{"investigation":{"slug":"acala-network","entity_name":"Acala Network","trust_score":32,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"Acala Network is a Polkadot-native DeFi hub offering a multi-collateralized stablecoin (aUSD), liquid staking, and an AMM DEX. On August 14, 2022, a misconfiguration in a newly deployed liquidity pool caused 3.022 billion aUSD to be erroneously minted, triggering a 99% depeg; approximately 98% of the erroneous tokens were subsequently recovered and burned via community governance votes. The incident raised significant concerns about the protocol's claimed decentralization after the team unilaterally placed the network in maintenance mode and froze token transfers without an on-chain vote.","sections":[{"content":"On August 14, 2022, a misconfiguration in the DexSavingRewardRates parameter of the accumulate_dex_saving function within Acala's incentives pallet caused the iBTC/aUSD liquidity pool — launched the same day — to mint aUSD instead of LP tokens as rewards. The root cause was a deprecated code path from Acala's Kusama canary network (Karura) that was improperly re-activated during pool deployment. A total of 3.022 billion aUSD were erroneously minted and claimed across 16 wallet addresses. The stablecoin's price collapsed from approximately $1.03 to $0.009 — a decline of roughly 99% — within hours of the exploit being discovered. Approximately 2.97 billion aUSD (about 98%) remained traceable on-chain. Community governance subsequently burned approximately 1.292 billion aUSD in a first vote and a further 1.682 billion in a second vote. Eight addresses were reported to have bridged tokens off-chain before the network freeze, with estimated permanent losses ranging between $1.6 million and $10 million according to on-chain analysts. A full trace report was released by Acala on September 5, 2022. The network resumed full operations on September 26, 2022.","heading":"August 2022 aUSD Minting Exploit","sources":[{"url":"https://www.coindesk.com/tech/2022/08/22/inside-the-3b-defi-exploit-of-acalas-crypto-platform","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/tech/2022/08/15/acalas-stablecoin-falls-99-percent-after-hackers-issue-13-billion-tokens","name":"coindesk.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/another-depeg-acala-trace-report-reveals-3b-ausd-erroneously-minted","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://medium.com/acalanetwork/acala-incident-report-14-08-2022-392089588642","name":"medium.com","type":"other","credibility":3},{"url":"https://cryptopotato.com/alcala-resumes-operations-after-printing-over-3-billion-in-stablecoins-by-mistake/","name":"cryptopotato.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following discovery of the exploit, Acala's team unilaterally placed the network in maintenance mode and froze token transfers — actions taken without a prior on-chain governance vote. This response drew immediate criticism from community members and DeFi commentators. Twitter users publicly questioned whether Acala could legitimately claim to be a decentralized protocol if the founding team held the practical ability to freeze user funds on demand. One widely-shared comment noted that any such decision 'would have to go to governance to be decentralized finance,' and asked: 'If Acala centrally controls that decision is this really DeFi?' Acala later framed the freeze as an emergency measure necessary to prevent permanent loss, and subsequent recovery and burn decisions were formally ratified through governance referendums. Nonetheless, the episode remains a documented example of unilateral founder-level intervention in a protocol that had marketed itself as censorship-resistant.","heading":"Centralization and Governance Controversy","sources":[{"url":"https://cointelegraph.com/news/network-and-token-freeze-after-acala-exploit-raises-questions","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://www.fxstreet.com/cryptocurrencies/news/network-and-token-freeze-after-acala-exploit-raises-questions-202208150329","name":"fxstreet.com","type":"other","credibility":3},{"url":"https://beincrypto.com/acala-network-ausd-depegs-by-99-as-hacker-issues-over-1-billion-tokens/","name":"beincrypto.