The BrincFi Backdoor: An Unresolved Insider Heist Still Working Through the Courts

Not every DeFi exploit fades quietly into the news cycle. The theft that hit BrincFi in December 2021 never really closed: more than three years on, the matter is still working through a California court, and the question of who actually pulled the trigger remains legally unresolved.

What sets this case apart from a typical smart-contract hack is the suspicion BrincFi itself has voiced publicly — that the person responsible for the breach was already inside the organization, in the role of its own Head of Development.

How the funds left

On December 14, 2021, BrincFi's staking contract lost 290 ETH. On-chain researcher YannickCrypto flagged the activity first, describing it plainly: "Contract deployer move funds to new address to rug them." Security firm Beosin later confirmed the root cause as a private-key compromise resulting in the loss of the 290 ETH.

The mechanism was almost embarrassingly simple. A single transaction transferred ownership of the staking contract to a new address:

• Ownership-transfer transaction: 0x09ae252d00122864070461e78810a3b91c4fb64076f72eb6dba775a80ca00df4
• Original deployer wallet: 0x43e0acd5314d0b8bcf34d45fc9f5b8ea2dd403b9
• Recipient / attacker wallet: 0x6B0b61323F6d77ef8A1a35D11FA877631d8f67Bb

Shortly afterward, the deployer wallet sent 0.5 ETH to that new address — apparently enough to cover the gas needed for what followed:

• Funding transaction: 0xc95e14ea17062bc04bd824fff995a110e07f67ea25c14b2c298768c6bb0c4944

Still holding admin rights, the deployer wallet then pushed an upgrade to the staking contract's implementation. Buried inside it was a function called rescueTokens:

function rescueTokens(address to, IERC20Upgradeable token) public onlyOwner {
    uint bal = token.balanceOf(address(this));
    require(bal > 0);
    token.transfer(to, bal);
}

Five lines were all it took. Once the upgrade went live, the attacker called that function twice — draining BRC tokens first, then gBRC. In total, 14.3 million BRC and 3.2 million gBRC tokens were pulled out, swapped for DAI, converted to ETH, and routed through Tornado Cash. The wallet Beosin's report described as "compromised" kept moving funds afterward. The 290 ETH taken was worth roughly $1.1 million at the time of the theft in December 2021 — measured in dollars today, that figure has since fallen to around $757,000.

An investigation commissioned by BrincFi and carried out by Certik found that "full authority over the staking contract" rested with the company's own Head of Development, directing suspicion inward rather than toward an anonymous outside actor.

The company's case against its own developer

BrincFi has publicly alleged that its former Head of Development, Daniel Choi, was behind the exploit. The company's own post-mortem put it directly: "As the Head of Development, he had the responsibility to keep the contract secure."

Choi did not disappear — he retained legal counsel, and BrincFi, operating under the name Pacific Coast Co. Ltd, filed a civil suit against him in Los Angeles County Superior Court, case number 22TRCV00231.

Progress has been slow. A January 2024 deposition in Los Angeles produced little clarity: BrincFi says Choi "answered certain questions, but did not answer all the questions asked of him," and the session was cut short after he said he felt unwell. The company also states Choi turned over only 2 of the 12 documents requested in discovery and objected to nearly every written question put to him. Days after being pressed about contacts outside the case, he switched to a new law firm.

The civil litigation over the alleged theft and fraud remains active and unresolved. BrincFi has pointed out that Choi continues to work in the crypto industry, now as a research engineer, while the case drags on.

A file that hasn't closed

More than three years after the December 2021 incident, BrincFi's loss is still an open matter: the funds are gone, no one has been held legally responsible, and the underlying weakness — a staking contract with an unrestricted, owner-only backdoor function — remains a familiar pattern across DeFi. Whether the root cause was an insider abusing legitimate access or an outsider who obtained the private key, the episode is a reminder that a single set of admin permissions can be as dangerous as any bug in the code itself.