Bitcoin layer-2 developer Alex Labs has successfully frozen over $3.9 million worth of cryptocurrency exploited from its BNB Smart Chain bridge, according to a May 16 social media post.
The team stated that the attacker sent the funds to various centralized exchanges (CEXs), enabling the funds to be frozen with the cooperation of these exchanges.
The team announced that it recovered the entire balances for 17 different tokens, including “all aBTC, sUSDT, xBTC, xUSD, ALEX, atALEX, LiSTX, LUNR, SKO, CHAX, $B20, ORDG, ORMM, ORNJ, TRIO, TX20 and STXS.”
Additionally, $13.7 million worth of Stacks (STX) tokens were exploited. Of these, the attacker mistakenly sent “about 3 million” to centralized exchanges.
A linked spreadsheet shows STX balances at each exchange used by the hacker, revealing that $3.7 million is held at exchanges, while $9.6 million remains in wallets under the attacker’s control.
The attacker accessed the funds by taking control of a private key linked to one of the bridge’s “vaults.”
However, “The smart contract code and infrastructure underlying ALEX were not compromised,” the team asserted.
Alex Labs has offered a 10% bounty to the attacker and a promise not to prosecute if they return 90% of the stolen funds.
READ MORE: Param Labs Raises $7 Million to Revolutionize Web3 Gaming Infrastructure
They are also preparing a police report to be filed if negotiations fail.
Given the possibility that not all funds will be recovered, the team is “evaluating deployment of $ALEX reserves held by ALEX Lab Foundation.”
These reserves may support a “treasury grant program” to compensate users who lost funds in the attack.
Due to the significant amount of STX tokens exploited, the team may propose a Stacks network upgrade to freeze the remaining funds and mint new tokens for the victims.
Network upgrades to freeze an attacker’s coins are rare but not unprecedented. Similar actions were taken during the 2016 Ethereum DAO hack and the PopcornSwap rug pull on the BNB Smart Chain.
However, such upgrades are rarely approved, and in the PopcornSwap case, the upgrade froze funds but did not reimburse investors.
Alex Labs stated it continues to monitor the attacker’s addresses with “multiple alarms” to prevent further cash outs.
Recently, Alex Labs is not the only Bitcoin layer-2 bridge attacked. On May 17, the XLink bridge was also compromised, losing $10 million.
A white-hat hacker managed to recover $4.3 million of the stolen funds.
The XLink attack mirrored the one against Alex, with the attacker using a phishing technique to obtain the team’s private key for unauthorized withdrawals.
To submit a crypto press release (PR), send an email to sales@cryptointelligence.co.uk.
