Verify a decision

{"actor":"system:backfill","investigation_id":"c275fe15-9424-451f-aec8-4c4a41641a09","kind":"publish","page_slug":"clipper","published_at":"2026-05-29T16:47:20.374Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Clipper","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://blog.clipper.exchange/what-is-clipper/","type":"other","url":""},{"credibility":3,"name":"https://iq.wiki/wiki/clipper-dex","type":"other","url":""},{"credibility":3,"name":"https://docs.clipper.exchange/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.theblock.co/linked/111163/dex-developer-shipyard-software-raises-21-million-for-its-first-exchange-clipper","type":"other","url":""},{"credibility":3,"name":"https://www.banklesstimes.com/news/2023/01/31/shipyard-software-raises-21m-for-clipper-decentralized-exchange-ravikant-among-backers/","type":"other","url":""},{"credibility":3,"name":"https://www.linkedin.com/pulse/clipper-dex-people-paul-veradittakit","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cryptonews.com/news/clipper-dex-says-withdrawal-vulnerability-led-to-450k-hack-denies-private-key-leak/","type":"other","url":""},{"credibility":3,"name":"https://crypto.news/clipper-dex-liquidity-pools-exploited-for-450000/","type":"other","url":""},{"credibility":3,"name":"https://thecyberexpress.com/clipper-cyberattack/","type":"other","url":""},{"credibility":3,"name":"https://www.web3isgoinggreat.com/?id=clipper-dex-hack","type":"other","url":""},{"credibility":3,"name":"https://quadrigainitiative.com/cryptocurrencyhackscamfraudwiki/index.php?title=Clipper_Exchange_Asset_Deposit/Withdrawal_Manipulation","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://quadrigainitiative.com/cryptocurrencyhackscamfraudwiki/index.php?title=Clipper_Exchange_Asset_Deposit/Withdrawal_Manipulation","type":"other","url":""},{"credibility":3,"name":"https://www.bitcoinsensus.com/news/clipper-dex-seeks-negotiation-with-hacker-after-450000-exploit/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://blog.clipper.exchange/after-rigorous-security-testing-clipper-dex-is-set-to-sail/","type":"other","url":""},{"credibility":3,"name":"https://medium.com/@clipper_dex/after-rigorous-security-testing-clipper-dex-is-set-to-sail-b21e6be46c43","type":"other","url":""},{"credibility":3,"name":"https://docs.clipper.exchange/audits","type":"other","url":""},{"credibility":3,"name":"https://thecyberexpress.com/clipper-cyberattack/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cryptopotato.com/zachxbt-targets-lesser-known-dex-in-fresh-allegations-over-illicit-crypto-flows/","type":"other","url":""},{"credibility":3,"name":"https://www.banklesstimes.com/articles/2026/05/04/zachxbt-alleges-tokenlon-processed-millions-in-suspected-illicit-crypto-funds/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.admiraldao.xyz/","type":"other","url":""},{"credibility":3,"name":"https://docs.clipper.exchange/governance-token/sail-supply-and-circulation","type":"other","url":""},{"credibility":3,"name":"https://iq.wiki/wiki/clipper-dex","type":"other","url":""},{"credibility":3,"name":"https://thecyberexpress.com/clipper-cyberattack/","type":"other","url":""}]}],"sources_used":[],"summary":"Clipper is a decentralized exchange (DEX) built by Shipyard Software and governed by AdmiralDAO, designed to offer retail traders the lowest per-transaction costs on trades under $10,000 using a novel Formula Market Maker (FMM) mechanism. On December 1, 2024, a protocol logic exploit drained approximately $457,878 from its Optimism and Base liquidity pools by manipulating a single-asset deposit and withdrawal function; the attacker voluntarily returned 104 ETH in January 2025. While the protocol has legitimate venture backing and a documented technical architecture, the exploit revealed a gap between audited and deployed code, and the protocol has been flagged by on-chain investigator ZachXBT.","timeline":[{"date":"2021-06-30","event":"Clipper DEX launches on Ethereum mainnet, developed by Shipyard Software. Protocol is prefunded with $1 million in alpha liquidity.","source":""},{"date":"2021-07-01","event":"Within two weeks of launch, Clipper reports $14 million per week in trading volume across approximately 1,800 traders and 5,000 transactions.","source":""},{"date":"2023-01-31","event":"Shipyard Software announces $21 million in combined equity and liquidity funding. Polychain Capital leads the equity round. Three Arrows Capital is among the liquidity pledgers (Three Arrows Capital had already collapsed in June 2022).","source":""},{"date":"2024-11-30","event":"Attacker begins exploit on Clipper's Base network pool at approximately 8:22 PM MST, followed by the Optimism pool at approximately 9:15 PM MST.","source":""},{"date":"2024-12-01","event":"Clipper publicly confirms the exploit. Total loss reported at approximately $457,878, affecting Optimism and Base pools and representing roughly 6% of TVL. Swaps and deposits are suspended across all chains. Single-asset withdrawals are disabled.","source":""},{"date":"2024-12-01","event":"Chaofan Shou of security firm Fuzzland publicly alleges the incident resulted from a private key leak. Clipper explicitly denies this characterization, attributing the exploit to a withdrawal function logic vulnerability.","source":""},{"date":"2024-12-04","event":"Clipper publishes official post-mortem detailing the exploit mechanism, root causes including the circuit-breaker database interaction, and remediation plans.","source":""},{"date":"2025-01-15","event":"The attacker voluntarily returns 104 ETH to the Clipper treasury, citing personal health issues for the delay and stating no further vulnerabilities are known to remain. AdmiralDAO begins planning LP refund distribution.","source":""}]},"v":1}