ACryptoS Halts Operations After $665,000 Exploit Hits 77 Vaults

Decentralized finance yield aggregator ACryptoS has halted operations after an attacker drained roughly $665,000 from 77 vaults across five blockchain networks. The project disclosed the incident on Nov. 9, disabled all deposits, and urged users to withdraw their remaining assets while withdrawals stay open.

The protocol said it can no longer sustain the maintenance required to keep the platform running, and it is winding down as a result. The affected products were the protocol's vaults, the core offering of a yield aggregator that automatically deploys user deposits into farming strategies.

How did the exploit work?

The root cause was missing input validation in the vault contracts. The flaw allowed an attacker to deposit a very small amount of tokens and receive most of a vault's shares in return, according to the project's own account of the incident.

That failure mode is particularly damaging for a vault architecture. Share minting determines how deposits and withdrawals settle against a vault's underlying holdings. When an attacker can acquire most of a vault's shares for a nominal deposit, the assets backing legitimate depositors' positions can be extracted through a normal withdrawal of those inflated shares. The result across ACryptoS was a total loss of approximately $665,000 spread across 77 individual vaults on five networks.

The multi-chain footprint amplified the operational damage. Because the affected vaults sat on five separate networks, the project faced simultaneous exposure on each chain rather than a single contained contract failure.

What is ACryptoS doing now?

The protocol has taken three concrete steps since the Nov. 9 disclosure:

• Deposits disabled. No new funds can enter any vault, closing the attack surface that the input-validation flaw left open.
• Withdrawals remain open. Users can still pull their assets out, and the project has explicitly urged them to do so.
• Wound-down operations. ACryptoS stated it can no longer sustain the maintenance the project requires, signaling a permanent shutdown rather than a pause.

The project also confirmed that funds taken in the exploit have moved through several cross-chain protocols after the theft. Chasing assets across multiple bridges and chains raises the difficulty of any recovery, since each hop can shift the funds between networks with different finality rules and monitoring coverage.

What about the stolen funds?

ACryptoS has offered the attacker a 10% bounty for returning the stolen funds. Bounty offers of this kind function as a negotiated settlement channel: the attacker keeps a defined cut, and depositors recover the remainder without reliance on law enforcement or blockchain forensics firms.

For a loss of about $665,000, the bounty would amount to roughly $66,500 if the attacker returns everything. The remaining balance, close to $598,500, would flow back toward the affected vaults and their depositors. Whether the attacker responds remains the central open question, and the offer carries no stated deadline.

What happens next?

The immediate priority for users is withdrawal: deposits are locked out, but exits remain available for as long as the project keeps the withdrawal path open during its wind-down. The 10% bounty window now defines the only active recovery track, and the fate of the roughly $665,000 in stolen funds will turn on whether the attacker accepts the offer before the trail through cross-chain protocols goes cold.