Kokomo Finance Vanishes With $4M Just Days After Optimism Launch

Kokomo Finance, a lending protocol on Optimism, disappeared with an estimated $4 million after its team deleted the project's website along with its Twitter, GitHub, and Medium accounts.

The protocol had only launched on Optimism less than a week earlier, and its native token, KOKO, had been trading for under 36 hours before the exit. Wrapped Bitcoin deposits were siphoned off through modifications made by the project's own deployer address. An estimated $2 million in tokens reportedly remains locked in the project's Optimism pools, but with the contracts now paused and withdrawals disabled, it remains unclear whether the team will attempt to extract the rest.

01How the exploit unfolded

Security firm Certik laid out the mechanics of the incident:

1. The deployer of the KOKO token, address 0x41BE, deployed an attack contract referred to as cBTC. It then adjusted the reward speed, paused borrowing, and swapped in a malicious implementation contract.
2. A separate address, 0x5a2d, then approved the cBTC contract to spend 7,010 sonne WBTC.
3. With the implementation contract now swapped for the malicious cBTC version, the attacker invoked the 0x804edaad method to move that sonne WBTC to address 0x5C8d.
4. That address then swapped the 7,010 sonne WBTC for 141 WBTC, worth roughly $4 million.

Beosin also confirmed the incident independently.

02Where the funds went

The rugged funds were traced to the following addresses:

• 0x8C0eCD7BACCed114729F8269B459E0A4D5e95C3b — 50 BTCB (~$1.4M)
• 0xB74C5e41E748BaBC32ce33813549E2503CDaB762 — 40 BTCB (~$1.1M)
• 0xC2AE8D3b0fb159cCD331a01A8C3632B95dB23CF5 — 32 BTCB (~$0.9M)
• 0x88340ff2292506D0D93934CbBFEA5ED1804CDa0d — 20 WBTC (~$0.6M)

Notably, the audit the project commissioned from 0xGuard covered only the token contract itself, not the broader protocol where the exploit originated.

03Context

Outside of Wintermute's Gnosis Safe incident the previous year, this ranks as the largest exploit recorded on Optimism to date. It arrived just as the ARB airdrop had dominated attention across Ethereum's layer-2 ecosystem, raising questions about whether user sentiment toward Optimism might shift — or whether attention will simply move to whichever new opportunity promises the next airdrop. For now, Kokomo Finance's activity has ceased entirely.