ALEX Lab (XLink bridge) hack — May 2024

In mid-May 2024 an attacker holding a private key that controlled ALEX Lab's XLink bridge pushed three successive upgrades of the Bridge Endpoint proxy on BNB Chain to a malicious implementation. CertiK, whose monitoring flagged the incident, dates it 14 May; CoinDesk and Taylor Monahan's research compilation date it 15 May. CertiK attributed the key compromise to a phishing attack on the deployer wallets.

The reported size varies widely because the attack ran across three chains and much of it was reversed. The figure CoinDesk used, which ALEX itself repeated, is $4.3 million on BNB Chain: roughly $3.3 million in stablecoins, over $300,000 in bitcoin and about $75,000 in Sugar Kingdom tokens. That leg largely failed. The attacker's malicious implementation left the withdrawal function open to anyone, and a white-hat front-ran the drain, taking about $4.4 million and later returning it under a negotiated 10% bounty. ALEX said around $4.5 million of a further $5 million exposed on Ethereum was recovered or secured.

The larger movement was on Stacks, where about 13.7 million STX left a bridge vault. Taylor Monahan's Lazarus research compilation values that at about $27.4 million. Cointelegraph, reporting ALEX's own published spreadsheet, described roughly $13.7 million in Stacks tokens exploited, with about $3 million sent to centralised exchanges, $9.6 million left in wallets under the attacker's direct control and $3.7 million identified as held at exchanges. CertiK put the Stacks leg at only about $2 million. No combined cross-chain USD total was ever published by ALEX.

ALEX froze more than $3.9 million at exchanges, recovering full balances of 17 tokens, and offered a 10% bounty valid until 18 May with a promise not to prosecute. On 25 June 2024 it said forensic work assisted by ZachXBT produced transaction evidence linking the attack to the Lazarus Group.