We value your privacy

We use cookies to enhance your browsing experience and analyze traffic anonymously for internal statistical purposes. By clicking “Accept all,” you consent to the use of cookies.

News Flash

Alex Protocol loses $8.3 million in DeFi Bitcoin exploit on Stacks

A flaw in the self-listing verification logic led to one of the largest hacks in the Stacks ecosystem

Alex Protocol

27 June 2025

Table of contents

  • $8.3 million gone: What happened to Alex Protocol?
  • A swift response: Refunds and recovery
  • A troubling precedent: the May 2024 hack
  • Post-mortem report still pending

$8.3 million gone: What happened to Alex Protocol?

Alex Protocol, a Bitcoin DeFi platform built on the Stacks blockchain, was hit by a devastating exploit on June 6, 2025, resulting in a loss of approximately $8.3 million in digital assets. According to an announcement on X, the breach was due to a vulnerability in the platform’s self-listing verification logic, which attackers used to drain liquidity from multiple asset pools.

The stolen assets included approximately 8.4 million STX tokens, 21.85 sBTC, 149,850 USDC, an unspecified amount of USDT, and 2.8 WBTC—marking the largest attack in Stacks’ DeFi history.

A swift response: Refunds and recovery

The Alex Lab Foundation, which supports the protocol’s development, has committed to fully refunding the affected users using its treasury reserves. The refunds will be processed in USDC, based on the average on-chain exchange rates between 10:00 and 14:00 UTC on the day of the attack.

Affected users will receive a personalized on-chain notification with a claim request. To be eligible, users must submit a form including their destination wallet address by June 10. The team stated that payments will be issued within seven days after verifying each claim.

A troubling precedent: the May 2024 hack

This is not the first time Alex Protocol has faced a major security breach. In May 2024, it was attacked via its cross-chain bridge infrastructure, leading to unauthorized withdrawals totaling $4.3 million. The team suspected involvement of the North Korean Lazarus Group, sharing wallet addresses used in the attack and collaborating with blockchain investigator ZachXBT to track stolen funds.

Post-mortem report still pending

Although the team has yet to disclose the technical details behind the latest exploit, a post-mortem report has been promised. This analysis will be crucial in restoring trust and bolstering the security and transparency of Bitcoin-based DeFi protocols.

Questions and answers

  1. What is Alex Protocol?
    It’s a DeFi platform on Bitcoin using the Stacks blockchain, offering services like DEX, yield farming, and lending.
  2. How much was stolen in the June 6 exploit?
    Roughly $8.3 million in STX, sBTC, USDC, USDT, and WBTC.
  3. What caused the vulnerability?
    A flaw in the self-listing verification mechanism.
  4. How will users be refunded?
    In USDC, based on average on-chain exchange rates during the attack window.
  5. What’s the deadline to claim refunds?
    By June 10, 2025.
  6. When will payments be made?
    Within 7 days after verifying the claims.
  7. How are users notified?
    Via personalized on-chain messages with a claim request form.
  8. Has Alex Protocol been hacked before?
    Yes, in May 2024 with a $4.3M loss due to a bridge exploit.
  9. Who was suspected in the 2024 attack?
    The North Korean Lazarus Group.
  10. Will a technical report be released?
    Yes, the team has promised a post-mortem report.
6
To top