What happened
On November 15, 2024, an attacker withdrew about $25.5 million in liquidity-pool tokens from Thala's Aptos v1 farming contracts. The issue was introduced in a November 1 patch to the boosted-farming code, not in ThalaSwap V2. The affected pools included MOD/USDC, MOD/THL, and THAPT/APT.
Thala paused the affected contracts, reverted the unsafe patch, and froze $11.5 million in MOD and THL while the incident was investigated. The attacker returned the exploited assets after a negotiated $340,000 bounty arrangement. Thala reported that user positions were made whole.
An update to the v1 boosted-farming unstake_max logic trusted a withdrawal amount without verifying it against the user's remaining recorded stake. That broke the LP-token accounting invariant and allowed an over-withdrawal after the attacker had reduced their legitimate stake to zero. The two-line patch bypassed Thala's normal security review.
How it happened
- Thala's v1 farming system accepted LP tokens from supported pools and tracked each user's stake.
- The attacker first added liquidity to a vulnerable pool, received LP tokens, and used the normal stake and unstake flow until the recorded stake was zero.
- They then submitted an unstake_max request for far more LP tokens than remained in their position.
- The updated contract failed to enforce the core invariant that an unstake request cannot exceed the caller's current stake, so the request succeeded even though the account had no remaining LP position.
- The attacker received the excess LP tokens and exchanged them into liquid assets, draining the affected farming-pool liquidity.
Protocol details
Security review history
- Spearbit View report
- OtterSec View report
- Zellic View report
Funds Recovery
Recovered
$25.0M
Net Loss
$339,150
Evidence
- report @ThalaLabs incident report x.com
- report Report cointelegraph.com
- analysis DeFiLlama defillama.com
- analysis Thala Nov 15 (Post Mortem) thalalabs.medium.com
- analysis Explained: The Thala Hack (November 2024) halborn.com
- analysis DeFi protocol Thala recovers $25 million following successful hacker negotiation theblock.co
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
