← Pike Financereviewed 2026-09-07 · 29 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Pike Finance against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
1 claimThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #5[disputed][awaiting moderator]in the timeline
“First exploit: attacker manipulates CCTP receiver address and amount, draining 299,127 USDC (~$299K) primarily from Arbitrum.”
reviewerThe first exploit drained 299,127 USDC (~$299K) primarily from Arbitrum.Pike's own contemporaneous announcement (a more authoritative primary source than the cited CertiK secondary analysis) describes the exploit as draining USDC across three chains, not primarily Arbitrum. The two sources are in tension; given the official statement's primacy, the page's single-chain framing is disputed.Proposed correction (not yet applied)First exploit: attacker manipulates CCTP receiver address and amount, draining 299,127 USDC (~$299K) across Ethereum, Arbitrum, and Optimism.
unverifiable
4 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #13[unverifiable][awaiting moderator]in section: Why the Second Attack Succeeded After the First
“Security analysts at Halborn and CertiK noted this type of issue is detectable through comprehensive storage-layout testing and proxy upgrade simulation prior to deployment — steps the Pike team did not take during the emergency response window.”
reviewerSecurity analysts at Halborn and CertiK specifically noted this type of issue is detectable through storage-layout testing and proxy upgrade simulation, and that Pike did not take these steps.The underlying technical explanation is well supported, but this sentence attributes a specific remediation recommendation and omission-of-testing judgment directly to named analysts that could not be located in the fetched source content; it reads as the page's own inference rather than a documented analyst statement. - #19[unverifiable][awaiting moderator]in section: Protocol Background and Backers
“The team has not publicly disclosed the names of founders or core contributors; the protocol operates under the PikeDAO governance brand.”
reviewerThe team has not publicly disclosed the names of founders or core contributors; the protocol operates under the PikeDAO governance brand.No cited source directly supports this claim; could not find any named founder in public reporting, consistent with the claim, but absence of evidence is not confirmation. - #26[unverifiable][awaiting moderator]in the timeline
“Pike Finance publishes community update, indicating relaunch on Base network and introduction of $P token with buyback program.”
reviewerPike Finance published a community update on October 21, 2024 indicating relaunch on Base and introduction of the $P token with a buyback program.Could not independently verify this specific community post's date or content due to access restrictions in this review environment; the broader relaunch-on-Base and $P-token facts are independently confirmed elsewhere. - #27[unverifiable][awaiting moderator]in the timeline
“Pike Finance announces quarterly town hall covering financial updates and P Buyback Program, signaling continued active development.”
reviewerPike Finance announced a quarterly town hall on December 9, 2024 covering financial updates and the P Buyback Program.Same access limitation as timeline[11]; unable to independently confirm this specific update.
stale
1 claimThe claim was accurate when written but events since have overtaken it.
- #21[stale][awaiting moderator]in section: Relaunch and Current Status
“The protocol's website remains active as of mid-2025, advertising borrowing, lending, and trading of blue-chip assets.”
reviewerThe protocol's website remains active as of mid-2025, advertising borrowing, lending, and trading of blue-chip assets.The 'mid-2025' currency claim is now well over a year stale relative to this review date, and more importantly omits that the token/protocol shows strong signs of abandonment (near-zero trading volume, 99%+ price collapse) that a reader assessing current risk would need to know.Proposed correction (not yet applied)The protocol's website remains active as of September 2026, though the $P token's trading volume has collapsed to negligible levels (around $20 in 24-hour volume, per CoinGecko) and its price is down more than 99% from its December 2024 all-time high, indicating the relaunch has not sustained meaningful market activity.citedpike.finance/
partially supported
5 claimsThe cited evidence supports part of the claim but not all of it.
- #10[partially supported][awaiting moderator]in section: CCTP Integration Vulnerability and Known Audit Finding
“Pike Finance integrated Circle's Cross-Chain Transfer Protocol (CCTP) to enable native USDC transfers across chains, activating this functionality on April 24, 2024 — just two days before the first exploit.”
reviewerPike activated CCTP-based USDC transfers on April 24, 2024, two days before the first exploit.The specific April 24 date appears accurate per secondary references to Pike's own post-mortem, but none of the three sources actually cited on the page for this claim mention that date when fetched directly. - #14[partially supported][awaiting moderator]in section: Protocol Response and User Reimbursement
“Following the second exploit, Pike Finance paused the protocol and offered a 20% bounty for return of funds. No funds were returned. The team announced a plan to make all affected users whole: Pike used 4% of the total supply of its native $P token (drawn from the Community Treasury allocation) as collateral to borrow approximately $2M in stablecoins from the team treasury, which were used to purchase the relevant assets (ETH, ARB, OP) on the open market and reimburse users at their pre-exploit balances.”
