Alex Protocol Strengthens Security and Restores User Trust via USDC Stable Compensation Following Major Exploit

The Biggest Exploit in Alex Protocol History: A Detailed Analysis of the Incident

Description of the incident

On June 6, 2025, the decentralized finance (DeFi) platform Alex Protocol, which runs on the Stacks blockchain, suffered one of the largest attacks in the Stacks ecosystem. As a result of the exploit, the attacker managed to withdraw digital assets worth over $8.3 million . This event became a serious challenge to the entire Bitcoin DeFi infrastructure and called into question the resilience of a number of security solutions 1 2 3 .

Reason and mechanism of attack

According to Alex Protocol’s official statement, the incident was caused by a vulnerability in the token self-listing verification logic. The attacker took advantage of this vulnerability to bypass checks and drain liquidity from several asset pools. The technical details of the exploit have not yet been disclosed, but the protocol team promised to publish a detailed report after completing an internal investigation 1 2 3 .

Losses and distribution of stolen assets

The following assets were withdrawn during the attack:

8.4 million Stacks (STX) tokens
21,85 Stacks Bitcoin (sBTC)
149,850 USDC and USDT
2,8 Wrapped Bitcoin (WBTC)

The total damage is estimated at $8.3 million , making this incident the largest exploit in the history of Stacks 1 2 4 .

Team response and compensation for victims

The Alex Lab Foundation , the organization that supports Alex Protocol, quickly announced that it would fully compensate affected users using its own treasury reserves. Payments will be made in USDC tokens . The compensation amount for each user is calculated based on the average on-chain rates from 10:00 to 14:00 UTC on the day of the attack to ensure fairness in a highly volatile market 1 2 5 .

Procedure for obtaining compensation

By June 8, affected wallets received an on-chain notification with a personalized claim form.
Users had to fill out a form and provide an address to receive funds by June 10.
Once applications are verified, USDC payments will be made within seven days.
Users who have not received the form are strongly encouraged to contact the team via email to resolve the situation 1 2 5 .

Additional details of the compensation program

STX holders will be compensated in USDC at a fixed rate of 0.68 USDC per 1 STX.
sBTC holders will be fully refunded in aBTC.
aBTC holders will receive 75% in aBTC and 25% in USDC (at the rate of 102,734 USDC for 1 aBTC).
Losses in aUSD are compensated by 91% in aUSD and 9% in USDC at a parity of 5 6 .

Not the first incident: May 2024 hack

Alex Protocol has had serious security issues before. In May 2024, the platform suffered a cross-chain bridge attack that resulted in the unauthorized withdrawal of $4.3 million in assets . An investigation revealed that the attackers had gained access to internal private keys through a phishing attack, allowing them to withdraw funds from one of the liquidity vaults 7 8 .

The Alex Protocol team has claimed that North Korean cybercriminal group Lazarus is likely to be involved in the attack . The investigation identified three wallets used by the attackers and collaborated with analyst ZachXBT to track down the stolen assets. Some of the funds were frozen on centralized exchanges, but there was no guarantee of a full refund 7 8 .

The significance of the incident for the industry

The Alex Protocol exploit was a wake-up call for the entire DeFi industry, especially for projects built on the Bitcoin and Stacks blockchains. It highlighted the importance of regular audits, transparency, and rapid response from teams to incidents. At the same time, the Alex Lab Foundation’s willingness to fully compensate users was a rare example of responsible behavior in the world of decentralized finance 1 2 9 .

Summary:
The Alex Protocol incidents in June and May 2024 demonstrate the vulnerability of even large DeFi platforms and highlight the need for continuous improvement of security and transparency mechanisms in the industry.

What are the technical details behind the vulnerability that caused the Alex Protocol exploit?

Technical details of the vulnerability that caused the Alex Protocol exploit

The essence of vulnerability

The Alex Protocol exploit on June 6, 2025 was caused by a critical vulnerability in the token self-listing verification logic. The underlying issue was the lack of verification of new tokens when they were added to the protocol, allowing an attacker to bypass security mechanisms and gain access to funds in liquidity pools 1 2 3 .

