Alex Protocol announces reimbursement plan for users hit by $8m exploit

Bitcoin-focused decentralized finance platform Alex Protocol has launched a Treasury Grant Program to reimburse users affected by a recent exploit that resulted in over $8 million in losses.

According to a June 8 announcement, the program will provide financial support through a combination of original tokens and USDC equivalents, depending on the type of asset lost.

Affected users must connect their impacted wallet to the official grant interface, review their specific compensation offer, and sign a confirmation message to accept the terms and conditions.

Alex Protocol was exploited on June 6, targeting several liquidity pools on the platform. Alex Protocol confirmed that the attacker exploited a vulnerability in its self-listing verification logic, allowing them to drain approximately 8.4 million STX, 21.85 sBTC, 149,850 aUSD, and 2.8 aBTC, resulting in total losses exceeding $8.3 million. 

Alex Lab has not yet published a technical post-mortem report, but one community member speculates that the issue may stem from a “Stacks limitation.”

According to an earlier update, payout amounts are based on average onchain prices observed from 10:00 am to 2:00 pm UTC during the incident. Notifications and claim instructions were sent to affected addresses by June 8.

The reimbursement structure includes full USDC compensation for STX holdings at a fixed exchange rate of 0.68 USDC per STX. 

Users who lost sBTC will receive 100% reimbursement in aBTC, while aBTC holders will get 75% of their losses in aBTC and the remaining 25% in USDC, calculated at a rate of 102,734 USDC per aBTC. For aUSD losses, 91% will be returned in aUSD, and 9% will be returned in USDC at parity.

Support payments will be distributed to eligible Ethereum addresses by June 17. Users must accept the grants by a deadline that will be communicated via official channels.

This is the second major exploit targeting Alex Protocol. Last year, the platform suffered a $4.3 million breach linked to its cross-chain bridge infrastructure. At the time, developers suspected the involvement of the North Korean hacker group Lazarus.

ALEX Lab initially offered a 10% bounty for the return of 90% of the assets, but the offer was later withdrawn without explanation.