Steadefi
Last changed 2026-10-10 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 35 → 53. Problems weighed by who is responsible: incidents the subject suffered −6.4, concerns that are not fraud −3.2, problems around the subject, caused by others −2.4. Version history →
Why this score
| Every page starts at | 65 |
| Concerns that are not fraud | -3.2 |
| Incidents it suffered (e.g. hacks) | -6.4 |
| Problems around it, caused by others | -2.4 |
| Sum | 53 |
Score: 53/100 (kept between 0 and 100)
How scoring works →Summary
Steadefi is a decentralized leveraged yield farming protocol operating on Arbitrum and Avalanche. On August 7, 2023, an attacker exploited a compromised deployer private key to drain approximately $1.14 million from the protocol's lending vaults across both chains. The protocol subsequently relaunched with enhanced security measures and issued a token-based compensation plan for affected users, though roughly 70% of stolen funds were never recovered.
Connected Entities
5 entities · 60 linked investigations- Paxful→mentioned with→Noones(70%)
- Steadefi→mentioned with→Arbitrum(70%)
- Steadefi→mentioned with→Noones(60%)
- Steadefi→mentioned with→Ethereum(80%)
- Steadefi→mentioned with→Paxful(60%)
- Noones→mentioned with→Paxful(70%)
- Noones→mentioned with→Ethereum(70%)
- Arbitrum→mentioned with→Ethereum(80%)
Timeline(10 events)
17 June 2023
A team member allegedly downloaded a malware-laden file during a Telegram conversation with an entity identifying itself as 'Spirit Blockchain Group', according to Steadefi's post-mortem.
28 June 2023
The deployer wallet's MetaMask seed phrases were compromised, allegedly as a result of the June 17 malware infection.
7 August 2023
Attacker exploited the compromised deployer private key at approximately 4:06 PM UTC to transfer ownership of all lending and strategy vaults on Arbitrum and Avalanche to address 0x9cf71F2ff126B9743319B60d2D873F0E508810dc. Approximately $1.14 million in assets drained and bridged to Ethereum mainnet via Synapse bridge.
9 August 2023
Steadefi publicly disclosed the exploit via Twitter, warning all funds were at risk.
10 August 2023
Deadline passed for Steadefi's bounty offer of 10% of stolen funds in exchange for the return of 90%. Offer was not accepted by the attacker.
23 August 2023
Steadefi published full exploit analysis and reimbursement plan. Recovery portal opened at steadefi.com/claim for proportional USDC distribution to affected wallets.
September 2023
Steadefi published relaunch and compensation plan, announcing security upgrades including multisig permissions, timelocks, and Hypernative real-time monitoring.
October 2023
On-chain analysis indicated attacker addresses began distributing funds through exchanges after alleged Tornado Cash mixing, per Merkle Science flow-of-funds analysis.
December 2023
Protocol relaunched as Steadefi v2 with SDY token (replacing STEADY), enhanced security architecture, and compensation tokenomics targeting affected users.
2024
Steadefi v3 vault migration announced, adding liquid restaking token (LRT) vault strategies and continued GMX v2 integration.
Decision Log
- slot 455364283 · hash 8UNZ1hcspQ6sfSjexvmKjExP5pcrhwj5Znbs4P3LJ5kw
- slot 422743531 · hash HGW6kDBQ93sztATG6qSjiqNvgCdDMQQxQvGFd8EkteiE
This investigation is cryptographically anchored to the Solana blockchain (2 decisions). 12 of 12 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:39 AM
last updated: 10/10/2026, 6:44:38 PM
4 viewsavoid.net — verified advice for a post-truth world