Verify a decision

{"actor":"system:backfill","investigation_id":"1c369f50-80cb-49e8-b817-572d1730d3cb","kind":"publish","page_slug":"bzx-protocol","published_at":"2026-05-30T12:58:41.458Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"bZx Protocol","sections":[{"content":"","heading":"Protocol Overview and History","severity":"low","sources":[{"credibility":2,"name":"What is bZx? A 3-minute guide to the defi trading platform — Decrypt","type":"news_article","url":"https://decrypt.co/resources/bzx-ethereum-defi-decentralized-finance-explained-guide"},{"credibility":2,"name":"b0x Rebrands to bZx and Announces Mainnet Launch Date — bZx Team on Medium","type":"official","url":"https://medium.com/bzxnetwork/b0x-rebrands-to-bzx-and-announces-mainnet-launch-date-ed4e0c4dd2df"},{"credibility":1,"name":"CFTC Imposes $250,000 Penalty Against bZeroX, LLC and Its Founders — CFTC Press Release 8590-22","type":"regulatory","url":"https://www.cftc.gov/PressRoom/PressReleases/8590-22"}]},{"content":"","heading":"February 2020 Flash Loan Attacks","severity":"high","sources":[{"credibility":1,"name":"Everything You Ever Wanted to Know About the DeFi 'Flash Loan' Attack — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2020/02/19/everything-you-ever-wanted-to-know-about-the-defi-flash-loan-attack"},{"credibility":1,"name":"DeFi Project bZx Exploited for Second Time in a Week, Loses $630K in Ether — CoinDesk","type":"news_article","url":"https://www.coindesk.com/markets/2020/02/18/defi-project-bzx-exploited-for-second-time-in-a-week-loses-630k-in-ether"},{"credibility":2,"name":"Market Dynamics of the 1st bZx Hack — Quantstamp Blog","type":"research","url":"https://quantstamp.com/blog/market-dynamics-of-the-1st-bzx-hack-part-1"},{"credibility":2,"name":"Feb 2020 — bZx Fulcrum Flash Loan/Oracle Manipulation — $918k — Quadriga Initiative Case Study","type":"research","url":"https://www.quadrigainitiative.com/casestudy/bzxdecentralizedlendingplatformattack.php"}]},{"content":"","heading":"September 2020 iToken Duplication Exploit","severity":"high","sources":[{"credibility":2,"name":"iToken Duplication Incident Report — bZx Network Official Blog","type":"official","url":"https://bzx.network/blog/incident"},{"credibility":2,"name":"DeFi Protocol bZx Lost $8.1 Million in a Third Attack — Finance Magnates","type":"news_article","url":"https://www.financemagnates.com/cryptocurrency/news/defi-protocol-bzx-lost-8-1-million-in-a-third-attack/"},{"credibility":2,"name":"bZx Protocol Exploit — Sep 14, 2020 — Detailed Analysis — ImmuneBytes","type":"research","url":"https://immunebytes.com/blog/bzx-protocol-exploit-sep-14-2020-detailed-analysis/"}]},{"content":"","heading":"November 2021 Private Key Compromise (~$55 Million)","severity":"critical","sources":[{"credibility":1,"name":"DeFi Lender bZx Suffers Hack for Reported $55M — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2021/11/05/defi-lender-bzx-suffers-hack-for-reported-55m"},{"credibility":2,"name":"Explained: The bZx Hack (November 2021) — Halborn Security","type":"research","url":"https://www.halborn.com/blog/post/explained-the-bzx-hack-november-2021"},{"credibility":1,"name":"Hacker Steals $55 Million from bZx DeFi Platform — The Record by Recorded Future","type":"news_article","url":"https://therecord.media/hacker-steals-55-million-from-bzx-defi-platform"},{"credibility":2,"name":"Class Action Alleges $55M bZx Crypto Hack Caused by 'Simple Negligence' — ClassAction.org","type":"court_filing","url":"https://www.classaction.org/news/class-action-alleges-55m-bzx-crypto-hack-caused-by-simple-negligence"},{"credibility":2,"name":"Nov 2021 — bZx Private Key Leak — $55.04m — Quadriga Initiative Case Study","type":"research","url":"https://www.quadrigainitiative.com/casestudy/bzxprivatekeyleak.php"}]},{"content":"","heading":"CFTC