Summary
ALEX (Automated Liquidity Exchange) is a decentralized finance protocol built on the Stacks blockchain, designed to bring DeFi capabilities to Bitcoin. The protocol has suffered two major security exploits: a $4.3 million hack in May 2024 attributed to North Korea's Lazarus Group via a private key compromise of its XLink bridge, and an $8.3 million exploit in June 2025 caused by a smart contract access control vulnerability. In both cases, ALEX Lab Foundation pledged full user reimbursement, though partial recovery of 2024 stolen funds remained ongoing as of mid-2025, and the native ALEX token has declined approximately 99.9% from its all-time high.
Connected Entities
2 entities · 1 linked investigation- + 1 more
Connected Through
1 shared actor · 1 investigationDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □ALEX Laborganizationalso inALEX Lab·24
Timeline(9 events)
2021-11-15
ALEX raises $5.8 million in funding round led by White Star Capital
2022-01-17
ALEX launches mainnet on the Stacks blockchain
2024-05-14
XLink bridge private key compromised via alleged phishing attack; CertiK detects suspicious transaction
2024-05-15
ALEX Lab confirms $4.3 million exploit; offers 10% bounty for return of 90% of stolen funds; files Singapore Police report
2024-05-18
10% bounty deadline passes; ALEX Lab reports $3.9 million frozen at centralized exchanges
2024-06-25
ALEX Lab attributes May 2024 exploit to North Korea's Lazarus Group, citing ZachXBT's on-chain forensic investigation
2025-06-06
Second major exploit: $8.3 million drained via smart contract access control vulnerability in self-listing logic; ALEX token drops ~45%
2025-06-17
ALEX Lab Foundation announces completion of Treasury Grant Program; claims 100% USDC reimbursement to all affected users
2025-07-01
Farming resumed on ALEX protocol following security review
Decision Log
- hash: sFCwp6QB1svCgx6bcvBe7fv2zsWXxw4wh84PUApgFLb
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:32 AM
last updated: 5/28/2026, 4:23:28 AM
avoid.net — verified advice for a post-truth world