Sovryn lending and margin on Rootstock (October 2026) hack — October 2026

Three transactions on 31 October 2026, at 08:34, 15:50 and 15:53 UTC, drained Sovryn's lending and margin contracts on Rootstock, the Bitcoin sidechain. The lending system failed to verify that tokens had actually arrived: a malicious conversion route reported swap output that the protocol accepted as collateral, and real assets then left the lending pools against it. Sovryn learned of it at 19:52 UTC and paused the core protocol at 20:10 UTC and the lending pools by 20:19 UTC.

Sovryn's reconciliation puts the attacker's net proceeds at 604,575.19 XUSD and 4.02606509 WRBTC, after the attacker's own starting capital. At the report's own valuation assumptions (XUSD at $0.995, BTC at $77,500; CoinGecko had BTC at about $77,275 that day) that is about $913,600, the headline here. A 24-hour withdrawal delay Sovryn had switched on five days earlier held seven further requests of 66,134 XUSD in escrow before they reached the attacker; they are excluded from the loss rather than counted as recovered. The unsupported loans and collateral the attack left behind overlap with this cash loss and are not added to it.

Lending, borrowing and margin trading remain halted while loans, collateral and pool balances are reconciled; Sovryn has not announced how losses will be allocated. A related attack on its XUSD/WRBTC AMM pool the next day is a separate entry, and Sovryn says it has not established that the same operator was behind both.