ACryptoS vault suffered an attack with losses of about $665,
The DeFi yield aggregator ACryptoS disclosed on November 9 that 77 Vaults across 5 chains had been attacked, with losses of approximately $665,000, caused by missing input checks. The project has closed deposits, kept withdrawals open, announced it is ending maintenance, asked users to withdraw funds as soon as possible, and offered the attacker a 10% bounty.
Event Timeline
- [11-09 00:18] ACryptoS announces Vaults attacked with losses of approximately $665,000; the team stops maintenance and asks users to withdraw funds as soon as possible (Wu Blockchain)
- [11-09 00:28] ACryptoS: vaults attacked with losses of approximately $665,000, project announces shutdown (PANews)
Background and Impact
On November 9, 2026, the DeFi yield aggregator ACryptoS announced that its Vaults had been attacked, involving 77 Vaults across 5 blockchains, with losses of approximately $665,000. According to the official post-mortem analysis, the attacker exploited missing input checks to mint the vast majority of shares in the Vaults through an extremely small single-token deposit. The project team has deployed emergency fixes, closing the deposit function while keeping the withdrawal channel open.
The stolen funds have been transferred through multiple cross-chain protocols, and the project team is tracking them; it has also offered the attacker a 10% bounty if the funds are returned. The two sources differ slightly in how they describe the project's fate: Wu Blockchain said ACryptoS no longer has enough resources to continue maintaining the protocol, announced it is ending maintenance, and asked users to withdraw funds as soon as possible; PANews' wording is that the project "has now ceased operations," likewise asking users to withdraw assets as soon as possible. Both accounts point to the protocol no longer continuing, but the wording differs in severity, and the full text of the official announcement is not presented in the materials.
According to DefiLlama data, the protocol's TVL once peaked at approximately $482 million in 2021 and has recently fallen to approximately $10.53 million. This means the approximately $665,000 loss is not insignificant relative to the protocol's current size; at the same time, the distribution of 77 Vaults across 5 chains also shows that multi-chain deployment exposes the same type of code flaw simultaneously across a wider scope. The attack method itself is not complex: missing input validation allowed an extremely small deposit to obtain the vast majority of shares — a flaw at the most basic layer of a contract. The project team's choice to exit maintenance after the attack also reflects the real-world pressure on long-tail DeFi protocols between security investment and team resources. Based on currently public information, the withdrawal channel remains open, but officials have not stated whether further compensation arrangements will follow.
For users who still hold positions in the protocol, the official guidance is to withdraw funds as soon as possible, and to do so while withdrawals are open, to avoid the uncertainty brought by a complete halt in maintenance later. For users who need to manage their own asset entry points, commonly available channels on the market include Binance registration app download, OKX registration app download, HTX registration app download, as well as Gate.io registration app download, Bitget registration app download, and others; how to choose is for users to decide themselves and bear the corresponding risks, and this article does not constitute any advice.
Frequently Asked Questions
### Can assets in ACryptoS still be withdrawn now?
Officials said that while closing the deposit function they have kept the withdrawal channel open and asked users to withdraw funds as soon as possible. The materials do not mention whether there is a withdrawal deadline, nor do they disclose any subsequent compensation plan; users should refer to the latest official announcements.
### How large is the scope of impact of this attack?
It involves 77 Vaults across 5 blockchains, with total losses of approximately $665,000. For reference, according to DefiLlama data, the protocol's TVL has fallen from a peak of approximately $482 million in 2021 to approximately $10.53 million recently.
### What points are worth watching going forward?
First, progress in tracking the stolen funds after they were transferred through multiple cross-chain protocols; second, whether the attacker responds to the project team's condition that "returned funds can retain a 10% bounty"; third, how long the withdrawal channel will remain open after maintenance stops and how assets will be handled.