Brinc Finance BRC Smart Contract rescueTokens Drain

Notice: This page is a freshly imported case study from an original repository. While the original content had a similar format, some sections may not have been fully completed. Please help fill in any empty sections or any missing information you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Brinc Finance Logo/Graphics

Brinc Finance introduced $BRC as a transparent, crypto-backed alternative to volatile cryptocurrencies and opaque stablecoins, using a bonding curve model that increases the token’s price with every purchase and ensures on-chain reserve backing with BTC, ETH, or DAI. However, on December 14, 2021, the platform suffered a major exploit when over $1 million in tokens were drained from its staking contract, using private keys know by its Head of Development, Daniel Choi. After the incident, Choi became unresponsive, retained legal counsel, and was named in a civil case by Brinc.fi, which remains unresolved as of March 2024. Despite pledging to compensate users and restore the platform, no viable recovery plan materialized, and Brinc.fi has since gone largely inactive, with its online presence disappearing and its promises unfulfilled.

About Brinc Finance

Brinc Finance introduces $BRC, a bonding curve token designed as an alternative to volatile cryptocurrencies and opaque stablecoins. Unlike Bitcoin, which suffers from extreme price swings due to its lack of intrinsic value, or stablecoins like Tether that offer no growth potential and questionable transparency, $BRC offers a new model. It is 100% backed by on-chain reserves of BTC, ETH, or DAI, and operates with complete transparency, allowing anyone to verify the reserves at any time.

Brinc Finance solves the issues of crypto volatility and opaque reserves by using a bonding curve pricing model. Every purchase of $BRC through its smart contract increases the token’s price, meaning early adopters benefit from continuous upward price movement. This algorithmic pricing also ensures that the token’s value cannot fall below the amount of crypto held in reserve. The system guarantees that price discovery is built into the protocol and visible on-chain, giving users full insight and eliminating reliance on centralized trust.

The bonding curve approach used by Brinc differs from how it’s typically applied in DeFi for automated market making and liquidity pools, as seen with projects like Uniswap or Balancer. Instead, Brinc uses the curve to determine the intrinsic value of its native token, creating a predictable, transparent, and appreciation-oriented asset. Brinc Finance aims to redefine the way tokens are issued and valued in decentralized finance, offering a more sustainable and transparent alternative to fiat-pegged stablecoins.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The private key of an internal developer with full contract access transferred control to an external address, enabling over $1 million in tokens to be drained and laundered through Tornado Cash.

Key Event Timeline - Brinc Finance BRC Smart Contract rescueTokens Drain

Date	Event	Description
December 13th, 2021 6:59:04 PM MST	Smart Contract Owner Transferred	The owner transferred the ownership of the Brinc staking contract to a new address.
December 13th, 2021 7:02:48 PM MST	Transfer ETH For Fees	Transfer of 0.5 ETH believed to be to pay for gas fees.
December 13th, 2021 7:05:14 PM MST	New Staking Contract Deployed	A new Brinc staking contract is deployed.
December 13th, 2021 7:05:56 PM MST	Implementation Address Changed	The implementation address is changed to the newly deployed staking smart contract.
December 13th, 2021 7:09:01 PM MST	All BRC Tokens Drained	The rescueTokens function is used to drain all the gBRC tokens from the smart contract.
December 13th, 2021 7:09:58 PM MST	All gBRC Tokens Drained	The rescueTokens function is used to drain all the gBRC tokens from the smart contract.
December 16th, 2021 11:38:45 PM MST	Brinc Finance Postmortem	Brinc Finance publishes a detailed post-mortem of the December 14, 2021 exploit, revealing that over $1 million in BRC and gBRC tokens were drained from the staking contract and converted to ETH. The attack was linked to their own Head of Development, who had exclusive control over the contract and has since become unresponsive, seeking legal representation. The team has revoked his access, initiated legal action, and is addressing security vulnerabilities. Brinc has disabled staking and committed to rebuilding trust while planning further updates to support affected users.
December 21st, 2021 10:01:19 PM MST	Brinc Updates Plans Moving Forward	Brinc Finance publishes an update acknowledging the distress caused by a recent exploit and outlines its ongoing recovery and future plans. The team has reported the incident to federal law enforcement and continues to pursue the uncooperative suspect. Affected users will be compensated using treasury assets, with further compensation options and a relaunch in the works. A snapshot of all staked assets has been planned for transparency, and more detailed audit and repayment information will follow. Brinc Finance remains committed to making things right and continuing the project.
April 3rd, 2023 3:07:00 AM MDT	Brinc Finance Rebrands To Brink X	A public rebranding campaign.
May 14th, 2025 10:25:00 AM MDT	Rekt News Article	Rekt News publishes their article about the situation.

Technical Details

"On Dec. 14th, 2021 UTC, a series of actions/transactions occurred, resulting in the loss of all tokens in the staking contract (BRC & gBRC)." "The only person within our team that had full authority over the staking contract, was our Head of Development."

Total Amount Lost

"The attacker gained 292 ETH (worth over $1 million)"

The total amount lost has been estimated at $1,105,000 USD.

Immediate Reactions

"Brinc.fi worked with Certik to investigate the incident and prepared the following initial report.

After the exploit, [the Head of Development] hasn’t been responsive to our questions and investigations. As the Head of Development, he had the responsibility to keep the contract secure. After continuous attempts to establish contact with him since the event, he has chosen to get legal representation in the form of an attorney. We will be exploring all legal avenues to resolve this issue.

More urgently, we have removed his rights/permissions and blocked this person’s access to any of our code and internal information. Additionally, we will fix the security issues that have led to this event and will be including additional security measures. Until we do, staking on Brinc.fi will be disabled. Users who attempt to stake directly via the contract will do so at their own risk."

Ultimate Outcome

The Brinc.fi team suspected the former head of development, Daniel Choi, as the individual responsible for the exploit. Following the incident, Choi was unresponsive and retained legal representation, prompting Brinc.fi to pursue a civil case against him for theft and fraud. As of March 5, 2024, a deposition was conducted, but Choi did not answer all questions, and the deposition was adjourned due to his health concerns. The civil case remains ongoing, with Brinc.fi continuing its efforts to hold Choi accountable.

Total Amount Recovered

The Brinc.fi team reports a desire for users to be made whole. However, no concrete plans were ever proposed or implemented that didn't involve Choi returning funds.

There do not appear to have been any funds recovered in this case.

Ongoing Developments

While Brinc Finance appears to no longer have a website, Twitter, or active Telegram, they promised 'The team is committed to doing whatever we can to make it right. We’re not giving up on the project and our vision.".

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.