Skip to main content
AVOID.NET

Penpie

avoid.net/penpiexyz→48/100·88% conf.
[AI-DRAFTED · AWAITING FACT-CHECK]

Last changed 2026-10-10 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 20 → 48. Problems weighed by who is responsible: incidents the subject suffered −20, concerns that are not fraud −6, problems around the subject, caused by others −2.6; legitimacy credit long-running +2; the penalty for incidents it suffered is capped at 20; fact-check adjustments (−8) now shown as page reliability, not in the score. Version history →

Why this score
Every page starts at65
Concerns that are not fraud-6
Incidents it suffered (e.g. hacks)-20
Problems around it, caused by others-2.6
Long-running+2
Sum38
  • The penalty for incidents it suffered is capped at 20 points.

Score: 48/100 (kept between 0 and 100)

How scoring works →
anchored·2T9nhX…Bnqj
Submit evidenceRecently updated. Know something it missed? Send it in.

Summary

Penpie is a yield optimizer and vote-escrowed liquidity layer built on top of Pendle Finance, developed by the Magpie XYZ team. On September 3, 2024, the protocol was exploited for approximately $27 million through a reentrancy vulnerability in its batch reward harvesting function, compounded by a permissionlessly registered fake Pendle market. The attacker laundered substantially all stolen funds through Tornado Cash within days, rejecting a negotiated bounty offer from the Penpie team.

Connected Entities

3 entities · 60 linked investigations
Organizations
□Pendle90□Penpie56
Tokens
♦Cointelegraph62
Relationships
  • Penpie→mentioned with→Pendle(80%)
  • Pendle→mentioned with→Penpie(80%)
  • Penpie→mentioned with→Cointelegraph(65%)
Also appears in
Evolved Apes·2Step App (FITFI)·50Crypto Dispensers / Virtual Assets LLC·26Hong Kong Insurance Agent Romance Scam — Fake Crypto App ($3.3M, July 2026)·0BTCPay Server — Lightning LND Macaroon Exploit (August 2026)·47Mining Automatic / Zan Shaikh·2MangoFarmSOL·2Base·81Blockstream Jade — Fake Firmware Phishing Campaign (August 2026)·0Wise Lending V2·52

Connected Through

3 shared actors · 93 investigations

Distinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.

Have evidence about Penpie?

Timeline(9 events)

2023

Zokyo completes security audit of PendleStaking contract. At this time, pool registration is owner-only, limiting the exploitability of the reentrancy path.

Zokyo Post-Mortem Analysis

May 2024

Penpie introduces permissionless pool registration, allowing any user to register a Pendle market with the protocol. AstraSec audits the new registration contracts in isolation; the PendleStakingBaseUpg contract is excluded from scope.

CoinTelegraph Crypto-Sec; Zokyo Post-Mortem

3 September 2024

Attacker funds exploit address with 10 ETH via Tornado Cash. Three exploit transactions execute between approximately 6:25 PM and 6:42 PM UTC. Approximately $27 million (11,113.6 ETH) is drained via reentrancy on batchHarvestMarketRewards using a fake Pendle market. Penpie and Pendle pause contracts within minutes. PNP token falls ~40%; PENDLE falls ~9%.

CoinDesk; Rekt.news; The Record

3 September 2024

Penpie team files police report at Kampong Java Neighbourhood Police Centre in Singapore. Team sends on-chain message to attacker offering negotiated bounty and promising no legal action if funds are returned.

The Record (Recorded Future News)

4 September 2024

Penpie files complaint with the FBI's Internet Crime Complaint Center (IC3). VPN IP address from attack is submitted to Singapore Technology Crime investigator.

The Record (Recorded Future News)

4 September 2024

Within 12 hours of the attack, the attacker launders approximately $7 million (5,600 ETH) through Tornado Cash, representing roughly 26% of stolen funds.

CoinTelegraph; DeFi Planet

6 September 2024

Attacker transfers 7,262 ETH (~$17.4 million) to an intermediary address and continues routing funds through Tornado Cash.

Bitcoinist; DailyCoin

10 September 2024

Attacker completes laundering of substantially all stolen funds — approximately 11,261 ETH — through Tornado Cash. Bounty offer is effectively rejected.

DailyCoin

7 October 2024

Magpie XYZ publishes PIP #15, the formal recovery plan for affected users, introducing Safu Recovery Tokens (SRT) and the Safupie insurance sub-DAO.

Magpie Governance Forum; The Defiant
Provenance & Audit Trail
Recorded on Solana ✓Verify on-chain20 Wayback Archives

Decision Log

  • #4rescore+28Recorded on Solana ✓10/10/2026, 6:41:31 PM
    slot 455360522 · hash BjP6n1bv3ff9FADnNrd6EV3mB4BLE9Tnf6QVqQuAkMnv
  • #3review revise-8Recorded on Solana ✓6/4/2026, 5:44:52 PM
    slot 424291272 · hash D5sErTXPrZkVQkTCviPWgQ6twuSDbD3RBcW8qi5ciK8T
  • #2reviewRecorded on Solana ✓6/4/2026, 5:44:52 PM
    slot 424291265 · hash CihrFfsDefEgoqzTrwDtbq22Bzv54gpcbu3r6F5WTwqJ
  • #1publishRecorded on Solana ✓6/1/2026, 5:48:38 PM
    slot 423640351 · hash DgZLnnZqBxVugfqXUfwBvq7gMfBvYVRZfKvYaBYP8um

This investigation is cryptographically anchored to the Solana blockchain (4 decisions). 20 of 21 cited source URLs have an Internet Archive snapshot.

full audit log →version history →

model: claude-sonnet-4-6

generated: 6/1/2026, 5:48:34 PM

last updated: 10/10/2026, 6:41:31 PM

4 views

avoid.net — verified advice for a post-truth world