{"investigation":{"slug":"exactly","entity_name":"Exactly Protocol","trust_score":32,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"Exactly Protocol is a decentralized, non-custodial fixed-rate and variable-rate lending protocol deployed on the Optimism Layer 2 network. On August 18, 2023, the protocol suffered a critical exploit resulting in approximately $7.3–$12 million in ETH stolen from 117 user accounts due to insufficient input validation in its DebtManager periphery contract. The protocol has since resumed operations, engaged law enforcement, offered a $700,000 bounty, and passed a governance proposal to compensate affected users with EXA tokens.","sections":[{"content":"On August 18, 2023, Exactly Protocol was exploited on the Optimism network. The attacker exploited a critical vulnerability in the DebtManager periphery contract, which failed to validate that the provided market address was a legitimate protocol market. By supplying a malicious fake market contract address, the attacker was able to bypass permit checks, insert victim wallet addresses as the effective message sender, and drain user collateral. The attack contract was deployed on Ethereum, bridged funds to Optimism to execute the exploit, then bridged the stolen assets back to Ethereum via both the native Optimism Bridge (approximately 2,832 ETH) and the Across Protocol bridge (approximately 1,490 ETH). Initial reports placed losses at approximately $7.3 million (4,324 ETH); later estimates put the figure as high as $12.04 million (7,160 ETH). The discrepancy appears to reflect different counting methodologies for funds in transit across bridges. A total of 117 user accounts were affected, with the top 10 victims accounting for approximately 84% of total damage and one wallet alone losing nearly $1.8 million. The protocol's TVL declined from approximately $37 million pre-hack to under $11 million in the weeks following the exploit. The EXA governance token fell over 12% on the day of the incident.","heading":"Security Exploit — August 2023","sources":[{"url":"https://rekt.news/exactly-protocol-rekt/","name":"rekt.news","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2023/08/18/crypto-lender-exactly-hit-by-12m-bridge-exploit","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-exactly-protocol-hack-august-2023","name":"halborn.com","type":"other","credibility":3},{"url":"https://immunebytes.com/blog/defi-exactly-protocol-hack-analysis/","name":"immunebytes.com","type":"other","credibility":3},{"url":"https://medium.com/neptune-mutual/how-was-exactly-protocol-exploited-5ecfa5ad968b","name":"medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The root cause of the exploit was insufficient validation in the DebtManager periphery contract. The leverage function did not verify whether the market address passed to it was a legitimate protocol market. This allowed an attacker to deploy a fraudulent market contract that, when called by the DebtManager, executed a malicious deposit function and hijacked the _msgSender field to impersonate victim wallets. The attacker then withdrew victim collateral and executed liquidations to collect liquidator incentives. The contract had undergone multiple audits prior to the hack; however, the DebtManager periphery contract was noted to have been an area where the auditing scope may not have fully captured the input validation flaw. Following the incident, ABDK Consulting audited the DebtManager contract, after which the Strategies section of the web application was re-enabled. Known attacker addresses include 0x3747dbbcb5c07786a4c59883e473a2e38f571af9, 0xe4f34a72d7c18b6f666d6ca53fbc3790bc9da042, and 0x417179df13ba3ed138b0a58eaa0c3813430a20e0. The attacker's initial funds were sourced from Tornado Cash on Ethereum before bridging to Optimism.","heading":"Technical Vulnerability Details","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-exactly-protocol-hack-august-2023","name":"halborn.com","type":"other","credibility":3},{"url":"https://immunebytes.com/blog/defi-exactly-protocol-hack-analysis/","name":"immunebytes.com","type":"other","credibility":3},{"url":"https://olympix.security/blog/exactly-protocol-lost-7-3m-the-code-worked-the-assumptions-didnt","name":"olympix.security","type":"other","credibility":3},{"url":"https://rekt.news/exactly-protocol-rekt/","name":"rekt.news","type":"other","credibility":3}],"severity":"medium"},{"content":"Immediately