reviewerPike used 4% of $P token supply as collateral to borrow ~$2M in stablecoins to reimburse users after offering an unfulfilled 20% bounty.The specific 4%-of-supply and ~$2M figures were independently corroborated through secondary summaries that appear to trace back to Pike's own mirror.xyz post-mortem, but the two sources actually cited on the page do not contain this level of detail (one lacks it, the other was inaccessible for direct verification). - #15[partially supported][awaiting moderator]in section: Protocol Background and Backers
“Pike Finance was founded in 2022 and describes itself as a natively cross-chain lending market enabling borrowing and lending of assets directly across multiple blockchains.”
reviewerPike Finance was founded in 2022.The 2022 founding date is plausible and matches RootData, which the page cites elsewhere (timeline[0]) but not in this section's source list. - #22[partially supported][awaiting moderator]in the timeline
“Pike Finance beta mainnet goes live. OtterSec audit has already flagged CCTP integration vulnerability; team has not patched it.”
reviewerPike Finance beta mainnet went live in April 2024, and OtterSec's audit had already flagged the CCTP integration vulnerability which the team had not patched.The mainnet-launch portion is confirmed by the cited source; the OtterSec/unpatched-vulnerability portion, while independently true, is not supported by the single source cited for this entry. - #23[partially supported][awaiting moderator]in the timeline
“Pike Finance enables USDC withdrawals via CCTP, activating the vulnerable integration pathway.”
reviewerPike Finance enabled USDC withdrawals via CCTP on April 24, 2024.Same underlying date/citation issue as the parallel claim in sections[2]: the date appears accurate based on secondary references to Pike's own post-mortem, but the single source cited here does not support it.
confirmed
18 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in section: First Exploit — April 26, 2024 (~$299K USDC)
“The protocol failed to perform proper input validation on the receiver address and transfer amounts passed through CCTP, allowing the attacker to manipulate both fields and redirect 299,127 USDC to their own wallet.”
reviewerThe first exploit stemmed from improper CCTP input validation that let the attacker redirect 299,127 USDC to their own wallet.Multiple independent research and news sources corroborate the exact figure and mechanism described. - #2[confirmed][no action needed]in section: First Exploit — April 26, 2024 (~$299K USDC)
“On-chain analysis tracked the stolen funds being bridged from Arbitrum to Ethereum via Stargate and subsequently deposited into Tornado Cash from attacker address 0xAdaF1626aEC26A7937aE7d1Fa0664e6E0904C1d0.”
reviewerStolen funds were bridged Arbitrum to Ethereum via Stargate and deposited into Tornado Cash from address 0xAdaF1626aEC26A7937aE7d1Fa0664e6E0904C1d0.Address and fund-flow path match independent incident-analysis reporting; the page omits an earlier BNB/BSC leg but does not misstate anything. - #3[confirmed][no action needed]in section: First Exploit — April 26, 2024 (~$299K USDC)
“A small residual amount of ETH (0.043 ETH) was sent directly to a Binance deposit address.”
reviewerA residual 0.043 ETH was sent directly to a Binance deposit address.Detail matches incident-analysis reporting on the residual dust amount. - #4[confirmed][no action needed]in section: First Exploit — April 26, 2024 (~$299K USDC)
“Pike Finance's auditing partner OtterSec had previously identified this vulnerability class in an audit, but according to Pike Finance's own post-exploit statement, 'Pike team was unable to address the identified vulnerability in a timely manner' before the attack occurred.”
reviewerOtterSec had previously identified the vulnerability class, and Pike stated it 'was unable to address the identified vulnerability in a timely manner.'The quote is verified verbatim in independent reporting on Pike's own statement. Identical wording also appears in sections[2]. - #6[confirmed][no action needed]in section: Second Exploit — April 30, 2024 (~$1.68M)
“On April 30, 2024, between 21:45 and 22:20 UTC, Pike Finance suffered a second and larger attack draining approximately $1.68M across three chains: $1,433,977 on Ethereum (479.39 ETH), $150,459 on Optimism (64,126 OP tokens), and $100,070 on Arbitrum (99,970 ARB tokens).”
reviewerThe second exploit drained ~$1.68M across Ethereum ($1,433,977 / 479.39 ETH), Optimism ($150,459 / 64,126 OP), and Arbitrum ($100,070 / 99,970 ARB).Exact figures corroborated by both the incident-analysis firm and Pike's own announcement. - #7[confirmed][no action needed]in section: Second Exploit — April 30, 2024 (~$1.68M)
“The root cause was a storage collision introduced during the emergency contract upgrade executed after the first exploit.”
