{"investigation":{"slug":"alex","entity_name":"ALEX Lab","trust_score":28,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"ALEX (Automated Liquidity Exchange) is a decentralized finance protocol built on the Stacks blockchain, designed to bring DeFi capabilities to Bitcoin. The protocol has suffered two major security exploits: a $4.3 million hack in May 2024 attributed to North Korea's Lazarus Group via a private key compromise of its XLink bridge, and an $8.3 million exploit in June 2025 caused by a smart contract access control vulnerability. In both cases, ALEX Lab Foundation pledged full user reimbursement, though partial recovery of 2024 stolen funds remained ongoing as of mid-2025, and the native ALEX token has declined approximately 99.9% from its all-time high.","sections":[{"content":"ALEX, short for Automated Liquidity Exchange, is an open-source DeFi protocol built on the Stacks blockchain — a Bitcoin layer-2 network that enables smart contracts anchored to Bitcoin's proof-of-work consensus. The protocol launched on mainnet in January 2022 and offers fixed-rate borrowing and lending, a decentralized exchange (DEX), yield farming, staking, and token launchpad services. ALEX positions itself as the leading DeFi application on the Stacks network. The protocol is supported by the ALEX Lab Foundation and is governed in part by its native ALEX token. In November 2021, the project raised $5.8 million in a funding round led by White Star Capital, with participation from Cultur3, GBIC, and OK Blockchain Capital. The co-founders are Chiente Hsu (CEO, former Global Head of Alpha Strategies at Credit Suisse and Global Head of Quantitative Investment Strategy Research at Morgan Stanley), Rachel Yu (co-founder, also with a Wall Street background), and Chan Ahn.","heading":"Overview and Background","sources":[{"url":"https://www.businesswire.com/news/home/20220117005119/en/Full-Service-Bitcoin-DeFi-Platform-ALEX-Launches-Mainnet-on-Stacks","name":"businesswire.com","type":"other","credibility":3},{"url":"https://decrypt.co/86082/stacks-based-crypto-project-alex-raises-5-8m-build-defi-bitcoin","name":"decrypt.co","type":"other","credibility":3},{"url":"https://whitestarcapital.com/companies/alex/","name":"whitestarcapital.com","type":"other","credibility":3},{"url":"https://www.gate.io/learn/articles/what-you-should-know-about-alex-lab/3416","name":"gate.io","type":"other","credibility":3}],"severity":"medium"},{"content":"On May 14–15, 2024, ALEX Lab's XLink bridge — a cross-chain service enabling token transfers between Stacks, BNB Smart Chain, and other networks — was exploited via a suspected private key compromise. Security firm CertiK reported that an attacker gained control of the deployer wallet through a phishing attack, then executed five malicious upgrades to the Bridge Endpoint contract, converting it to unverified bytecode. The attacker drained approximately $300,000 in Bitcoin, $3.3 million in stablecoins, and $75,000 in Sugar Kingdom (SKO) tokens — totaling roughly $4.3 million. Approximately 13.7 million STX tokens were extracted from the vault on the Stacks chain. Notably, a whitehat actor intervened on the BNB Smart Chain component of the attack, withdrawing approximately $4.3 million before the attacker could claim those funds — considered one of the first documented on-chain rescues of this type. ALEX Lab acknowledged the breach on May 15, offered a 10% bounty for return of 90% of stolen funds (deadline May 18), and stated it had identified the individual responsible. The team filed a police report with the Singapore Police Force and submitted it to 24 major centralized exchanges, resulting in the freezing of approximately $3.9 million in stolen assets pending investigation.","heading":"May 2024 Exploit: XLink Bridge Compromise ($4.3 Million)","sources":[{"url":"https://www.coindesk.com/business/2024/05/15/bitcoin-defi-tool-alex-lab-loses-43m-in-hack-offers-10-bounty-for-stolen-funds","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.certik.com/resources/blog/alex","name":"certik.com","type":"other","credibility":3},{"url":"https://rekt.news/alexlab-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://coinfomania.com/alex-labs-confirms-major-security-breach-suspends-platform-operations-and-launches-full-investigation-into-multi-asset-hack","name":"coinfomania.