Verify a decision

{"actor":"system:backfill","investigation_id":"b5522c6d-d69b-486c-b4c0-05b0c589ea9c","kind":"publish","page_slug":"foom-cash","published_at":"2026-05-26T15:34:25.422Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"FOOM Cash","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coingecko.com/en/coins/foom","type":"other","url":""},{"credibility":3,"name":"https://coinmarketcap.com/currencies/foom/","type":"other","url":""},{"credibility":3,"name":"https://etherscan.io/token/0xd0D56273290D339aaF1417D9bfa1bb8cFe8A0933","type":"other","url":""},{"credibility":3,"name":"https://basescan.org/address/0xdb203504ba1fea79164af3ceffba88c59ee8aafd","type":"other","url":""},{"credibility":3,"name":"https://foom.cash/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cointelegraph.com/news/white-hat-hacker-recovers-2-26m-foom-cash-exploit","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/the-unfinished-proof","type":"other","url":""},{"credibility":3,"name":"https://phemex.com/news/article/foomcash-loses-226-million-in-copycat-attack-exploiting-zksnark-vulnerability-62810","type":"other","url":""},{"credibility":3,"name":"https://www.kucoin.com/news/flash/privacy-gaming-platform-foom-cash-suffers-2-26m-loss-in-attack","type":"other","url":""},{"credibility":3,"name":"https://www.ainvest.com/news/foom-cash-exploit-2-26m-loss-1-83m-white-hat-recovery-flow-2603/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://rekt.news/the-unfinished-proof","type":"other","url":""},{"credibility":3,"name":"https://www.mexc.com/news/839809","type":"other","url":""},{"credibility":3,"name":"https://financefeeds.com/foom-cash-recovers-1-84m-after-2-26m-exploit-with-help-from-white-hat-hacker/","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/white-hat-hacker-recovers-2-26m-foom-cash-exploit","type":"other","url":""},{"credibility":3,"name":"https://phemex.com/news/article/white-hat-hacker-recovers-81-of-226m-stolen-from-foom-cash-63670","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://rekt.news/the-unfinished-proof","type":"other","url":""},{"credibility":3,"name":"https://www.ainvest.com/news/foom-cash-exploit-2-26m-flow-breakdown-2602/","type":"other","url":""},{"credibility":3,"name":"https://tradersunion.com/news/cryptocurrency-news/show/1572208-foom-cash-a-next/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://rekt.news/the-unfinished-proof","type":"other","url":""},{"credibility":3,"name":"https://foom.cash/","type":"other","url":""},{"credibility":3,"name":"https://financefeeds.com/foom-cash-recovers-1-84m-after-2-26m-exploit-with-help-from-white-hat-hacker/","type":"other","url":""},{"credibility":3,"name":"https://www.ainvest.com/news/foom-cash-exploit-2-26m-loss-1-83m-white-hat-recovery-flow-2603/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://foom.cash/","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/the-unfinished-proof","type":"other","url":""},{"credibility":3,"name":"https://www.coingecko.com/en/coins/foom","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coingecko.com/en/coins/foom","type":"other","url":""},{"credibility":3,"name":"https://coinmarketcap.com/currencies/foom/","type":"other","url":""},{"credibility":3,"name":"https://www.ainvest.com/news/foom-cash-exploit-2-26m-loss-1-83m-white-hat-recovery-flow-2603/","type":"other","url":""},{"credibility":3,"name":"https://coinpaprika.com/coin/foom-foom/","type":"other","url":""}]}],"sources_used":[],"summary":"FOOM Cash (foom.cash) is a pseudonymous, privacy-focused decentralized lottery protocol built on Ethereum and Base, marketed as an 'upgraded Tornado Cash' using zk-SNARKs cryptography. On February 26, 2026, the protocol suffered a $2.26 million exploit caused by a critical deployment error in its Groth16 trusted setup — a flaw publicly known from an identical exploit on Veil Cash days earlier that the team failed to patch. The team had been silent for approximately three months prior to the attack and was subsequently flagged as a notable risk by AVOID.NET due to compounding concerns: anonymous founders, serious operational negligence, misleading post-incident communications, and unverifiable audit claims.","timeline":[{"date":"2024-01-23","event":"FOOM token records its all-time low price of $0.071455, indicating the token has been tradeable since at least this date.","source":""},{"date":"2025-10-06","event":"FOOM token records its all-time high price of $0.061871 according to CoinGecko.","source":""},{"date":"2025-11-01","event":"FOOM Cash team social accounts go silent, entering an approximately three-month communication blackout while holding millions in user funds (approximate date per rekt.news analysis).","source":""},{"date":"2026-02-20","event":"Veil Cash, a smaller Base-network privacy protocol using the same Groth16 setup, is exploited via identical gamma/delta misconfiguration. A public post-mortem is published.","source":""},{"date":"2026-02-26","event":"FOOM Cash exploited for $2.26 million across Ethereum and Base. A single Base transaction drains approximately $427,000. Pseudonymous actor Duha exploits the Base contract under the terms of the publicly posted Bitcointalk bug bounty.","source":""},{"date":"2026-02-26","event":"Duha enters the EthSecurity Telegram group to publicly dispute FOOM Cash's demand for 90% fund return, citing the unconditional bounty terms. SEAL is requested as mediator.","source":""},{"date":"2026-02-27","event":"Security firm Decurity conducts recovery operations on Ethereum, front-running the original attacker to secure approximately $1.84 million of the stolen funds.","source":""},{"date":"2026-03-01","event":"FOOM Cash issues its first public statement in approximately three months, four days after the exploit. The statement reframes Duha as a white hat who 'moved to secure funds' and makes no mention of the bounty dispute or initial demand for fund return.","source":""},{"date":"2026-03-03","event":"Final recovery figures confirmed: $1.84 million (81%) recovered. Duha awarded $320,000 bounty; Decurity awarded $100,000 security fee. $420,000 in funds remains unrecovered.","source":""}]},"v":1}