{"investigation":{"slug":"exactly","entity_name":"Exactly Protocol","trust_score":67,"severity_base":67,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"Exactly Protocol is a decentralized lending and borrowing platform offering both fixed- and variable-rate markets, originally launched on Ethereum in November 2022 and expanded to Optimism in March 2023. In August 2023 it suffered a roughly $7.3 million exploit of its DebtManager contract; the team has since published audit history, offered a bounty for information on the attacker, and pivoted toward a consumer product (the Exa App and Exa Card) built on the same lending infrastructure. No confirmed user compensation or fund recovery was found in available reporting.","sections":[{"content":"Exactly Protocol is a non-custodial, open-source decentralized finance (DeFi) lending and borrowing protocol. Its distinguishing design feature is a dual market structure: a variable-rate pool that supplies liquidity to a series of fixed-rate pools tied to specific maturity dates, with fixed rates determined by each pool's utilization rather than by trading maturity tokens on an AMM. According to project materials and third-party descriptor sites, the protocol was started in 2021, launched on Ethereum mainnet in November 2022, and expanded to Optimism (OP Mainnet) in March 2023. Its governance token, EXA, has a stated total supply of 10,000,000 tokens, with 1,000,000 (10%) allocated to a DAO treasury. Gabriel Gruber has been publicly identified in press coverage as a founder of the protocol.","heading":"Protocol Overview","sources":[{"url":"https://exact.ly/","name":"Exactly Protocol official site","type":"official","credibility":2},{"url":"https://dappradar.com/dapp/exactly-protocol","name":"Exactly Protocol DappRadar listing","type":"other","credibility":3},{"url":"https://docs.exact.ly/governance/exactly-token-exa/tokenomics","name":"Exactly Protocol EXA tokenomics docs","type":"official","credibility":2},{"url":"https://www.forbesargentina.com/innovacion/un-hackeo-us-7-millones-preocupa-industria-crypto-argentina-n39392","name":"Forbes Argentina - Un hackeo de US$7 millones preocupa a la industria crypto argentina","type":"news_article","credibility":2}],"severity":"low"},{"content":"On August 18, 2023, Exactly Protocol was exploited for an amount most security researchers and outlets put at approximately $7.2-7.3 million (roughly 4,300-4,324 ETH); some early reports, citing on-chain analytics firm De.Fi, put the figure as high as $12 million. The Block, citing blockchain security firms BlockSec and Beosin, reported losses of 'over 4300 ether ($7.3 million)' on Optimism. The attacker exploited the protocol's DebtManager periphery contract: per analysis from Halborn and SolidityScan, the attacker bypassed a permit verification check by supplying the address of a fake, malicious market contract, altering the apparent message sender to impersonate a victim, and then re-entering a deleverage function through an untrusted external call to drain user-deposited collateral. The Exactly team paused the protocol shortly after detecting the issue, restricting activity to withdrawals, and total value locked fell sharply from roughly $37-39 million before the attack to around $11.7 million afterward. The incident occurred the same week as a similar exploit of the unrelated Harbor Protocol (built by ComDex), leading to joint coverage of both incidents by several outlets. Halborn noted that the exploited vulnerability had not been identified despite the project's history of multiple prior smart contract audits.","heading":"August 2023 Smart Contract Exploit","sources":[{"url":"https://www.theblock.co/post/246196/exactly-protocol-exploited-7-million-optimism-layer-2-network","name":"The Block - Exactly Protocol exploited for over $7 million on Optimism Layer 2 network","type":"news_article","credibility":2},{"url":"https://cointelegraph.com/news/defi-protocols-exactly-harbor-hacked-separate-attacks","name":"Cointelegraph - DeFi protocols Exactly, Harbor hacked in separate attacks","type":"news_article","credibility":2},{"url":"https://therecord.media/millions-stolen-exactly-harbor-protocol-defi-cryptocurrency","name":"The Record - Millions stolen from Exactly, Harbor Protocol in separate DeFi attacks","type":"news_article","credibility":1},{"url":"https://www.halborn.com/blog/post/explained-the-exactly-protocol-hack-august-2023","name":"Halborn - Explained: The Exactly Protocol Hack (August 2023)","type":"research","credibility":2},{"url":"https://blog.solidityscan.com/exactly-protocol-hack-analysis-6ebc99d3e7b1/","name":"SolidityScan - Exactly Protocol Hack Analysis","type":"research","credibility":2},{"url":"https://neptunemutual.com/blog/how-was-exactly-protocol-exploited/","name":"Neptune Mutual - How was Exactly Protocol exploited?","type":"research","credibility":2},{"url":"https://forklog.com/en/defi-project-exactly-protocol-hacked-for-12-million/","name":"ForkLog - DeFi project Exactly Protocol hacked for $12 million","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Following the exploit, Exactly's team publicly stated it was investigating the issue, had paused the protocol, and was attempting to contact the attacker. According to Forbes Argentina, which quoted a statement attributed to co-founder Gabriel Gruber, the team said it approved a fix and planned to reactivate the protocol once deployed, and separately said it was trying to communicate with the hacker to recover the stolen funds. The team reportedly offered the attacker the option to keep a 10% fee in exchange for returning the remaining funds without facing further pursuit. When the attacker did not respond, Exactly announced a $700,000 bounty for information leading to the recovery of the stolen funds and identification of the attacker, according to CryptoNews and CoinPaper coverage. The team also said it filed police reports and was working with blockchain analytics firm Chainalysis, per The Record's reporting. Exactly published an incident post-mortem on its official Medium account; independent news searches did not surface confirmation that the post-mortem specified a user compensation plan, nor did they find any report that the attacker returned funds or that affected users were reimbursed. This absence of confirmed compensation should be treated as an open question rather than evidence that no compensation occurred, since the post-mortem's full content could not be independently verified.","heading":"Team Response and Compensation","sources":[{"url":"https://medium.com/@exactly_protocol/exactly-protocol-incident-post-mortem-b4293d97e3ed","name":"Exactly Protocol - Incident Post-Mortem (Medium)","type":"official","credibility":2},{"url":"https://www.forbesargentina.com/innovacion/un-hackeo-us-7-millones-preocupa-industria-crypto-argentina-n39392","name":"Forbes Argentina - Un hackeo de US$7 millones preocupa a la industria crypto argentina","type":"news_article","credibility":2},{"url":"https://therecord.media/millions-stolen-exactly-harbor-protocol-defi-cryptocurrency","name":"The Record - Millions stolen from Exactly, Harbor Protocol in separate DeFi attacks","type":"news_article","credibility":1},{"url":"https://cryptonews.com/news/exactly-protocol-announces-700000-bounty-for-information-hacker/","name":"CryptoNews - Exactly Protocol Announces $700,000 Bounty For Information on Hacker","type":"news_article","credibility":2}],"severity":"high"},{"content":"Exactly's own security documentation lists a long history of third-party audits spanning 2021 through 2025, from firms including ABDK, Chainsafe, Coinspect, Cryptecon, Hashlock, OpenZeppelin, Quantstamp, and Sherlock. Coinspect alone is listed as having performed five rounds of audits on the core protocol between November 2021 and March 2023, plus three further audits of its RewardsController module. ABDK's audit series began in October 2022 and continued after the August 2023 