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/alex-labs-freezes-3-9-million-exploited-funds-cexs-after-hack","name":"cointelegraph.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On June 25, 2024, ALEX Lab publicly attributed the May 2024 exploit to the Lazarus Group, a hacking collective widely assessed by U.S. and international authorities to be affiliated with the North Korean government. The attribution was made following an investigation conducted in collaboration with on-chain investigator ZachXBT. According to ALEX Lab, the team identified three wallet addresses used during the May 16 attack. Funds from those addresses were traced through a secondary wallet to a Tron-based address previously linked to Lazarus Group activity. ZachXBT's on-chain forensics provided the transaction linkage evidence. ALEX Lab described the evidence as 'substantial' while stopping short of certainty. The team also cooperated with the Singapore Police Force, which was coordinating with centralized exchanges holding frozen assets. As of mid-2025, 8 of 15 centralized exchanges had returned frozen funds, with discussions ongoing with the remaining 7. The Lazarus Group has been linked to numerous major crypto thefts, including the 2022 Ronin Bridge hack ($650 million).","heading":"Lazarus Group Attribution and ZachXBT Investigation","sources":[{"url":"https://cryptonews.com/news/alex-lab-links-4m-exploit-to-north-korea-backed-lazarus-group/","name":"cryptonews.com","type":"other","credibility":3},{"url":"https://cryptoslate.com/bitcoin-defi-app-alex-lab-links-4-million-exploit-to-lazarus-group/","name":"cryptoslate.com","type":"other","credibility":3},{"url":"https://www.cryptotimes.io/2024/06/25/alex-lab-uncovers-lazarus-groups-role-in-4-million-exploit/","name":"cryptotimes.io","type":"other","credibility":3},{"url":"https://invezz.com/news/2024/06/25/defi-protocol-alex-labs-suspects-lazarus-groups-involvement-in-4m-hack/","name":"invezz.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On June 6, 2025, at approximately 09:30 UTC, ALEX Protocol suffered a second major security incident resulting in losses of approximately $8.3 million (with independent security analysts at Halborn estimating total losses closer to $16.18 million when including tokens not directly reimbursed). The root cause was a vulnerability in the protocol's self-listing verification logic and vault permission system. The attacker deployed a malicious token contract named 'ssl-labubu-672d3' containing a hidden transfer function. By calling the set-approved-token function, the contract was granted vault-level permissions. When swap operations triggered the malicious token's transfer function, the attacker's code executed with vault privileges, enabling drainage of multiple liquidity pools. Stolen assets included approximately 8.4 million STX, 21.85 sBTC, 149,850 USDC/USDT, and 2.8 WBTC. Security firm Halborn noted the exploited vulnerability existed in code outside the scope of prior audits, highlighting a gap in the protocol's security review processes. ALEX Lab suspended platform operations following the incident and launched a full investigation. The ALEX token dropped approximately 45% in the immediate aftermath of the exploit announcement.","heading":"June 2025 Exploit: Smart Contract Access Control Failure ($8.3 Million)","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-alex-protocol-hack-june-2025","name":"halborn.com","type":"other","credibility":3},{"url":"https://www.cryptotimes.io/2025/06/07/alex-protocol-loses-8-37m-in-hack-due-to-security-flaw/","name":"cryptotimes.io","type":"other","credibility":3},{"url":"https://negg.blog/en/alex-protocol-loses-83-million-in-defi-bitcoin-exploit-on-stacks/","name":"negg.blog","type":"other","credibility":3},{"url":"https://www.guardrail.ai/blog/alex-protocol-hack-june-2025","name":"guardrail.ai","type":"other","credibility":3},{"url":"https://unchainedcrypto.com/alex-lab-to-reimburse-users-after-8-3m-exploit/","name":"unchainedcrypto.