Summary
RiskOnBlast was a GambleFi (gambling and exchange) platform launched on the Blast Layer-2 network in February 2024. Its anonymous team executed an exit scam (rug pull) on February 24, 2024, draining approximately 420 ETH (~$1.3 million) from over 750 investor wallets immediately after the IDO cap was reached. The project is linked by on-chain evidence to a serial fraud group responsible for more than $20 million in losses across multiple DeFi protocols.
Connected Entities
1 entities · 10 linked investigationsTimeline(7 events)
2024-02-22
RiskOnBlast IDO contract (0x25f8c342e430c85829ef5021c0720f0c60969840) deployed on Blast L2. RISK token presale opens.
2024-02-23
IDO closes after reaching 420 ETH (~$1.25 million) cap from over 750 investor wallets.
2024-02-24
At 14:35 UTC, IDO creator wallet (0x1eeb963133f657ed3228d04b8cd9a13280efc558) calls withdraw() on the IDO contract 17 minutes after cap is confirmed, draining all 420.50 ETH. Team deletes website and social media accounts.
2024-02-25
Coinbase tech lead Andrew Choi alerts the community to disappearance of project's website and X account. On-chain researchers SomaXBT and Amir Ormu begin documenting fund flows. Funds are distributed to ChangeNow (~$495k), MEXC (~$386k), Bybit (~$193k), Railgun (~$125k), and other services.
2024-02-26
CoinDesk and multiple crypto outlets report the incident as the first confirmed exit scam on Blast network. CertiK publishes on-chain incident analysis.
2024-04-14
ZachXBT publicly identifies Leaper Finance on Blast as a new project being funded by the same fraud group, with ~$1 million in laundered funds from prior scams (including alleged RiskOnBlast proceeds) seeded into the protocol.
2024-04-15
ZachXBT also flags ZebraLending on Base as a concurrent suspected operation by the same group (~$311k TVL). Following the exposure, Leaper Finance and Glori Finance deactivate social media and websites, consistent with the RiskOnBlast pattern.
Decision Log
- hash: H2xYibieWRqYxutRfzFsoXCpXivmLtLD6JMtKdhYr2xB
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:34 AM
last updated: 5/28/2026, 8:16:04 AM
avoid.net — verified advice for a post-truth world