← Sonne Financereviewed 2026-10-21 · 21 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Sonne Finance against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
4 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #10[disputed][awaiting moderator]in section: The Exploit
“its market capitalization dropped to roughly $4.25 million”
reviewerSONNE fell more than 60% on the day of the exploit to approximately $0.026, with market cap dropping to roughly $4.25 millionThe 60% drop and $0.026 price are confirmed by the cited CoinDesk source, but that same source gives market cap as ~$20 million, not $4.25 million. The $4.25M figure traces to a different outlet reporting a different (15%) drop percentage — the two numbers can't both be true of the same moment, and the cited source directly contradicts the $4.25M figure used.Proposed correction (not yet applied)its market capitalization dropped to roughly $20 million - #11[disputed][awaiting moderator]in section: On-Chain Evidence
“0x5d0d99e9886581ff8fcb01f35804317f5ed80bbb (held ~$10.67M at time of analysis)”
reviewerAttacker address 0x5d0d99e9886581ff8fcb01f35804317f5ed80bbb held approximately $10.67M at time of analysisThe address itself is correctly attributed to the attacker, but the dollar figure attached to it is roughly 58% higher than what the cited source reports; could reflect a different snapshot time not disclosed on the page, but as written it is not supported by the cited source.Proposed correction (not yet applied)0x5d0d99e9886581ff8fcb01f35804317f5ed80bbb (held ~$6.75M at time of analysis per CertiK's tracing) - #17[disputed][awaiting moderator]in section: Recovery
“The team stated: 'We are sincerely sorry about the situation, and we are doing everything in our power and we are in contact with anyone that can help with recovering the funds.'”
reviewerThe team publicly stated: 'We are sincerely sorry about the situation, and we are doing everything in our power and we are in contact with anyone that can help with recovering the funds.'Extensive searching (exact-phrase search and direct re-fetch of the cited article) found no instance of the quoted sentence anywhere; the cited source contains a materially different team statement. This looks like a misattributed or fabricated quote and should be replaced with the verified statement.Proposed correction (not yet applied)The team stated: 'We are ready to give bounty to exploiter as well as not to commit pursuing the issue further, in case of returning the funds.' - #18[disputed][awaiting moderator]in section: Recovery
“According to Nefture Security's tracing analysis, the attacker and the protocol allegedly reached a negotiated agreement. Under the alleged terms, the attacker returned most of the stolen funds while retaining approximately $7.2 million as a negotiated 'bounty.'”
reviewerAccording to Nefture Security's tracing analysis, the attacker and protocol reached a negotiated agreement where the attacker retained ~$7.2 million as a bountyThis appears to be a fabricated attribution: the cited article does not contain a 'Nefture Security tracing analysis,' does not report any negotiated agreement, and does not mention $7.2 million. It directly contradicts the claim by saying recovery looked unlikely. No other source corroborates this narrative either. This is the most serious finding on the page and should be removed rather than merely softened, though the page's own hedge ('has not been confirmed by a Tier 1 source') already signals appropriate caution to readers.Proposed correction (not yet applied)No independent on-chain tracing analysis confirms a negotiated return of funds; reporting on the attacker's wallet activity, including the May 26, 2024 Tornado Cash transfer, suggests that any recovery was partial at best.
unverifiable
3 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #4[unverifiable][awaiting moderator]in section: Background
“public references identify at least one founder by the pseudonym 'Wilbur.'”
reviewerAt least one founder is identified by the pseudonym 'Wilbur'Weakest possible sourcing for a claim about a named individual's identity — the only basis is a URL slug, not article text. Could not find independent corroboration either way. - #5[unverifiable][awaiting moderator]in section: Background
“The protocol operated under a 2-of-3 multisig governance structure.”
reviewerThe protocol operated under a 2-of-3 multisig governance structureCould not find a source stating the specific 2-of-3 threshold; the multisig's existence is confirmed but not this specific configuration detail.citeddocs.sonne.finance/ - #21[unverifiable][awaiting moderator]in section: Risk Assessment
“Sonne Finance had allegedly implemented mitigations for this vulnerability class in other markets but failed to apply them correctly during the VELO market launch.”
reviewerSonne Finance had allegedly implemented mitigations for this vulnerability class elsewhere but failed to apply them during the VELO launchPlausible but could not be independently confirmed; the page's own hedge ('allegedly') is appropriate given the thin sourcing.
partially supported
3 claimsThe cited evidence supports part of the claim but not all of it.