following the exploit, Exactly Protocol paused the protocol while retaining user withdrawal functionality. The team acknowledged the incident publicly and initiated an internal investigation. In early September 2023, the protocol team contacted the United States Department of Homeland Security. Homeland Security Investigations (HSI) opened a case assigned case number NY02HR23NY0001. The team also engaged blockchain analytics firm Chainalysis to trace the stolen funds. A $700,000 bounty was publicly announced for information leading to the arrest of the attacker and full recovery of stolen funds. Exactly Protocol also filed a police report. No public confirmation of fund recovery or attacker identification has been found as of mid-2026.","heading":"Protocol Response and Law Enforcement Engagement","sources":[{"url":"https://medium.com/@exactly_protocol/exactly-protocol-recap-4-e58db6dca618","name":"medium.com","type":"other","credibility":3},{"url":"https://cryptonews.com/news/exactly-protocol-announces-700000-bounty-for-information-hacker/","name":"cryptonews.com","type":"other","credibility":3},{"url":"https://www.pymnts.com/cryptocurrency/2023/crypto-market-exactly-protocol-targeted-in-12-million-hack/","name":"pymnts.com","type":"other","credibility":3}],"severity":"medium"},{"content":"In response to the August 2023 exploit, the Exactly Protocol governance community approved proposal EXAIP-03, which allocated one million EXA tokens — representing 10% of the total EXA token supply and approximately 20% of the community-designated allocation — to be distributed pro rata among the 117 affected users. Token vesting was scheduled to begin in June 2024 under a linear 48-month vesting schedule, delivered via Sablier NFTs. The proposal included a recovery adjustment clause: if stolen funds were recovered before June 1, 2024, the value of compensation would be reduced proportionally to the recovery amount; recoveries after that date would not trigger adjustments. No public announcement confirming stolen fund recovery before the June 2024 deadline has been located.","heading":"User Compensation Proposal (EXAIP-03)","sources":[{"url":"https://medium.com/@exactly_protocol/exaip-03-addressing-the-exactly-protocol-hack-and-compensating-affected-users-6e2cd4a0a179","name":"medium.com","type":"other","credibility":3},{"url":"https://medium.com/@exactly_protocol/exactly-protocol-report-q4-2023-5ab2e0838c77","name":"medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Exactly Protocol was founded by Gabriel Gruber (CEO) and Lucas Lain (CTO), both based in Argentina. Gruber previously co-founded Properati, a Latin American real estate platform acquired by OLX Group in 2018, and worked at the Central Bank of Argentina. Lain previously held senior engineering roles at Compass.com and Squarespace.com. The protocol is developed under Exa Labs. Notable investors and advisors include Kain Warwick (co-founder of Synthetix), Esteban Ordano (co-founder of Decentraland), and Matias Woloski (co-founder of Auth0). The protocol has a Immunefi bug bounty program active for ongoing security disclosures.","heading":"Team and Investors","sources":[{"url":"https://www.crunchbase.com/person/gabriel-gruber","name":"crunchbase.com","type":"other","credibility":3},{"url":"https://rocketreach.co/gabriel-gruber-email_732721","name":"rocketreach.co","type":"other","credibility":3},{"url":"https://www.rootdata.com/member/Gabriel%20Gruber?k=OTA5Mw%3D%3D","name":"rootdata.com","type":"other","credibility":3},{"url":"https://immunefi.com/bounty/exactly/","name":"immunefi.