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Prior to the August 2022 incident, Acala's codebase had been audited by Trail of Bits, SlowMist, and SRLabs, with SRLabs providing ongoing security assurance. The exploit code itself was described as 'mature code' that had been audited multiple times and battle-tested on Karura. However, the vulnerability stemmed from a parameter misconfiguration rather than a novel code flaw — a category of risk that standard smart contract audits do not systematically cover, as parameter changes can be applied via governance votes without triggering new audit requirements. Trail of Bits publicly acknowledged that their review 'didn't perform an exhaustive review of the Honzon protocol' and that additional reviews were required for full coverage. This gap between formal audit scope and operational deployment risk contributed directly to the incident.","heading":"Security Audit Failures and Pre-Exploit Posture","sources":[{"url":"https://medium.com/quillhash/acalas-unlimited-usd-minting-exploit-analyzation-8ac8c5183a38","name":"medium.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/tech/2022/08/22/inside-the-3b-defi-exploit-of-acalas-crypto-platform","name":"coindesk.com","type":"other","credibility":3},{"url":"https://hackenproof.com/blog/industry-news/defi-network-acala-lost-1-2-billion-ausd-in-exploit","name":"hackenproof.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the community burn votes and network resumption, aUSD did not fully recover its $1.00 peg — reports indicated it was trading at approximately $0.77 in the months after the September 2022 reactivation. The Acala Foundation donated 2.489 million ACA, 80,853 DOT, and additional assets to recapitalize liquidity pools to pre-incident levels. A bounty of up to 5% was offered to users returning incident-related funds. The protocol subsequently launched an 'Acala 2.0 Sinai Upgrade' on June 17, 2024, with stated improvements to DeFi functionality and security. As of mid-2026, the ACA token trades at approximately $0.00074, representing a decline of over 99% from its all-time high of $2.79. TVL on the protocol has contracted significantly from peak levels reached prior to the exploit.","heading":"aUSD Peg Recovery and Post-Incident Protocol Health","sources":[{"url":"https://cryptopotato.com/alcala-resumes-operations-after-printing-over-3-billion-in-stablecoins-by-mistake/","name":"cryptopotato.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/tech/2022/08/16/acala-stablecoins-nears-1-peg-after-community-burns-12b-ausd-minted-by-exploiters","name":"coindesk.com","type":"other","credibility":3},{"url":"https://parachains.info/details/acala_network","name":"parachains.info","type":"other","credibility":3}],"severity":"medium"},{"content":"Acala Network was co-founded by Bette Chen, Bryan Chen, Ruitao Su, and Fuyao Jiang. The project grew out of a 2019 Substrate Hackathon collaboration. Ruitao Su and colleagues previously co-founded Laminar, an open finance margin trading platform. The project received five Web3 Foundation grants and raised approximately $7.3 million in a 2020 funding round, with backers including Polychain Capital, Pantera Capital, Coinbase Ventures, and Hypersphere. Acala won Polkadot's first parachain slot auction in late 2021, securing approximately $1.3 billion in DOT crowdloan contributions from community participants. The ACA token was publicly distributed via an ICO that ran August 31 to September 3, 2021.","heading":"Project Background and Funding","sources":[{"url":"https://www.kraken.com/learn/what-is-acala-aca","name":"kraken.com","type":"other","credibility":3},{"url":"https://www.crunchbase.com/organization/acala-network","name":"crunchbase.com","type":"other","credibility":3},{"url":"https://cryptopotato.com/acala-wins-polkadots-first-parachain-auction-with-1-3-billion-secured/","name":"cryptopotato.com","type":"other","credibility":3}],"severity":"medium"},{"content":"As of 2025-2026, Acala Network continues to operate as a Polkadot parachain. Development activity includes an Ambassador Program V3 approved via on-chain governance and a Roadmap 3.0 planned for Q4 