Enforcement Action Against bZeroX and Ooki DAO","severity":"critical","sources":[{"credibility":1,"name":"CFTC Imposes $250,000 Penalty Against bZeroX, LLC and Its Founders and Charges Successor Ooki DAO — CFTC Press Release 8590-22","type":"regulatory","url":"https://www.cftc.gov/PressRoom/PressReleases/8590-22"},{"credibility":1,"name":"Statement of CFTC Division of Enforcement Director on the Ooki DAO Litigation Victory — CFTC Press Release 8715-23","type":"regulatory","url":"https://www.cftc.gov/PressRoom/PressReleases/8715-23"},{"credibility":1,"name":"CFTC Wins Lawsuit Against Ooki DAO — CoinDesk","type":"news_article","url":"https://www.coindesk.com/policy/2023/06/09/cftc-wins-lawsuit-against-ooki-dao"},{"credibility":2,"name":"Ooki DAO to Shut Down After 'Precedent Setting' Court Battle with CFTC — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/ooki-dao-to-shut-down-after-precedent-setting-court-battle-with-cftc"},{"credibility":2,"name":"Court Holds DAO May Be Sued as 'Person' and Orders Shutdown of Ooki DAO Website — Baker McKenzie Blockchain Blog","type":"research","url":"https://blockchain.bakermckenzie.com/2023/06/13/court-holds-dao-may-be-sued-as-person-and-orders-the-shutdown-of-ooki-dao-website/"}]},{"content":"","heading":"DAO Liability Class Action (Sarcuni et al. v. bZx DAO)","severity":"high","sources":[{"credibility":1,"name":"DAO Token Holders Are Plausibly Liable, Judge Rules in bZx Class Action — The Block","type":"news_article","url":"https://www.theblock.co/post/223237/bzx-dao-liability-class-action"},{"credibility":2,"name":"DAO Deemed 'General Partnership' in Negligence Suit over Crypto Hack — Proskauer Rose LLP","type":"research","url":"https://www.proskauer.com/blog/dao-deemed-general-partnership-in-negligence-suit-over-crypto-hack-prompting-decentralized-orgs-to-rethink-corporate-formation"},{"credibility":2,"name":"Federal Court Holds DAO Members Can Be Treated as General Partners Subject to Joint and Several Liability — Dechert LLP","type":"research","url":"https://www.dechert.com/knowledge/onpoint/2023/4/federal-court-holds-dao-members-can-be-treated-as-general-partne.html"},{"credibility":2,"name":"Putative Class Action Lawsuit Alleges DAO Members Are Jointly and Severally Liable for a Cryptocurrency Hack — Skadden","type":"research","url":"https://www.skadden.com/insights/publications/2022/05/putative-class-action-lawsuit-alleges-dao-members"}]}],"sources_used":[{"credibility":1,"name":"CFTC Press Release 8590-22 — bZeroX and Ooki DAO Charges","type":"regulatory","url":"https://www.cftc.gov/PressRoom/PressReleases/8590-22"},{"credibility":1,"name":"CFTC Press Release 8715-23 — Ooki DAO Litigation Victory Statement","type":"regulatory","url":"https://www.cftc.gov/PressRoom/PressReleases/8715-23"},{"credibility":1,"name":"Everything You Ever Wanted to Know About the DeFi 'Flash Loan' Attack — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2020/02/19/everything-you-ever-wanted-to-know-about-the-defi-flash-loan-attack"},{"credibility":1,"name":"DeFi Project bZx Exploited for Second Time in a Week — CoinDesk","type":"news_article","url":"https://www.coindesk.com/markets/2020/02/18/defi-project-bzx-exploited-for-second-time-in-a-week-loses-630k-in-ether"},{"credibility":1,"name":"DeFi Lender bZx Suffers Hack for Reported $55M — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2021/11/05/defi-lender-bzx-suffers-hack-for-reported-55m"},{"credibility":1,"name":"Hacker Steals $55 Million from bZx DeFi Platform — The Record by Recorded Future","type":"news_article","url":"https://therecord.media/hacker-steals-55-million-from-bzx-defi-platform"},{"credibility":1,"name":"DAO Token Holders Are Plausibly Liable, Judge Rules in bZx Class Action — The Block","type":"news_article","url":"https://www.theblock.co/post/223237/bzx-dao-liability-class-action"},{"credibility":1,"name":"CFTC