$10 000 000 USD

JANUARY 2022

GLOBAL

ARBIX FINANCE

DESCRIPTION OF EVENTS

"Arbix Finance labelled themselves as an arbitrage-focused project on BSC, in which users could deposit into single-asset vaults in order “to gain optimal yield with low risk”."

 

"Arbix Finance is a yield farming platform on Binance Smart Chain utilizing Arbitrage Earning Protocol to gain optimal yield with low risk." "Arbitrage Earning Protocol takes the vaults' liquidity to make profit against DEXs (e.g. pancakeswap, apeswap, etc..) The profit occurs when there are same-asset price discrepancies among the DEXs."

 

"Under Arbix Finance users can deposit BEP20 token assets into the vaults and reap competitive profits. Unlike many yield farming platforms, users do not have to concern about impermanent loss since all of the vaults are single-asset."

 

"Despite providing the project’s audit in November of last year, and marking all major or critical issues as resolved, Certik decided to publish a basic incident analysis."

 

"The exploited contract was not in the audit scope that was done for Arbix. The project inserted eight `mint()` functions to a newly deployed ARBX ERC20 contract which allowed the owner to mint any amount of ARBX tokens to any address."

 

"We’ve received inbounds that may indicate high risks regarding to a project named Arbix Finance. Privileged functionalities appear in those smart contracts and we wish the community DYOR enough before interacting with the dApp."

 

"Steer clear from Arbix Finance says @certikorg after the firm identified the BSC-based yield farming protocol as a rug pull."

 

"Basically @certik_io @certikorg audited and proudly certified Arbix Finance to have a multi-signature mechanism to approve funds management without even KYC them. They alerted the investors after the devs already rug pulled the TVL."

 

"#Arbix Finance has been identified as #rugpull. Privileged functionalities appear in the identified smart contracts."

 

"The funds deposited by users ($10M) were directed to unverified pools via the depositor contract."

 

"$ARBX contract has mint() with onlyOwner function. 10M $ARBX were minted to 8 addresses. ~4.5M ARBX were minted to: 0x161262d172699cf0a5e09b6cdfa5fee7f32c183d. The 4.5M ARBX were then dumped."

 

"Also stolen were: $920k Binance-pegged ETH, $2.25M in BSC-USD, $1.7M BUSD, $1.4M CAKE, $1M BSC-USDC, As well as lesser amounts of ADA, DOT, DOGE, LINK, XRP and WBNB."

 

"Starting around 3 AM +UTC on Jan 4th, the project drained the vaults of users’ funds and deleted their website, Twitter and Telegram accounts."

 

"Using the platform’s Skytrace tool to analyze the risk of fraud, the firm determined that the hacker moved the funds to Ethereum through decentralized exchange AnySwap USDT."

 

Explore This Case Further On Our Wiki

Arbix Finance was a yield farming smart contract, which was audited by CertiK. However, funds were deposited instead on an unaudited smart contract which featured additional centralized mint functions for the owner. This enabled the full $10m which had been invested to be stolen. The website and other social media have been removed. There does not appear to be any proposal for recovery.

Sources And Further Reading

 For questions or enquiries, email info@quadrigainitiative.com.

Get Social

  • email
  • reddit
  • telegram
  • Twitter

© 2019 - 2025 Quadriga Initiative. Your use of this site/service accepts the Terms of Use and Privacy Policy. This site is not associated with Ernst & Young, Miller Thompson, or the Official Committee of Affected Users. Hosted in Canada by HosterBox.