What happened
On June 6, 2025, a malicious token contract was admitted to ALEX Lab's approval path on Stacks and then used to drain vault-held assets. Opened analysis reports an official loss inventory of about $8.3 million and an on-chain-inclusive estimate of about $16.18 million; the supplied $16.1 million aligns with the latter estimate, not the project's reported inventory.
How it happened
- The attacker deployed a malicious token with a crafted transfer function and created a token pool.
- The self-listing path granted that contract vault-level approval.
- A farming-setting call enabled the malicious transfer path.
- During
swap-x-for-y, the vault called the malicious transfer usingas-contract, allowing the contract to act with vault authority and drain assets.
Protocol details
Classification
Borrowing and Lending / Protocol Logic / Access Control
Protocol Type
DEX
Implementation language
Clarity
Protocol links
Website
@ALEXLabBTC
Evidence
- report Post-mortem rekt.news
- report Report unchainedcrypto.com
- report @ALEXLabBTC incident report x.com
- analysis DeFiLlama defillama.com
- analysis Explained: The ALEX Protocol Hack (June 2025) halborn.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
