Sovryn XUSD/WRBTC AMM pool on Rootstock (November 2026) hack — November 2026

At 18:42:46 UTC on 1 November 2026, the day after its lending contracts were drained, Sovryn's XUSD/WRBTC AMM pool on Rootstock was exploited through a related flaw. The pool's fee processing accepted an output number without checking that the tokens were delivered: real WRBTC moved from the pool to the protocol's own fee collector, and the distorted reserves let the attacker take a large XUSD withdrawal. The lending pause then in force did not cover AMM swaps, fee collection or Zero redemptions.

The transaction paid 541,455.998 XUSD to the attacker, which we confirmed from its token transfers; at the $0.995 XUSD price Sovryn uses that is $538,749, the headline here. The pool's net custody fell by about 542,184 XUSD and 6.646 WRBTC, but Sovryn says about 6.639 RBTC of that is pool principal still in protocol custody, so it is not counted as stolen. The proceeds were converted through DLLR and ZUSD and bridged out within the hour, including 5.1 BTC paid out on Bitcoin and about 0.136 ETH; those are the same proceeds, not further losses.

Sovryn changed the fee controls by 20:42 UTC, delisted the pool on 2 November and halted the AMM's affected routes and the Zero protocol through SIP-0097 on 7 November. Nothing has been returned and LP losses are still being reconciled. A separate extraction of 69,381 XUSD from Babelfish's reward inventory on 4 November is below this registry's threshold.