Briefing
ALEX Protocol, a prominent Bitcoin-based DeFi platform on the Stacks layer, experienced a significant security breach on June 6, 2025, resulting in a total loss of $16.18 million in various digital assets. The incident stemmed from a critical access control vulnerability within the protocol’s vault system, which allowed an attacker to manipulate asset listings and drain liquidity pools. This exploit underscores the persistent risks associated with complex smart contract interactions and the imperative for rigorous validation mechanisms in decentralized finance.
Context
Prior to this incident, the ALEX Protocol had a history of security challenges, including a $4.3 million exploit in May 2024 targeting its XLink bridge, attributed to either a compromised private key or insufficient input validation. This established a precedent of vulnerability within the protocol’s architecture, indicating a prevailing attack surface susceptible to sophisticated manipulation. The current exploit leveraged a new vector, but highlights a recurring pattern of systemic security gaps.
Analysis
The incident’s technical mechanics involved a sophisticated manipulation of the protocol’s self-listing and vault access controls. The attacker deployed a fake token embedded with a malicious transfer function, subsequently creating a liquidity pool with this fraudulent asset. By calling set-approved-token , the attacker illicitly granted vault-level permissions to the malicious contract. This enabled the manipulation of the set-enable-farming flag, and when the ALEX Lab contract invoked the fake token’s transfer function using as-contract , it effectively bypassed the intended access controls, allowing the attacker to systematically drain tokens from multiple liquidity pools.
Parameters
- Protocol Targeted → ALEX Protocol (Alex Lab)
- Attack Vector → Failed Access Controls / Smart Contract Manipulation
- Date of Incident → June 6, 2025
- Total Financial Impact → $16.18 Million
- Affected Assets → STX, ALEX, sUSDT, sUSDC, xBTC, USDA, aBTC, sBTC
- Affected Blockchain → Stacks Network (Bitcoin Layer 2)
Outlook
In response, ALEX Lab has paused the compromised self-listing feature and initiated collaboration with third-party auditors to conduct a comprehensive review of all smart contracts. The team has also committed to fully reimbursing affected users in USDC, calculated based on average on-chain asset prices during the exploit window. This incident will likely drive a renewed focus on stringent access control audits and robust input validation practices across the DeFi ecosystem, particularly for protocols integrating complex token listing and vault functionalities. Similar protocols on the Stacks network and other Bitcoin Layer 2 solutions must immediately review their smart contract permissions and transaction validation logic to mitigate contagion risk.
