ACryptoS vaults (November 2026) hack — November 2026
Incident facts
| Date of incident | |
|---|---|
| Publicly disclosed | November 8, 2026 |
| Target type | Other |
| Loss | $665,429As reported, basis unstated |
| Method | Contract logic errordepositMulti() accepted a token-amount array shorter than the number of tokens in the vault, so a tiny single-token deposit was priced against an undervalued pool and minted most of the shares, which were then redeemed against both assets |
| Chains | Arbitrum, BNB Chain, Polygon, Base, Optimism |
| Outcome | Project shut down |
What happened
On 8 November 2026 an attacker drained 77 concentrated-liquidity vaults of the yield aggregator ACryptoS on Arbitrum, BNB Chain, Polygon, Base and Optimism. The vaults' depositMulti() function did not check that the list of deposit amounts matched the number of tokens in the vault. By sending a tiny amount of one token, the attacker made the vault undervalue the assets it already held, received most of its shares, and redeemed them against both tokens.
SlowMist puts the loss at $665,429; ACryptoS's own analysis gives about $665,000 across the same 77 vaults. ACryptoS said at 17:17 UTC on 8 November that it had deployed an emergency fix, disabled deposits and left withdrawals open. It also said it no longer had the resources to maintain the protocol, declared it deprecated and told users to withdraw. Remaining depositors can redeem only what is left in each vault.
The team offered the attacker a 10% bounty to return the funds, which had moved through several cross-chain protocols. Nothing had been reported returned by 9 November.
Sources
- ACryptoS on X (8 November 2026)Primary · retrieved 2026-11-09
- SlowMist Hacked database, ACryptoS entry (8 November 2026)Aggregator · retrieved 2026-11-09
- TokenPost (9 November 2026)Secondary · retrieved 2026-11-09
- crypto.news (9 November 2026)Secondary · retrieved 2026-11-09
Changes to this entry
- Recorded at SlowMist's $665,429, consistent with ACryptoS's own ~$665k. Outcome project-shutdown: the team deprecated the protocol on 8 November.
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "ACryptoS vaults (November 2026) hack — November 2026", iTokenly, accessed 2026-11-10, https://itokenly.com/hacks/acryptos-vaults-november-2026https://itokenly.com/hacks/acryptos-vaults-november-2026Permalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.