{"id":9,"date":"2022-12-28T00:00:00","date_gmt":"2022-12-28T00:00:00","guid":{"rendered":"https:\/\/de.fi\/blog\/?p=9"},"modified":"2023-09-17T11:16:44","modified_gmt":"2023-09-17T11:16:44","slug":"the-most-evil-crypto-scam-defrost-finance-was-funded-with-criminal-money-cb08c99fb6d9","status":"publish","type":"post","link":"https:\/\/de.fi\/blog\/the-most-evil-crypto-scam-defrost-finance-was-funded-with-criminal-money-cb08c99fb6d9","title":{"rendered":"The MOST EVIL Crypto SCAM: Boris and Bob Rug-Pulled $19mln"},"content":{"rendered":"<p>Yesterday, we published the <a href=\"https:\/\/medium.com\/@DeDotFiSecurity\/exclusive-the-defrost-team-rugpulled-12m-7m-999b24c13f47\">first part<\/a> of our investigation on the Defrost Finance Rug Pull. The entire De.Fi\u2019s security department has been investigating the Rug Pull of Defrost Finance, the people who are behind it, and collecting all on\/off-chain data. We present to you the <strong>NEW and the FINAL<\/strong> part of Defrost Finance Saga.<\/p>\n<p>Since we published the first part, we have gathered much more information about the people behind Defrost Finance and the way the project was funded. That\u2019s why we are now going out with the 2nd part of the Defrost Saga \u2014 One of <strong>the Most Evil Crypto Scam: Rug Pulled Defrost Finance and its Connection to Criminal Money.<\/strong><\/p>\n<p>We have spent 2 years on creating the <a href=\"https:\/\/de.fi\/rekt-database\">Largest Crypto Hacks Database<\/a> with more than 3,160 hacks added and manually verified by our on-chain researchers and Solidity engineers. Our on-chain investigations have been mentioned by Forbes, Bloomberg, Wall Street Journal, and Blockworks.<\/p>\n<p>We thought that we had already seen every type of Rug Pull and Scam possible.<\/p>\n<p>But then Defrost Finance happened, and decided to make a little Christmas gift for its Community \u2014 <strong>rug pull<\/strong> them for $12M.<\/p>\n<p>The way they have done this might be the <strong>most sneaky<\/strong> way to rug pull users that DeFi has ever seen.<\/p>\n<h3 id=\"how-it-started-\">How it started:<\/h3>\n<p>On December 24th, the World has seen the following tweet by Defrost Finance:<\/p>\n<p><img decoding=\"async\" class=\"legacymediumimages\" src=\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/06\/0uxKKAfE_fQDVpylW.png\" alt=\"[https:\/\/twitter.com\/Defrost_Finance\/status\/1606455304841236480](https:\/\/twitter.com\/Defrost_Finance\/status\/1606455304841236480)\" \/><\/p>\n<p>Defrost claimed that their V2 smart contract was exploited, and that attacker used a flash loan to withdraw funds.<\/p>\n<p>However, the V1 contracts had been hacked as well resulting in the $12M loss. The oracle address in the protocol\u2019s collateral vaults was replaced with a malicious one, that triggered liquidations of collateralized user funds.<\/p>\n<p><strong>0x3cd5854fe3a13707b7882d8290d3cae793a7751a \u2014 <\/strong>the Address that called <strong>setOracleAddress()<\/strong> was added as the Origin address by deployment of the DefrostFactory address:<\/p>\n<p><img decoding=\"async\" class=\"legacymediumimages\" src=\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/06\/0R5XUFTXNPKkLwoIw.png\" alt=\"[https:\/\/snowtrace.io\/tx\/0x21fb9837044464cfa5db531e7ad07cbed9f60f57315d4a76291dbd2f3803e38d#eventlog](https:\/\/snowtrace.io\/tx\/0x21fb9837044464cfa5db531e7ad07cbed9f60f57315d4a76291dbd2f3803e38d#eventlog)\" \/><\/p>\n<p>The creator of the<a href=\"https:\/\/snowtrace.io\/address\/0x7f08ba62fadaf3b4b70a8ddc22b3c63669bddeb2#code\">** multisig wallet<\/a><strong>, which has to approve the oracle replacement function before it executes, <\/strong>is the same address that requested the oracle replacements**:<\/p>\n<p><img decoding=\"async\" class=\"legacymediumimages\" src=\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/06\/0a30afrUvGBuNi33H.png\" alt=\"[https:\/\/snowtrace.io\/tx\/0xfb5faa1e8e51e3649f318f0453002137747c13da7ab8895437e58df86e999bfd](https:\/\/snowtrace.io\/tx\/0xfb5faa1e8e51e3649f318f0453002137747c13da7ab8895437e58df86e999bfd)\" \/><\/p>\n<p><a href=\"https:\/\/snowtrace.io\/tx\/0xa5224414de6f5314250108d0ee15abe743e8a2608b09bff2740d19f241a844f7\">This is an application<\/a> for signing the oracle replacement by the multisig:<\/p>\n<p><img decoding=\"async\" class=\"legacymediumimages\" src=\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/06\/0qrWRlppBcKzAqTiu.png\" alt=\"[https:\/\/snowtrace.io\/tx\/0xa5224414de6f5314250108d0ee15abe743e8a2608b09bff2740d19f241a844f7](https:\/\/snowtrace.io\/tx\/0xa5224414de6f5314250108d0ee15abe743e8a2608b09bff2740d19f241a844f7)\" \/><\/p>\n<p><strong>Addresses