Incident Overview
DeFi yield aggregator ACryptoS suffered a vault exploit due to a missing input validation check in the depositMulti function (array length not verified against token count). Attackers could deposit a tiny single-token amount to mint the vast majority of vault shares and withdraw a proportional share of both tokens. The attack hit 77 vaults across 5 chains (Arbitrum, BSC, Polygon, Base, Optimism), with total losses of approximately $665,000. Deposits have been disabled while withdrawals remain open; the project offered a 10% whitehat bounty for fund return and announced it is being deprecated due to lack of resources, urging users to withdraw ASAP.
Sources & References
This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.