Zunami Protocol Compromised Admin All Collateral Drained

Notice: This page is a freshly imported case study from an original repository. While the original content had a similar format, some sections may not have been fully completed. Please help fill in any empty sections or any missing information you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Zunami Protocol Logo/Homepage

Zunami Protocol is a decentralized finance platform that optimizes yield by issuing aggregated stablecoins like zunUSD and zunETH, backed by diversified assets managed in omnipools across major DeFi platforms. Governed by ZUN token holders through DAO voting, it offers around 20% APY with automated portfolio rebalancing and strong decentralization features. However, a recent exploit occurred when an attacker gained control of an admin-level wallet, withdrew $500,000 in collateral, and quickly laundered the funds through Tornado Cash. This protocol-level breach was beyond user control, and while the team acknowledged the hack and launched an investigation, reimbursement seems unlikely. The founder continues to probe the incident.

About Zunami Protocol

Zunami Protocol is a decentralized finance (DeFi) platform designed to optimize yield generation through aggregated stablecoins and omnipools. At its core, Zunami issues aggregated stablecoins like zunUSD and zunETH, which are backed by diversified assets in yield-generating strategies across various DeFi protocols. These assets are held in omnipools, which combine liquidity and flexibility, enabling efficient, decentralized, and profitable collateral management.

The omnipools are structured to maximize returns—offering users an average APY of around 20%—by distributing capital across multiple DeFi platforms such as Curve Finance, Convex Finance, Stake DAO, FRAX Finance, and C.R.E.A.M. Finance. The collateral within these pools is managed through DAO voting, ensuring that strategy adjustments are community-driven. Zunami’s Algorithmic Peg Stabilizer (APS) further ensures that stablecoin prices remain steady, automatically rebalancing portfolios and compounding yields.

The ZUN token powers governance and liquidity functions within the ecosystem. Holders can vote on protocol decisions, manage liquidity-as-a-service (LaaS), influence token emissions, and earn rewards through staking. Notably, ZUN stakers act as an additional collateral layer, reinforcing stability and receiving 100% of the protocol’s revenue in return.

Security-wise, Zunami has emphasized decentralization with no proxy contracts, DAO-based risk management, and independent audits. Its open documentation and Gitbook provide full technical transparency. In sum, Zunami Protocol is an innovative approach to stablecoin yield farming—combining aggregation, decentralization, and automated strategy execution.

The Reality

Unfortunately, it appears that the private key for the Zunami Protocol was not held securely.

What Happened

Zunami Protocol was exploited for approximately $500,000 after an attacker gained unauthorized access to a privileged wallet and withdrew collateral backing its stablecoins.

Key Event Timeline - Zunami Protocol Compromised Admin All Collateral Drained

Date	Event	Description
May 14th, 2025 3:42:47 PM MDT	First Emergency Withdrawal Transaction	The first emergency withdrawal transaction on the Ethereum blockchain.
May 14th, 2025 3:52:59 PM MDT	Funds Start Going To TornadoCash	The stolen funds start being cashed out through TornadoCash.
May 15th, 2025 6:32:00 AM MDT	Zunami Protocol Notification Tweet	Zunami Protocol posts on Twitter with a very initial tweet noting that the zunUSD and zunETH have been stolen. They claim to be investigating the situation.
May 16th, 2025 12:18:04 AM MDT	Analysis By Securrtech	Securrtech publishes an analysis of the exploit on Medium. Securrtech’s analysis provides a detailed account of the $500,000 security breach that occurred on May 15, 2025. The report begins with an overview of the incident, noting that the attacker targeted the collateral backing Zunami’s flagship stablecoins, zunUSD and zunETH, and quickly moved the stolen funds through Tornado Cash to obscure their trail.
May 29th, 2025 10:49:00 AM MDT	Update From Founder Sterx	Sterx, the founder of Zunami Protocol, provides a Twitter/X update stating that the team is actively investigating the recent exploit and is considering both possibilities: a compromised deployer wallet or malicious intent by the key holder. They are collaborating with a professional investigator to uncover the root cause and have committed to sharing the full results of the investigation once they become available.
June 10th, 2025 6:33:00 AM MDT	Update From Chief Technology Officer	Zunami Protocol chief technology officer Mikhail Zelenin issued a personal apology for his absence following the hack, explaining he needed time to recover psychologically. He suspects the breach may have stemmed from Russian border police cloning his laptop during a border crossing, gaining access to unsecured source code. Despite transitioning to a DAO, some security updates were overlooked due to limited development resources, and he admits to making critical mistakes while managing the project alone.
June 13th, 2025 10:04:00 AM MDT	Second Rekt Article Published	Rekt News publishes a second article about Zunami Protocol which includes this exploit, after $500k goes missing from the protocol. The chief technology officer Mikhail Zelenin is a primary suspect, however he has a story about border security guards potentially holding his laptop for hours of analysis.

Technical Details

This exploit stemmed from a compromise of privileged access. The attacker appears to have obtained control over an admin-level wallet, which allowed them to withdraw and redeem protocol collateral without triggering traditional safeguards. Once the assets were redeemed, the attacker funneled the resulting ETH through a crypto mixer, effectively concealing their identity.

This was a protocol-level exploit, meaning end users could not have prevented the attack, and no action was required from them during the breach.

Total Amount Lost

Sources all appear to consistently report the amount of the loss at $500k.

The total amount lost has been estimated at $500,000 USD.

Immediate Reactions

It is reported that the team's first reaction on Discord was simply the word "Rekt".

The team later followed up to acknowledge the hack on Twitter/X.

Ultimate Outcome

Funds were moved through TornadoCash within 10 minutes of the exploit. An investigation was started.

Total Amount Recovered

Investigation is ongoing and there does not appear to be any hope of reimbursement.

There do not appear to have been any funds recovered in this case.

Ongoing Developments

The founder is reportedly still investigating the exploit. There are two theories being explored. The CTO Mikhail Zelenin provided an alternate explanation involving border security seizing the funds:

"Guys, I am deeply sorry for not being in contact with the community. It was very hard to receive the hack message again, so I spent some time with a specialist to get my psyche back to normal.

Phil, the founder Kirill has access to the key as well. I personally sent it to him in the beginning. Three of us have keys. My current hypothesis is that during my crossing of the Russian border, my laptop was deeply investigated by Russian police. I am not sure what software they have, but for many hours it was in police possession. All source codes of the protocol were there without cryptographic security.

The second problem is that during the switch to the DAO, the strategies weren't switched because I was sure that I had done it before. Because of the absence of investment in the protocol, I was the only developer and I was trying my best to support it, but I made simple mistakes even though the protocol was fully rewritten for safety.

I still don't have any other hypothesis except the cloning of my hard drive and investigating it at the airport border."

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.