that were signing oracle replacements<\/strong> in the protocol\u2019s vaults are:<\/p>\n<ul>\n<li><a href=\"https:\/\/snowtrace.io\/address\/0xf40d59331dcef16a5e6c4f2e5bcc2ca968dea619\">0xF40D59331DCEf16a5E6C4f2E5BCC2cA968DeA619<\/a><\/li>\n<li><a href=\"https:\/\/snowtrace.io\/address\/0xebbe39e3003013753a0109594b9451bcde625bb7\">0xEBbE39e3003013753a0109594b9451bcDe625bB7<\/a><\/li>\n<li><a href=\"https:\/\/snowtrace.io\/address\/0xbe22766fdd63d4acc60e6c209ef2eae6dbfc4814\">0xbE22766FDd63d4acc60E6c209ef2eAE6DBFC4814<\/a><\/li>\n<\/ul>\n<p>Now, if Defrost Finance claims that the hack happened due to a compromise of the wallets managing the multisig \u2014 <strong>how is it possible that 4 wallets got compromised at the same time? How were they stored?<\/strong><\/p>\n<p><img decoding=\"async\" class=\"legacymediumimages\" src=\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/06\/03mNK-Iu75Q7t3fqz.png\" alt=\"\" \/><\/p>\n<p>This is one of the <strong>oracle replacement transactions<\/strong>:<\/p>\n<p><img decoding=\"async\" class=\"legacymediumimages\" src=\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/06\/0hhYqW5UlqHzy10Pw.png\" alt=\"[https:\/\/snowtrace.io\/tx\/0x34eb46f498c418285323e6e146ae84ea836e49822fa254c865f59d650261c3dd](https:\/\/snowtrace.io\/tx\/0x34eb46f498c418285323e6e146ae84ea836e49822fa254c865f59d650261c3dd)\" \/><\/p>\n<h3 id=\"the-timeline-of-defrost-finance-rug-pull-looks-like-this-\">The timeline of Defrost Finance Rug Pull looks like this:<\/h3>\n<p><img decoding=\"async\" class=\"legacymediumimages\" src=\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/06\/1o2nsCNHGA0ULeUvfiOcFqg.png\" alt=\"\" \/><\/p>\n<h3 id=\"-connection-of-all-the-above-mentioned-addresses-points-out-the-hack-was-an-insider-job-\">\ud83d\udea8 Connection of all the above mentioned addresses points out the hack was an insider job! \ud83d\udea8<\/h3>\n<h3 id=\"the-funny-part-\">The funny part?<\/h3>\n<p>Exactly 1 month before rug pulling its users using the oracle vulnerability, Defrost Finance has i<strong>nsured themselves with 2 Crypto Insurance Providers<\/strong>: <a href=\"https:\/\/app.insurace.io\/\">**Insurace<\/a><strong> and [<\/strong>Degis Insurance](<a href=\"https:\/\/mobile.twitter.com\/projectdegis)**\">https:\/\/mobile.twitter.com\/projectdegis)**<\/a> \u2026 against <strong>\u201cOracle Failure\u201d<\/strong>.<\/p>\n<p>What a coincidence! \ud83e\udd26\u200d\u2642\ufe0f<\/p>\n<p><img decoding=\"async\" class=\"legacymediumimages\" src=\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/06\/0PA7vFF5DGXQ7aRKq.png\" alt=\"[Article Announcing the Insurance against \u201cOracle Failure\u201d on official Defrost\u2019s Medium](https:\/\/medium.com\/@Defrost_Finance\/the-degis-insurance-lets-get-into-the-details-7d7b8e1c91f1)\" \/><\/p>\n<p>Official announcement of the cooperation on insurance by Degis:<\/p>\n<p><img decoding=\"async\" class=\"legacymediumimages\" src=\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/06\/18jmIrihPAFeMxbh5-5KIxg.png\" alt=\"[https:\/\/twitter.com\/projectdegis\/status\/1594691914502410240?s=46](https:\/\/twitter.com\/projectdegis\/status\/1594691914502410240?s=46&amp;t=lAJ7gNxEmV69P20sJJj9rQ)\" \/><\/p>\n<p><img decoding=\"async\" class=\"legacymediumimages\" src=\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/06\/0h-tX-VbmZaxBubjN.png\" alt=\"[Screenshot from Insurace Official Website](https:\/\/app.insurace.io\/)\" \/><\/p>\n<h3 id=\"now-is-where-things-are-getting-interesting-\">Now is where things are getting interesting.<\/h3>\n<p>So, back to DeFrost. Just as we did previously with <a href=\"https:\/\/de.fi\/blog\/the-bundles-finance-saga-defiyield-info-9a25a8b99140\">Bundles<\/a>,<a href=\"https:\/\/de.fi\/blog\/the-yffs-saga-how-a-yield-farming-project-was-compelled-to-fix-its-code-6c5ee77816bb\"> YFFS<\/a>, <a href=\"https:\/\/de.fi\/blog\/pancake-bunny-saga-revealing-all-the-details-of-tough-transformation-d4a68801d4f\">PancakeBunny<\/a>,<a href=\"https:\/\/de.fi\/blog\/how-deus-finance-fixed-its-code-following-a-defiyield-info-report-51775ef59a5b\"> Deus<\/a>, and <a href=\"https:\/\/de.fi\/blog\/report-the-alpha-lab-infinite-minting-saga-team-controls-96-of-the-tokens-8a7d107c740\">Alpha Homora<\/a> cases \u2014 <strong>we are writing this article to inform the Community about the concerns we have about this project. <\/strong>As a premise, we would directly say that it seems like they are hiding.<\/p>\n<p><strong>But let\u2019s start from the beginning.