Verify a decision

{"actor":"system:backfill","investigation_id":"bd9e30c1-a563-48ef-837a-233f5679928c","kind":"publish","page_slug":"dfx-v2","published_at":"2026-05-28T16:22:18.842Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"DFX V2","sections":[{"content":"On November 10, 2022, DFX Finance V2 was exploited through a critical reentrancy vulnerability in the protocol's flash loan function. The flash function lacked a reentrancy guard, allowing the attacker (wallet address 0x14c19962e4a899f29b3dd9ff52ebfb5e4cb9a067, using attack contract 0x6cfa86a352339e766ff1ca119c8c40824f41f22d) to borrow stablecoins via a flash loan, re-deposit those borrowed funds back into the liquidity pool within the same transaction, bypass the loan repayment check (since the pool balance appeared unchanged), and then withdraw LP tokens representing their deposit — effectively receiving funds twice. The primary attacker extracted approximately $4.3 million, including roughly 2,963 ETH (~$3.8M) and approximately $500,000 in stablecoins. The exploit transaction hash is 0x390def749b71f516d8bf4329a4cb07bb3568a3627c25e607556621182a17f1f9. An independent MEV bot front-ran the original exploit transaction and extracted an additional approximately $3.2 million. The DFX Finance team publicly requested the MEV bot operator return those funds; no confirmation of recovery has been reported. Security firm PeckShield and others flagged the attack in real time. Total losses across both parties amounted to approximately $7.5 million.","heading":"Security Exploit — November 2022 Reentrancy Attack","severity":"critical","sources":[{"credibility":2,"name":"Explained: The DFX Finance Hack (November 2022) — Halborn","type":"research","url":"https://www.halborn.com/blog/post/explained-the-dfx-finance-hack-november-2022"},{"credibility":2,"name":"Decoding DFX Finance Exploit — QuillAudits","type":"research","url":"https://quillaudits.medium.com/decoding-dfx-finance-exploit-quillaudits-9a58f7b033d"},{"credibility":2,"name":"Polychain-backed DFX Finance hacked for $7.5 million — The Block","type":"news_article","url":"https://www.theblock.co/post/185796/polychain-dfx-finance-hacked"},{"credibility":2,"name":"DFX Finance Hacked, Attacker Funnels $4M Funds to Tornado Cash — BeInCrypto","type":"news_article","url":"https://beincrypto.com/dfx-finance-hacked-exploiter-drains-4m-funnels-funds-tornado-cash/"}]},{"content":"Following the November 10, 2022 exploit, the primary attacker began routing stolen ETH through Tornado Cash, a cryptocurrency mixing service used to obscure transaction origins and impede on-chain tracking. Multiple security monitoring firms and blockchain analytics providers observed the fund flows in near-real time. No public attribution of the attacker's real-world identity has been established. The $3.2 million held by the MEV bot operator remained at the bot address; DFX Finance publicly appealed for return of those funds without confirmed response.","heading":"Fund Movement — Tornado Cash Laundering","severity":"critical","sources":[{"credibility":2,"name":"DFX Finance Hacked, Attacker Funnels $4M Funds to Tornado Cash — BeInCrypto","type":"news_article","url":"https://beincrypto.com/dfx-finance-hacked-exploiter-drains-4m-funnels-funds-tornado-cash/"},{"credibility":2,"name":"DFX Finance Hacked for $4M — Attacker Moves Funds Through Tornado Cash — DailyCoin","type":"news_article","url":"https://dailycoin.com/dfx-finance-hacked-for-4m-attacker-moves-funds-through-tornado-cash/"}]},{"content":"The reentrancy vulnerability exploited in the November 2022 attack was introduced specifically in V2 of the DFX Finance protocol. The V2 codebase underwent a security audit by PickAx (documented in the