Wins Lawsuit Against Ooki DAO — CoinDesk","type":"news_article","url":"https://www.coindesk.com/policy/2023/06/09/cftc-wins-lawsuit-against-ooki-dao"},{"credibility":2,"name":"Ooki DAO to Shut Down After 'Precedent Setting' Court Battle with CFTC — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/ooki-dao-to-shut-down-after-precedent-setting-court-battle-with-cftc"},{"credibility":2,"name":"Explained: The bZx Hack (November 2021) — Halborn Security","type":"research","url":"https://www.halborn.com/blog/post/explained-the-bzx-hack-november-2021"},{"credibility":2,"name":"DeFi Protocol bZx Lost $8.1 Million in a Third Attack — Finance Magnates","type":"news_article","url":"https://www.financemagnates.com/cryptocurrency/news/defi-protocol-bzx-lost-8-1-million-in-a-third-attack/"},{"credibility":2,"name":"iToken Duplication Incident Report — bZx Network Official Blog","type":"official","url":"https://bzx.network/blog/incident"},{"credibility":2,"name":"Market Dynamics of the 1st bZx Hack — Quantstamp Blog","type":"research","url":"https://quantstamp.com/blog/market-dynamics-of-the-1st-bzx-hack-part-1"},{"credibility":2,"name":"Class Action Alleges $55M bZx Crypto Hack Caused by 'Simple Negligence' — ClassAction.org","type":"court_filing","url":"https://www.classaction.org/news/class-action-alleges-55m-bzx-crypto-hack-caused-by-simple-negligence"},{"credibility":2,"name":"DAO Deemed 'General Partnership' in Negligence Suit over Crypto Hack — Proskauer Rose LLP","type":"research","url":"https://www.proskauer.com/blog/dao-deemed-general-partnership-in-negligence-suit-over-crypto-hack-prompting-decentralized-orgs-to-rethink-corporate-formation"},{"credibility":2,"name":"Court Holds DAO May Be Sued as 'Person' and Orders Shutdown of Ooki DAO Website — Baker McKenzie","type":"research","url":"https://blockchain.bakermckenzie.com/2023/06/13/court-holds-dao-may-be-sued-as-person-and-orders-the-shutdown-of-ooki-dao-website/"},{"credibility":2,"name":"What is bZx? — Decrypt","type":"news_article","url":"https://decrypt.co/resources/bzx-ethereum-defi-decentralized-finance-explained-guide"},{"credibility":2,"name":"Feb 2020 — bZx Fulcrum Flash Loan/Oracle Manipulation Case Study — Quadriga Initiative","type":"research","url":"https://www.quadrigainitiative.com/casestudy/bzxdecentralizedlendingplatformattack.php"},{"credibility":2,"name":"Nov 2021 — bZx Private Key Leak Case Study — Quadriga Initiative","type":"research","url":"https://www.quadrigainitiative.com/casestudy/bzxprivatekeyleak.php"},{"credibility":2,"name":"CFTC Settles Claims Against Founders and Sues Ooki DAO — Skadden Insights","type":"research","url":"https://www.skadden.com/insights/publications/2022/10/cftc-settles-claims"}],"summary":"bZx Protocol was an Ethereum-based decentralized margin trading and lending protocol founded in 2017 by Tom Bean and Kyle Kistner. The protocol suffered four separate security incidents between 2020 and 2021, culminating in a ~$55 million hack attributed to a phishing-induced private key compromise. Following a transfer of control to a DAO structure, the successor Ooki DAO was sued by the CFTC for operating an unregistered derivatives exchange, ultimately receiving a default judgment, trading bans, and a court-ordered shutdown in June 2023.","timeline":[{"date":"2017-08","event":"Tom Bean and Kyle Kistner conceive bZx Protocol after reading 0x, Kyber, and Bancor whitepapers.","source":"Decrypt / bZx team interviews","source_url":"https://decrypt.co/resources/bzx-ethereum-defi-decentralized-finance-explained-guide"},{"date":"2018-02","event":"bZx whitepaper published.","source":"bZx Network Medium","source_url":"https://medium.com/bzxnetwork/b0x-rebrands-to-bzx-and-announces-mainnet-launch-date-ed4e0c4dd2df"},{"date":"2018-12","event":"bZx