<\/strong><\/p>\n<p>Since 2020, we at De.Fi have performed more than 60+ Security Audits, we also analyze the functions \/ hints if the project retains the ability to scam investors with the following:<\/p>\n<ul>\n<li>Infinite minting;<\/li>\n<li>Anti-rug pool functions;<\/li>\n<li>Minting Exploits;<\/li>\n<li>Liquidity pooled;<\/li>\n<li>Transfer Allowlist;<\/li>\n<li>Owner tampering;<\/li>\n<li>Backdoor library.<\/li>\n<\/ul>\n<p>1 year ago, De.Fi released a 120-page audit on Defrost Finance \u2014 <a href=\"https:\/\/de.fi\/audit-database\/de.fi\/defrost_finance\">**click here to see the full pdf file<\/a>.** On page 33, we\u2019ve stated the following:<\/p>\n<p><em>\u201c<strong>The Origin EOAs can replace the Oracle address<\/strong>. Collateral asset prices in the vaults of Defrost Finance depend on oracle contracts. In case the new oracle is insecure and can cause a sharp and unpredictable change in the price of an asset, <strong>this can lead to liquidation of user collaterals<\/strong>.\u201d<\/em><\/p>\n<p><img decoding=\"async\" class=\"legacymediumimages\" src=\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/06\/0W9a_-4JLgfWxiuBT.png\" alt=\"[The 33rd page of DeFiYield.App\u2019s Audit Report on Defrost Finance](https:\/\/safefiles.defiyield.info\/safe\/files\/audit\/pdf\/SC_audit_for_defrost_f_1.pdf)\" \/><\/p>\n<p>We have warned about exactly what happened pn December 24th \u2014 the risk associated with the Origin EOAs being replaced with Oracle address in a centralized manner. This is what Defrost Finance used to manipulate with fake oracle and rug pull its users. And warned people about it. Accordingly, it was indicated by <a href=\"https:\/\/www.coindesk.com\/business\/2022\/12\/25\/defrost-finance-hacked-in-attack-some-say-may-have-been-a-rug-pull\/?utm_content=editorial&amp;utm_term=organic&amp;utm_campaign=coindesk_main&amp;utm_source=twitter&amp;utm_medium=social\">**Coindesk<\/a>**, where the journal has featured our Audit and the warning about the crucial vulnerability that we stated in it:<\/p>\n<p><img decoding=\"async\" class=\"legacymediumimages\" src=\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/06\/0vCjMM93GcoHZo0T4.png\" alt=\"[Coindesk Article Featuring DeFiYield.App Audit](https:\/\/www.coindesk.com\/business\/2022\/12\/25\/defrost-finance-hacked-in-attack-some-say-may-have-been-a-rug-pull\/?utm_content=editorial&amp;utm_term=organic&amp;utm_campaign=coindesk_main&amp;utm_source=twitter&amp;utm_medium=social)\" \/><\/p>\n<p><strong>In total, 151 issues had been detected, 13 of which were Critical and High Risk.<\/strong> Many who read our Audit and were able to withdraw their funds from DeFrost were lucky enough to save their funds as a result.<\/p>\n<p><img decoding=\"async\" class=\"legacymediumimages\" src=\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/06\/0qP9dixd1l_bByofS.png\" alt=\"[The 9th page of DeFiYield.App\u2019s Audit Report on Defrost Finance](https:\/\/safefiles.defiyield.info\/safe\/files\/audit\/pdf\/SC_audit_for_defrost_f_1.pdf)\" \/><\/p>\n<p><strong>We have got in touch with Defrost Finance team 2 times:<\/strong><\/p>\n<ul>\n<li>1 Year ago, after we\u2019ve performed an Audit on them. Back then we texted them to inform them about all the issues that we\u2019ve found, and asked them to improve the correspondent functions of their smart smart contract. They never responded to us.<\/li>\n<li>Yesterday, after their rug pull. Have they responded? No.<\/li>\n<\/ul>\n<h3 id=\"defrost-finance-got-caught-\">Defrost Finance got caught.<\/h3>\n<p>After PeckShield\u2019s and our investigations that we\u2019ve <a href=\"https:\/\/twitter.com\/DeDotFiSecurity\/status\/1606805685311791104\">**posted on Twitter<\/a>**, it was clear for the Defrost Finance team that they\u2019d been caught, and now there is no way for them to simply launder the funds and live in peace in the Bahamas.<\/p>\n<p>That\u2019s how they started to think of ways of returning funds back to the users.<\/p>\n<p>On the next day after the exploit, they proposed the \u201chacker\u201d a <strong>20% reward<\/strong> for returning the \u201cstolen\u201d funds:<\/p>\n<p><img decoding=\"async\" class=\"legacymediumimages\" src=\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/06\/0OLsvosbJb8mo3IzK.png\" alt=\"[Official Tweet by Defrost Finance](https:\/\/twitter.com\/Defrost_Finance\/status\/1606985259299790848?cxt=HHwWgIDTvYillM0sAAAA)\" \/><\/p>\n<p>And on the next day, the \u201chacker\u201d <strong>has returned all the stolen $12M<\/strong>:<\/p>\n<p><img decoding=\"async\" class=\"legacymediumimages\" src=\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/06\/0ARD_4HF56bnIQC1a.png\" alt=\"9.9M DAI were returned:: [https:\/\/etherscan.io\/address\/0x5Ad30D7Ec1Ff9D95031E2b4ec2698Df29262867B#tokentxns](https:\/\/etherscan.io\/address\/0x5Ad30D7Ec1Ff9D95031E2b4ec2698Df29262867B#tokentxns)\" \/><\/p>\n<p><img decoding=\"async\" class=\"legacymediumimages\" src=\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/06\/0cftybJVI7r2FjPoo.png\" alt=\"And 2.5k ETH were returned as well: [https:\/\/etherscan.io\/address\/0x5Ad30D7Ec1Ff9D95031E2b4ec2698Df29262867B](https:\/\/etherscan.io\/address\/0x5Ad30D7Ec1Ff9D95031E2b4ec2698Df29262867B)\" \/><\/p>\n<p>Following the bounty hacking industry standard it\u2019s <strong>IMPOSSIBLE to get a resolution so fast! <\/strong>The dealing process in the bounty program is much longer!