- #3[partially supported][awaiting moderator]in section: Background
“received a $600,000 grant from the Optimism Foundation to bootstrap liquidity”
reviewerSonne Finance received a $600,000 grant from the Optimism Foundation to bootstrap liquidityDollar amount is supported by the cited source; the specific 'Optimism Foundation' framing is a reasonable but unverified inference. - #15[partially supported][awaiting moderator]in section: Recovery
“The team engaged SEAL 911 (Security Alliance) for incident response coordination.”
reviewerThe team engaged SEAL 911 (Security Alliance) for incident response coordinationSecurity Alliance ('SEAL') involvement is real, but the page's specific framing (naming the SEAL 911 product and describing formal coordination) is more specific than what the sources state. - #16[partially supported][awaiting moderator]in section: Recovery
“Sonne Finance publicly offered the attacker a 10% bounty in exchange for return of the stolen funds and a commitment not to pursue further legal or investigative action.”
reviewerSonne Finance publicly offered the attacker a 10% bounty in exchange for fund return and no further legal actionThe 10% figure is true but is supported by a different source (Halborn) than the one cited in this section (The Record), which explicitly calls the bounty amount undisclosed. A citation-swap rather than a factual error.
confirmed
11 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in the summary
“Sonne Finance is a Compound V2 fork deployed on Optimism that was exploited for approximately $20 million on May 14, 2024, in what became the largest exploit in Optimism's history.”
reviewerSonne Finance was exploited for approximately $20 million on May 14, 2024, the largest exploit in Optimism's historyIndependently confirmed via the on-chain transaction timestamp (May 14, 10:18pm UTC) and multiple Tier-2 security-firm reports. Resolves a minor press discrepancy where some outlets (writing from Asia time zones) dated the attack May 15. - #2[confirmed][no action needed]in the summary
“The attack exploited a well-known precision-loss donation vulnerability in Compound V2 forks, triggered during the rollout of a new VELO token market; the attacker leveraged a multi-transaction deployment architecture and a two-day timelock window to manipulate exchange rates and drain user funds.”
reviewerThe attack was triggered by a VELO market rollout using a multi-transaction deployment and two-day timelockConsistent across Sonne's own post-mortem, Halborn, CertiK and The Block. - #6[confirmed][no action needed]in section: Background
“deployed on Optimism (launched September 2022) and later expanded to Base”
reviewerSonne Finance launched on Optimism in September 2022Matches the cited source; only a single outlet gives the specific month, so confidence is moderate rather than high. - #7[confirmed][no action needed]in section: The Exploit
“On May 4, 2024, Sonne Improvement Proposal 15 was introduced to list the VELO token (Velodrome Finance's native token) as a collateral market. The proposal passed unanimously with 2.3 million SONNE votes on May 7.”
reviewerSIP-15 was introduced May 4, 2024 to list VELO and passed unanimously with 2.3 million SONNE votes on May 7Independently confirmed via DefiLlama's on-chain governance archive. - #8[confirmed][no action needed]in section: The Exploit
“The mechanism: the attacker flash-loaned 35,569,150 VELO and donated them directly to the newly created soVELO contract, bypassing the standard mint pathway.”
reviewerThe attacker flash-loaned 35,569,150 VELO and exploited redeemUnderlying truncation using 1 wei of soVELOTechnical mechanism and figures match the cited security-firm writeups. - #9[confirmed][no action needed]in section: The Exploit
“The exploit transaction hash is 0x9312ae377d7ebdf3c7c3a86f80514878deb5df51aad38b6191d55db53e42b7f0.”
reviewerThe exploit transaction hash is 0x9312ae377d7ebdf3c7c3a86f80514878deb5df51aad38b6191d55db53e42b7f0Verified directly against the block explorer, not just a secondary writeup. - #12[confirmed][no action needed]in section: On-Chain Evidence
“0x6277ab36a67cfb5535b02ee95c835a5eec554c07 (held ~$7.79M, bridged to ETH mainnet)”
reviewerAttacker address 0x6277ab36a67cfb5535b02ee95c835a5eec554c07 held approximately $7.79M, bridged to Ethereum mainnetClose match to the cited primary tracing source. - #13[confirmed][no action needed]in section: On-Chain Evidence
“On May 26, 2024, the attacker transferred 1,600 ETH (approximately $6.2 million at the time) to Tornado Cash in an apparent laundering attempt.”
reviewerOn May 26, 2024, the attacker transferred 1,600 ETH (~$6.2 million) to Tornado CashConfirmed by the cited source; initial May 14-16 press coverage only speculated about intent to use Tornado Cash, so this later, dated transfer is a useful independent data point. - #14[confirmed][no action needed]in section: On-Chain Evidence
“Approximately $6.5 million in additional protocol funds was preserved when a SEAL contributor intervened by adding VELO tokens to the market before the attacker could drain it.”
reviewerApproximately $6.5 million was preserved when a SEAL contributor added VELO tokens to the market before the attacker could drain itMatches Sonne's own post-mortem and Halborn's analysis closely. - #19[confirmed][no action needed]in section: Recovery
“Separately verified is the May 26, 2024 transfer of 1,600 ETH to Tornado Cash, which complicates any claims of full fund recovery.”
reviewerSeparately verified is the May 26, 2024 transfer of 1,600 ETH to Tornado Cash, complicating claims of full recoverySame underlying fact as the On-Chain Evidence section claim; this instance is appropriately hedged as the one solid data point amid an otherwise unconfirmed recovery narrative. - #20[confirmed][no action needed]in section: Risk Assessment
“Security researchers at Halborn, CertiK, and QuillAudits uniformly concluded that the attack was entirely preventable.”
reviewerSecurity researchers at Halborn, CertiK, and QuillAudits concluded the attack was entirely preventable via atomic batchingConsistent characterization across all three cited security firms.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.