Verify a decision

{"actor":"system:backfill","investigation_id":"7a1254db-5cf5-448b-99b9-e773bf1ae9ee","kind":"publish","page_slug":"ankr","published_at":"2026-05-28T16:29:12.313Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Ankr","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://kriptomat.io/cryptocurrencies/ankr/what-is-ankr/","type":"other","url":""},{"credibility":3,"name":"https://www.ankr.com/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.ankr.com/blog/after-action-report-our-findings-from-abnbc-token-exploit/","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/ankr-confirms-exploit-asks-for-immediate-trading-halt","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/ankr-helio-rekt","type":"other","url":""},{"credibility":3,"name":"https://www.merklescience.com/blog/hack-track-analysis-of-ankr-exploit","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/business/2022/12/21/defi-protocol-ankr-says-ex-employee-caused-5m-exploit","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://rekt.news/ankr-helio-rekt","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/ankr-deploys-15m-to-make-whole-users-as-helio-stablecoin-recovers-after-exploit","type":"other","url":""},{"credibility":3,"name":"https://www.cryptotimes.io/2022/12/03/helio-protocol-exploited-for-15m-after-ankr-exploit/","type":"other","url":""},{"credibility":3,"name":"https://beincrypto.com/bnb-based-hay-destablecoin-loses-peg-ankr-exploit/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.ankr.com/blog/after-action-report-our-findings-from-abnbc-token-exploit/","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/ankr-says-ex-employee-caused-5m-exploit-vows-to-improve-security","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/business/2022/12/21/defi-protocol-ankr-says-ex-employee-caused-5m-exploit","type":"other","url":""},{"credibility":3,"name":"https://blockworks.co/news/ankr-confirms-5m-crypto-hack-was-an-inside-job","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cointelegraph.com/news/ankr-exploit-victims-group-alleges-the-company-only-reimbursed-them-50","type":"other","url":""},{"credibility":3,"name":"https://zycrypto.com/ankr-reveals-compensation-plan-for-users-affected-by-5-million-hack/","type":"other","url":""},{"credibility":3,"name":"https://www.ankr.com/blog/the-details-of-ankrs-bnb-exploit-relief-efforts-and-our-stance-on-compensation/","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/markets/2022/12/02/defi-protocol-ankr-exploited-for-over-5m","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.ankr.com/blog/after-action-report-our-findings-from-abnbc-token-exploit/","type":"other","url":""},{"credibility":3,"name":"https://www.ankr.com/blog/ankr-2025-wrap-up/","type":"other","url":""},{"credibility":3,"name":"https://www.ankr.com/blog/ankr-approach-to-safety-risk-and-protecting-our-community/","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/ankr-says-ex-employee-caused-5m-exploit-vows-to-improve-security","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://zachxbt.mirror.xyz/","type":"other","url":""},{"credibility":3,"name":"https://medium.com/@investigationsbyzachxbt","type":"other","url":""}]}],"sources_used":[],"summary":"Ankr is a Web3 infrastructure and liquid staking protocol founded in 2017, providing RPC endpoints for over 75 blockchains and BNB Chain-based liquid staking products. In December 2022, a former employee executed a supply chain attack that compromised Ankr's private deployer key, enabling unlimited minting of aBNBc tokens and resulting in approximately $5 million in direct losses, with cascading secondary losses of roughly $19 million through Helio Protocol's HAY stablecoin depeg. Ankr subsequently compensated affected users, implemented multi-signature controls, and continues to operate, though questions persist over the completeness of user reimbursement.","timeline":[{"date":"2017-01-01","event":"Ankr founded by Chandler Song, Ryan Fang, and Stanley Wu.","source":""},{"date":"2019-03-01","event":"ANKR token launched via ICO on Binance Launchpad, raising approximately $18.7 million.","source":""},{"date":"2019-01-01","event":"Ankr mainnet released.","source":""},{"date":"2020-01-01","event":"Ankr launches Stkr liquid staking protocol, introducing aBNBc and related derivatives.","source":""},{"date":"2022-12-01","event":"Former Ankr employee's malicious supply chain code activates upon a legitimate software update, exfiltrating the deployer private key.","source":""},{"date":"2022-12-02","event":"Attacker deploys malicious aBNBc contract and mints approximately 60 trillion aBNBc tokens. PeckShield flags exploit at 12:35 UTC. Approximately $5 million extracted via PancakeSwap and bridged to Ethereum. aBNBc price crashes ~99.5%.","source":""},{"date":"2022-12-02","event":"Secondary exploit against Helio Protocol: attackers use collapsed aBNBc as collateral to drain approximately $15.5 million from Helio's HAY stablecoin pool via an unupdated price oracle. HAY depegs to $0.20.","source":""},{"date":"2022-12-02","event":"Approximately 3,360 ETH laundered through Tornado Cash; additional 900 BNB sent through Tornado Cash.","source":""},{"date":"2022-12-02","event":"Ankr issues public statement confirming exploit, requests trading halt on aBNBc, announces compensation plan.","source":""},{"date":"2022-12-21","event":"Ankr formally attributes attack to a former team member, announces law enforcement referral, and details new multi-signature security controls.","source":""},{"date":"2023-01-01","event":"Victims group publicly alleges Ankr provided only 50% reimbursement to users affected through Stader and pStake protocols.","source":""},{"date":"2024-01-01","event":"Ankr's Asphere enterprise arm achieves SOC 2 Type 1 compliance.","source":""},{"date":"2025-01-01","event":"Ankr's Asphere achieves SOC 2 Type 2 compliance. No public confirmation of prosecution of the former employee has been reported.","source":""}]},"v":1}