Alex Protocol Suffers $8.3M Exploit on Stacks Blockchain

The decentralized finance (DeFi) sector, despite its innovative promise, continues to face persistent security challenges, a reality underscored by a recent major exploit. Alex Protocol, a prominent DeFi platform operating on the Stacks blockchain, became the latest victim of a significant security breach, resulting in a loss of approximately $8.3 million in digital assets. This incident marks another critical reminder of the vulnerabilities inherent in the rapidly evolving landscape of blockchain technology.

Details of the Recent Exploit

The attack on Alex Protocol occurred on June 6, 2025, stemming from a critical flaw identified within the platform’s self-listing verification logic. This vulnerability, described as an on-chain limitation on Stacks, enabled malicious actors to circumvent security protocols and drain various liquidity pools. The stolen assets comprised a diverse portfolio, including a substantial amount of 8.4 million STX tokens, 2.8 wrapped Bitcoin (wBTC), and close to $150,000 in stablecoins (USDC and USDT), alongside over 21 Stacks Bitcoin. This breach represents one of the most significant security incidents recorded within the Stacks ecosystem.

On June 6, 2025, ALEX Protocol was exploited via a flaw in the self-listing verification logic (an on-chain limitation on Stacks). As a result, the attacker drained several asset pools, with the breakdown of lost assets as follows:

STX: 8,403,867.57 STX → $ 5,691,255.93

sBTC:… June 6, 2025

— ALEX 🟧 No. 1 Bitcoin DeFi (@ALEXLabBTC) June 6, 2025

Commitment to User Compensation

In response to the breach, the Alex Lab Foundation has swiftly announced its unwavering commitment to fully compensate all affected users. The foundation plans to utilize its own reserves to cover the losses, with reimbursements to be made in USDC stablecoins. The amount of compensation for each affected user will be precisely calculated based on the average market prices of the compromised assets on the day of the attack.

The compensation process has been clearly outlined: affected users will receive a notification and a personalized claim form by June 8. To facilitate timely processing, these completed forms must be submitted to the developers by June 10, 2025. The Alex Lab Foundation has pledged to process all payouts within one week following the verification of submitted claims.

A History of Vulnerability: Previous Incident

This recent exploit is not the first time Alex Protocol has faced a significant security challenge. The platform previously suffered a cyberattack in May 2024, which resulted in the loss of $4.3 million. That incident was attributed to a vulnerability within a cross-chain bridge. Investigations into the May 2024 breach notably pointed to the potential involvement of the infamous North Korean hacking group, Lazarus.

#CertiKInsight 🚨

We have seen a suspicious transaction affecting @ALEXLabBTC

Initial evidence points to a possible private key compromise.

Deployer of 0xb3955302E58FFFdf2da247E999Cd9755f652b13b upgrades to a suspicious implementation.

In total ~$4.3m worth of assets have… pic.twitter.com/02kiw2dFrm

— CertiK Alert (@CertiKAlert) May 14, 2024

Following both the May 2024 and the recent June 2025 incidents, the Alex Protocol team has demonstrated a consistent approach by engaging with leading analytics firms to investigate the breaches thoroughly. The platform has also committed to publishing comprehensive technical reports detailing the root causes and mitigation strategies for each incident, aiming to foster transparency and improve security measures within the DeFi space. These incidents highlight the ongoing battle against sophisticated cyber threats in the cryptocurrency domain, with reported losses from hacking attacks in May alone nearing $244 million across the industry.