How the attack was carried out

Deployment of a malicious token:
The attacker created a special token with a malicious implementation of the transfer function. This token was added to the protocol via a self-listing mechanism, which lacked strict verification of the token’s code and access rights 1 2 .
Gaining enhanced privileges:
Through the set-approved-token function, the attacker ensured that their token was granted vault-level permissions. This allowed the token to interact with the protocol’s internal contracts as a trusted asset 1 .
Internal Call Manipulation:
During normal swap-x-for-y operations, Alex Protocol smart contracts called the transfer function of a malicious token. Due to incorrect internal checks, the protocol incorrectly determined that the transfer was initiated by the storage contract itself, rather than an external token. This allowed an attacker to initiate a withdrawal from the pool without the appropriate permissions 1 2 .
Blockchain limitations:
An additional factor is the limitation of the Stacks blockchain, which did not allow for reliable detection of failed transactions. This allowed an attacker to reference erroneous transactions and bypass transaction status checks 3 .

Causes and consequences

Insufficient checks on listing:
The protocol did not require rigorous auditing or whitelisting of new tokens, allowing a malicious contract to be introduced.
Permissions system bugs:
Internal protocol functions did not distinguish the initiator of the call, resulting in privilege escalation.
Limitations of the Stacks infrastructure:
The current architecture did not allow for the correct handling of failed transactions, which further facilitated the attack 3 .

Why Self-Listing Logic Was Vulnerable to Attackers

The Alex Protocol exploit was the result of a combination of smart contract design flaws, insufficient token verification, and Stacks infrastructure. The case highlights the need for comprehensive audits and rigorous listing procedures for DeFi platforms 1 2 3 .

Alex Protocol’s self-listing logic was vulnerable because it lacked strict verification and validation of new tokens that could be added to the protocol without proper auditing and control.

This allowed the attacker to create and implement a malicious token with a modified transfer function, which was given enhanced access rights within the protocol via a self-listing mechanism. As a result, internal smart contracts mistakenly accepted calls from this token as legitimate, which allowed the attacker to freely withdraw liquidity from pools [according to the incident description].

The main reason for the vulnerability is insufficient verification and the lack of restrictions on adding new tokens , which violates the basic principles of security: integrity and control of access to funds. In addition, the features of the Stacks blockchain infrastructure did not allow for the correct processing of failed transactions, which further facilitated the bypass of protective mechanisms.

Thus, it was the lack of comprehensive verification and control during self-listing that made this mechanism vulnerable to exploitation by attackers, which led to a major exploit worth over $8 million.

How the aftermath of the previous May hack has affected the protocol’s security measures

The search results provided do not provide any direct information on how exactly the aftermath of the May hack has affected Alex Protocol’s security measures. However, based on known facts and standard practices in the DeFi industry, some reasonable conclusions can be drawn.

Following the May 2024 hack, in which attackers gained access to internal private keys and withdrew $4.3 million from the platform, the Alex Protocol team likely took the following steps to strengthen security:

Increased control over private keys and infrastructure: The incident exposed a vulnerability in key management, which typically leads to revisions to storage and access procedures, implementation of multi-factor authentication and hardware security modules.
Increased smart contract audits and reviews: After a major incident, DeFi protocols typically conduct deeper and more frequent audits to identify potential vulnerabilities, especially in critical components like the cross-chain bridge.
Implementation of monitoring and analytics: Cooperation with blockchain analysts (e.g. ZachXBT) after the May attack indicates an increased focus on monitoring suspicious transactions and quickly responding to incidents.
Increased transparency and communication with users: The promise to fully compensate victims and promptly communicate compensation indicates a commitment to rebuilding trust and improving community engagement.

Thus, the aftermath of the May hack likely served as a catalyst for reviewing and strengthening security measures at Alex Protocol, however, given the repeated exploit in June, it can be assumed that some systemic vulnerabilities and organizational weaknesses have not yet been fully addressed.

