HermesVault Hack

On May 20, 2026, the Algorand-based privacy protocol HermesVault was exploited for approximately 261,000 ALGO (~$29,500). HermesVault has since disabled deposits and permanently retired the protocol.

The exploit bypassed HermesVault’s privacy guarantees by targeting the "LogicSig" (Logic Signature) verification script. While the core zk-circuits functioned as intended, a vulnerability in the guard logic against rekeying allowed the attacker to rekey the withdrawal verifier contract. By doing so, the attacker gained unauthorized control over the contract and was able to execute withdrawals, completely circumventing the zk-proof validation path.

The attacker utilized a rekey transaction to hijack the verifier, followed by a withdrawal transaction to drain the funds. The protocol team identified the flaw, patched the underlying algoplonk library to prevent similar rekeying attacks in the future, and initiated an immediate refund process. Because the protocol has retired, the team is manually verifying claims from users who can prove ownership of their deposit addresses via secret notes.

Attacker Address: 2PYF5VFHZYXR7NDXHEPVNJJ73FKTXKTQ3TAUH6ZIIEEL73MCTXUN4GQEL4

Exploit Transactions:

Rekeying: PPYN7EUFUOMGKHJJSZG2DDYMSUIF66LV2YOXMSEJGLVUOYLJCSVQ

Withdrawal: ZBNGF7QOQ6MZZP2PUXPK5VOLZSQBU3QTEYW6UVX4J2JSU2ACEQ7Q