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the August 2023 exploit and remediation, Exactly Protocol resumed operations on Optimism. The team expanded its product offering through the Exa App, a consumer-facing application enabling users to access crypto-backed credit, fixed-rate deposits, and an Exa Visa Signature Credit Card. In February 2025, Exactly Protocol announced a partnership with fintech platform Uphold, which committed to integrating the Exa Credit Card and Exa Loans into the Uphold platform. The team set a stated goal of reaching one million Exa App users by 2026. TVL and user counts remain substantially lower than the pre-hack levels of approximately $37 million. The EXA token continues to trade on public markets.","heading":"Current Operations (2024–2026)","sources":[{"url":"https://gov.optimism.io/t/exactly-protocol-and-the-exa-app-scaling-onchain-finance-on-optimism/9962","name":"gov.optimism.io","type":"other","credibility":3},{"url":"https://medium.com/@exactly_protocol/connecting-the-dots-the-exactly-protocol-and-the-exa-app-f9579ad74c67","name":"medium.com","type":"other","credibility":3},{"url":"https://medium.com/@exactly_protocol/scaling-the-dots-44634b918b2f","name":"medium.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/exactly","name":"defillama.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Exactly Protocol has been flagged by pseudonymous blockchain investigator ZachXBT. The precise basis and scope of ZachXBT's flag have not been independently confirmed through a publicly accessible primary source at time of investigation. Given the documented August 2023 exploit — involving Tornado Cash-funded attacker wallets, cross-chain bridge abuse, and losses of $7.3–$12 million — the protocol falls within categories that ZachXBT regularly monitors. Users should treat the ZachXBT flag in conjunction with the confirmed exploit record when assessing protocol risk. This section's characterization of the flag is based on available secondary context and should be treated as low-confidence pending direct primary source confirmation.","heading":"ZachXBT Flag","sources":[{"url":"https://zachxbt.mirror.xyz/","name":"zachxbt.mirror.xyz","type":"other","credibility":3},{"url":"https://t.me/investigations","name":"t.me","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021-07","event":"Exactly Protocol founded by Gabriel Gruber and Lucas Lain under Exa Labs.","source":"","date_original":"2021-07-01"},{"date":"2022-11","event":"Exactly Protocol launched on Ethereum Mainnet.","source":"","date_original":"2022-11-01"},{"date":"2023-03","event":"Exactly Protocol deployed on Optimism Layer 2 network.","source":"","date_original":"2023-03-01"},{"date":"2023-08-18","event":"Exploit executed via malicious market address in DebtManager contract; approximately $7.3–$12 million in ETH stolen from 117 user accounts. Protocol temporarily paused. EXA token fell over 12%.","source":""},{"date":"2023-08-19","event":"Protocol published post-mortem identifying DebtManager vulnerability. $700,000 bounty announced for information leading to attacker arrest and fund recovery.","source":""},{"date":"2023-09","event":"Protocol team contacted US Department of Homeland Security; HSI opened case NY02HR23NY0001. Chainalysis engaged to trace stolen funds.","source":"","date_original":"2023-09-01"},{"date":"2023-09","event":"ABDK Consulting completed audit of remediated DebtManager contract; Strategies section of web app re-enabled.","source":"","date_original":"2023-09-01"},{"date":"2023-10","event":"EXAIP-03 governance proposal approved; one million EXA tokens allocated as compensation to 117 hack victims, with 48-month linear vesting beginning June 2024.","source":"","date_original":"2023-10-01"},{"date":"2024-06","event":"Vesting of EXAIP-03 compensation tokens commenced via Sablier NFTs for affected users.","source":"","date_original":"2024-06-01"},{"date":"2025-02","event":"Exactly Protocol announced partnership with Uphold fintech platform to integrate Exa Credit Card and Exa Loans.","source":"","date_original":"2025-02-01"},{"date":"2025-03","event":"Exa App launched to general users in 160+ countries, enabling crypto-backed credit cards and fixed-rate lending.","source":"","date_original":"2025-03-01"}],"sources_used":[{"url":"https://rekt.news/exactly-protocol-rekt/","name":"rekt.news","type":"other","archive_url":"http://web.archive.org/web/20260118090442/https://rekt.news/exactly-protocol-rekt","credibility":3,"archive_timestamp":"2026-01-18T09:04:42+00:00"},{"url":"https://www.coindesk.com/business/2023/08/18/crypto-lender-exactly-hit-by-12m-bridge-exploit","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20260725211127/https://www.coindesk.com/business/2023/08/18/crypto-lender-exactly-hit-by-12m-bridge-exploit","credibility":3,"archive_timestamp":"2026-07-25T21:11:27+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-exactly-protocol-hack-august-2023","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260517000737/https://www.halborn.com/blog/post/explained-the-exactly-protocol-hack-august-2023","credibility":3,"archive_timestamp":"2026-05-17T00:07:37+00:00"},{"url":"https://immunebytes.com/blog/defi-exactly-protocol-hack-analysis/","name":"immunebytes.