Verify a decision

{"actor":"system:backfill","investigation_id":"92e0c575-a6d1-42dd-81e7-240757082fb7","kind":"publish","page_slug":"sweat-economy-sweat-protocol","published_at":"2026-06-15T12:19:43.845Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Sweat Economy (SWEAT Protocol)","sections":[{"content":"Sweat Economy is the crypto arm of Sweatcoin, a mobile fitness app founded in 2015 by Oleg Fomenko, Anton Derlyatka, and Egor Khmelev. The app rewards users for walking and physical activity. In September 2022, Sweat Economy launched the SWEAT token on NEAR Protocol via a Token Generation Event (TGE), enabling users to convert earned in-app sweatcoins into SWEAT cryptocurrency at a rate of 1,000 steps per SWEAT token. Users manage tokens through the Sweat Wallet application. The project selected NEAR Protocol for its low transaction fees, scalability, and eco-friendly consensus mechanism. As of the TGE, the Sweatcoin app had approximately 35 million active users; the broader user base has since grown to over 120 million registered accounts. In July 2022, Sweat Economy raised $13 million in a private token sale led by Electric Capital, Spartan Capital, OKX Blockdream Ventures, Goodwater Capital, and GSR Ventures.","heading":"Protocol Overview","severity":"low","sources":[{"credibility":1,"name":"CoinDesk: Health and Fitness App Sweat Economy Raises $13M in Private Token Sale","type":"news_article","url":"https://www.coindesk.com/business/2022/07/28/health-and-fitness-app-sweat-economy-raises-13m-in-private-token-sale-to-move-to-web3"},{"credibility":1,"name":"Sweat Economy Official About Page","type":"official","url":"https://sweateconomy.com/about"},{"credibility":2,"name":"CoinGecko: What is SWEAT and Sweatcoin?","type":"research","url":"https://www.coingecko.com/learn/what-is-sweat-sweatcoin-sweat-economy"}]},{"content":"On April 29, 2026, at approximately 13:36 UTC, an unidentified attacker exploited a vulnerability in the SWEAT token contract deployed on NEAR Protocol. Within approximately 30 seconds, the attacker drained approximately 13.71 billion SWEAT tokens from multiple Sweat Foundation-linked wallets and the top 100 holder accounts, representing approximately 65% of the total token supply. The drained tokens were estimated at approximately $3.46 million in value at the time of the attack. Blockchain security firm Blockaid detected and publicly flagged the exploit in real time, identifying the attacker's on-chain address as 3be304b2151870b2be88b9de0b80acab921337ad152584138bd852fc6e9ae018, with the largest exploit transaction recorded as DvrSMfY85Anc6AuLUmoEDkDdab7qX5NUZLu76HN8NoPn. The attacker deployed a purpose-built Rust drainer contract described by reporting as an 'exploit-resolve' module, indicating pre-attack preparation and a high degree of automation. Drained funds were aggregated into a primary address holding approximately $2.68 million worth of tokens, with a secondary staging address holding approximately $761,000. The attacker attempted to liquidate stolen tokens through Ref Finance, a NEAR-native decentralized exchange, and cross-chain bridge infrastructure including Wormhole and Portal Bridge. The specific access control or logic vulnerability in the Rust-based SWEAT token contract has not been publicly disclosed as of the date of this report; the Sweat Foundation committed to a detailed forensic post-mortem that had not been published at the time of this writing.","heading":"April 2026 Smart Contract Exploit","severity":"critical","sources":[{"credibility":1,"name":"The Block: SWEAT protocol thwarts multi-million dollar exploit, restores user balances","type":"news_article","url":"https://www.theblock.co/post/399498/sweat-protocol-thwarts-multi-million-dollar-exploit-restores-user-balances"},{"credibility":2,"name":"NullTx: 13.71 Billion SWEAT Tokens Drained In Seconds From Multiple Foundation Wallets","type":"news_article","url":"https://nulltx.com/13-71-billion-sweat-tokens-drained-in-seconds-from-multiple-foundation-wallets-in-an-exploit-of-mass-penetration/"},{"credibility":2,"name":"Crypto Times: Sweat Economy Tokens Worth Over $2M Drained in Reported