What happened
On November 15, 2024, an attacker withdrew about $25.5 million in liquidity-pool tokens from Thala's Aptos v1 farming contracts. The issue was introduced in a November 1 patch to the boosted-farming code, not in ThalaSwap V2. The affected pools included MOD/USDC, MOD/THL, and THAPT/APT.
Thala paused the affected contracts, reverted the unsafe patch, and froze $11.5 million in MOD and THL while the incident was investigated. The attacker returned the exploited assets after a negotiated $340,000 bounty arrangement. Thala reported that user positions were made whole.
An update to the v1 boosted-farming unstake_max logic trusted a withdrawal amount without verifying it against the user's remaining recorded stake. That broke the LP-token accounting invariant and allowed an over-withdrawal after the attacker had reduced their legitimate stake to zero. The two-line patch bypassed Thala's normal security review.
Case & protocol details
Attack Timeline
Thala's v1 farming system accepted LP tokens from supported pools and tracked each user's stake. The attacker first added liquidity to a vulnerable pool, received LP tokens, and used the normal stake and unstake flow until the recorded stake was zero. They then submitted an unstake_max request for far more LP tokens than remained in their position.
The updated contract failed to enforce the core invariant that an unstake request cannot exceed the caller's current stake, so the request succeeded even though the account had no remaining LP position. The attacker received the excess LP tokens and exchanged them into liquid assets, draining the affected farming-pool liquidity.
Funds Recovery
Recovered
$25.2M
Net Loss
$331,500
Evidence & learning
Sources and on-chain records
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.