ThalaSwap
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·25TqEL…qDHfSummary
ThalaSwap is the decentralized exchange component of Thala Labs, an Aptos-based DeFi protocol offering an AMM, the Move Dollar (MOD) overcollateralized stablecoin, liquid staking, and a launchpad. On November 15, 2024, an input-validation bug introduced in a two-line patch to the v1 farming contract allowed an attacker to drain $25.5 million in liquidity pool tokens; funds were fully recovered within hours after SEAL 911 identified the exploiter via on-chain evidence and the attacker returned assets in exchange for a $300,000 bounty.
Connected Entities
4 entities · 51 linked investigations- ThalaSwap→mentioned with→Amazon(60%)
- ThalaSwap→mentioned with→Aptos(70%)
- ThalaSwap→mentioned with→Terraform Labs(80%)
Connected Through
3 shared actors · 51 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Amazonorganization
- □Terraform Labsorganization
- □Aptosorganization
Timeline(9 events)
25 October 2022
Thala Labs raises $6 million seed round co-led by ParaFi Capital, White Star Capital, and Shima Capital
6 April 2023
Thala protocol launches on Aptos mainnet; reaches $10M TVL within days
November 2024
Two-line patch deployed to v1 farming contract, introducing the unstake_max input-validation bug that bypassed standard security review
15 November 2024
Exploit begins at 4:46 AM PST from address 0xf7…; second larger drain completed at 7:10 AM PST from address 0x80…; total $25.5M in LP tokens stolen
15 November 2024
TVL alerts trigger at 5:12 AM PST; vulnerability identified by 7:30 AM PST; all relevant contracts paused; $11.5M in Thala assets frozen
15 November 2024
SEAL 911 and Ogle identify attacker via on-chain evidence within minutes; on-chain message sent to attacker at 9:34 AM PST
15 November 2024
Attacker agrees to return all funds by 10:13 AM PST in exchange for $300,000 protocol bounty and $40,000 personal payment; full recovery confirmed by 11:13 AM PST
16 November 2024
Thala Labs publishes post-mortem on Medium detailing root cause, timeline, and remediation steps including OtterSec re-audit and withdrawal rate limits
2025
ThalaSwap V3 (CLMM concentrated liquidity) becomes primary liquidity venue; protocol remains operational with $2.23M TVL as of mid-2026
Decision Log
- slot 445506900 · hash 5Ewdxd6c6R3Q3DivXwPSCEYDbEMeTwHPibh1b21o5Hhe
- slot 443520292 · hash 7RtzThQaLGqWXuiHYfK3RJ5NScY8fpxgP95J5mP1ZXB4
- slot 443520288 · hash BXyWJW1S6Kp7mzTbGwJtc5FSoEVb4DSQu1TChMo9do4w
- slot 443509197 · hash D3SExuLJdW5KkuZWNsjuEkBPyULhCAW4QwRQvQ2MJpq6
- slot 443509098 · hash A7HPJvsFmATq6G5qJxEtTEYPtUMqhHc1C4AdTxv8amYV
- slot 420905951 · hash HALS5dXKqGfBFLNxGvqNbUAP2cacfZYnjQnuECj4r5FA
This investigation is cryptographically anchored to the Solana blockchain (6 decisions). 8 of 12 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:27 AM
last updated: 8/29/2026, 1:33:16 AM
5 viewsavoid.net — verified advice for a post-truth world