Verify a decision

{"actor":"system:backfill","investigation_id":"dcafe9c0-ab56-4103-8599-a784d9b0a215","kind":"publish","page_slug":"ooki","published_at":"2026-05-26T15:34:19.615Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Ooki Protocol","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.cftc.gov/PressRoom/PressReleases/8590-22","type":"other","url":""},{"credibility":3,"name":"https://decrypt.co/resources/bzx-ethereum-defi-decentralized-finance-explained-guide","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/policy/2022/09/26/cftcs-ooki-dao-action-shatters-illusion-of-regulator-proof-protocol","type":"other","url":""},{"credibility":3,"name":"https://www.binance.com/en/support/announcement/429180a14a2f40e9ba8bbd5f6b2b4dc1","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.cftc.gov/PressRoom/PressReleases/8590-22","type":"other","url":""},{"credibility":3,"name":"https://www.skadden.com/insights/publications/2022/10/cftc-settles-claims","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.cftc.gov/PressRoom/PressReleases/8590-22","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/policy/2022/09/26/cftcs-ooki-dao-action-shatters-illusion-of-regulator-proof-protocol","type":"other","url":""},{"credibility":3,"name":"https://www.winston.com/en/crypto-law-corner/cftcs-charges-against-ooki-dao-could-have-significant-implications-for-daos","type":"other","url":""},{"credibility":3,"name":"https://www.sidley.com/en/insights/newsupdates/2022/10/doubts-about-daos-novel-cftc-enforcement-case-targets-decentralized-finance-community","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.cftc.gov/PressRoom/PressReleases/8715-23","type":"other","url":""},{"credibility":3,"name":"https://www.cftc.gov/media/8736/enfookidaoorder060923/download","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/policy/2023/06/09/cftc-wins-lawsuit-against-ooki-dao","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/ooki-dao-to-shut-down-after-precedent-setting-court-battle-with-cftc","type":"other","url":""},{"credibility":3,"name":"https://blockchain.bakermckenzie.com/2023/06/13/court-holds-dao-may-be-sued-as-person-and-orders-the-shutdown-of-ooki-dao-website","type":"other","url":""},{"credibility":3,"name":"https://beincrypto.com/ooki-dao-cftc-battle/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coindesk.com/markets/2020/02/18/defi-project-bzx-exploited-for-second-time-in-a-week-loses-630k-in-ether","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/tech/2020/02/19/everything-you-ever-wanted-to-know-about-the-defi-flash-loan-attack","type":"other","url":""},{"credibility":3,"name":"https://peckshield.medium.com/bzx-hack-full-disclosure-with-detailed-profit-analysis-e6b1fa9b18fc","type":"other","url":""},{"credibility":3,"name":"https://peckshield.medium.com/bzx-hack-ii-full-disclosure-with-detailed-profit-analysis-8126eecc1360","type":"other","url":""},{"credibility":3,"name":"https://quantstamp.com/blog/market-dynamics-of-the-1st-bzx-hack-part-1","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://immunebytes.com/blog/bzx-protocol-exploit-sep-14-2020-detailed-analysis/","type":"other","url":""},{"credibility":3,"name":"https://cryptobriefing.com/bzxs-third-exploit-2020-ends-with-8-million-lost/","type":"other","url":""},{"credibility":3,"name":"https://coincodex.com/article/9473/bzx-defi-protocol-suffers-8-million-loss-as-attacker-exploits-token-duplication-vulnerability/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coindesk.com/business/2021/11/05/defi-lender-bzx-suffers-hack-for-reported-55m","type":"other","url":""},{"credibility":3,"name":"https://decrypt.co/85360/ethereum-defi-project-bzx-hacked-again-reported-55-million","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-bzx-hack-november-2021","type":"other","url":""},{"credibility":3,"name":"https://therecord.media/hacker-steals-55-million-from-bzx-defi-platform","type":"other","url":""},{"credibility":3,"name":"https://www.classaction.org/media/sarcuni-et-al-v-bzx-dao-et-al.pdf","type":"other","url":""},{"credibility":3,"name":"https://www.classaction.org/news/class-action-alleges-55m-bzx-crypto-hack-caused-by-simple-negligence","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.theblock.co/post/223237/bzx-dao-liability-class-action","type":"other","url":""},{"credibility":3,"name":"https://www.ibanet.org/decentralised-autonomous-organisations-and-liability-in-litigation","type":"other","url":""},{"credibility":3,"name":"https://www.proskauer.com/blog/dao-deemed-general-partnership-in-negligence-suit-over-crypto-hack-prompting-decentralized-orgs-to-rethink-corporate-formation