<\/p>\n<p>Moreover:<\/p>\n<p>Why has \u201cthe hacker\u201d returned the full amount of $12M? Why haven\u2019t they taken the proposed 20% Bounty? Or have they sent back the \u201cstolen\u201d $12M and hoped that the Defrost Team will return the promised 20% back (unrealistic scenario, but anyway)?<\/p>\n<p><strong>Our question is: can the Defrost Team show to the public the transaction with which they have returned the 20% reward to the hacker?<\/strong><\/p>\n<p><strong>However, the Developers Behind the Defrost Finance had a more successful RUG PULL in their Career\u2026<\/strong><\/p>\n<h2 id=\"defrost-and-finnexus-team\">DEFROST AND FINNEXUS TEAM<\/h2>\n<p>The Developers of Defrost Finance <strong>are the same people as the Developers of FinNexus <\/strong>(later it will be rebranded to Phoenix Finance), where the admin key had \u201cleaked\u201d, which resulted in a $7M loss in 2021. Following our research, considering all the inputs, there is a high chance that it was a rug pull, and the private key didn\u2019t just \u201cleak\u201d.<\/p>\n<p><img decoding=\"async\" class=\"legacymediumimages\" src=\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/06\/0udGICRV8rZEe2IU0.png\" alt=\"[https:\/\/defiyield.app\/rekt-database\/phoenix_finance_(finnexus)](https:\/\/defiyield.app\/rekt-database\/finnexus)\" \/><\/p>\n<p>Now we move on to the most interesting part of the entire saga: we believe that people who position themselves as the core team of Defrost Finance are not even real people. Let us explain:<\/p>\n<p>It has become clear that at least 3 developers of Phoenix Finance (a.k.a. FinNexus that has rug pulled for $7M in 2021) and Defrost Finance are the same people. We have found the same profiles behind GitHub repositories of both projects; moreover, it looks like all these accounts are owned by 1 person, who uses the suffix \u201cjqg\u201d in all of their domains:<\/p>\n<p><img decoding=\"async\" class=\"legacymediumimages\" src=\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/06\/0ZV0jdiQOev4uY_Un.png\" alt=\"\" \/><\/p>\n<p>Now, ask yourself this: would people who are publicly KYC\u2019d behind RUG PULLED (the fact of the rug pull wasn\u2019t 100% clear in 2021, but now it has become clear) FinNexus, and whose identities can be easily found on the Web, start a 2nd project \u2014 Defrost Finance, with the same GitHub accounts, knowing, that they want to Rug Pull it too? To do that, you either need to:<\/p>\n<ul>\n<li>Want to go to jail really bad;<\/li>\n<li>Make a mistake and use same accounts for Defrost Finance, therefore, accidentally DOX your team, which was planned to be anonymous.<\/li>\n<\/ul>\n<p>If you carefully check LinkedIn\u2019s of FinNexus Founders, you will notice that those are clearly fake. No activity. No information. No links to previous projects \/ organizations \/ companies. Nothing.<\/p>\n<p>Want more evidence of the Defrost Finance team being the same people as the FinNexus team? No problem! Today, after the first part of our investigation went live yesterday, FinNexus\u2019s website went down. What a coincidence!<\/p>\n<p><img decoding=\"async\" class=\"legacymediumimages\" src=\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/06\/0wB8Q1Y-Yv1D9kDWX.png\" alt=\"[https:\/\/finnexus.io\/](https:\/\/finnexus.io\/)\" \/><\/p>\n<p>Yesterday, however, the website was still live. Unfortunately, the latest snapshot of the website taken by the webarchive is November 16th:<\/p>\n<p><img decoding=\"async\" class=\"legacymediumimages\" src=\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/06\/0Vz5IjD4961HEAyjd.png\" alt=\"[http:\/\/web.archive.org\/web\/20221116225700\/https:\/\/finnexus.io\/](http:\/\/web.archive.org\/web\/20221116225700\/https:\/\/finnexus.io\/)\" \/><\/p>\n<p><strong>At the end, we have the scheme that looks like this:<\/strong><\/p>\n<p><img decoding=\"async\" class=\"legacymediumimages\" src=\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/06\/1jCBuy0RWkNSuVSzmGgGc1g.png\" alt=\"The team behind Defrost Finance and FinNexus (Phoenix Finance)\" \/><\/p>\n<ul>\n<li>Boris Yang\u2019s linkedin: <a href=\"https:\/\/www.linkedin.com\/in\/boris-yang-371297199\/\">https:\/\/www.linkedin.com\/in\/boris-yang-371297199\/<\/a> \u2014 clearly a fake one;<\/li>\n<li>Linkedin of Jacky Wang (their Business co-Founder [whatever that means]): <a href=\"https:\/\/www.linkedin.com\/in\/jacky-wang-776458173\/\">https:\/\/www.linkedin.com\/in\/jacky-wang-776458173\/<\/a> \u2014 is clearly fake also;<\/li>\n<li>Lu Jianqiang linkedin: <a href=\"https:\/\/www.linkedin.com\/in\/%E5%BB%BA%E5%BC%BA-%E5%90%95-4400b5168\/\">https:\/\/www.linkedin.com\/in\/%E5%BB%BA%E5%BC%BA-%E5%90%95-4400b5168\/<\/a> \u2014 also fake.