official DFX Finance GitHub repository under audits/2022-09-DFXv2-Pickax-Audit.pdf), conducted in September 2022 — approximately two months before the hack. The audit did not detect the missing reentrancy guard on the flash function. The vulnerability could have been prevented by adding the standard nonReentrant modifier to that function. This represents a significant audit failure; reentrancy is a well-documented class of smart contract vulnerability. The incident underscores that a passed audit does not guarantee the absence of critical vulnerabilities.","heading":"Audit Failures — PickAx V2 Audit","severity":"high","sources":[{"credibility":2,"name":"Explained: The DFX Finance Hack (November 2022) — Halborn","type":"research","url":"https://www.halborn.com/blog/post/explained-the-dfx-finance-hack-november-2022"},{"credibility":1,"name":"DFX V2 PickAx Audit PDF — DFX Finance GitHub","type":"official","url":"https://github.com/dfx-finance/protocol-v1-deprecated/blob/main/audits/2022-09-DFXv2-Pickax-Audit.pdf"},{"credibility":2,"name":"Decoding DFX Finance Exploit — QuillAudits","type":"research","url":"https://quillaudits.medium.com/decoding-dfx-finance-exploit-quillaudits-9a58f7b033d"}]},{"content":"Within 20–30 minutes of the first exploit transaction on November 10, 2022, the DFX Finance team was notified of suspicious activity. The team executed an emergency pause of all smart contracts within minutes of confirming the attack. Polygon contracts, which shared identical vulnerabilities, were also shut down in an emergency procedure. The DFX token declined over 33% within 24 hours of the public announcement. On January 19, 2023, a community-approved reimbursement proposal was activated: affected users receive one DFX token per one US dollar lost, distributed block-by-block over a three-year period via Sablier streaming to prevent market flooding. The proposal was documented at docs.dfx.finance. No cash recovery from the attacker has been publicly reported.","heading":"Protocol Response and Reimbursement Plan","severity":"high","sources":[{"credibility":1,"name":"Reimbursement Plan — DFX Finance Official Docs","type":"official","url":"https://docs.dfx.finance/dfx-finance/faqs/reimbursement-plan"},{"credibility":3,"name":"Proposal to Reimburse Users Impacted by Hack — DFX Finance Forum","type":"community_report","url":"https://forum.dfx.finance/t/proposal-to-reimburse-users-impacted-by-hack/457/2"},{"credibility":2,"name":"DFX Finance Hacked, Attacker Funnels $4M Funds to Tornado Cash — BeInCrypto","type":"news_article","url":"https://beincrypto.com/dfx-finance-hacked-exploiter-drains-4m-funnels-funds-tornado-cash/"}]},{"content":"DFX Finance is a decentralized foreign exchange (FX) protocol built on Ethereum (with Polygon and Arbitrum deployments) that uses a dynamically tuned bonding curve and real-world FX price feeds to optimize trading of fiat-backed stablecoins. The protocol was founded by Adrian Li and Kevin Zhang and launched in 2021. In February 2021, DFX Finance raised a $5 million seed round led by Polychain Capital and True Ventures, with participation from Lemniscap and FBG Capital. DFX V2 added flash loan support and generalized pool creation (previously restricted to the DFX team). V3 was subsequently released with support for non-stablecoin assets. As of 2024-2025, the protocol's TVL is approximately $111,000 across all chains — a significant decline from pre-hack levels — and 24-hour revenue and fees have fallen to effectively zero.","heading":"Background — Protocol and Funding","severity":"medium","sources":[{"credibility":2,"name":"DFX Finance — DefiLlama","type":"on_chain","url":"https://defillama.com/protocol/dfx-finance"},{"credibility":2,"name":"DFX