Defrost Finance responds to “exit scam” allegations, denies rug pull.

Until now, Defrost Finance had not publicly commented on the rug-pull allegations in the media.

Defrost Finance, the decentralized trading platform that was the victim of a $12 million hack in the run-up to Christmas, has denied allegations that it “rugged” its users as part of an elaborate “exit scam.”

On December 23, the platform announced that it had been the victim of a flash loan attack, which resulted in the draining of user funds from its V2 protocol. A day later, a hacker stole the admin key for a second, much larger attack on the V1 protocol.

It is believed that the attacker(s) carried out the flash loan attack by including a bogus collateral token and a malicious price oracle to liquidate users.

Observers, including blockchain security firms Peckshield and CertiK, as well as asset management platform DeFiYield, have suggested that may be the members of the team may have been behind the “exit scam” — given that the exploit required an admin key.

However, the team behind Defrost Finance broke its silence on the rug-pull accusations in an exclusive statement to Cointelegraph on December 28, stating: 

“We deny the accusations that the team rugged users. A compromised key does not equate to a rug pull, as much as the episode may raise doubts among the public.”

Defrost’s denial of involvement was based on two key arguments.

First, Defrost claimed that if they had planned to stage a rug pull, they would have done so months ago, when the rug’s total value locked (TVL) approached $200 million.

On December 23, Defrost Finance’s TVL had dropped to just $13.14 million, that is the day of the first attack, according to DefiLlama.

“Anyone behind a rug pull would have probably defrauded investors when our TVL was 15 times what it is today.”

Second, Defrost contended that if they were the perpetrators, they would have “fled” long ago, which they haven’t.

“Anyone anticipating the inevitable attention from the crypto community would have fled long ago. Yet here we are, working to return the funds to their rightful owners,” the statement said.

Defrost Finance’s announcement came just hours after DeFiYield, a decentralized finance investment platform, accused Defrost Finance of “rug pulling” its users in a Medium blog post on December 27.

DeFiYield cited on-chain data claiming that the creator of the multi-sig wallet was the same address that requested and later approved the transactions that inserted the malicious source oracle that liquidated users.

It also claimed that the developers behind Defrost Finance were the same as those behind Pheonix Finance (FinNexus), which was exploited for $7.6 million in what some speculated was an “inside job” in May 2021.

Defrost stated that it regrets not being able to share more information about the attack because its top priority has been assisting users in reclaiming their funds.

“There are several issues that we would like to address in recent Defrost Finance reports. We regret that we cannot go into enough detail — but the community will understand that this is a sensitive matter, and our priority must be to assist our users in retrieving their funds. “All other concerns are secondary,” it stated.

Defrost is clearly upset about the allegations, and earlier today it warned members of its Telegram group that it will ban anyone who attempts to spread the “false narrative” that the team is to blame for the recent attacks.

“At this point, it’s not conducive to moving forward to continue allowing the public chats to operate like the Wild Wild West. Will be enforcing stricter protocols.”

On December 26, Defrost announced on Twitter that it had recovered all of the funds stolen in the V1 hack and that it had begun the process of returning funds to affected users hours later.

The Ethereum wallet controlled by Defrost, which is being used to facilitate the return of funds, currently shows that $2.9 million in Ether and $9.9 million in Dai have been returned.

“This will take a little time since we need to map who had what and where, but the wheels are turning fast and the entire process will be managed through smart contracts. “It will be completely transparent and fairly quick,” Defrost said in a recent statement.

However, no information on the V2 protocol has been released as of yet.