reviewerThe second exploit's root cause was a storage collision from the emergency post-first-exploit contract upgrade.Consistent with multiple independent technical write-ups (Halborn, CertiK, SolidityScan). - #8[confirmed][no action needed]in section: Second Exploit — April 30, 2024 (~$1.68M)
“This allowed the attacker to call initialize() a second time, assign themselves the isActive admin role, invoke upgradeToAndCall() to deploy a malicious implementation contract, and then drain all deposited funds.”
reviewerThe attacker called initialize() a second time, assigned themselves the isActive admin role, and used upgradeToAndCall() to deploy a malicious implementation.Technical mechanism independently corroborated by a third audit-firm write-up (SolidityScan) not cited on the page. - #9[confirmed][no action needed]in section: Second Exploit — April 30, 2024 (~$1.68M)
“The attacker consolidated approximately 562 ETH in total (including ETH bridged from Arbitrum and Optimism) and routed the full amount into RAILGUN, a zero-knowledge privacy protocol, to obscure the money trail.”
reviewerThe attacker consolidated ~562 ETH and routed it into RAILGUN.Figure and destination match the cited on-chain analysis source. - #11[confirmed][no action needed]in section: CCTP Integration Vulnerability and Known Audit Finding
“Pike Finance subsequently issued a correction stating: 'The term USDC vulnerability was inaccurate for summarizing last week's exploit,' confirming the flaw resided entirely in Pike's own contract logic, not in Circle's CCTP or Gelato's systems.”
reviewerCircle disputed Pike's 'USDC vulnerability' framing, and Pike issued a correction stating the term was inaccurate.Quote verified verbatim against the cited source. - #12[confirmed][no action needed]in section: Why the Second Attack Succeeded After the First
“Because upgradeable proxy contracts use delegatecall, storage state is read from the proxy contract's storage, not the implementation's — any misalignment between the proxy layout and the implementation layout causes state to be misread.”
reviewerBecause upgradeable proxies use delegatecall, storage is read from the proxy, so a storage-layout misalignment between proxy and implementation causes state to be misread.Standard, independently-verifiable description of proxy/delegatecall storage semantics matching the technical write-ups. - #16[confirmed][no action needed]in section: Protocol Background and Backers
“Pike secured $50,000 in seed funding from Circle and Wormhole in November 2023 to support its mainnet launch.”
reviewerPike secured $50,000 in seed funding from Circle and Wormhole in November 2023.Amount, funders, and timing confirmed; 'seed funding' vs. the source's 'grant' phrasing is a minor, non-material terminology difference. - #17[confirmed][no action needed]in section: Protocol Background and Backers
“The protocol launched its testnet in December 2023 and went live on beta mainnet in early April 2024 — weeks before the exploits.”
reviewerPike Finance launched its testnet in December 2023.Matches cited source directly. - #18[confirmed][no action needed]in section: Protocol Background and Backers
“The protocol's GitHub organization is nutsfinance/pike-protocol.”
reviewerThe protocol's GitHub organization is nutsfinance/pike-protocol.Directly confirmed. - #20[confirmed][no action needed]in section: Relaunch and Current Status
“Pike Finance relaunched following the April 2024 incidents, migrating to the Base network and introducing a native $P governance token.”
reviewerPike Finance relaunched, migrating to Base and introducing the $P governance token.Independently corroborated via current market-data aggregators. - #24[confirmed][no action needed]in the timeline
“Pike Finance offers 20% bounty for return of stolen funds. No funds are returned. Team announces plan to reimburse all affected users using $P token treasury collateral.”
reviewerPike offered a 20% bounty, no funds were returned, and the team announced a plan to reimburse users via $P treasury collateral.Matches cited source; more granular reimbursement mechanics are addressed separately under sections[4]. - #25[confirmed][no action needed]in the timeline
“Pike Finance issues correction clarifying that the term 'USDC vulnerability' was inaccurate; acknowledges the root cause was Pike's own improper integration of CCTP, not a flaw in Circle's protocol.”
reviewerPike issued a correction clarifying that the 'USDC vulnerability' term was inaccurate and the root cause was its own CCTP integration.Consistent with the verified quote used elsewhere on the page. - #28[confirmed][no action needed]in the summary
“Within days of launch, the protocol suffered two separate exploits on April 26 and April 30, 2024, draining approximately $299K and $1.68M respectively for a combined loss of roughly $1.98M.”
reviewerThe two exploits combined for a loss of roughly $1.98M ($299K + $1.68M).Figures and arithmetic check out; the combined total is reported as $1.9M-$1.98M across sources depending on rounding, consistent with the page's figure. - #29[confirmed][no action needed]in the summary
“Pike Finance is a natively cross-chain lending protocol built on Wormhole's messaging layer and Circle's Cross-Chain Transfer Protocol (CCTP), which launched its beta mainnet in early 2024.”
reviewerPike Finance launched its beta mainnet in early 2024.Consistent with cited and independently found reporting.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.