Verify a decision

{"actor":"system:backfill","investigation_id":"e1f52b35-22bd-40ff-b8ca-12bded5dbd8d","kind":"publish","page_slug":"xtoken","published_at":"2026-05-26T03:49:41.094Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"xToken","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://medium.com/xtoken/introducing-xtoken-2fd50d0f943b","type":"other","url":""},{"credibility":3,"name":"https://tracxn.com/d/companies/xtokenmarket/__dtK8Ocu4Lkbht1eagx29wYdwwxbeIzmi0c4gIV1rRX0","type":"other","url":""},{"credibility":3,"name":"https://www.defipulse.com/blog/founder-fireside-chat-with-michael-j-cohen-of-xtoken","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coindesk.com/markets/2021/05/12/defi-protocol-xtoken-suffers-245m-exploit","type":"other","url":""},{"credibility":3,"name":"https://www.theblock.co/post/104667/defi-protocol-xtoken-exploit-attack","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/xtoken-rekt","type":"other","url":""},{"credibility":3,"name":"https://medium.com/xtoken/initial-report-on-xbnta-xsnxa-exploit-d6e784387f8e","type":"other","url":""},{"credibility":3,"name":"https://web3isgoinggreat.com/?id=2021-05-12-0","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-xtoken-hack-august-2021","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/xtoken-rekt-x2","type":"other","url":""},{"credibility":3,"name":"https://medium.com/xtoken/xsnx-post-mortem-666d35071f38","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/beleaguered-defi-project-xtoken-suffers-second-major-exploit-since-may","type":"other","url":""},{"credibility":3,"name":"https://coingeek.com/xtoken-defi-protocol-loses-7m-in-yet-another-exploit/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://beincrypto.com/xtoken-proposes-compensation-after-25m-defi-hack/","type":"other","url":""},{"credibility":3,"name":"https://gov.xtoken.cafe/t/proposal-for-compensation-for-xtoken-hack/109","type":"other","url":""},{"credibility":3,"name":"https://coingeek.com/xtoken-defi-protocol-loses-7m-in-yet-another-exploit/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://rekt.news/xtoken-rekt","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-xtoken-hack-august-2021","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/xtoken-rekt-x2","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://beincrypto.com/xtoken-proposes-compensation-after-25m-defi-hack/","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/beleaguered-defi-project-xtoken-suffers-second-major-exploit-since-may","type":"other","url":""},{"credibility":3,"name":"https://medium.com/xtoken/xtoken-2-0-a8e8db69eefd","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/xtoken","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://rekt.news/xtoken-rekt","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/xtoken-rekt-x2","type":"other","url":""}]}],"sources_used":[],"summary":"xToken (XTK) was a DeFi protocol offering wrapped staking tokens and liquidity management on Ethereum, founded by Michael J. Cohen in 2020. The protocol suffered two major flash loan exploits in 2021 — a $24.5 million attack in May and a $4.5 million attack in August — resulting in total losses exceeding $29 million and the permanent retirement of its flagship xSNX product. The XTK governance token subsequently lost approximately 99.84% of its value, and compensation paid to victims was significantly below the amounts stolen.","timeline":[{"date":"2020-09-10","event":"xToken completes its first funding round, raising funds toward a total of $3 million across two rounds. Protocol founded by Michael J. Cohen in Brooklyn, NY.","source":""},{"date":"2021-05-12","event":"xToken suffers its first major exploit. An attacker borrows 61,833 ETH via dYdX flash loan and exploits vulnerabilities in both xBNTa (invalid mint path) and xSNXa (oracle manipulation via Uniswap v2 / Kyber). Approximately $24.5 million is drained from Bancor and Balancer liquidity pools. Assets stolen include ~2,400 ETH, 781,000 BNT, 407,000 SNX, and 1.9 billion xBNTa tokens. xToken pauses minting across all contracts.","source":""},{"date":"2021-05-16","event":"xToken proposes a compensation plan offering 1% of XTK supply to hack victims, vested over one year. Community feedback leads to an upward revision to 2% (~20 million tokens, worth approximately $3.84 million at prevailing prices — roughly 15% of the stolen amount).","source":""},{"date":"2021-08-29","event":"xToken suffers its second major exploit. An attacker exploits an access control bug in the xSNXAdmin callFunction (using `require(sender==address(this))` instead of verifying the dYdX flash loan caller). The attacker borrows 25,000 ETH from dYdX and 1 million SNX from Aave, manipulates SNX price, and extracts approximately $4.5 million from xSNX holders.","source":""},{"date":"2021-08-30","event":"xToken announces permanent retirement of the xSNX product and pledges a second XTK-based compensation program for affected users. XTK is trading at approximately $0.12, down ~90% from its April 2021 peak of ~$1.36.","source":""},{"date":"2022-03-01","event":"xToken launches xToken Terminal, a rebranded capital markets and liquidity management platform for Web3 projects, representing an attempted pivot away from staking token products.","source":""},{"date":"2024-01-01","event":"XTK token trades at approximately $0.0000244 — a decline of approximately 99.84% from its all-time high. Market capitalization falls below $10,000. Protocol never recovers meaningful total value locked (TVL).","source":""}]},"v":1}