4/5 The hack itself exploited a critical flaw in the verification oracle contract. Attackers manipulated proof submissions to mint fake identities, draining reward pools and governance tokens. No user keys were directly compromised, yet the protocol's core promise of secure personhood verification was shattered. Funds flowed to mixers within minutes, complicating recovery. Post-mortem analysis pointed to missing input sanitization and an unpatched dependency. Unlike typical rug pulls, this was a sophisticated technical breach highlighting how even advanced zk tech fails without rigorous testing. The team later admitted delayed response times worsened the situation, allowing further drainage before freezes could activate.
Hack breakdown:
• Vulnerability: Oracle manipulation via malformed ZK proofs
• Amount stolen: ~$85M equivalent
• Method: Automated scripts bypassing checks
• Aftermath: Contracts paused but too late for many