2025. An Ecosystem Growth Fund with approximately $2 million in assets is under discussion for deployment in early 2026. The ACA token has experienced severe value erosion, trading at a fraction of a cent as of May 2026. The aUSD stablecoin has not demonstrated reliable peg maintenance since the 2022 exploit. The protocol's long-term viability remains uncertain given the magnitude of trust damage from the exploit and subsequent token price decline. No regulatory enforcement actions (SEC, CFTC, or equivalent) have been publicly identified against Acala Network or its founders as of the investigation date.","heading":"Current Status and Ongoing Risks","sources":[{"url":"https://parachains.info/details/acala_network","name":"parachains.info","type":"other","credibility":3},{"url":"https://coinmarketcap.com/cmc-ai/acala/latest-updates/","name":"coinmarketcap.com","type":"other","credibility":3},{"url":"https://www.coingecko.com/en/coins/acala","name":"coingecko.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2019","event":"Founders Bette Chen, Bryan Chen, Ruitao Su, and Fuyao Jiang meet at the first Substrate Hackathon and begin collaborating on what becomes Acala Network.","source":"","date_original":"2019-01-01"},{"date":"2020-03","event":"Acala raises $1.4 million in a seed round from investors including Polychain Capital.","source":"","date_original":"2020-03-01"},{"date":"2020-09","event":"Acala raises approximately $7.3 million in additional funding with backing from Coinbase Ventures, Pantera Capital, and Polychain Capital.","source":"","date_original":"2020-09-01"},{"date":"2021-08-31","event":"ACA token ICO sale begins, running through September 3, 2021.","source":""},{"date":"2021-11","event":"Acala wins Polkadot's first parachain auction, securing approximately $1.3 billion in DOT crowdloan contributions.","source":"","date_original":"2021-11-01"},{"date":"2022-08-04","event":"Acala announces the upcoming launch of the iBTC/aUSD liquidity pool.","source":""},{"date":"2022-08-13","event":"iBTC/aUSD liquidity pool goes live on Acala Network.","source":""},{"date":"2022-08-14","event":"Misconfiguration in DexSavingRewardRates parameter triggers erroneous minting of 3.022 billion aUSD across 16 addresses. aUSD price collapses from $1.03 to $0.009. Acala team unilaterally places network in maintenance mode and freezes token transfers. Community governance passes urgent votes to pause DEX, Honzon protocol, oracle pallet, and cross-chain communications.","source":""},{"date":"2022-08-15","event":"Community governance burns approximately 1.292 billion erroneously minted aUSD. CoinTelegraph and CoinDesk report on centralization criticisms surrounding the network freeze.","source":""},{"date":"2022-08-17","event":"Acala publishes initial trace results identifying 3.022 billion erroneous aUSD mints across 16 addresses.","source":""},{"date":"2022-08-20","event":"Second governance vote approves burning of remaining 1.682 billion aUSD held in LP positions.","source":""},{"date":"2022-09-05","event":"Acala publishes full incident trace report confirming approximately 2.97 billion aUSD recovered with losses from off-chain transfers estimated between $1.6 million and $10 million.","source":""},{"date":"2022-09-26","event":"Acala Network announces resumption of full operations after community referendum approves reactivation.","source":""},{"date":"2024-06-17","event":"Acala 2.0 Sinai Upgrade deployed, with stated improvements to DeFi functionality and security architecture.","source":""},{"date":"2025","event":"ACA token records closing price of approximately $0.010, representing a 90%+ decline year-over-year.","source":"","date_original":"2025-01-01"},{"date":"2026","event":"ACA token falls to approximately $0.00072, down approximately 92.9% from the prior year and over 99% from its all-time high of $2.79.","source":"","date_original":"2026-01-01"}],"sources_used":[{"url":"https://www.coindesk.com/tech/2022/08/22/inside-the-3b-defi-exploit-of-acalas-crypto-platform","name":"coindesk.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.coindesk.com/tech/2022/08/15/acalas-stablecoin-falls-99-percent-after-hackers-issue-13-billion-tokens","name":"coindesk.