<\/li>\n<\/ul>\n<p><img decoding=\"async\" class=\"legacymediumimages\" src=\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/06\/1RxJjidP0bJ0oMTgTVJ6snQ.png\" alt=\"Doran the Community Manager have stated that the founders \u2018\u2019Michele\/Melter\u2019\u2019 are based in the Chinese Timezone. This fact is to be verified.\" \/><\/p>\n<p>Pay attention to the Tornado Cash Mixer logo that we\u2019ve put near the Defrost Finance (on the scheme above).<\/p>\n<p><img decoding=\"async\" class=\"legacymediumimages\" src=\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/06\/1Rd8kC1l5120Y9rgrqOKlNg.png\" alt=\"\" \/><\/p>\n<p>You might wonder why we did it? It\u2019s because the deployer of Defrost Finance was funded from the Tornado Cash mixer on Avalanche. Now, ask yourself: as a Founder of a Tier-1 Avalanche Project (at all time highs, Defrost had $120M TVL), would you want to DEPLOY your DAPP with funds from Tornado Cash, unless there is something you want to hide (for example the source of your income?)<\/p>\n<p>It\u2019s very likely that it was needed to hide the fact that funds used to deploy Defrost Finance were the SAME funds Defrost Finance\u2019s Founders stole from FinNexus Finance in the 2021 Rug Pull<\/p>\n<p><img decoding=\"async\" class=\"legacymediumimages\" src=\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/06\/0jv8dHci8Kl4B9Kk6.png\" alt=\"[Defrost Finance was funded with Tornado Cash Mixer\u2019s Wallet](https:\/\/snowtrace.io\/address\/0xbbb2229ed5d1ca3501f8c4ef31741b6800e12d3b)\" \/><\/p>\n<p>All <strong>three multisig signers<\/strong> were funded by one address:<\/p>\n<ul>\n<li><a href=\"https:\/\/snowtrace.io\/tx\/0x0f3442385e191501d86efa89a1730df84223a5cb709f59e164398b78abfa217e\">https:\/\/snowtrace.io\/tx\/0x0f3442385e191501d86efa89a1730df84223a5cb709f59e164398b78abfa217e<\/a><\/li>\n<li><a href=\"https:\/\/snowtrace.io\/tx\/0x5c6cf35f4560f8097f5a983e30013700651e71b67097ca25cb7ee87d63a53cf2\">https:\/\/snowtrace.io\/tx\/0x5c6cf35f4560f8097f5a983e30013700651e71b67097ca25cb7ee87d63a53cf2<\/a><\/li>\n<li><a href=\"https:\/\/snowtrace.io\/tx\/0x93e9385f24fd09303442171296e2803b94ab1bdcedffc09ad00e14b90f7d5a57\">https:\/\/snowtrace.io\/tx\/0x93e9385f24fd09303442171296e2803b94ab1bdcedffc09ad00e14b90f7d5a57<\/a><\/li>\n<\/ul>\n<p><img decoding=\"async\" class=\"legacymediumimages\" src=\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/06\/0qDN0Al4nqUJ-Didn.png\" alt=\"\" \/><\/p>\n<p>The address on the screenshots above (that was sending funds to all 3 Defrost\u2019s multisig signers), clearly belongs to Tornado Cash Mixer:<\/p>\n<p><img decoding=\"async\" class=\"legacymediumimages\" src=\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/06\/0JBg8y0Oe-dhTBqhN.png\" alt=\"[https:\/\/etherscan.io\/tx\/0x8634fa7f9e18eb5bf2962fc0ca929bb340ddedd351b8398b09ad8cef60d732cb](https:\/\/etherscan.io\/tx\/0x8634fa7f9e18eb5bf2962fc0ca929bb340ddedd351b8398b09ad8cef60d732cb)\" \/><\/p>\n<p>The connection between Phoenix Finance (FinNexus) and Defrost Finance <strong>can be found on Defrost\u2019s GitHub, in the following repository:<\/strong><\/p>\n<p><img decoding=\"async\" class=\"legacymediumimages\" src=\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/06\/09Af19anDQgZbejjO.png\" alt=\"[https:\/\/github.com\/Phoenix-Finance\/FinNexus-Eth-Token](https:\/\/github.com\/Phoenix-Finance\/FinNexus-Eth-Token)\" \/><\/p>\n<p><strong>AFTER-RUG-BEHAVIOR<\/strong><\/p>\n<p>In our <a href=\"https:\/\/medium.com\/@DeDotFiSecurity\/exclusive-the-defrost-team-rugpulled-12m-7m-999b24c13f47\">First Article<\/a>, we provided all the data needed to prove the rug pull fact behindDefrost Finance\u2019s $12M scam, showing the connection between Defrost Finance and Finnexus (the project rug pulled in 2021 and then rebranded to Phoenix Finance).