According to figures shared by Cypher Protocol core contributor “Barrett,” the stolen funds included $314,674 in USDT, USDC, and Solana (SOL) that were sent to Binance by a wallet associated with the pseudonymous dev Hoak. In addition, the same wallet amassed over $184,077 in ETH, RLB, ORCA, RAY, USDT, USDC, BONK, JitoSOL, mSOL, and WSOL.
Hoak’s public confession appears to have been triggered by a simmering investigation that began on the Cypher Protocol Discord server. Cypher Protocol is a cross-margin decentralized exchange on the Solana blockchain.
“First and foremost I would like to deeply apologize to all affected parties, I know at this point nothing is going to take back my actions, and I have to face the consequences, [and] I am also in no way, shape, or form attempting to victimize myself,” Hoak wrote. “But this is the culmination of what snowballed into a crippling gambling addiction and probably multiple other psychological factors that went by unchecked for too long.”
In the confession, Hoak said the situation that led to the Cypher Protocol theft dates back to an unexplained event at the first Solana Breakpoint conference in November 2021.
“The victims were my brother and Max from Mango DAO,” Hoak wrote. “Coincidentally, what someone else did to me and my brother was the same thing I ended up doing to Max.”
According to Hoak, after an unnamed previous project failed to get off the ground, he began working with Cypher Protocol, which offers access to margined spot and derivatives markets and borrowing and lending services.
“I’d found my footing with Cypher,” he recalled. “These guys became family to me, I loved them and the mission we had, I worked and worked, I tried to innovate within the DEX design space, I failed, I worked some more, and I broke.”
Cypher Protocol core contributor Barrett subsequently posted details of the theft on Twitter, including Hoak’s wallet address, alleging that the theft happened via 36 withdrawal transactions over months.
“This is incredibly saddening to me,” Barrett wrote. “I never thought this would be a possibility, having a core contributor who stayed on after the [Cypher] exploit to try and rebuild the project be the one who rugged funds from the redemption contract.”
In August of last year, an attacker exploited the Cypher protocol, stealing roughly $1 million in user funds. The so-called redemption contract was an attempt to make good on that loss and repay Cypher users—that is, until a member of Cypher’s own team “rugged” the contract, as Barrett put it.
As Barrett explained, the theft was first detected when a member of the Cypher Protocol Discord server reported that they were unable to withdraw funds, which Hoak said he would resolve. However, the user reported they could not withdraw after the deadline Hoak provided.
“I have reached out to law enforcement with the information in the below document,” Barrett said, posting a link to a Google Docs document containing extensive details about the theft.
Taking to Twitter, Internet Sleuth ZachXBT said he knew Hoak, adding that he helped the Cypher Protocol team with the exploit back in 2023. As a result of that collaboration, ZachXBT said he had Hoak’s personal information.
When Decrypt inquired about whether ZachXBT intended to share that information with law enforcement, he replied, “As needed yes.”
“I currently have no energy left whatsoever and considering no one is going to want anything to do with me after all this, I believe there’s no way forward, and it’s actually over for me,” Hoak wrote. “Whatever comes next is in God’s hands.”
“I’m sorry I fucked up,” his Twitter thread concluded.