exploit, covering peripheral contracts (September 2023), the EscrowedEXA token (October 2023), an updated interest rate model (2024), and later updates to the Exa App and rewards systems (2025). Despite this volume of pre-exploit review, the vulnerability in the DebtManager periphery contract that was exploited in August 2023 was not caught by any prior audit, which security firm Halborn highlighted as notable given the project's 'numerous smart contract audits.' Exactly has continued to commission audits for new components after the hack, including Quantstamp's review of the Exa App's WebAuthn plugin (2024-2025) and Sherlock/Chainsafe reviews of its staking program (2024).","heading":"Audit History and Security Posture","sources":[{"url":"https://docs.exact.ly/security/audits","name":"Exactly Protocol - Security Audits (official docs)","type":"official","credibility":2},{"url":"https://medium.com/@exactly_protocol/insights-from-coinspect-abdk-consulting-audits-a6c7ebea26ea","name":"Exactly Protocol - Insights from Coinspect, ABDK, Consulting Audits (Medium)","type":"official","credibility":2},{"url":"https://www.coinspect.com/blog/exactly-protocol-audits/","name":"Coinspect - Exactly Protocol Audits","type":"research","credibility":2},{"url":"https://www.halborn.com/blog/post/explained-the-exactly-protocol-hack-august-2023","name":"Halborn - Explained: The Exactly Protocol Hack (August 2023)","type":"research","credibility":2}],"severity":"medium"},{"content":"Exactly has continued operating after the 2023 exploit but at substantially reduced scale: DefiLlama data shows total value locked of roughly $12.5 million as of October 2026, down from an all-time high of approximately $39.8 million reached on August 14, 2023, just days before the hack. The team has since built a consumer-facing product, the Exa App, a self-custodial 'onchain banking' mobile app using smart-contract wallets (via Alchemy's Account Kit and a custom WebAuthn passkey module) to let users earn yield, borrow, and spend through a linked card called the Exa Card, which an Alchemy case study describes as usable in over 160 countries with installment payments. On February 26, 2025, Uphold and Exactly announced a proposed partnership, approved by the Exactly DAO, under which Uphold would invest in EXA tokens and act as an exclusive distribution partner for a crypto-collateralized credit card, starting in Latin America; per the announcement, the deal remained 'subject to due diligence and required approvals.' A related governance proposal (EXAIP-21) reportedly authorized transfer of 1,000,000 EXA tokens from the DAO treasury to Uphold Inc. as part of this arrangement. Independent, non-promotional confirmation of the partnership's completion or of current Exa Card usage figures was not found beyond the companies' own materials.","heading":"Current Protocol Status and Product Evolution","sources":[{"url":"https://defillama.com/protocol/exactly?treasury=true","name":"DefiLlama - Exactly protocol TVL","type":"on_chain","credibility":2},{"url":"https://www.alchemy.com/case-studies/exa-app-smart-wallets","name":"Alchemy case study - How Exa App reimagined banking with smart wallets","type":"other","credibility":2},{"url":"https://cryptoslate.com/press-releases/uphold-and-exa-plan-to-bring-crypto-credit-card-and-yield-service-to-the-mass-market/","name":"CryptoSlate - Uphold and Exa plan to bring crypto credit card and yield service to the mass market","type":"other","credibility":2},{"url":"https://www.coingecko.com/en/coins/exactly-protocol","name":"CoinGecko - Exactly Protocol (EXA)","type":"other","credibility":2}],"severity":"low"},{"content":"Exactly is governed through an on-chain DAO using the EXA token, with a stated total supply of 10,000,000 EXA. Per the protocol's documentation, proposals require a minimum of 100 EXA to submit, undergo a one-day voting delay followed by a five-day voting period, and need support equivalent to roughly 100,000 EXA (about 