<\/p>\n<p>Today, our research got featured on CoinTelegraph: <a href=\"https:\/\/cointelegraph.com\/news\/defrost-finance-breaks-silence-on-exit-scam-accusations-denies-rug-pull\">https:\/\/cointelegraph.com\/news\/defrost-finance-breaks-silence-on-exit-scam-accusations-denies-rug-pull<\/a><\/p>\n<p>After this, we got in touch with the Defrost Team asking them to KYC again. <strong>Unfortunately, no reply has come from its founders.<\/strong><\/p>\n<p>What Defrost Finance started doing instead is just banning everyone sending the link to this article in their chat and they are seen lying about the \u201cprivate key getting compromised\u201d \u2014 nonsense.<\/p>\n<p><img decoding=\"async\" class=\"legacymediumimages\" src=\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/06\/0AwsEIqU9saYD9hV5.png\" alt=\"Defrost Admin Banning Users who send this Article in Chat\" \/><\/p>\n<p>The <strong>victims<\/strong> of Defrost\u2019s Rug Pull have united in a Telegram chat, where they dig into the case deeper:<\/p>\n<p><img decoding=\"async\" class=\"legacymediumimages\" src=\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/06\/1jFmizWZERblcKSqy6Sk14w.png\" alt=\"[https:\/\/t.me\/defrost_rugpull_victims](https:\/\/t.me\/defrost_rugpull_victims)\" \/><\/p>\n<p>We have also chatted with a user who claim to be the largest holder of Defrost Finance V1. Now he is hoping for the refund:<\/p>\n<p><img decoding=\"async\" class=\"legacymediumimages\" src=\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/06\/18XzxMsfrUk32KyHNCeiaiQ.png\" alt=\"[https:\/\/twitter.com\/tsetoshi\/status\/1606909545162608641?s=20](https:\/\/twitter.com\/tsetoshi\/status\/1606909545162608641?s=20)\" \/><\/p>\n<h2 id=\"conclusion\">CONCLUSION<\/h2>\n<p>De.Fi has been fighting DeFi Scams for years, as our main goal is for DeFi to become a safer and a more convenient place for a retail investor. We believe that only by being safe and fully trustless, DeFi can have mass adoption and then we can finally go Bankless!<\/p>\n<p>That\u2019s why we\u2019ve written the Amazon\u2019s Bestseller: <a href=\"https:\/\/www.amazon.com\/Wall-Street-Over-Cryptocurrency-Decentralized\/dp\/1527295362\">**\u201cThe Wall Street Era is Over\u201d<\/a> <strong>\u2014 <\/strong>the most comprehensive guide on Web3, and how to safekeep your crypto funds.**<\/p>\n<p><img decoding=\"async\" class=\"legacymediumimages\" src=\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/06\/0wTjd77CUESKJQ58k.png\" alt=\"[https:\/\/www.amazon.com\/Wall-Street-Over-Cryptocurrency-Decentralized\/dp\/1527295362](https:\/\/www.amazon.com\/Wall-Street-Over-Cryptocurrency-Decentralized\/dp\/1527295362)\" \/><\/p>\n<p><strong>Have comments or opinions? Let us know!<\/strong><\/p>\n<p><strong>Check out other articles from the Saga series:<\/strong><\/p>\n<ul>\n<li><a href=\"https:\/\/de.fi\/blog\/how-deus-finance-fixed-its-code-following-a-defiyield-info-report-51775ef59a5b\">The Deus Finance Saga<\/a><\/li>\n<li><a href=\"https:\/\/de.fi\/blog\/the-yffs-saga-how-a-yield-farming-project-was-compelled-to-fix-its-code-6c5ee77816bb\">The YFFS Saga<\/a><\/li>\n<li><a href=\"https:\/\/de.fi\/blog\/the-bundles-finance-saga-defiyield-info-9a25a8b99140\">The Bundles Finance Saga<\/a><\/li>\n<li><a href=\"https:\/\/de.fi\/blog\/pancake-bunny-saga-revealing-all-the-details-of-tough-transformation-d4a68801d4f\">Pancake Bunny Saga<\/a><\/li>\n<li><a href=\"https:\/\/de.fi\/blog\/report-the-alpha-lab-infinite-minting-saga-team-controls-96-of-the-tokens-8a7d107c740\">Alpha Homora Saga<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Yesterday, we published the first part of our investigation on the Defrost Finance Rug Pull.<\/p>\n","protected":false},"author":2,"featured_media":5551,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[55],"class_list":["post-9","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-defi-security","tag-defi_vs_scams"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.10 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>The MOST EVIL Crypto SCAM: Boris and Bob Rug-Pulled $19mln<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/de.fi\/blog\/the-most-evil-crypto-scam-defrost-finance-was-funded-with-criminal-money-cb08c99fb6d9\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"The MOST EVIL Crypto SCAM: Boris and Bob Rug-Pulled $19mln\" \/>\n<meta property=\"og:description\" content=\"Yesterday, we published the first part of our investigation on the Defrost Finance Rug Pull.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/de.fi\/blog\/the-most-evil-crypto-scam-defrost-finance-was-funded-with-criminal-money-cb08c99fb6d9\" \/>\n<meta property=\"og:site_name\" content=\"De.Fi Blog\" \/>\n<meta property=\"article:published_time\" content=\"2022-12-28T00:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-09-17T11:16:44+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2022\/12\/Re-entrancy-Attacks-1-1-1.