ALEX Protocol hack — June 2025

On 6 June 2025 an attacker drained several liquidity pools on ALEX Protocol, a decentralised exchange on the Bitcoin layer Stacks, by abusing the protocol's self-listing verification logic.

ALEX's own account is that the verification step could be defeated by referencing a failed transaction, which let a token that should have been rejected pass the listing checks. Halborn's analysis fills in the mechanism: the attacker deployed a token containing a weaponised transfer function, created a pool for it and called set-approved-token to grant its contract vault permissions. Because ALEX executes a token's transfer through as-contract during swap-x-for-y, the call appeared to originate from the vault, so the protocol's access controls did not stop it and pool assets could be moved out. ALEX said the underlying problem was an on-chain limitation of Stacks, namely the inability to reliably detect failed transactions.

ALEX published a breakdown totalling $8,373,227.13: 8,403,867.57 STX worth $5,691,255.93, 21.85 sBTC worth $2,244,751.87, 149,850 in USDC/USDT and 2.80 WBTC. That total is disputed. Halborn reports a figure of $16.18 million calculated by the researcher Crusader__btc, which adds aBTC and ALEX tokens moved in the same transaction that ALEX left out of its reimbursement scope.

The ALEX Lab Foundation committed to reimbursing affected users in full from foundation funds, priced at average on-chain rates between 10:00 and 14:00 UTC on 6 June, with claim forms due by 10 June. The ALEX token fell about 45% within a day. No arrests or fund recovery have been reported.