Protect Your Project Today
Strengthen your project with the largest web3 security provider.
A CertiK security expert will review your request and follow up shortly.

Risk On Blast Incident Analysis

Reports ·Incident Analysis ·
Risk On Blast Incident Analysis

Introduction

On 24 February, GambleFi project RiskOnBlast is thought to have become the first confirmed exit scam to occur on the Blast ecosystem, a layer-2 project on Ethereum. RiskOnBlast had launched an uncapped Initial DEX Offering (IDO), declaring to X user @mooncat2878, an early investor of the project, that the aim was to raise $1 million.

RoB2

The exact reason is unknown but the IDO was later capped at 420 ETH, approximately 1.3million,beforefundswerewithdrawnandsenttocentralizedexchangessuchasMEXC,ByBitandBinance.Asfundswerebeingwithdrawn,theprojectsXaccountandwebsitewasalsodeleted.Thisincidentbringsthetotallosttoexitscamsto 1.3 million, before funds were withdrawn and sent to centralized exchanges such as MEXC, ByBit and Binance. As funds were being withdrawn, the projects X account and website was also deleted. This incident brings the total lost to exit scams to ~65 million in 2024.

RiskonBlast

Background

RiskonBlast was in the early phases of project development having only recently launched an IDO with a fully diluted valuation (FDV) of $625k for their GambleFi project. GambleFi projects are akin to web2 gambling sites, users bet their crypto on a variety of games for a chance to win more crypto. The screenshot below is from a test version of the project’s roulette game in which users bet on yellow, green or black.

RoB1

The project had also signed up to Blast’s BIG BANG competition for project developers in which 50% of the upcoming Blast airdrop will be distributed amongst the winners. Part of the competition’s registration requires that a video is uploaded of a project member introducing themself and the project, whether RiskOnBlast submitted a genuine video or not is unknown.

RoB3

The project’s submission though, was sufficient enough for Blast to give the project an ‘Undeniable’ rating for potential which many investors saw as a green light to invest.

RoB4

IDO Contract

RiskOnBlast’s IDO contract, 0x25f8c342e430c85829ef5021c0720f0c60969840, was created on 22 Feb and was initially said to be an uncapped public sale, stating that the community could decide on their value. Though the timing and reason is unclear this was later capped to 420 ETH which was reached just two days later. The final IDO deposit was made at 14:18 UTC then at 14:35 UTC the funds were withdrawn and RiskOnBlast disappeared, deleting their social media account and website.

Stolen Fund Movement

IDO Withdrawal

After the IDO reached 420 ETH on 24 Feb, the IDO creator 0x1eeb963133f657ed3228d04b8cd9a13280efc558 called the contracts withdraw() function to withdraw the contract’s balance.

RoB5

Asset Distribution

The withdrawn ETH was swapped for WETH and DAI and split into multiple wallets which was then distributed as per the summary below.

RoB6

$24.8k of the funds were bridged via ThorChain to a Cosmos wallet. The receiving wallet can be identified within the memo field of a ThorChain transaction.

RoB7

Similarly, for funds bridged with Rango, the destination chain and wallet can be identified within the transaction logs.

RoB8

Summary of stolen funds:

  • 420.50 ETH (~$1.3m) withdrawn from the presale contract then laundered via multiple routes.
    • $494,912 via ChangeNow
    • $385,743 via MEXC
    • $193,055 via ByBit
    • $125,000 via Railgun
    • $24.8k to cosmos12alg6yvhz9ympry4h2zhsy0547t6llx8grnprd via ThorChain
    • $20,000 via SideShift
    • Approximately $50k was lost to MEV during token swaps
    • Below, 24,759 was bridged via RangoBridge to Arbitrum [0x09c366e8ec6cc5c53454ac16d237cf7fa719783e](https://arbiscan.io/address/0x09c366e8ec6cc5c53454ac16d237cf7fa719783e#tokentxns) which aggregated129.1k before sending the funds to a Binance account. The funds received at 11:13 and 11:15 were transferred via deBridge.

RoB9

Conclusion

RiskOnBlast became the first project to be a confirmed exit scam on the Blast network taking approximately $1.3 million from their IDO contract and is in the top 3 largest exit scams on token projects in 2024. A combination of market conditions and Blast having just launched their mainnet in February likely led to increased hype for the project amongst early adopters. As favourable market conditions continue to return it’s important to not let hype and fear of missing out prevent due diligence on a project. Many projects can be researched on CertiK’s Skynet, which provides valuable insight into many web3 projects. CertiK Skynet - Web3 Security, Due Diligence and Insights

Related Blogs

Resolv Protocol Incident Analysis
Reports ·Incident Analysis

Resolv Protocol Incident Analysis

On 22 March 2026, the Revolv protocol was exploited, resulting in a loss of ~$26.8M due to a compromise of the project's cloud infrastructure which gave access to Resolv’s AWS Key Management Service (KMS).

Movie Token Incident Analysis
Reports ·Incident Analysis

Movie Token Incident Analysis

On 10 March 2026, the Movie Token (MT) contract was exploited for approximately $242,000 due to a critical flaw in its 'sell' logic. The vulnerability stemmed from a double-counting error: when a user sold MT tokens, the contract simultaneously transferred them to the liquidity pair for the swap and added that same balance to a pendingBurnAmount variable. When distributeDailyRewards() subsequently burned those pending tokens, it created an artificial supply shock, inflating the MT price and allowing the attacker to drain value from the pool.

SOF/LAXO Incident Analysis
Reports ·Incident Analysis

SOF/LAXO Incident Analysis

In February 2026 two separate exploits occurred on the BNB Smart Chain (BSC), affecting SOF and LAXO tokens, leveraging the same class of vulnerability: a flawed token burn mechanism that allowed price manipulation within a single transaction.