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the May 2024 exploit, ALEX Lab announced a recovery and reimbursement framework, including a treasury grant program and evaluation of token reissuance options for affected users. By May 2025, 8 of 15 centralized exchanges had returned frozen STX, with the remaining 7 still under negotiation. Following the June 2025 exploit, ALEX Lab Foundation announced it would fully reimburse all affected users using treasury reserves. Compensation was paid in USDC, calculated using the average on-chain exchange rates between 10:00 AM and 2:00 PM UTC on the day of the attack. The Treasury Grant Program was described as completed by June 17, 2025, with the foundation stating that all eligible users received 100% reimbursement. Farming resumed in July 2025. However, the ALEX token remained down approximately 87% from pre-2025 exploit levels as of late 2025, reflecting persistent market skepticism.","heading":"Reimbursement and Recovery Efforts","sources":[{"url":"https://www.theblock.co/post/357368/stacks-based-alex-lab-to-reimburse-users-after-8-3-million-exploit-as-token-drops-45","name":"theblock.co","type":"other","credibility":3},{"url":"https://crypto.news/alex-protocol-announces-reimbursement-plan-for-users-hit-by-8m-exploit/","name":"crypto.news","type":"other","credibility":3},{"url":"https://medium.com/alexgobtc/distribution-of-alex-protocol-revenue-and-recovered-stx-35c8e359b874","name":"medium.com","type":"other","credibility":3},{"url":"https://unchainedcrypto.com/alex-lab-to-reimburse-users-after-8-3m-exploit/","name":"unchainedcrypto.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The ALEX token (ticker: ALEX) reached an all-time high of approximately $0.54. As of late 2025, it was trading near $0.0015–$0.004, representing a decline of approximately 99.7–99.9% from its peak. The market capitalization had fallen to approximately $1.4–$3.6 million depending on the data source and date, ranking the token outside the top 1,900 cryptocurrencies by market cap. The circulating supply is approximately 881 million tokens out of a maximum supply of 1 billion. The token's severe depreciation reflects the combined impact of the two major exploits and ongoing uncertainty about the protocol's security posture.","heading":"Token Performance and Market Status","sources":[{"url":"https://coinmarketcap.com/currencies/alex-lab/","name":"coinmarketcap.com","type":"other","credibility":3},{"url":"https://www.coingecko.com/en/coins/alex-lab","name":"coingecko.com","type":"other","credibility":3}],"severity":"medium"},{"content":"ALEX Lab had engaged security firm CertiK, which detected the suspicious transaction during the May 2024 XLink bridge exploit. However, the private key compromise that enabled that attack was not a smart contract audit failure — it involved operational security failures at the key management level, possibly facilitated by a phishing attack on team members. The June 2025 exploit targeted a smart contract vulnerability that was outside the scope of prior audits, indicating incomplete audit coverage of the full codebase. Halborn's post-mortem emphasized that comprehensive audits covering all existing code — not only new features — are essential for protocols of ALEX's complexity. The occurrence of two significant exploits within approximately 13 months, exploiting different attack vectors, suggests systemic gaps in both operational and smart contract security practices.","heading":"Security Posture and Audit