raises approximately $7.8 million in a BZRX token ICO.","source":"Decrypt","source_url":"https://decrypt.co/resources/bzx-ethereum-defi-decentralized-finance-explained-guide"},{"date":"2019-06","event":"Fulcrum DeFi margin trading interface launches on Ethereum mainnet.","source":"IQ.wiki / Ivan on Tech Academy","source_url":"https://iq.wiki/wiki/bzx"},{"date":"2019-07","event":"bZx Protocol mainnet launch following rebrand from 'b0x'.","source":"bZx Network Medium","source_url":"https://medium.com/bzxnetwork/b0x-rebrands-to-bzx-and-announces-mainnet-launch-date-ed4e0c4dd2df"},{"date":"2019-10","event":"Torque fixed-interest lending front end launches.","source":"IQ.wiki","source_url":"https://iq.wiki/wiki/bzx"},{"date":"2020-02-15","event":"First flash loan attack on Fulcrum: attacker exploits undercollateralization logic bug, netting approximately $350,000 in ETH.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2020/02/19/everything-you-ever-wanted-to-know-about-the-defi-flash-loan-attack"},{"date":"2020-02-18","event":"Second flash loan attack: attacker manipulates sUSD price oracle on Kyber Network and extracts approximately $633,000 in ETH.","source":"CoinDesk","source_url":"https://www.coindesk.com/markets/2020/02/18/defi-project-bzx-exploited-for-second-time-in-a-week-loses-630k-in-ether"},{"date":"2020-07","event":"BZRX governance token launched via Uniswap IDO.","source":"IQ.wiki / Decrypt","source_url":"https://iq.wiki/wiki/bzx"},{"date":"2020-09-14","event":"Third exploit: iToken duplication bug allows attacker to mint ~$8.1 million in tokens including LINK, ETH, USDT, USDC, and DAI.","source":"Finance Magnates / bZx Incident Report","source_url":"https://www.financemagnates.com/cryptocurrency/news/defi-protocol-bzx-lost-8-1-million-in-a-third-attack/"},{"date":"2021-08-23","event":"bZeroX, LLC transfers protocol control to bZx DAO; founders describe move as making the protocol 'enforcement-proof'.","source":"CFTC Press Release 8590-22","source_url":"https://www.cftc.gov/PressRoom/PressReleases/8590-22"},{"date":"2021-11-05","event":"Fourth and largest breach: phishing email compromises developer private keys; over $55 million drained from Polygon and BSC deployments and affected user wallets.","source":"CoinDesk / The Record","source_url":"https://www.coindesk.com/business/2021/11/05/defi-lender-bzx-suffers-hack-for-reported-55m"},{"date":"2021-11-12","event":"Kaspersky attributes November 2021 hack to BlueNoroff, a North Korean state-linked threat actor.","source":"Halborn Security blog","source_url":"https://www.halborn.com/blog/post/explained-the-bzx-hack-november-2021"},{"date":"2022-05-02","event":"Class action Sarcuni et al. v. bZx DAO filed in S.D. California alleging negligence and joint and several liability of all BZRX token holders.","source":"Skadden Insights","source_url":"https://www.skadden.com/insights/publications/2022/05/putative-class-action-lawsuit-alleges-dao-members"},{"date":"2022-09-22","event":"CFTC simultaneously settles charges against bZeroX LLC and founders ($250,000 penalty) and files new civil enforcement action against Ooki DAO.","source":"CFTC Press Release 8590-22","source_url":"https://www.cftc.gov/PressRoom/PressReleases/8590-22"},{"date":"2023-03","event":"U.S. district court rules bZx DAO plausibly constitutes a 'general partnership' under California law, opening all BZRX token holders to joint and several liability.","source":"The Block","source_url":"https://www.theblock.co/post/223237/bzx-dao-liability-class-action"},{"date":"2023-06-09","event":"Judge William H. Orrick grants CFTC default judgment against Ooki DAO: $643,542 penalty, permanent trading bans, and mandatory website shutdown ordered.","source":"CFTC Press Release 8715-23","source_url":"https://www.cftc.gov/PressRoom/PressReleases/8715-23"}]},"v":1}