0x706d696e706d…706d6971
ACryptoS Suffers $665,000 Exploit Across 77 Vaults, Halts Operations
A missing input check let an attacker drain roughly $665,000 from 77 ACryptoS vaults on five chains. Deposits are closed, withdrawals open, and maintenance has stopped.
Outputs
ACryptoS reported roughly $665,000 in losses from an attack on 77 vaults across five blockchains.
The exploit stemmed from a missing input check that let the attacker receive most vault shares for a tiny deposit.
Deposits are disabled and withdrawals open; the team has stopped protocol maintenance for lack of resources.
ACryptoS offered the attacker a 10% bounty for returning the funds.
Protocol TVL peaked near $482 million in 2021 and recently stood at roughly $10.53 million.
DeFi yield protocol ACryptoS lost roughly $665,000 to an attack that hit 77 vaults across five blockchains, the team disclosed, forcing it to disable all new deposits and urge users to withdraw their funds.
The protocol has also shut down maintenance. The team said it no longer has enough resources to keep ACryptoS running, a decision that effectively ends active development on a protocol that once held hundreds of millions of dollars.
What exactly did the attacker do?
A post-incident analysis by ACryptoS traced the exploit to a missing input check in the vault contracts. That flaw let the attacker make a very small deposit in one asset and, in return, receive most of the shares in the affected vaults.
In other words, the attacker bought control of the vaults almost for free. Share issuance, the mechanism that normally protects existing depositors' proportional claim on vault assets, failed to price the deposit correctly. The attacker then walked away with the difference.
The team has installed an emergency fix. New deposits remain disabled while withdrawals stay open, so users who still hold positions can exit at will.
Where did the money go?
ACryptoS said it is tracking the stolen funds after they moved through multiple cross-chain protocols. The trail cuts across at least five networks, which complicates any recovery effort because cross-chain bridges and messaging layers fragment the on-chain record.
The project has offered the attacker a 10% bounty for returning the funds. That figure, roughly $66,500 on the reported loss, follows a common playbook in DeFi incidents: negotiate first, litigate later, and rarely litigate at all.
What does this change for depositors?
The practical answer is urgency. Withdrawals remain open, but nobody maintains the protocol anymore. Emergency fixes can hold, yet unmaintained code on five chains carries operational risk that grows with time — from integration breakage, from further exploits, from simple rot.
The scale of the decline matters here. ACryptoS peaked at about $482 million in total value locked in 2021, according to the project's own figures. Before the incident, TVL stood at roughly $10.53 million.
That is a 98% drawdown from the peak, sustained over nearly four years. The protocol survived the 2022 bear market and the collapse of the DeFi yield farming boom, but it did not survive the loss of the resources needed to keep auditing, patching and monitoring its contracts.
A wider signal for small-cap DeFi
The incident fits a pattern. Protocols with declining fee revenue often cut back on security work before they cut back on marketing, and the first visible symptom is sometimes an exploit of code that shipped years earlier.
For ACryptoS users, the window that matters is now: withdrawals are open, deposits are closed, and the 10% bounty offer gives the attacker a financial reason to negotiate rather than launder the proceeds through further cross-chain hops. Whether the funds move back or keep moving outward will decide if any of the $665,000 is recovered.
via tokenpost.com (Source)
More from Marcus Bennett
Show full bio
Senior reporter covering money, funding and market shifts around crypto and web3 industry at Mempool Brief.
778 articles