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1920\" \/>\n\t<meta property=\"og:image:height\" content=\"1008\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"De.Fi Security\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@dedotfi\" \/>\n<meta name=\"twitter:site\" content=\"@dedotfi\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"De.Fi Security\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"15 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/de.fi\/blog\/the-most-evil-crypto-scam-defrost-finance-was-funded-with-criminal-money-cb08c99fb6d9#article\",\"isPartOf\":{\"@id\":\"https:\/\/de.fi\/blog\/the-most-evil-crypto-scam-defrost-finance-was-funded-with-criminal-money-cb08c99fb6d9\"},\"author\":{\"name\":\"De.Fi Security\",\"@id\":\"https:\/\/de.fi\/blog\/#\/schema\/person\/bc7c94cb5e037c8978c6059885825591\"},\"headline\":\"The MOST EVIL Crypto SCAM: Boris and Bob Rug-Pulled $19mln\",\"datePublished\":\"2022-12-28T00:00:00+00:00\",\"dateModified\":\"2023-09-17T11:16:44+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/de.fi\/blog\/the-most-evil-crypto-scam-defrost-finance-was-funded-with-criminal-money-cb08c99fb6d9\"},\"wordCount\":1974,\"publisher\":{\"@id\":\"https:\/\/de.fi\/blog\/#organization\"},\"keywords\":[\"De.Fi vs Scams\"],\"articleSection\":[\"De.Fi Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/de.fi\/blog\/the-most-evil-crypto-scam-defrost-finance-was-funded-with-criminal-money-cb08c99fb6d9\",\"url\":\"https:\/\/de.fi\/blog\/the-most-evil-crypto-scam-defrost-finance-was-funded-with-criminal-money-cb08c99fb6d9\",\"name\":\"The MOST EVIL Crypto SCAM: Boris and Bob Rug-Pulled $19mln\",\"isPartOf\":{\"@id\":\"https:\/\/de.fi\/blog\/#website\"},\"datePublished\":\"2022-12-28T00:00:00+00:00\",\"dateModified\":\"2023-09-17T11:16:44+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/de.fi\/blog\/the-most-evil-crypto-scam-defrost-finance-was-funded-with-criminal-money-cb08c99fb6d9#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/de.fi\/blog\/the-most-evil-crypto-scam-defrost-finance-was-funded-with-criminal-money-cb08c99fb6d9\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/de.fi\/blog\/the-most-evil-crypto-scam-defrost-finance-was-funded-with-criminal-money-cb08c99fb6d9#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/de.fi\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"The MOST EVIL Crypto SCAM: Boris and Bob Rug-Pulled $19mln\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/de.fi\/blog\/#website\",\"url\":\"https:\/\/de.fi\/blog\/\",\"name\":\"De.Fi Blog\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/de.fi\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/de.fi\/blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/de.fi\/blog\/#organization\",\"name\":\"De.Fi\",\"url\":\"https:\/\/de.fi\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/de.fi\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/06\/spaces_XOyvZ43P03BZ8mN6KNWT_icon_1hV2Waqet2YS2jtkV0f3_Logo.webp\",\"contentUrl\":\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/06\/spaces_XOyvZ43P03BZ8mN6KNWT_icon_1hV2Waqet2YS2jtkV0f3_Logo.webp\",\"width\":223,\"height\":234,\"caption\":\"De.Fi\"},\"image\":{\"@id\":\"https:\/\/de.fi\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/twitter.com\/dedotfi\",\"https:\/\/t.me\/dedotfi\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/de.fi\/blog\/#\/schema\/person\/bc7c94cb5e037c8978c6059885825591\",\"name\":\"De.Fi Security\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/de.fi\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/6f2f941b8d00bf81e01f135977bd5284977931ec40bfd2c06000150d2a6d661d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/6f2f941b8d00bf81e01f135977bd5284977931ec40bfd2c06000150d2a6d661d?s=96&d=mm&r=g\",\"caption\":\"De.Fi Security\"},\"url\":\"https:\/\/de.fi\/blog\/author\/defisecurity\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"The MOST EVIL Crypto SCAM: Boris and Bob Rug-Pulled $19mln","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/de.fi\/blog\/the-most-evil-crypto-scam-defrost-finance-was-funded-with-criminal-money-cb08c99fb6d9","og_locale":"en_US","og_type":"article","og_title":"The MOST EVIL Crypto SCAM: Boris and Bob Rug-Pulled $19mln","og_description":"Yesterday, we published the first part of our investigation on the Defrost Finance Rug Pull.","og_url":"https:\/\/de.fi\/blog\/the-most-evil-crypto-scam-defrost-finance-was-funded-with-criminal-money-cb08c99fb6d9","og_site_name":"De.Fi