On June 6, 2025, the DeFi platform ALEX Protocol - a decentralized financial protocol developed on Stacks - became the target of a serious security exploit. Hackers exploited a vulnerability in the self-listing verification logic, thereby draining assets from multiple liquidation pools of the system. The total damage was estimated at over 8.37 million USD.
Specifically, the stolen assets included 8.4 million STX (equivalent to about 5.69 million USD), 21.85 sBTC (about 2.24 million USD), 149,850 USDC/USDT (valued at approximately 150,000 USD), and 2.8 WBTC (equivalent to 287,000 USD). This security flaw originated from a limitation in Stacks' on-chain verification design, allowing the attacker to bypass the review mechanism and seize all assets in the related pools on ALEX.
Immediately after the incident, the ALEX Lab Foundation announced a plan to fully compensate all losses for affected users. Accordingly, users will receive a 100% compensation in USDC stablecoin, based on the medium on-chain exchange rate recorded from 5:00 PM to 9:00 PM Vietnam time on 6/6/2025. The total value of the compensation package exceeds 8.37 million USD.
