Thala Labs Hack

On November 15, 2024, Thala Labs faced an exploit in its v1 farming contracts that led to the unauthorized withdrawal of $25.5 million in liquidity pool tokens.

The vulnerability resided in an isolated component of Thala’s v1 farming mechanism, enabling the attacker to withdraw liquidity pool tokens and drain assets, including $2.5 million in THL tokens and $9 million of the Move Dollar (MOD) stablecoin. Upon detecting the breach, Thala halted all affected contracts, preventing further losses. Partnering with law enforcement and security experts, the project traced the hacker’s identity, leading to negotiations that saw the full return of user assets in exchange for a $300,000 bounty.

Thala’s front end has since been restored, though farming remains paused pending a thorough code review and re-audit to bolster security and ensure trust.