1% of supply) to pass; EXA locked in the project's Sablier vesting contracts carries the same voting power as liquid tokens. Governance scope covers collateral requirements, new collateral listings, borrowing/lending terms, and incentive programs. The project also operates an escrowed token, esEXA, an ERC-20 that can be minted by locking EXA. Most of the circulating EXA supply is held in a Timelock contract described as a security measure. Treasury and reward allocations, including the 1,000,000 EXA transfer associated with the Uphold partnership, are proposed and voted on through EXAIPs (Exactly Improvement Proposals). The team has published governance explainer content on its official Medium account describing the rollout of this system.","heading":"Governance and Tokenomics","sources":[{"url":"https://docs.exact.ly/governance/exactly-token-exa/tokenomics","name":"Exactly Protocol - EXA Tokenomics docs","type":"official","credibility":2},{"url":"https://medium.com/@exactly_protocol/the-exactly-protocol-governance-is-here-281ac8b5df94","name":"Exactly Protocol - Governance is here (Medium)","type":"official","credibility":2},{"url":"https://docs.exact.ly/governance/exactly-protocol-governance/proposals-and-voting","name":"Exactly Protocol - Proposals and Voting docs","type":"official","credibility":2}],"severity":"low"}],"timeline":[{"date":"2022-11","event":"Exactly Protocol launched on Ethereum mainnet.","source":"Exactly Protocol descriptor pages","source_url":"https://dappradar.com/dapp/exactly-protocol"},{"date":"2023-03","event":"Exactly Protocol expanded to the Optimism (OP Mainnet) network.","source":"Exactly Protocol descriptor pages","source_url":"https://dappradar.com/dapp/exactly-protocol"},{"date":"2023-08-14","event":"Exactly Protocol reaches an all-time-high total value locked of approximately $39.8 million, days before the exploit.","source":"DefiLlama","source_url":"https://defillama.com/protocol/exactly?treasury=true","date_evidence":"The all-time high was $39.82 million on August 14, 2023"},{"date":"2023-08","event":"Attacker exploits a validation flaw in Exactly's DebtManager periphery contract, draining approximately $7.2-7.3 million in ETH; the team pauses the protocol.","source":"Cointelegraph","source_url":"https://cointelegraph.com/news/defi-protocols-exactly-harbor-hacked-separate-attacks","date_evidence":"A fresh round of attacks targeted the DeFi ecosystem on Aug. 18, with Exactly protocol exploited for nearly $7.3 million","date_original":"2023-08-18"},{"date":"2023-08","event":"Exactly announces a $700,000 bounty for information leading to recovery of the stolen funds and identification of the attacker, after an earlier offer letting the attacker keep a 10% fee went unanswered.","source":"CryptoNews","source_url":"https://cryptonews.com/news/exactly-protocol-announces-700000-bounty-for-information-hacker/"},{"date":"2025-02","event":"Uphold and Exactly announce a proposed partnership, approved by the Exactly DAO, to launch a crypto-collateralized credit card starting in Latin America.","source":"CryptoSlate","source_url":"https://cryptoslate.com/press-releases/uphold-and-exa-plan-to-bring-crypto-credit-card-and-yield-service-to-the-mass-market/","date_evidence":"Uphold and Exa plan to bring crypto credit card and yield service to the mass market","date_original":"2025-02-26"}],"sources_used":[{"url":"https://exact.ly/","name":"Exactly Protocol official site","type":"official","archive_url":"http://web.archive.org/web/20261008165023/https://exact.ly/","credibility":2,"archive_timestamp":"2026-10-08T16:50:23+00:00"},{"url":"https://docs.exact.ly/security/audits","name":"Exactly Protocol - Security Audits (official docs)","type":"official","archive_url":"http://web.archive.org/web/20261008163103/https://docs.exact.ly/security/audits","credibility":2,"archive_timestamp":"2026-10-08T16:31:03+00:00"},{"url":"https://docs.exact.ly/governance/exactly-token-exa/tokenomics","name":"Exactly Protocol - EXA Tokenomics docs","type":"official","archive_url":"http://web.archive.org/web/20260622230050/https://docs.exact.ly/governance/exactly-token-exa/tokenomics","credibility":2,"archive_timestamp":"2026-06-22T23:00:50+00:00"},{"url":"https://therecord.media/millions-stolen-exactly-harbor-protocol-defi-cryptocurrency","name":"The Record - Millions stolen from Exactly, Harbor Protocol in separate DeFi attacks","type":"news_article","archive_url":"http://web.archive.org/web/20260413105723/https://therecord.media/millions-stolen-exactly-harbor-protocol-defi-cryptocurrency","credibility":1,"archive_timestamp":"2026-04-13T10:57:23+00:00"},{"url":"https://www.theblock.co/post/246196/exactly-protocol-exploited-7-million-optimism-layer-2-network","name":"The Block - Exactly Protocol exploited for over $7 million on Optimism Layer 2 network","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cointelegraph.com/news/defi-protocols-exactly-harbor-hacked-separate-attacks","name":"Cointelegraph - DeFi protocols Exactly, Harbor hacked in separate attacks","type":"news_article","archive_url":"http://web.archive.org/web/20260820003019/https://cointelegraph.com/news/defi-protocols-exactly-harbor-hacked-separate-attacks","credibility":2,"archive_timestamp":"2026-08-20T00:30:19+00:00"},{"url":"https://neptunemutual.com/blog/how-was-exactly-protocol-exploited/","name":"Neptune Mutual - How was Exactly Protocol exploited?","type":"research","archive_url":"http://web.archive.org/web/20251206035035/https://neptunemutual.com/blog/how-was-exactly-protocol-exploited/","credibility":2,"archive_timestamp":"2025-12-06T03:50:35+00:00"},{"url":"https://medium.com/@exactly_protocol/exactly-protocol-incident-post-mortem-b4293d97e3ed","name":"Exactly Protocol - Incident Post-Mortem (Medium)","type":"official","archive_url":"http://web.archive.org/web/20260915114549/https://medium.com/@exactly_protocol/exactly-protocol-incident-post-mortem-b4293d97e3ed","credibility":2,"archive_timestamp":"2026-09-15T11:45:49+00:00"},{"url":"https://medium.com/@exactly_protocol/insights-from-coinspect-abdk-consulting-audits-a6c7ebea26ea","name":"Exactly Protocol - Insights from Coinspect, ABDK, Consulting Audits (Medium)","type":"official","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.coinspect.com/blog/exactly-protocol-audits/","name":"Coinspect - Exactly Protocol Audits","type":"research","archive_url":"http://web.archive.org/web/20261008153304/https://www.coinspect.com/blog/exactly-protocol-audits/","credibility":2,"archive_timestamp":"2026-10-08T15:33:04+00:00"},{"url":"https://www.coingecko.com/en/coins/exactly-protocol","name":"CoinGecko - Exactly Protocol (EXA)","type":"other","archive_url":"http://web.archive.org/web/20261005173029/https://www.coingecko.com/en/coins/exactly-protocol","credibility":2,"archive_timestamp":"2026-10-05T17:30:29+00:00"},{"url":"https://www.alchemy.com/case-studies/exa-app-smart-wallets","name":"Alchemy case study - How Exa App reimagined banking with smart wallets","type":"other","archive_url":"http://web.archive.org/web/20260306081850/https://www.alchemy.com/case-studies/exa-app-smart-wallets","credibility":2,"archive_timestamp":"2026-03-06T08:18:50+00:00"},{"url":"https://medium.com/@exactly_protocol/the-exactly-protocol-governance-is-here-281ac8b5df94","name":"Exactly Protocol - Governance is here (Medium)","type":"official","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://medium.com/@exactly_protocol/explore-the-advantages-of-exactly-protocol-a-new-approach-with-variable-fixed-interest-rates-e83eb9d64ff","name":"Exactly Protocol - Explore the advantages of Exactly Protocol (Medium)","type":"official","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://medium.com/@exactly_protocol/exactly-protocol-and-optimism-join-forces-to-bring-defi-to-the-end-user-53dc6397465a","name":"Exactly Protocol and Optimism join forces (Medium)","type":"official","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://x.com/ExactlyProtocol/status/1902434196758405557","name":"Exactly