Finance — Crunchbase","type":"other","url":"https://www.crunchbase.com/organization/dfx-finance"},{"credibility":2,"name":"Polychain-backed DFX Finance hacked for $7.5 million — The Block","type":"news_article","url":"https://www.theblock.co/post/185796/polychain-dfx-finance-hacked"}]},{"content":"The DFX governance token experienced a greater than 33% price decline within 24 hours of the November 2022 hack announcement. DFX traded at approximately $0.167 at the time of the attack disclosure, down from a January 2022 price near $2.47. The token reached a post-hack all-time high of approximately $1.64 on March 18, 2024, before declining steeply. As of mid-2025, DFX trades at approximately $0.0008, representing a near-total loss from its 2022 levels. The market cap ranks around #5754 globally with a live market cap of approximately $40,000. The reimbursement plan issued new DFX tokens to hack victims on a vesting schedule, adding sell pressure to the token over the 2023–2026 period.","heading":"Token and Market Impact","severity":"medium","sources":[{"credibility":2,"name":"DFX Finance Price — CoinMarketCap","type":"other","url":"https://coinmarketcap.com/currencies/dfx-finance/"},{"credibility":2,"name":"DFX Finance Price — CoinGecko","type":"other","url":"https://www.coingecko.com/en/coins/dfx-finance"},{"credibility":2,"name":"DFX Finance Hacked, Attacker Funnels $4M Funds to Tornado Cash — BeInCrypto","type":"news_article","url":"https://beincrypto.com/dfx-finance-hacked-exploiter-drains-4m-funnels-funds-tornado-cash/"}]},{"content":"No SEC enforcement actions, CFTC proceedings, DOJ charges, or OFAC sanctions against DFX Finance, its founders (Adrian Li, Kevin Zhang), or the protocol have been identified in available public records as of the date of this investigation. The attacker's identity has not been publicly established, and no criminal charges related to the November 2022 hack have been publicly reported.","heading":"Regulatory and Legal Status","severity":"low","sources":[{"credibility":2,"name":"DFX Finance — Crunchbase","type":"other","url":"https://www.crunchbase.com/organization/dfx-finance"}]}],"sources_used":[{"credibility":2,"name":"Explained: The DFX Finance Hack (November 2022) — Halborn","type":"research","url":"https://www.halborn.com/blog/post/explained-the-dfx-finance-hack-november-2022"},{"credibility":2,"name":"Decoding DFX Finance Exploit — QuillAudits","type":"research","url":"https://quillaudits.medium.com/decoding-dfx-finance-exploit-quillaudits-9a58f7b033d"},{"credibility":2,"name":"Polychain-backed DFX Finance hacked for $7.5 million — The Block","type":"news_article","url":"https://www.theblock.co/post/185796/polychain-dfx-finance-hacked"},{"credibility":2,"name":"DFX Finance Hacked, Attacker Funnels $4M Funds to Tornado Cash — BeInCrypto","type":"news_article","url":"https://beincrypto.com/dfx-finance-hacked-exploiter-drains-4m-funnels-funds-tornado-cash/"},{"credibility":2,"name":"DFX Finance Hacked for $4M — Attacker Moves Funds Through Tornado Cash — DailyCoin","type":"news_article","url":"https://dailycoin.com/dfx-finance-hacked-for-4m-attacker-moves-funds-through-tornado-cash/"},{"credibility":1,"name":"Reimbursement Plan — DFX Finance Official Docs","type":"official","url":"https://docs.dfx.finance/dfx-finance/faqs/reimbursement-plan"},{"credibility":1,"name":"DFX V2 PickAx Audit PDF — DFX Finance GitHub","type":"official","url":"https://github.com/dfx-finance/protocol-v1-deprecated/blob/main/audits/2022-09-DFXv2-Pickax-Audit.pdf"},{"credibility":2,"name":"DFX Finance — DefiLlama","type":"on_chain","url":"https://defillama.com/protocol/dfx-finance"},{"credibility":2,"name":"DFX Finance — CoinMarketCap","type":"other","url":"https://coinmarketcap.com/currencies/dfx-finance/"},{"credibility":2,"name":"DFX Finance — CoinGecko","type":"other","url":"https://www.coingecko.com/en/coins/dfx-finance"},{"credibility":2,"name":"DFX Finance — Crunchbase","type":"other","url":"https://www.crunchbase.com/organization/dfx-finance"},{"credibility":2,"name":"DFX Finance Attack Overview — CertiK","type":"research","url":"https://www.certik.com/resources/blog/27ZZE58zgmjoOnIbygqfJL-dfx-finance"},{"credibility":2,"name":"Polychain's DFX Finance Suffers Loss of Over $7.5M — DeFi Planet","type":"news_article","url":"https://defi-planet.com/2022/11/polychains-dfx-finance-suffers-loss-of-over-7-5m-in-dex-pool-hack/"}],"summary":"DFX Finance is a decentralized foreign exchange protocol optimized for trading fiat-backed stablecoins such as CADC, EURS, and XSGD, backed by investors including Polychain Capital. On November 10, 2022, the V2 smart contracts were exploited via a reentrancy vulnerability in the flash loan function, resulting in approximately $7.5 million in total losses split between a primary attacker (~$4.3M) and an MEV front-running bot (~$3.2M). The stolen funds were funneled into Tornado Cash; the protocol subsequently paused all contracts, launched a DFX-token reimbursement plan, and later released V3, but TVL remains near zero as of 2024.","timeline":[{"date":"2021-02-01","event":"DFX Finance raises $5 million seed round led by Polychain Capital and True Ventures.","source":"The Block","source_url":"https://www.theblock.co/post/185796/polychain-dfx-finance-hacked"},{"date":"2021-01-01","event":"DFX Finance protocol launches on Ethereum mainnet.","source":"DFX Finance Official Docs","source_url":"https://docs.dfx.finance/"},{"date":"2022-09-01","event":"PickAx completes a security audit of DFX V2 smart contracts; the reentrancy vulnerability in the flash loan function is not identified.","source":"DFX Finance GitHub","source_url":"https://github.com/dfx-finance/protocol-v1-deprecated/blob/main/audits/2022-09-DFXv2-Pickax-Audit.pdf"},{"date":"2022-11-10","event":"DFX Finance V2 exploited via reentrancy attack; attacker wallet 0x14c19962e4a899f29b3dd9ff52ebfb5e4cb9a067 extracts approximately $4.3 million. MEV bot front-runs the attack and extracts an additional $3.2 million. Total losses: approximately $7.5 million.","source":"QuillAudits / Halborn","source_url":"https://quillaudits.medium.com/decoding-dfx-finance-exploit-quillaudits-9a58f7b033d"},{"date":"2022-11-10","event":"DFX Finance team pauses all smart contracts on Ethereum and Polygon within 20-30 minutes of detecting the attack.","source":"BeInCrypto","source_url":"https://beincrypto.com/dfx-finance-hacked-exploiter-drains-4m-funnels-funds-tornado-cash/"},{"date":"2022-11-11","event":"Primary attacker begins routing stolen ETH through Tornado Cash to obscure the transaction trail. DFX token price falls more than 33% within 24 hours.","source":"DailyCoin","source_url":"https://dailycoin.com/dfx-finance-hacked-for-4m-attacker-moves-funds-through-tornado-cash/"},{"date":"2023-01-19","event":"Community reimbursement proposal activated: affected users receive 1 DFX per $1 lost, distributed over three years via Sablier streaming.","source":"DFX Finance Official Docs","source_url":"https://docs.dfx.finance/dfx-finance/faqs/reimbursement-plan"},{"date":"2023-02-01","event":"DFX Finance relaunches with improved V2 smart contracts following post-hack security remediation.","source":"CoinMarketCap","source_url":"https://coinmarketcap.com/currencies/dfx-finance/"},{"date":"2024-03-18","event":"DFX token reaches post-hack all-time high of approximately $1.64.","source":"CoinMarketCap","source_url":"https://coinmarketcap.com/currencies/dfx-finance/"}]},"v":1}