Alex Protocol, a Bitcoin decentralized finance (DeFi) platform built on the Stacks blockchain, experienced an exploitation on June 6, which led to a loss of $8.3 million in digital assets.
Through an X statement, Alex Protocol indicated that the compromise was due to a weakness in its self-listing verification system. The intruder took advantage of this loophole to extract liquidity from numerous asset pools.
The Bitcoin DeFi platform reported that the perpetrators extracted approximately 8.4 million Stacks (STX) tokens, 21.85 Stacks Bitcoin (sBTC), 149,850 in USDC (USDC) and USDt (USDT), and 2.8 Wrapped Bitcoin (WBTC). This occurrence is among the most significant breaches within the Stacks ecosystem to date.
In light of the incident, the Alex Lab Foundation, which supports the protocol, committed to fully compensating impacted users by utilizing its treasury reserves.
Cointelegraph attempted to contact Alex Protocol via its X account but did not receive a reply before the article’s publication.
Alex Protocol to compensate affected users following exploit
According to Alex Lab, restitution will be made in USDC tokens. The protocol plans to calculate reimbursement based on the average on-chain exchange rates from 10:00 am UTC to 2:00 pm UTC on the day of the incident.
Alex Lab disclosed that wallets impacted by the breach will receive an on-chain notification by June 8, which will include a personalized claim form. Users need to submit the filled-out form along with a receiving wallet address by June 10.
The team stated it will authenticate received claims and disburse USDC payments within a week. Users who do not acquire a form were encouraged to connect with the team via email.
The team did not disclose the technical details regarding the exploit but is anticipated to publish a post-incident analysis.
Related: Bybit announces security enhancements in response to $1.4B breach
Alex Protocol targeted by another breach in May 2024
This is not the initial security challenge where Alex Protocol has incurred significant losses. In May 2024, the DeFi platform was subject to an exploit involving its cross-chain bridge infrastructure. This event resulted in the unauthorized withdrawal of $4.3 million in cryptocurrency from the platform.
The DeFi protocol suggested that the May exploit was possibly associated with the North Korean cybercrime group Lazarus. The team referenced three wallets utilized in the attack and mentioned their collaboration with blockchain analyst ZachXBT to trace the pilfered assets.
Magazine: China to prohibit Bitcoin ownership? Gate.io to pay $30M due to liquidations: Asia Express