Incident

ALEX Protocol reports major breach, $8.37 Million Loss


Learn More

ALEX Protocol, a Bitcoin decentralized finance (DeFi) platform built on the Stacks blockchain, is reporting its second significant security incident in just over a year, resulting in losses of approximately $8.37 million on June 6, 2025. 

The attack exploited a vulnerability in the platform's self-listing verification logic, in how ALEX Protocol handled failed transactions on the Stacks network. Stacks blockchain  inherent on-chain limitation prevented proper verification of transaction failures. Attackers exploited this using rejected data to falsely authorize fund withdrawals from multiple asset pools. 

The hackers siphoned about 8.4 million Stacks (STX) tokens, 21.85 Stacks Bitcoin (sBTC), 149,850 in USDC and USDt, and 2.8 Wrapped Bitcoin (WBTC). The precise breakdown of stolen assets includes:

  • 8,403,867.57 STX tokens valued at $5,691,255.93
  • 21.85 sBTC worth $2,244,751.87
  • 149,850 USDC/USDT totaling $149,850
  • 2.80 WBTC valued at $287,369.33

The number of affected users is not disclosed. The total confirmed loss amounts to $8,373,227.13. The attack also triggered significant market repercussions, with ALEX token plunging over 50% and STX dropping around 10% on the day.

This incident marks ALEX Protocol's second major security breach in just over a year. In May 2024, the platform suffered a $4.3 million exploit involving its XLink bridge, which was suspected to be linked to a private key compromise and potentially connected to the North Korean cybercrime group Lazarus. 

 ALEX Lab Foundation immediately acknowledged the incident is preparing a reimbursement plan. The organization pledged to fully reimburse affected users using its treasury reserves, with all compensation to be paid in USDC based on average on-chain exchange rates between 10:00 and 14:00 UTC on June 6, 2025.

 ALEX Protocol or identified through available sources. Similarly, specific details about the attack methodology and the identity of the perpetrators remain undisclosed as investigations continue.

ALEX Protocol reports major breach, $8.37 Million Loss