Attack","type":"news_article","url":"https://www.cryptotimes.io/2026/04/30/sweat-economy-tokens-worth-over-2m-drained-in-reported-attack/"},{"credibility":2,"name":"FinanceFeeds: SWEAT Protocol Restores Funds After $3.5M Exploit Drains 65% of Supply","type":"news_article","url":"https://financefeeds.com/sweat-protocol-restores-funds-after-3-5m-exploit-drains-65-of-supply/"},{"credibility":2,"name":"Phemex News: SweatEconomy Attacked — 65% of SWEAT Tokens Stolen","type":"news_article","url":"https://phemex.com/news/article/sweateconomy-suffers-major-attack-65-of-sweat-tokens-stolen-77473"}]},{"content":"The Sweat Foundation responded rapidly to the exploit. The SWEAT token contract was paused immediately upon detection to prevent further unauthorized transfers. The Foundation contacted MEXC exchange after the attacker attempted to liquidate stolen tokens on that platform; MEXC froze the attacker's account, preventing further liquidation. Rhea Finance, a NEAR-based liquidity protocol, halted SWEAT trading to restrict the attacker's ability to convert stolen tokens. As a result of these coordinated measures, all external user account balances were fully restored. A patched token contract was subsequently deployed and normal operations resumed. Recovery was confirmed by approximately May 4, 2026. The Sweat Foundation publicly credited MEXC with enabling 100% fund recovery. The Foundation also committed to filing a formal incident report with law enforcement and conducting a comprehensive forensic analysis to produce a detailed post-mortem report; neither had been published as of the date of this writing.","heading":"Incident Response and Fund Recovery","severity":"high","sources":[{"credibility":2,"name":"CoinCentral: SWEAT Protocol Restores Balances After Exploit Drains 13.7 Billion Tokens","type":"news_article","url":"https://coincentral.com/sweat-protocol-restores-balances-after-exploit-drains-13-7-billion-tokens/"},{"credibility":2,"name":"Outposts: SWEAT Token Exploit Resolved — All User Funds Safe After Top 100 Accounts Drained","type":"news_article","url":"https://outposts.io/article/sweat-token-exploit-resolved-all-user-funds-safe-after-top-7039875d-f6c7-423e-b952-a9cf94d82808"},{"credibility":2,"name":"BSCN: Sweat Economy Recovers All Drained Funds After Attacker Steals 67% Of Token Supply On Near","type":"news_article","url":"https://bsc.news/news/sweat-economy-recovers-funds-near-exploit"},{"credibility":2,"name":"MEXC News: SWEAT Protocol Restores Balances After Exploit Drains 13.7 Billion Tokens","type":"news_article","url":"https://www.mexc.com/news/1063339"}]},{"content":"The SWEAT token launched in September 2022 and reached an all-time high of approximately $0.0181 in March 2024. By May 2026, the token reached a low of approximately $0.000177, a decline of more than 99% from its all-time high. As of June 2026, the market capitalization of SWEAT is approximately $6.56 million with roughly 8.5 billion tokens in circulation, placing it outside the top 1,300 tokens by market cap. The exploit contributed to significant downward price pressure around the event date. The scale of the drain — approximately 65% of supply controlled momentarily by a single attacker — represents an extreme concentration risk event regardless of the outcome. The fact that all drained tokens were concentrated in Sweat Foundation-linked wallets and the top 100 holders also raises questions about the degree to which foundation-controlled supply dominated the circulating token economy at the time.","heading":"Token Market Impact","severity":"high","sources":[{"credibility":2,"name":"CoinLore: Sweatcoin - Sweat Economy Historical Prices","type":"research","url":"https://www.coinlore.com/coin/sweatcoin-sweat-economy/historical-data"},{"credibility":2,"name":"CoinMarketCap: SWEAT Price Today","type":"research","url":"https://coinmarketcap.com/currencies/sweat-economy/"}]},{"content":"The exploit exposed several risk factors relevant to ongoing assessment of the protocol. First, a Rust-based NEAR smart contract powering the primary token contained a critical vulnerability that allowed wholesale draining of the largest accounts in approximately 30 seconds, suggesting