The Stacks DeFi protocol ALEX announced that it was attacked due to a vulnerability in its coin listing verification logic, with the attacker extracting funds from multiple asset pools, resulting in a total loss of approximately 8.37 million USD. The specific losses are:
STX loss of 8.4 million STX (approximately 5.69 million USD), sBTC loss of 21.85 sBTC (approximately 2.24 million USD), USDC/USDT loss of 149,850 (approximately 149,800 USD), WBTC/BTC loss of 2.80 WBTC (approximately 287,400 USD).
The ALEX Lab Foundation will use the treasury to fully compensate each affected user for their losses, with compensation paid in USDC. The compensation calculation will be based on the average on-chain exchange rate between 18:00 and 22:00 on June 6, 2025. Affected wallet addresses will receive a private notification before 7:59 on June 9, 2025, containing a claims form. The claims form must be submitted before 7:59 UTC on June 11, 2025, to confirm the receiving wallet address. Upon confirmation, the compensated USDC will be sent within 7 working days.