Alex Protocol, a Bitcoin decentralized finance (DeFi) platform on the Stacks blockchain, suffered an exploit on June 6, resulting in $8.3 million in digital asset losses.  

In an X announcement, Alex Protocol said the breach was caused by a vulnerability in its self-listing verification logic. The attacker used the flaw to drain liquidity from several asset pools. 

The Bitcoin DeFi platform said the attackers siphoned about 8.4 million Stacks (STX) tokens, 21.85 Stacks Bitcoin (sBTC), 149,850 in USDC (USDC) and USDt (USDT), and 2.8 Wrapped Bitcoin (WBTC). The incident is one of the largest exploits in the Stacks ecosystem to date.

In response to the incident, Alex Lab Foundation, the organization supporting the protocol, pledged to fully reimburse affected users using its treasury reserves. 

Cointelegraph reached out to Alex Protocol through its X account but did not receive a response by the time of publication.

Alex Protocol to reimburse affected users post-exploit

According to Alex Lab, compensation will be issued in USDC tokens. The protocol will base its reimbursement calculations on the average onchain exchange rates between 10:00 am UTC and 2:00 pm UTC on the day of the attack. 

Alex Lab said wallets affected by the attack will receive an onchain notification by June 8, including a personalized claim form. Users must submit the completed form with a receiving wallet address by June 10.

The team said it will verify submitted claims and distribute USDC payments within seven days. Users who do not receive a form were urged to contact the team via email.

The team did not reveal the technical mechanisms behind the exploit but is expected to release a post-mortem report. 

Related: Bybit reveals security overhaul in response to $1.4B hack

Alex Protocol hit by another hack in May 2024

This is not the first security incident in which Alex Protocol has lost millions. In May 2024, the DeFi platform suffered an exploit involving its crosschain bridge infrastructure. The incident led to the unauthorized withdrawal of $4.3 million in crypto from the platform. 

The DeFi protocol said the May exploit was likely linked to the North Korean cybercrime group Lazarus. The team pointed to three wallets used in the attack and said they worked with blockchain analyst ZachXBT to trace the stolen assets. 

Magazine: China to ban owning Bitcoin? Gate.io to pay $30M over liquidations: Asia Express