either an access control flaw or an unauthorized call path in the contract logic. Second, the concentration of the vast majority of the token supply in foundation-controlled wallets and the top 100 holder accounts created a single point of failure: a single malicious contract interaction could drain most of the circulating supply at once. Third, the precise vulnerability has not been publicly disclosed, and no completed forensic post-mortem had been published as of the date of this report. Fourth, while MEXC's intervention was credited as the key recovery mechanism, recovery relied on the willingness and speed of a centralized exchange to act — a dependency that may not be reproducible in future incidents. The Sweat Foundation has not publicly disclosed whether an independent security audit of the patched contract has been completed.","heading":"Security Posture and Outstanding Risk Factors","severity":"high","sources":[{"credibility":1,"name":"The Block: SWEAT protocol thwarts multi-million dollar exploit, restores user balances","type":"news_article","url":"https://www.theblock.co/post/399498/sweat-protocol-thwarts-multi-million-dollar-exploit-restores-user-balances"},{"credibility":2,"name":"FinanceFeeds: SWEAT Protocol Restores Funds After $3.5M Exploit Drains 65% of Supply","type":"news_article","url":"https://financefeeds.com/sweat-protocol-restores-funds-after-3-5m-exploit-drains-65-of-supply/"}]}],"sources_used":[{"credibility":1,"name":"The Block: SWEAT protocol thwarts multi-million dollar exploit, restores user balances","type":"news_article","url":"https://www.theblock.co/post/399498/sweat-protocol-thwarts-multi-million-dollar-exploit-restores-user-balances"},{"credibility":1,"name":"CoinDesk: Health and Fitness App Sweat Economy Raises $13M in Private Token Sale","type":"news_article","url":"https://www.coindesk.com/business/2022/07/28/health-and-fitness-app-sweat-economy-raises-13m-in-private-token-sale-to-move-to-web3"},{"credibility":2,"name":"NullTx: 13.71 Billion SWEAT Tokens Drained In Seconds From Multiple Foundation Wallets","type":"news_article","url":"https://nulltx.com/13-71-billion-sweat-tokens-drained-in-seconds-from-multiple-foundation-wallets-in-an-exploit-of-mass-penetration/"},{"credibility":2,"name":"CoinCentral: SWEAT Protocol Restores Balances After Exploit Drains 13.7 Billion Tokens","type":"news_article","url":"https://coincentral.com/sweat-protocol-restores-balances-after-exploit-drains-13-7-billion-tokens/"},{"credibility":2,"name":"Crypto Times: Sweat Economy Tokens Worth Over $2M Drained in Reported Attack","type":"news_article","url":"https://www.cryptotimes.io/2026/04/30/sweat-economy-tokens-worth-over-2m-drained-in-reported-attack/"},{"credibility":2,"name":"FinanceFeeds: SWEAT Protocol Restores Funds After $3.5M Exploit Drains 65% of Supply","type":"news_article","url":"https://financefeeds.com/sweat-protocol-restores-funds-after-3-5m-exploit-drains-65-of-supply/"},{"credibility":2,"name":"BSCN: Sweat Economy Recovers All Drained Funds After Attacker Steals 67% Of Token Supply On Near","type":"news_article","url":"https://bsc.news/news/sweat-economy-recovers-funds-near-exploit"},{"credibility":2,"name":"Outposts: SWEAT Token Exploit Resolved — All User Funds Safe After Top 100 Accounts Drained","type":"news_article","url":"https://outposts.io/article/sweat-token-exploit-resolved-all-user-funds-safe-after-top-7039875d-f6c7-423e-b952-a9cf94d82808"},{"credibility":2,"name":"Phemex News: SweatEconomy Attacked — 65% of SWEAT Tokens Stolen","type":"news_article","url":"https://phemex.com/news/article/sweateconomy-suffers-major-attack-65-of-sweat-tokens-stolen-77473"},{"credibility":2,"name":"MEXC News: SWEAT Protocol Restores Balances After Exploit Drains 13.7 Billion Tokens","type":"news_article","url":"https://www.mexc.com/news/1063339"},{"credibility":2,"name":"Tekedia: Sweat Economy on NEAR Protocol Exploited, Draining 13.71B Sweat Tokens","type":"news_article","url":"https://www.tekedia.com/sweat-economy-on-near-protocol-exploited-draining-13-71b-sweat-tokens/"},{"credibility":1,"name":"Sweat Economy Official About Page","type":"official","url":"https://sweateconomy.com/about"},{"credibility":2,"name":"CoinGecko: What is SWEAT and Sweatcoin?","type":"research","url":"https://www.coingecko.com/learn/what-is-sweat-sweatcoin-sweat-economy"},{"credibility":2,"name":"CoinLore: Sweatcoin - Sweat Economy Historical Prices","type":"research","url":"https://www.coinlore.com/coin/sweatcoin-sweat-economy/historical-data"},{"credibility":2,"name":"CoinMarketCap: SWEAT Price Today","type":"research","url":"https://coinmarketcap.com/currencies/sweat-economy/"}],"summary":"Sweat Economy is a move-to-earn protocol on NEAR Protocol that rewards users with SWEAT tokens for physical activity, built on top of the Sweatcoin app which has over 120 million registered users. On April 29, 2026, the SWEAT token contract on NEAR was exploited via a Rust smart contract vulnerability, allowing an attacker to drain approximately 13.71 billion SWEAT tokens — roughly 65% of total supply — valued at approximately $3.5 million, within 30 seconds. The Sweat Foundation coordinated with MEXC exchange and Rhea Finance to freeze attacker funds and ultimately restored all external user balances, with a patched contract subsequently deployed.","timeline":[{"date":"2015-01-01","event":"Sweatcoin app founded by Oleg Fomenko, Anton Derlyatka, and Egor Khmelev.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2022/07/28/health-and-fitness-app-sweat-economy-raises-13m-in-private-token-sale-to-move-to-web3"},{"date":"2022-07-28","event":"Sweat Economy raises $13 million in a private token sale led by Electric Capital, Spartan Capital, OKX Blockdream Ventures, Goodwater Capital, and GSR Ventures.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2022/07/28/health-and-fitness-app-sweat-economy-raises-13m-in-private-token-sale-to-move-to-web3"},{"date":"2022-09-12","event":"SWEAT token generation event (TGE) launches on NEAR Protocol. Users can create in-app NEAR wallets and begin earning SWEAT tokens at a rate of 1,000 steps per token.","source":"CoinGecko","source_url":"https://www.coingecko.com/learn/what-is-sweat-sweatcoin-sweat-economy"},{"date":"2024-03-01","event":"SWEAT token reaches its all-time high of approximately $0.0181.","source":"CoinLore Historical Prices","source_url":"https://www.coinlore.com/coin/sweatcoin-sweat-economy/historical-data"},{"date":"2026-04-29","event":"At approximately 13:36 UTC, an attacker exploits a vulnerability in the NEAR-based SWEAT token contract using a purpose-built Rust drainer contract. Approximately 13.71 billion SWEAT tokens (65% of total supply, ~$3.46 million) are drained from foundation-linked wallets and the top 100 holder accounts within roughly 30 seconds. Blockchain security firm Blockaid detects and flags the exploit in real time.","source":"The Block","source_url":"https://www.theblock.co/post/399498/sweat-protocol-thwarts-multi-million-dollar-exploit-restores-user-balances"},{"date":"2026-04-29","event":"Sweat Foundation pauses the SWEAT token contract immediately after detection. MEXC exchange freezes the attacker's account. Rhea Finance halts SWEAT trading on its NEAR-based liquidity platform.","source":"CoinCentral","source_url":"https://coincentral.com/sweat-protocol-restores-balances-after-exploit-drains-13-7-billion-tokens/"},{"date":"2026-04-30","event":"Initial news coverage of the exploit is published. Dollar value of drained tokens reported as between $2 million and $3.5 million across outlets.","source":"Crypto Times","source_url":"https://www.cryptotimes.io/2026/04/30/sweat-economy-tokens-worth-over-2m-drained-in-reported-attack/"},{"date":"2026-05-04","event":"Full recovery of all external user balances confirmed. Sweat Foundation deploys a patched token contract and resumes normal operations. MEXC credited for enabling 100% fund recovery.","source":"Outposts","source_url":"https://outposts.io/article/sweat-token-exploit-resolved-all-user-funds-safe-after-top-7039875d-f6c7-423e-b952-a9cf94d82808"},{"date":"2026-05-01","event":"SWEAT token reaches a new low of approximately $0.000177, reflecting post-exploit market pressure.","source":"CoinLore Historical Prices","source_url":"https://www.coinlore.com/coin/sweatcoin-sweat-economy/historical-data"}]},"v":1}