If more detailed reports are published from the Alex Protocol team, they will be able to provide an accurate picture of the specific security policy changes and technical improvements made since the May incident.

What steps is the Alex Protocol team taking to prevent similar attacks in the future?

The Alex Protocol team is taking several key steps to prevent similar attacks in the future:

Publishing a detailed technical report on the reasons behind the latest attack and security measures, promoting transparency and understanding of the protocol’s vulnerabilities 1 .
Actively collaborate with security analysts and blockchain experts to identify and fix vulnerabilities, as well as track suspicious activity and stolen assets 1 .
Implementing stricter verification and control procedures when listing tokens to eliminate the possibility of adding malicious or incorrectly implemented tokens through the self-listing mechanism (taking into account the identified vulnerability) 1 .
Strengthening audits of smart contracts and infrastructure , especially in critical components such as cross-chain bridges and permissions management mechanisms, to minimize the risks of replay exploits 1 .
Develop and implement a notification and compensation system for users , which allows for prompt response to incidents and maintains community trust 1 .
Enhanced monitoring and incident response capabilities , including the use of on-chain analytics and collaboration with security experts, to help quickly detect and block suspicious transactions 1 .

As such, the Alex Protocol team aims to strengthen the protocol’s security in a comprehensive manner, combining technical improvements, auditing, transparency, and community engagement to reduce the likelihood of similar attacks happening again.

How USDC Refunds Will Help Restore User Trust in the Platform

USDC reimbursement helps restore user confidence in Alex Protocol for several key reasons:

USDC Stability and Transparency: USDC is one of the largest and most transparent stablecoins, fully backed by USD reserves and short-term Treasury bonds. The issuing company, Circle, regularly publishes independent audit reports, giving users confidence that each USDC token can be exchanged for a dollar at a rate of 1:1 1 2 6 .
Regulated and Trusted Issuer: Circle has received a trust charter from US regulators, increasing the level of trust among institutional and retail investors in USDC as a payment instrument integrated into traditional financial systems 1 .
Volatility Protection: Unlike many crypto assets, USDC is not subject to large price fluctuations, allowing affected users to retain the value of their refunded funds without the risk of loss due to market volatility 6 .
Fast and convenient conversion: USDC is widely supported on most crypto exchanges and DeFi platforms, making it easy to access funds and use or withdraw them 6 7 .
Positive signal for the community: The promise to pay compensation in USDC demonstrates the responsibility of the Alex Protocol team and its desire to minimize user losses, which helps build trust and reduce panic in the community.

Therefore, using USDC for compensation is not just a technical solution, but an important step that provides stability, transparency and convenience for users, helping to restore their trust in the platform after a major incident.

How USDC Refunds Will Strengthen User Confidence in Platform Stability

USDC reimbursement will strengthen user confidence in the stability of the Alex Protocol platform for the following reasons:

USDC Price Stability: USDC is a stablecoin pegged 1:1 to the US dollar, providing a hedge against crypto market volatility and keeping the value of the funds exchanged constant for users 1 2 3 .
Transparency and reliability of the issuer: Circle, the company that issues USDC, holds 100% of its reserves in liquid assets – cash and short-term US Treasury bonds, undergoing regular independent audits. This increases the credibility of USDC as a reliable digital asset 1 3 8 .
Fast liquidity and wide support: USDC is supported by most crypto exchanges and DeFi platforms, allowing affected users to easily convert their refunds into other assets or withdraw to fiat 9 10 .
Crisis Resilience: Despite past stress tests (such as the 2023 Silicon Valley Bank crisis), Circle has responded quickly and maintained USDC’s peg to the dollar, proving the stability and reliability of the stablecoin 2 4 .
Positive signal for the community: Paying compensation in USDC demonstrates the responsibility and willingness of the Alex Protocol team to minimize user losses, which helps restore trust and reduce panic 5 .

Thus, USDC reimbursement provides users with confidence in the safety of their funds, reduces the risks associated with market volatility, and maintains the stability of the platform, which is an important factor in restoring and strengthening trust in Alex Protocol.