First: who's telling this story
Full disclosure before anything else. This website sits on zabu.finance — the domain that hosted the original Zabu Finance protocol. The farm is gone. There's no token to buy here, no app to connect a wallet to, and nothing to invest in. Today the domain is an educational magazine about Avalanche DeFi and security; the reasoning behind that choice is on our About page.
We're telling this story because the domain owes it to the people who lived through it, and because it remains one of the clearest security lessons in Avalanche history. No spin. Here's what happened.
What Zabu Finance was
Zabu Finance launched in August 2021, right in the middle of Avalanche's farming gold rush. It was a yield farm: you deposited tokens — including LP tokens from Trader Joe and Pangolin — and earned the protocol's own ZABU token as a reward. If that loop is new to you, our yield farming guide walks through it step by step.
The site looked the part. A MetaMask connect button, farm and pool pages, token logos, an audit badge in the footer. In the frantic weeks after Avalanche Rush began, millions of dollars flowed in. Deposits worked. Rewards dripped. Everything ran fine — for about a month.
The timeline, start to finish
| Date | Event |
|---|---|
| August 2021 | Zabu Finance launches its farm on Avalanche; deposits climb into the millions |
| September 12, 2021 | An attacker exploits a transfer-fee accounting flaw and mints a gigantic pile of ZABU |
| Same day | The attacker dumps the tokens into liquidity pools, pulling out roughly $3.2 million |
| Hours later | ZABU's price collapses to effectively zero; the team confirms the exploit publicly |
| Late 2021 | Talk of compensation and a relaunch fades; site activity winds down by December |
It was widely reported at the time as one of the first major exploits on Avalanche. Not a "first" anyone wanted on their résumé.
How the exploit worked, in plain English
The bug wasn't exotic. It was bookkeeping.
Some tokens charge a fee on every transfer — send 100, and only 96 arrive, with the rest burned or redirected. Zabu's farm had a pool contract meant for exactly this kind of token; the code called the type spTaxToken. The fatal detail: on deposit, the contract wrote down the amount you sent, not the amount that actually arrived after the fee.
A tiny gap on paper. Here's how the attacker turned it into $3.2 million:
- Deposit a transfer-fee token into the farm. The contract credits more than it really received.
- Withdraw the full credited amount — quietly draining a little of what everyone else deposited.
- Loop the deposit-withdraw cycle again and again, each pass bending the farm's internal numbers further from reality.
- Use the broken accounting to claim an absurd amount of ZABU rewards — billions of tokens, minted in moments.
- Sell it all into the ZABU liquidity pools on Avalanche's exchanges, walking away with roughly $3.2 million in other tokens and leaving ZABU worthless.
No stolen keys. No phishing email. The contract did exactly what it was written to do — that's what made the loss so hard to argue with, and so instructive.
The lessons that outlived the token
The postmortems at the time all pointed the same directions, and every one of them still holds:
- Audit badges aren't armor. The project displayed an audit badge; the flaw shipped anyway. An audit lowers risk. It doesn't remove it, and it never guarantees the whole system was reviewed.
- Weird tokens break naive math. Transfer-fee tokens have wrecked many protocols the same way, before Zabu and since. Any contract that assumes "sent" equals "received" is a countdown timer.
- TVL is not a safety score. Millions in deposits just means a bigger prize behind the same lock.
- Speed cuts both ways. The fast, cheap chain that made farming fun also let one attacker loop the flaw many times within minutes.
Was it a rug pull? No — insiders didn't do this; an outside attacker did. From a depositor's chair, though, the distinction is cold comfort: the money's gone either way. We cover the deliberate kind in our rug-pull guide, and here's the uncomfortable truth — the checks in that guide would not have caught this bug. Contract risk survives every checklist. That's why position size is the defense of last resort.
What really happened, in one paragraph
A month-old Avalanche farm credited deposits it never fully received. One attacker noticed, looped the flaw, minted billions of ZABU, and sold them for about $3.2 million while the token's price fell to nothing. Depositors lost the value of their rewards, ZABU holders lost nearly everything, and the protocol faded out within months — part of the same boom-and-bust arc told in our Avalanche DeFi history. The domain survived, and telling this story straight is the whole reason the current site exists. Consider it a $3.2 million lesson, offered to you at no charge.