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://medium.com/neptune-mutual/how-was-exactly-protocol-exploited-5ecfa5ad968b","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://olympix.security/blog/exactly-protocol-lost-7-3m-the-code-worked-the-assumptions-didnt","name":"olympix.security","type":"other","archive_url":"http://web.archive.org/web/20260412142342/https://olympix.security/blog/exactly-protocol-lost-7-3m-the-code-worked-the-assumptions-didnt","credibility":3,"archive_timestamp":"2026-04-12T14:23:42+00:00"},{"url":"https://medium.com/@exactly_protocol/exactly-protocol-recap-4-e58db6dca618","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cryptonews.com/news/exactly-protocol-announces-700000-bounty-for-information-hacker/","name":"cryptonews.com","type":"other","archive_url":"http://web.archive.org/web/20260726001647/https://cryptonews.com/news/exactly-protocol-announces-700000-bounty-for-information-hacker/","credibility":3,"archive_timestamp":"2026-07-26T00:16:47+00:00"},{"url":"https://www.pymnts.com/cryptocurrency/2023/crypto-market-exactly-protocol-targeted-in-12-million-hack/","name":"pymnts.com","type":"other","archive_url":"http://web.archive.org/web/20260217141011/https://www.pymnts.com/cryptocurrency/2023/crypto-market-exactly-protocol-targeted-in-12-million-hack/","credibility":3,"archive_timestamp":"2026-02-17T14:10:11+00:00"},{"url":"https://medium.com/@exactly_protocol/exaip-03-addressing-the-exactly-protocol-hack-and-compensating-affected-users-6e2cd4a0a179","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://medium.com/@exactly_protocol/exactly-protocol-report-q4-2023-5ab2e0838c77","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.crunchbase.com/person/gabriel-gruber","name":"crunchbase.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://rocketreach.co/gabriel-gruber-email_732721","name":"rocketreach.co","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.rootdata.com/member/Gabriel%20Gruber?k=OTA5Mw%3D%3D","name":"rootdata.com","type":"other","archive_url":"http://web.archive.org/web/20260119213538/https://www.rootdata.com/member/Gabriel%20Gruber?k=OTA5Mw%3D%3D","credibility":3,"archive_timestamp":"2026-01-19T21:35:38+00:00"},{"url":"https://immunefi.com/bounty/exactly/","name":"immunefi.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://gov.optimism.io/t/exactly-protocol-and-the-exa-app-scaling-onchain-finance-on-optimism/9962","name":"gov.optimism.io","type":"other","archive_url":"http://web.archive.org/web/20251113024848/https://gov.optimism.io/t/exactly-protocol-and-the-exa-app-scaling-onchain-finance-on-optimism/9962","credibility":3,"archive_timestamp":"2025-11-13T02:48:48+00:00"},{"url":"https://medium.com/@exactly_protocol/connecting-the-dots-the-exactly-protocol-and-the-exa-app-f9579ad74c67","name":"medium.com","type":"other","archive_url":"http://web.archive.org/web/20251025110938/https://medium.com/@exactly_protocol/connecting-the-dots-the-exactly-protocol-and-the-exa-app-f9579ad74c67","credibility":3,"archive_timestamp":"2025-10-25T11:09:38+00:00"},{"url":"https://medium.com/@exactly_protocol/scaling-the-dots-44634b918b2f","name":"medium.com","type":"other","archive_url":"http://web.archive.org/web/20260622230149/https://medium.com/@exactly_protocol/scaling-the-dots-44634b918b2f","credibility":3,"archive_timestamp":"2026-06-22T23:01:49+00:00"},{"url":"https://defillama.com/protocol/exactly","name":"defillama.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://zachxbt.mirror.xyz/","name":"zachxbt.mirror.xyz","type":"other","archive_url":"http://web.archive.org/web/20251025091919/https://zachxbt.mirror.xyz/","credibility":3,"archive_timestamp":"2025-10-25T09:19:19+00:00"},{"url":"https://t.me/investigations","name":"t.me","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:38.838284+00:00","updated_at":"2026-08-30T05:14:10.110813+00:00"}}