Skip to main content
AVOID.NET
Sign in

Veil Cash

avoid.net/veil-cash→38/100·72% conf.
[AI-DRAFTED · AWAITING VERIFICATION][src:defillama]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·2xYzi8…FLVH

Summary

Veil Cash is a zero-knowledge privacy protocol deployed on Coinbase's Base L2 network, enabling anonymous ETH and USDC transfers via zk-SNARK proofs and a UTXO model. In February 2026 the protocol's legacy pools were exploited due to an incomplete Groth16 trusted-setup ceremony, resulting in 2.9 ETH being drained before funds were returned by the exploiter. The incident attracted industry attention because the same misconfiguration pattern was subsequently replicated in a larger $2.26 million exploit of FoomCash, raising broader questions about cryptographic setup hygiene across ZK DeFi protocols.

Connected Entities

7 entities · 60 linked investigations
Organizations
□Ethereum64□Vitalik Buterin25□Veil Cash□Binance45□Base68□ZachXBT82
Tokens
♦Coinbase62
Relationships
  • Ethereum→mentioned with→Coinbase(60%)
  • ZachXBT→mentioned with→Ethereum(70%)
  • ZachXBT→mentioned with→Binance(60%)
  • Binance→mentioned with→Ethereum(65%)
  • Coinbase→mentioned with→Base(70%)
  • Coinbase→mentioned with→ZachXBT(70%)
  • Ethereum→mentioned with→Vitalik Buterin(80%)
  • Veil Cash→mentioned with→Vitalik Buterin(80%)
  • Vitalik Buterin→mentioned with→Ethereum(65%)
  • Vitalik Buterin→mentioned with→ZachXBT(70%)
  • + 7 more
Also appears in
Vitalik Buterin·25Base·68Ethereum·64Lendf.me·30Levyathan·18Jump Trading·42OpenZeppelin AI Exploit Threat Vector·15StableMagnet·2Shibarium·28Dean Daghita / CMDSS (Command Services and Support)·0+ 50 more

Connected Through

6 shared actors · 606 investigations

Distinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.

Have evidence about Veil Cash?

Timeline(10 events)

2024

Veil Cash protocol launches on Base L2 with zk-SNARK privacy pools for ETH and USDC.

June 2024

Coinbase EAS (Ethereum Attestation Service) integration introduced, allowing Coinbase-verified users auto-approval into verified pools.

2025

Pashov Audit Group completes a security review of Veil Cash smart contracts; the Groth16 verifier contract is explicitly listed out of scope.

21 February 2026

Attacker exploits the Groth16 verifier misconfiguration (delta == gamma) in Veil Cash's legacy Base pool, executing 29 fraudulent withdrawals and draining 2.9 ETH in a single transaction.

21 February 2026

DefimonAlerts (Decurity security firm) intervenes and rescues remaining pool funds from the legacy pools.

21 February 2026

Exploiter returns all drained funds unprompted at approximately 22:05 UTC; 100% of Veil Cash user funds recovered.

22 February 2026

Public proof-of-concept for the Veil Cash Groth16 exploit published on GitHub by researcher DK27ss. Rekt.news covers incident as 'The Unfinished Proof'.

22 February 2026

Pashov Audit Group publicly confirms on X that the verifier was out of scope for their audit engagement.

26 February 2026

FoomCash suffers a $2.26 million exploit using the identical Groth16 misconfiguration pattern first publicly documented in the Veil Cash incident.

March 2026

CryptoTimes and Halborn publish post-mortems linking the FoomCash exploit directly to the Veil Cash incident as the originating template.

Provenance & Audit Trail
Anchored on SolanaVerify on-chain13 Wayback Archivessrc:defillama

Decision Log

This investigation is cryptographically anchored to the Solana blockchain (4 events). 13 of 18 cited source URLs have an Internet Archive snapshot.

Fact-checked 2026-09-0934 claims checked5 corrections pending0 applied⛓ anchoredSee findings →
full audit log →version history →

model: claude-sonnet-4-6

generated: 5/4/2026, 2:54:13 AM

last updated: 9/11/2026, 12:56:57 AM

21 views

avoid.net — verified advice for a post-truth world