Protocol official X post","type":"social_media","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.halborn.com/blog/post/explained-the-exactly-protocol-hack-august-2023","name":"Halborn - Explained: The Exactly Protocol Hack (August 2023)","type":"research","archive_url":"http://web.archive.org/web/20261008152432/https://www.halborn.com/blog/post/explained-the-exactly-protocol-hack-august-2023","credibility":2,"archive_timestamp":"2026-10-08T15:24:32+00:00"},{"url":"https://blog.solidityscan.com/exactly-protocol-hack-analysis-6ebc99d3e7b1/","name":"SolidityScan - Exactly Protocol Hack Analysis","type":"research","archive_url":"http://web.archive.org/web/20260611094439/https://blog.solidityscan.com/exactly-protocol-hack-analysis-6ebc99d3e7b1/","credibility":2,"archive_timestamp":"2026-06-11T09:44:39+00:00"},{"url":"https://forklog.com/en/defi-project-exactly-protocol-hacked-for-12-million/","name":"ForkLog - DeFi project Exactly Protocol hacked for $12 million","type":"news_article","archive_url":"https://web.archive.org/web/20261030204441/https://forklog.com/en/mastercard-launches-cbdc-initiative-with-ripple-and-consensys/","credibility":2,"archive_timestamp":"2026-10-30T20:44:41+00:00"},{"url":"https://www.forbesargentina.com/innovacion/un-hackeo-us-7-millones-preocupa-industria-crypto-argentina-n39392","name":"Forbes Argentina - Un hackeo de US$7 millones preocupa a la industria crypto argentina","type":"news_article","archive_url":"http://web.archive.org/web/20260120083053/https://www.forbesargentina.com/innovacion/un-hackeo-us-7-millones-preocupa-industria-crypto-argentina-n39392","credibility":2,"archive_timestamp":"2026-01-20T08:30:53+00:00"},{"url":"https://cryptonews.com/news/exactly-protocol-announces-700000-bounty-for-information-hacker/","name":"CryptoNews - Exactly Protocol Announces $700,000 Bounty For Information on Hacker","type":"news_article","archive_url":"http://web.archive.org/web/20261008152652/https://cryptonews.com/news/exactly-protocol-announces-700000-bounty-for-information-hacker/","credibility":2,"archive_timestamp":"2026-10-08T15:26:52+00:00"},{"url":"https://cryptoslate.com/press-releases/uphold-and-exa-plan-to-bring-crypto-credit-card-and-yield-service-to-the-mass-market/","name":"CryptoSlate - Uphold and Exa plan to bring crypto credit card and yield service to the mass market","type":"other","archive_url":"https://web.archive.org/web/20261030204415/https://cryptoslate.com/press-releases/uphold-and-exa-plan-to-bring-crypto-credit-card-and-yield-service-to-the-mass-market/","credibility":2,"archive_timestamp":"2026-10-30T20:44:15+00:00"},{"url":"https://defillama.com/protocol/exactly?treasury=true","name":"DefiLlama - Exactly protocol TVL","type":"on_chain","archive_url":"https://web.archive.org/web/20261028165533/https://defillama.com/protocol/exactly?treasury=true","credibility":2,"archive_timestamp":"2026-10-28T16:55:33+00:00"},{"url":"https://docs.exact.ly/governance/exactly-protocol-governance/proposals-and-voting","name":"Exactly Protocol - Proposals and Voting docs","type":"official","archive_url":"http://web.archive.org/web/20260511143101/https://docs.exact.ly/governance/exactly-protocol-governance/proposals-and-voting","credibility":2,"archive_timestamp":"2026-05-11T14:31:01+00:00"},{"url":"https://dappradar.com/dapp/exactly-protocol","name":"Exactly Protocol DappRadar listing","type":"other","archive_url":"https://web.archive.org/web/20261028165432/https://dappradar.com/dapp/exactly-protocol","credibility":3,"archive_timestamp":"2026-10-28T16:54:32+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-05-04T02:54:38.838284+00:00","updated_at":"2026-11-02T00:00:23.554+00:00"},"source_quality":{"total":25,"tier1":0,"tier2":2,"tier3":1,"unrated":22},"follower_count":null,"content_updated_at":"2026-11-02T00:00:25.119Z","last_fact_checked_at":"2026-11-02T00:00:23.805Z","fact_check_next_allowed_at":null,"update_next_allowed_at":null}