Blog","article_published_time":"2022-12-28T00:00:00+00:00","article_modified_time":"2023-09-17T11:16:44+00:00","og_image":[{"width":1920,"height":1008,"url":"https:\/\/de.fi\/blog\/wp-content\/uploads\/2022\/12\/Re-entrancy-Attacks-1-1-1.png","type":"image\/png"}],"author":"De.Fi Security","twitter_card":"summary_large_image","twitter_creator":"@dedotfi","twitter_site":"@dedotfi","twitter_misc":{"Written by":"De.Fi Security","Est. reading time":"15 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/de.fi\/blog\/the-most-evil-crypto-scam-defrost-finance-was-funded-with-criminal-money-cb08c99fb6d9#article","isPartOf":{"@id":"https:\/\/de.fi\/blog\/the-most-evil-crypto-scam-defrost-finance-was-funded-with-criminal-money-cb08c99fb6d9"},"author":{"name":"De.Fi Security","@id":"https:\/\/de.fi\/blog\/#\/schema\/person\/bc7c94cb5e037c8978c6059885825591"},"headline":"The MOST EVIL Crypto SCAM: Boris and Bob Rug-Pulled $19mln","datePublished":"2022-12-28T00:00:00+00:00","dateModified":"2023-09-17T11:16:44+00:00","mainEntityOfPage":{"@id":"https:\/\/de.fi\/blog\/the-most-evil-crypto-scam-defrost-finance-was-funded-with-criminal-money-cb08c99fb6d9"},"wordCount":1974,"publisher":{"@id":"https:\/\/de.fi\/blog\/#organization"},"keywords":["De.Fi vs Scams"],"articleSection":["De.Fi Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/de.fi\/blog\/the-most-evil-crypto-scam-defrost-finance-was-funded-with-criminal-money-cb08c99fb6d9","url":"https:\/\/de.fi\/blog\/the-most-evil-crypto-scam-defrost-finance-was-funded-with-criminal-money-cb08c99fb6d9","name":"The MOST EVIL Crypto SCAM: Boris and Bob Rug-Pulled $19mln","isPartOf":{"@id":"https:\/\/de.fi\/blog\/#website"},"datePublished":"2022-12-28T00:00:00+00:00","dateModified":"2023-09-17T11:16:44+00:00","breadcrumb":{"@id":"https:\/\/de.fi\/blog\/the-most-evil-crypto-scam-defrost-finance-was-funded-with-criminal-money-cb08c99fb6d9#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/de.fi\/blog\/the-most-evil-crypto-scam-defrost-finance-was-funded-with-criminal-money-cb08c99fb6d9"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/de.fi\/blog\/the-most-evil-crypto-scam-defrost-finance-was-funded-with-criminal-money-cb08c99fb6d9#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/de.fi\/blog\/"},{"@type":"ListItem","position":2,"name":"The MOST EVIL Crypto SCAM: Boris and Bob Rug-Pulled $19mln"}]},{"@type":"WebSite","@id":"https:\/\/de.fi\/blog\/#website","url":"https:\/\/de.fi\/blog\/","name":"De.Fi Blog","description":"","publisher":{"@id":"https:\/\/de.fi\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/de.fi\/blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/de.fi\/blog\/#organization","name":"De.Fi","url":"https:\/\/de.fi\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/de.fi\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/06\/spaces_XOyvZ43P03BZ8mN6KNWT_icon_1hV2Waqet2YS2jtkV0f3_Logo.webp","contentUrl":"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/06\/spaces_XOyvZ43P03BZ8mN6KNWT_icon_1hV2Waqet2YS2jtkV0f3_Logo.webp","width":223,"height":234,"caption":"De.Fi"},"image":{"@id":"https:\/\/de.fi\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/twitter.com\/dedotfi","https:\/\/t.me\/dedotfi"]},{"@type":"Person","@id":"https:\/\/de.fi\/blog\/#\/schema\/person\/bc7c94cb5e037c8978c6059885825591","name":"De.Fi Security","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/de.fi\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/6f2f941b8d00bf81e01f135977bd5284977931ec40bfd2c06000150d2a6d661d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/6f2f941b8d00bf81e01f135977bd5284977931ec40bfd2c06000150d2a6d661d?s=96&d=mm&r=g","caption":"De.Fi Security"},"url":"https:\/\/de.fi\/blog\/author\/defisecurity"}]}},"_links":{"self":[{"href":"https:\/\/de.fi\/blog\/wp-json\/wp\/v2\/posts\/9","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/de.fi\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/de.fi\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/de.fi\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/de.fi\/blog\/wp-json\/wp\/v2\/comments?post=9"}],"version-history":[{"count":7,"href":"https:\/\/de.fi\/blog\/wp-json\/wp\/v2\/posts\/9\/revisions"}],"predecessor-version":[{"id":5134,"href":"https:\/\/de.fi\/blog\/wp-json\/wp\/v2\/posts\/9\/revisions\/5134"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/de.fi\/blog\/wp-json\/wp\/v2\/media\/5551"}],"wp:attachment":[{"href":"https:\/\/de.fi\/blog\/wp-json\/wp\/v2\/media?parent=9"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/de.fi\/blog\/wp-json\/wp\/v2\/categories?post=9"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/de.fi\/blog\/wp-json\/wp\/v2\/tags?post=9"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}