On June 6, 2025, ALEX Protocol, a decentralized finance platform operating on the Stacks blockchain, experienced a significant security breach that led to the theft of over $8.3 million worth of digital assets.
The breach was traced back to a flaw in the protocol’s self-listing verification process, which was linked to inherent limitations of the Stacks network. This vulnerability allowed an attacker to manipulate asset listings and disrupt various liquidity pools.
In the aftermath of the incident, the ALEX Lab Foundation announced a comprehensive compensation plan aimed at reimbursing all affected users in USDC. This initiative is part of their commitment to restoring user trust and ensuring that all users are made whole following the hacking event.
Analysis of the Exploit and Asset Losses
The attack exploited a specific weakness in the ALEX Protocol’s asset verification logic for self-listed assets. Due to this vulnerability, the attacker was able to bypass the regular verification procedures and execute unauthorized withdrawals from multiple pools.
The stolen assets included a combination of STX, sBTC, USDC, USDT, and WBTC. Below is a summary of the losses incurred:
- 8,403,867.57 STX, valued at approximately $5,691,255.93
- 21.85 sBTC, amounting to about $2,244,751.87
- 149,850 USDC/USDT, totaling $149,850.00
- 2.80 WBTC, worth $287,369.33
In total, the estimated value of the stolen assets was $8,373,227.13. This incident has prompted discussions regarding the risks associated with automated DeFi systems, particularly in light of the self-service nature of many protocols and the questionable on-chain safeguards that are meant to protect users.
ALEX Promises Full User Compensation in USDC
Shortly after the breach, the ALEX Lab Foundation issued a statement confirming that it would fully compensate all affected users. Reimbursements will be made entirely in USDC, a stablecoin pegged to the US dollar, to mitigate exposure to market fluctuations.
To ensure fairness, the foundation will calculate each user’s compensation based on the average on-chain exchange rates recorded between 10:00 UTC and 14:00 UTC on the day of the attack, June 6, 2025. This time window accurately reflects the period during which the exploit occurred, allowing for precise asset valuations.
ALEX’s decision to fully reimburse the stolen funds showcases a significant financial commitment to uphold its integrity and responsibility within the decentralized finance space. Such actions are noteworthy and uncommon in this industry.
Claim Process and Timeline for Affected Users
ALEX has outlined a clear timeline for affected users to process their reimbursement claims. By June 8, 2025, at 23:59 UTC, all impacted wallet addresses will receive a private on-chain notification containing a direct link to a claims form. This form must be completed to qualify for reimbursement. The exact timing of this notification has not been disclosed yet.
The deadline to submit the claims form and confirm the crypto wallet address is set for June 10, 2025, at 23:59 UTC. After this date, submissions for USDC compensation will not be accepted. If the 1:1 USDC payment is not converted before a future exchange date, users have the option to specify another currency or token at the time of filing.
The importance of acting promptly and checking for notifications has been emphasized by the ALEX team. Users are encouraged to reach out to [email protected] for immediate assistance if they do not receive a claim notification by the June 8 deadline or have any questions about the process.
The ALEX Lab Foundation remains committed to restoring the lost funds. Every user affected by the exploit will be returned to their pre-incident state in full. While the exploit revealed certain structural vulnerabilities, they appear to be well-contained. The staff and engineers at ALEX Lab are dedicated to making the necessary adjustments without jeopardizing the platform’s stability.