","type":"other","url":""},{"credibility":3,"name":"https://www.blockchainandthelaw.com/2023/04/dao-deemed-general-partnership-in-negligence-suit-over-crypto-hack-prompting-decentralized-orgs-to-rethink-corporate-formation/","type":"other","url":""},{"credibility":3,"name":"https://www.skadden.com/insights/publications/2022/05/putative-class-action-lawsuit-alleges-dao-members","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.cftc.gov/PressRoom/PressReleases/8590-22","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/policy/2023/06/09/cftc-wins-lawsuit-against-ooki-dao","type":"other","url":""},{"credibility":3,"name":"https://blockchaintipsheet.com/policy/cftc-enforcement-action-bzerox-bzx-ooki-decentralized-autonomous-organizations/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cointelegraph.com/news/ooki-dao-to-shut-down-after-precedent-setting-court-battle-with-cftc","type":"other","url":""},{"credibility":3,"name":"https://www.coingecko.com/en/coins/ooki","type":"other","url":""},{"credibility":3,"name":"https://coinmarketcap.com/currencies/ooki-protocol/","type":"other","url":""},{"credibility":3,"name":"https://www.fintechanddigitalassets.com/2023/07/whats-next-for-daos-in-the-wake-of-the-ooki-decision/","type":"other","url":""}]}],"sources_used":[],"summary":"Ooki Protocol (formerly bZx Protocol) is a decentralized margin trading and lending protocol on Ethereum that was the subject of the first-ever CFTC enforcement action against a DAO, resulting in a 2023 default judgment ordering the protocol to cease operations and pay $643,542 in penalties. The protocol suffered four separate security incidents between 2020 and 2021 totaling over $64 million in losses, including a $55 million phishing-based hack attributed by Kaspersky to the North Korean state-linked BlueNoroff group. Following the CFTC judgment, the Ooki DAO's website was ordered shut down and the protocol has been effectively defunct.","timeline":[{"date":"2017-01-01","event":"bZx Protocol founded by Tom Bean and Kyle Kistner after reading DeFi whitepapers from 0x, Kyber, and Bancor.","source":""},{"date":"2019-06-01","event":"bZeroX, LLC begins operating the bZx Protocol, offering leveraged margin trading and lending without regulatory registration.","source":""},{"date":"2020-02-15","event":"First flash loan attack on bZx Protocol: attacker manipulates WBTC price oracle and nets approximately 1,193 ETH (~$318,000).","source":""},{"date":"2020-02-18","event":"Second flash loan attack on bZx Protocol within four days: attacker manipulates sUSD price feed, netting approximately $633,000.","source":""},{"date":"2020-09-14","event":"Third bZx exploit: iToken duplication bug allows attacker to mint tokens without collateral; approximately $8.1 million in LINK, ETH, and stablecoins stolen. Majority later recovered.","source":""},{"date":"2021-08-23","event":"bZeroX transfers control of the bZx Protocol to the bZx DAO. Founders market the transfer to the community as making operations 'enforcement-proof.'","source":""},{"date":"2021-11-05","event":"Fourth and largest bZx hack: phishing email compromises a developer's private keys; approximately $55 million stolen across Polygon and Binance Smart Chain.","source":""},{"date":"2021-11-12","event":"Kaspersky attributes the November 2021 bZx hack to BlueNoroff, a subgroup of North Korea's state-sponsored Lazarus Group (APT38).","source":""},{"date":"2021-12-01","event":"bZx DAO rebrands as Ooki DAO; BZRX token migrated to OOKI token at a 1:10 ratio.","source":""},{"date":"2022-05-01","event":"Class action lawsuit Sarcuni et al. v. bZx DAO et al. filed in U.S. District Court, S.D. California, alleging negligent security practices caused $55 million hack.","source":""},{"date":"2022-09-22","event":"CFTC simultaneously: (1) files and settles charges against bZeroX LLC and founders Tom Bean and Kyle Kistner for $250,000; and (2) files the first-ever federal charges against a DAO — Ooki DAO — for CEA violations.","source":""},{"date":"2023-03-27","event":"U.S. District Court denies motion to dismiss in Sarcuni class action, finding bZx/Ooki DAO is plausibly a general partnership and token holders are plausibly liable as partners.","source":""},{"date":"2023-06-08","event":"U.S. District Judge William H. Orrick grants CFTC default judgment against Ooki DAO: $643,542 penalty, permanent trading bans, and order to shut down the Ooki DAO website.","source":""},{"date":"2023-06-09","event":"CFTC Division of Enforcement Director Ian McGinley declares ruling demonstrates 'DeFi is not a regulatory-free zone.' Ooki DAO announces shutdown.","source":""}]},"v":1}