Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·2vGoVP…JVDRSummary
Prisma Finance is a Liquity-forked, Ethereum-based DeFi protocol that allowed users to mint overcollateralized stablecoins (mkUSD and ULTRA) against liquid staking tokens (LSTs) such as wstETH, rETH, sfrxETH, and cbETH. On March 28, 2024, a critical vulnerability in the protocol's MigrateTroveZap helper contract was exploited for approximately $11.6 million, with a total loss across all attacker wallets of roughly $12.3 million; the primary exploiter sent the majority of stolen funds through Tornado Cash while claiming a 'whitehat rescue,' and as of 2026 the protocol's TVL has collapsed from a pre-exploit peak of approximately $220 million to under $300K.
Connected Entities
6 entities · 60 linked investigations- ZachXBT→mentioned with→Ethereum(70%)
- ZachXBT→mentioned with→Bybit(70%)
- PrismaLST→mentioned with→Ethereum(80%)
- FixedFloat→mentioned with→ZachXBT(60%)
- PrismaLST→mentioned with→ZachXBT(70%)
- PrismaLST→mentioned with→TRON(65%)
- Bybit→mentioned with→ZachXBT(70%)
- PrismaLST→mentioned with→FixedFloat(70%)
- PrismaLST→mentioned with→Bybit(65%)
- FixedFloat→mentioned with→Ethereum(70%)
- + 1 more
Timeline(11 events)
September 2023
Prisma Finance launches on Ethereum mainnet, offering LST-backed stablecoin minting via mkUSD.
2024
Prisma introduces ULTRA, a second stablecoin backed by liquid restaking tokens (LRTs).
28 March 2024
Exploit begins at 11:25 UTC. Primary attacker (EOA 0x7E39E3B3ff7ADef2613d5Cc49558EAB74B9a4202) exploits MigrateTroveZap vulnerability, draining approximately $11.6 million. Two copycat attackers follow, bringing total losses to approximately $12.3 million.
28 March 2024
Emergency multisig pauses Prisma protocol at 12:51 UTC. Official post states mkUSD and ULTRA stablecoins remain overcollateralized and are not at immediate risk.
29 March 2024
Attacker-linked wallets begin routing stolen ETH through Tornado Cash. Approximately 1,850 ETH confirmed through the mixing protocol.
31 March 2024
Primary attacker sends on-chain messages claiming 'white hat rescue' and demanding a public press conference, team doxing, and a formal apology before discussing fund return.
April 2024
Prisma Finance confirms approximately $540,000 in user funds remain at risk. Disputes attacker's white hat framing given Tornado Cash deposits.
5 April 2024
Core contributor Frank Olson proposes plan to safely unpause the protocol. DAO governance vote yields 100% approval to resume operations.
6 April 2024
Prisma Finance resumes operations following a post-exploit security audit. Users can again deposit LST/LRT collateral and mint stablecoins.
16 April 2024
ZachXBT publishes investigation alleging identification of primary exploiter, linking wallet funding to FixedFloat, Bybit, and TRON withdrawals, and connecting the attacker to prior exploits including Arcade_xyz and Pine Protocol.
May 2026
DeFiLlama data shows Prisma Finance TVL below $300,000, down from a pre-exploit peak of approximately $220 million, indicating near-total user exit from the protocol.
Decision Log
- hash: 87GaV9gwajjLurrfH83u7rXfARMBHm1cXwj2ZyFf4qQK
This investigation is cryptographically anchored to the Solana blockchain (1 event). 13 of 20 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-5
generated: 5/4/2026, 2:54:33 AM
last updated: 9/1/2026, 9:58:43 AM
5 viewsavoid.net — verified advice for a post-truth world