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://cointelegraph.com/news/another-depeg-acala-trace-report-reveals-3b-ausd-erroneously-minted","name":"cointelegraph.com","type":"other","archive_url":"https://web.archive.org/web/20260830083558/https://cointelegraph.com/news/another-depeg-acala-trace-report-reveals-3b-ausd-erroneously-minted","credibility":3,"archive_timestamp":"2026-08-30T08:35:58+00:00"},{"url":"https://medium.com/acalanetwork/acala-incident-report-14-08-2022-392089588642","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cryptopotato.com/alcala-resumes-operations-after-printing-over-3-billion-in-stablecoins-by-mistake/","name":"cryptopotato.com","type":"other","archive_url":"http://web.archive.org/web/20251007024957/https://cryptopotato.com/alcala-resumes-operations-after-printing-over-3-billion-in-stablecoins-by-mistake/","credibility":3,"archive_timestamp":"2025-10-07T02:49:57+00:00"},{"url":"https://cointelegraph.com/news/network-and-token-freeze-after-acala-exploit-raises-questions","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20260218080338/https://cointelegraph.com/news/network-and-token-freeze-after-acala-exploit-raises-questions","credibility":3,"archive_timestamp":"2026-02-18T08:03:38+00:00"},{"url":"https://www.fxstreet.com/cryptocurrencies/news/network-and-token-freeze-after-acala-exploit-raises-questions-202208150329","name":"fxstreet.com","type":"other","archive_url":"https://web.archive.org/web/20260901041349/https://www.fxstreet.com/cryptocurrencies/news/network-and-token-freeze-after-acala-exploit-raises-questions-202208150329","credibility":3,"archive_timestamp":"2026-09-01T04:13:49+00:00"},{"url":"https://beincrypto.com/acala-network-ausd-depegs-by-99-as-hacker-issues-over-1-billion-tokens/","name":"beincrypto.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://medium.com/quillhash/acalas-unlimited-usd-minting-exploit-analyzation-8ac8c5183a38","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://hackenproof.com/blog/industry-news/defi-network-acala-lost-1-2-billion-ausd-in-exploit","name":"hackenproof.com","type":"other","archive_url":"https://web.archive.org/web/20260901040208/https://hackenproof.com/error","credibility":3,"archive_timestamp":"2026-09-01T04:02:08+00:00"},{"url":"https://www.coindesk.com/tech/2022/08/16/acala-stablecoins-nears-1-peg-after-community-burns-12b-ausd-minted-by-exploiters","name":"coindesk.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://parachains.info/details/acala_network","name":"parachains.info","type":"other","archive_url":"http://web.archive.org/web/20260415135604/https://parachains.info/details/acala_network","credibility":3,"archive_timestamp":"2026-04-15T13:56:04+00:00"},{"url":"https://www.kraken.com/learn/what-is-acala-aca","name":"kraken.com","type":"other","archive_url":"http://web.archive.org/web/20260718082523/https://www.kraken.com/learn/what-is-acala-aca","credibility":3,"archive_timestamp":"2026-07-18T08:25:23+00:00"},{"url":"https://www.crunchbase.com/organization/acala-network","name":"crunchbase.com","type":"other","archive_url":null,"credibility":3,"archive_error":"forbiddenaccess","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cryptopotato.com/acala-wins-polkadots-first-parachain-auction-with-1-3-billion-secured/","name":"cryptopotato.com","type":"other","archive_url":"http://web.archive.org/web/20260609211029/https://cryptopotato.com/acala-wins-polkadots-first-parachain-auction-with-1-3-billion-secured/","credibility":3,"archive_timestamp":"2026-06-09T21:10:29+00:00"},{"url":"https://coinmarketcap.com/cmc-ai/acala/latest-updates/","name":"coinmarketcap.com","type":"other","archive_url":"http://web.archive.org/web/20251210210757/https://coinmarketcap.com/cmc-ai/acala/latest-updates/","credibility":3,"archive_timestamp":"2025-12-10T21:07:57+00:00"},{"url":"https://www.coingecko.com/en/coins/acala","name":"coingecko.com","type":"other","archive_url":"http://web.archive.org/web/20251013160733/https://www.coingecko.com/en/coins/acala","credibility":3,"archive_timestamp":"2025-10-13T16:07:33+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:55.008585+00:00","updated_at":"2026-09-01T04:16:57.655289+00:00"}}