SubQuery Network
Summary
SubQuery Network is a Web3 data indexing protocol originally built for the Polkadot ecosystem, founded by Sam Zou and James Bayly out of New Zealand-based OnFinality. The project raised $10.8M in seed and Series A funding, launched its mainnet and SQT token in February 2024, and suffered a significant smart-contract exploit on April 12, 2026 in which a missing access-control modifier allowed an attacker to drain approximately 382 million SQT tokens (~$134,000 USD) from staker and delegator wallets across five transactions. ZachXBT flagged the entity in connection with this incident; the team published a full disclosure report and executed on-chain compensation for all affected wallets.
Connected Entities
1 entities- + 1 more
Timeline(11 events)
2021-01-01
SubQuery raises $1.8 million seed round led by DeFi Alliance, D1 Ventures, Hypersphere Ventures, DFG, and The LAO.
2021-09-11
SubQuery announces $9 million Series A round co-led by Arrington Capital, DCG, and Stratos Technologies.
2022-04-12
SubQuery Network passes Hacken smart contract security audit with no material findings.
2024-02-22
SQT token deposits open on Bybit exchange ahead of mainnet TGE.
2024-02-23
SubQuery mainnet launches and SQT token begins trading on Bybit at approximately $0.0144.
2024-03-29
SQT reaches all-time high price of approximately $0.0855.
2024-12-31
SQT price ends 2024 approximately 76% below its launch price, trading around $0.005.
2026-04-12
Smart contract exploit on Base network drains approximately 382 million SQT (~$134,000 USD) from staking contract, 272 individual wallets, RewardsBooster, and Treasury via missing onlyOwner access control on the Settings contract setContractAddress() function.
2026-04-13
SubQuery team identifies full attack vector, simulates exploit traces, and deploys fix restoring onlyOwner modifiers to affected contract functions.
2026-04-14
On-chain compensation distribution begins; SubQuery publishes full public disclosure and recovery plan.
2026-04-15
On-chain compensation to all 272 affected staker and delegator wallets completed.
Decision Log
- hash: 8JaTx5x63Df2ia9ZMJmRDQjMKXkZNny3aQhRspMjLSKZ
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:17 AM
last updated: 5/29/2026, 2:53:12 AM
avoid.net — verified advice for a post-truth world