Bitcoin decentralized finance (DeFi) platform ALEX Protocol has recently suffered an attack, losing $8.3 million in user funds. This represents the second exploit of the Stacks-based project in just over a year following a previous heist by the notorious North Korean Lazarus hackers group from North Korea.
ALEX Protocol Falls Victim To Self-Listing Verification Flaw
In an X post on June 6, the development team behind the ALEX Protocol announced the DeFi project experienced an exploit due to a vulnerability in its self-listing verification logic i.e. a security mechanism meant to prevent unauthorized asset listings. A failure is this security system could potentially allow bad actors to introduce malicious, unauthorized or fake assets to the ALEX protocol which can be exchanged for legitimate assets.
By slipping past the self-verification logic, hackers were able to drain several asset pools making away with 8,403,867.57 Stacks (STX), valued at $5,691,255.93, 21.85 sBTC ($2,244,751.87), 149,850 USDC/USDT ($149,850), and 2.80 WBTC ($287,369.33) leading to a total haul of $8,373,227.13.
ALEX Protocol Announces Compensation Plan
Following this recent cyber attack, the developers behind ALEX Protocol has pledged to cover all user losses using the ALEX Lab Foundation Treasury. All compensation will be paid in USDC and based on the average on-chain exchange value of the stolen assets at the time of the exploit between 10:00 UTC – 14:00 UTC on June 6,2025.
By 23:59 UTC on June 8, all affected wallets should have received a private on-chain notification alongside a claim form. The claimants are expected to fill the form which should include a receiving wallet address before proceeding to submit ahead of the deadline on June 10 by 23:59 UTC.
The ALEX Protocol management team further states that all affected wallets should expect a full compensation within seven days after the submitted form is verified. It is worth stating that all victims with questions or those who fail to receive notification email before specified deadline are advised to reach out via the email stated in the announcement.
The ALEX Protocol is built on the Bitcoin network using the Stacks blockchain. It is a popular DeFi platform offering a range of services, including lending, borrowing, and trading. Additionally, ALEX supports cross-chain bridges, enabling users to transfer assets seamlessly from other networks such as Ethereum and BNB Smart Chain.
As earlier stated, the DeFi project had suffered a previous exploit in May 2024 when the Lazarus group withdrew $4.5 million through the platform’s bridge on the BNB Smart Chain Network.