History","sources":[{"url":"https://www.certik.com/resources/blog/alex","name":"certik.com","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-alex-protocol-hack-june-2025","name":"halborn.com","type":"other","credibility":3},{"url":"https://rekt.news/alexlab-rekt","name":"rekt.news","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021-11-15","event":"ALEX raises $5.8 million in funding round led by White Star Capital","source":""},{"date":"2022-01-17","event":"ALEX launches mainnet on the Stacks blockchain","source":""},{"date":"2024-05-14","event":"XLink bridge private key compromised via alleged phishing attack; CertiK detects suspicious transaction","source":""},{"date":"2024-05-15","event":"ALEX Lab confirms $4.3 million exploit; offers 10% bounty for return of 90% of stolen funds; files Singapore Police report","source":""},{"date":"2024-05-18","event":"10% bounty deadline passes; ALEX Lab reports $3.9 million frozen at centralized exchanges","source":""},{"date":"2024-06-25","event":"ALEX Lab attributes May 2024 exploit to North Korea's Lazarus Group, citing ZachXBT's on-chain forensic investigation","source":""},{"date":"2025-06-06","event":"Second major exploit: $8.3 million drained via smart contract access control vulnerability in self-listing logic; ALEX token drops ~45%","source":""},{"date":"2025-06-17","event":"ALEX Lab Foundation announces completion of Treasury Grant Program; claims 100% USDC reimbursement to all affected users","source":""},{"date":"2025-07","event":"Farming resumed on ALEX protocol following security review","source":"","date_original":"2025-07-01"}],"sources_used":[{"url":"https://www.businesswire.com/news/home/20220117005119/en/Full-Service-Bitcoin-DeFi-Platform-ALEX-Launches-Mainnet-on-Stacks","name":"businesswire.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://decrypt.co/86082/stacks-based-crypto-project-alex-raises-5-8m-build-defi-bitcoin","name":"decrypt.co","type":"other","archive_url":"http://web.archive.org/web/20260508074728/https://decrypt.co/86082/stacks-based-crypto-project-alex-raises-5-8m-build-defi-bitcoin","credibility":3,"archive_timestamp":"2026-05-08T07:47:28+00:00"},{"url":"https://whitestarcapital.com/companies/alex/","name":"whitestarcapital.com","type":"other","archive_url":"http://web.archive.org/web/20260610055358/https://whitestarcapital.com/companies/alex/","credibility":3,"archive_timestamp":"2026-06-10T05:53:58+00:00"},{"url":"https://www.gate.io/learn/articles/what-you-should-know-about-alex-lab/3416","name":"gate.io","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.coindesk.com/business/2024/05/15/bitcoin-defi-tool-alex-lab-loses-43m-in-hack-offers-10-bounty-for-stolen-funds","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20260725153346/https://www.coindesk.com/business/2024/05/15/bitcoin-defi-tool-alex-lab-loses-43m-in-hack-offers-10-bounty-for-stolen-funds","credibility":3,"archive_timestamp":"2026-07-25T15:33:46+00:00"},{"url":"https://www.certik.com/resources/blog/alex","name":"certik.com","type":"other","archive_url":"http://web.archive.org/web/20260211045439/https://www.certik.com/resources/blog/alex","credibility":3,"archive_timestamp":"2026-02-11T04:54:39+00:00"},{"url":"https://rekt.news/alexlab-rekt","name":"rekt.news","type":"other","archive_url":"http://web.archive.org/web/20260322055936/https://rekt.news/alexlab-rekt","credibility":3,"archive_timestamp":"2026-03-22T05:59:36+00:00"},{"url":"https://coinfomania.com/alex-labs-confirms-major-security-breach-suspends-platform-operations-and-launches-full-investigation-into-multi-asset-hack","name":"coinfomania.com","type":"other","archive_url":"https://web.archive.org/web/20260829233755/https://coinfomania.com/alex-labs-confirms-major-security-breach-suspends-platform-operations-and-launches-full-investigation-into-multi-asset-hack/","credibility":3,"archive_timestamp":"2026-08-29T23:37:55+00:00"},{"url":"https://cointelegraph.com/news/alex-labs-freezes-3-9-million-exploited-funds-cexs-after-hack","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20260725135159/https://cointelegraph.com/news/alex-labs-freezes-3-9-million-exploited-funds-cexs-after-hack","credibility":3,"archive_timestamp":"2026-07-25T13:51:59+00:00"},{"url":"https://cryptonews.com/news/alex-lab-links-4m-exploit-to-north-korea-backed-lazarus-group/","name":"cryptonews.com","type":"other","archive_url":"http://web.archive.org/web/20260803161235/https://cryptonews.com/news/alex-lab-links-4m-exploit-to-north-korea-backed-lazarus-group/","credibility":3,"archive_timestamp":"2026-08-03T16:12:35+00:00"},{"url":"https://cryptoslate.com/bitcoin-defi-app-alex-lab-links-4-million-exploit-to-lazarus-group/","name":"cryptoslate.com","type":"other","archive_url":"https://web.archive.org/web/20260829235815/https://cryptoslate.com/bitcoin-defi-app-alex-lab-links-4-million-exploit-to-lazarus-group/","credibility":3,"archive_timestamp":"2026-08-29T23:58:15+00:00"},{"url":"https://www.cryptotimes.io/2024/06/25/alex-lab-uncovers-lazarus-groups-role-in-4-million-exploit/","name":"cryptotimes.io","type":"other","archive_url":"https://web.archive.org/web/20260829151321/https://www.cryptotimes.io/2024/06/25/alex-lab-uncovers-lazarus-groups-role-in-4-million-exploit/","credibility":3,"archive_timestamp":"2026-08-29T15:13:21+00:00"},{"url":"https://invezz.com/news/2024/06/25/defi-protocol-alex-labs-suspects-lazarus-groups-involvement-in-4m-hack/","name":"invezz.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.halborn.com/blog/post/explained-the-alex-protocol-hack-june-2025","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260517001803/https://www.halborn.com/blog/post/explained-the-alex-protocol-hack-june-2025","credibility":3,"archive_timestamp":"2026-05-17T00:18:03+00:00"},{"url":"https://www.cryptotimes.io/2025/06/07/alex-protocol-loses-8-37m-in-hack-due-to-security-flaw/","name":"cryptotimes.io","type":"other","archive_url":"http://web.archive.org/web/20251103175046/https://www.cryptotimes.io/2025/06/07/alex-protocol-loses-8-37m-in-hack-due-to-security-flaw/","credibility":3,"archive_timestamp":"2025-11-03T17:50:46+00:00"},{"url":"https://negg.blog/en/alex-protocol-loses-83-million-in-defi-bitcoin-exploit-on-stacks/","name":"negg.blog","type":"other","archive_url":"http://web.archive.org/web/20260418071952/https://negg.blog/en/alex-protocol-loses-83-million-in-defi-bitcoin-exploit-on-stacks/","credibility":3,"archive_timestamp":"2026-04-18T07:19:52+00:00"},{"url":"https://www.guardrail.ai/blog/alex-protocol-hack-june-2025","name":"guardrail.ai","type":"other","archive_url":"http://web.archive.org/web/20260819194927/https://www.guardrail.ai/blog/alex-protocol-hack-june-2025","credibility":3,"archive_timestamp":"2026-08-19T19:49:27+00:00"},{"url":"https://unchainedcrypto.com/alex-lab-to-reimburse-users-after-8-3m-exploit/","name":"unchainedcrypto.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.theblock.co/post/357368/stacks-based-alex-lab-to-reimburse-users-after-8-3-million-exploit-as-token-drops-45","name":"theblock.co","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://crypto.news/alex-protocol-announces-reimbursement-plan-for-users-hit-by-8m-exploit/","name":"crypto.news","type":"other","archive_url":"http://web.archive.org/web/20251009013701/https://crypto.news/alex-protocol-announces-reimbursement-plan-for-users-hit-by-8m-exploit/","credibility":3,"archive_timestamp":"2025-10-09T01:37:01+00:00"},{"url":"https://medium.com/alexgobtc/distribution-of-alex-protocol-revenue-and-recovered-stx-35c8e359b874","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://coinmarketcap.com/currencies/alex-lab/","name":"coinmarketcap.com","type":"other","archive_url":"http://web.archive.org/web/20260530142750/https://coinmarketcap.com/currencies/alex-lab/","credibility":3,"archive_timestamp":"2026-05-30T14:27:50+00:00"},{"url":"https://www.coingecko.com/en/coins/alex-lab","name":"coingecko.com","type":"other","archive_url":"http://web.archive.org/web/20251013164129/https://www.coingecko.com/en/coins/alex-lab","credibility":3,"archive_timestamp":"2025-10-13T16:41:29+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:32.467185+00:00","updated_at":"2026-08-30T01:16:27.167471+00:00"}}