Bitcoin DeFi project ALEX exploited again, aBTC and sBTC depeg

Just over a year after a suspected private key hack, “Bitcoin DeFi” platform ALEX Protocol has been exploited again, this time with losses estimated at $14 million.

The team initially announced a security incident, following reports of a hack circulating on X, before later publishing a more detailed incident report. The projects website remains “under maintenance.”

Notice: Incident Report on Recent Exploit

ALEX Protocol recently experienced an exploit that led to a partial loss of funds. We were able to detect and contain the attack early, minimizing further impact.

The report points to an issue with correctly identifying failed transactions on Stacks, a DeFi-focused layer two scaling solution for the Bitcoin network.

This allowed the attacker to bypass checks using data from a failed transaction and withdraw the funds.

The “partial loss of funds” amounts to an estimated $14 million, according to crypto security firm QuillAudits. Amongst the tokens stolen was 63.5 wrapped bitcoin (aBTC and sBTC), both of which have depegged significantly upon being sold off by the hacker.

Similarly, the value of Stacks‘ STX is down approximately 10% on the day, and the platform’s own ALEX token is down over 50%.

Other Stacks-based projects have confirmed that the exploit is contained to the ALEX Protocol, but Pontis has paused its bridge to contain funds within the network, and Bitflow, Stacks exchange aggregator, is removing the affected pools from its routes.

Last May, in what Certik suspected was a private key compromise, $4.3 million was removed from ALEX Protocol‘s XLink bridge connecting the project to Binance’s BNB Chain.

Despite the security upgrades and the migration of exchange and token contracts that followed, the changes have apparently proved insufficient to prevent todays far more costly attack.