arbitrum(80%)
  • Orange Finance→mentioned with→SushiSwap(60%)
  • ZachXBT→mentioned with→Ethereum(70%)
  • Safe{Wallet}→mentioned with→Ethereum(80%)
  • Safe{Wallet}→mentioned with→Arbitrum(60%)
  • Orange Finance→mentioned with→Safe{Wallet}(65%)
  • SushiSwap→mentioned with→Arbitrum(65%)
  • SushiSwap→mentioned with→Ethereum(60%)
  • + 8 more
Also appears in
Aperture LM·28Trenton Richard Johnston·2Crossmint·70Hedera·55Bedrock Protocol·41BNB Chain Bridge·16TraderTraitor / UNC4899·0Nobitex June 2025 Hack (Predatory Sparrow)·10Robinhood Crypto·54KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus·0+ 50 more

Connected Through

6 shared actors · 625 investigations

Distinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.

Have evidence about Orange Finance?

Timeline(12 events)

2023

Orange Finance publishes 2023 roadmap on Mirror, outlining plans for Uniswap v3 automated liquidity management vaults on Arbitrum.

June 2023

Orange Finance Alpha Orange Vault launches on Arbitrum, targeting the USDC.e/ETH pool with delta-hedging via Aave.

April 2024

Orange Finance submits LTIPP grant application to the Arbitrum Foundation requesting 150,000 ARB, reporting $1.32M TVL and 170 depositors.

June 2024

Orange Finance and Stryke Protocol announce vault integration partnership, enabling liquidity management for Stryke's options AMM.

December 2024

Orange Finance expands to Berachain, launching Orange Vaults with Stryke. Protocol TVL reaches approximately $1.5M on Arbitrum.

8 January 2025

Attacker compromises Orange Finance admin private key, exploits single-signature multi-sig misconfiguration, upgrades all smart contracts, and drains approximately $843,556 across all active vaults on Arbitrum. Stolen assets converted to ETH and bridged via Stargate.

8 January 2025

Orange Finance posts warning on X advising users to revoke all contract approvals. Team states they are 'not sure what happened' and that contracts are no longer under their control.

8 January 2025

Orange Finance sends on-chain message to attacker's address offering white-hat arrangement with 24-hour deadline and guarantee of no law enforcement involvement.

8 January 2025

Stryke Protocol pauses associated vaults and disables deposits/withdrawals as a precautionary measure following the exploit.

9 January 2025

Orange Finance publishes follow-up incident report on Mirror detailing loss breakdown by wallet, attack steps, and notes engagement of Seal 911 for investigation.

9 January 2025

A separate Arbitrum-based protocol targeted by a copycat attack similar to Orange Finance's exploit; white-hat hackers successfully prevent fund loss.

9 January 2025

CyversAlerts and multiple on-chain security monitors publish alerts cataloguing the Orange Finance exploit. Incident flagged by ZachXBT's investigations channel.

Provenance & Audit Trail
Anchored on SolanaVerify on-chain12 Wayback Archivessrc:defillama

Decision Log

This investigation is cryptographically anchored to the Solana blockchain (1 event). 12 of 19 cited source URLs have an Internet Archive snapshot.

full audit log →version history →

model: claude-sonnet-4-6

generated: 5/4/2026, 2:54:26 AM

last updated: 9/16/2026, 12:39:23 PM

5 views

avoid.net — verified advice for a post-truth world