Alex Lab, a prominent Bitcoin DeFi protocol built on the Stacks blockchain, suffered a major security breach on June 6, resulting in the loss of around $8.3 million of digital assets. 

The attacker exploited a vulnerability in the protocol’s self-listing verification logic, allowing them to drain liquidity from several asset pools. The stolen assets included 8.4 million Stacks (STX) tokens, 21.85 Stacks Bitcoin (sBTC), and a few hundred thousand dollars of stablecoins USDT, USDC and Wrapped Bitcoin (wBTC).

The exploit triggered a sharp market reaction, with the $ALEX token plummeting 45% following the news. The development followed an earlier $4.3 million theft from Alex Lab in May last year that the protocol linked to North Korean state-sponsored cybercrime outfit Lazarus Group.

This story is an excerpt from the Unchained Daily newsletter.

Alex Lab Foundation, the entity behind the protocol, committed to fully reimbursing all affected customers using its treasury reserves. 

The team said compensation would be issued in USDC stablecoins, with reimbursement amounts calculated based on average onchain exchange rates between 10:00 a.m. and 2:00 p.m. UTC on the day of the attack.