ThalaSwap
Last changed 2026-10-27 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 62 → 55. Problems weighed by who is responsible: incidents the subject suffered −9.6, concerns that are not fraud −3.2, problems around the subject, caused by others −1.6; legitimacy credit long-running +4; fact-check adjustments (+20) now shown as page reliability, not in the score. Version history →
Why this score
| Every page starts at | 65 |
| Concerns that are not fraud | -3.2 |
| Incidents it suffered (e.g. hacks) | -9.6 |
| Problems around it, caused by others | -1.6 |
| Long-running | +4 |
| Sum | 55 |
Score: 55/100 (kept between 0 and 100)
How scoring works →Summary
ThalaSwap is the decentralized exchange component of Thala Labs, an Aptos-based DeFi protocol offering an AMM, the Move Dollar (MOD) overcollateralized stablecoin, liquid staking, and a launchpad. On November 15, 2024, an input-validation bug introduced in a two-line patch to the v1 farming contract allowed an attacker to drain $25.5 million in liquidity pool tokens; funds were fully recovered within hours after SEAL 911 identified the exploiter via on-chain evidence and the attacker returned assets in exchange for a $300,000 bounty.
Connected Entities
4 entities · 50 linked investigations- ThalaSwap→mentioned with→Amazon(60%)
- ThalaSwap→mentioned with→Aptos(70%)
- ThalaSwap→mentioned with→Terraform Labs(80%)
Connected Through
3 shared actors · 50 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Amazonorganization
- □Terraform Labsorganization
- □Aptosorganization
Timeline(9 events)
25 October 2022
Thala Labs raises $6 million seed round co-led by ParaFi Capital, White Star Capital, and Shima Capital
6 April 2023
Thala protocol launches on Aptos mainnet; reaches $10M TVL within days
November 2024
Two-line patch deployed to v1 farming contract, introducing the unstake_max input-validation bug that bypassed standard security review
15 November 2024
Exploit begins at 4:46 AM PST from address 0xf7…; second larger drain completed at 7:10 AM PST from address 0x80…; total $25.5M in LP tokens stolen
15 November 2024
TVL alerts trigger at 5:12 AM PST; vulnerability identified by 7:30 AM PST; all relevant contracts paused; $11.5M in Thala assets frozen
15 November 2024
SEAL 911 and Ogle identify attacker via on-chain evidence within minutes; on-chain message sent to attacker at 9:34 AM PST
15 November 2024
Attacker agrees to return all funds by 10:13 AM PST in exchange for $300,000 protocol bounty and $40,000 personal payment; full recovery confirmed by 11:13 AM PST
16 November 2024
Thala Labs publishes post-mortem on Medium detailing root cause, timeline, and remediation steps including OtterSec re-audit and withdrawal rate limits
2025
ThalaSwap V3 (CLMM concentrated liquidity) becomes primary liquidity venue; protocol remains operational with $2.23M TVL as of mid-2026
Decision Log
- slot 461963950 · hash 64cxkTHQz7fCizPYSC2HTtbt9XV6gpqTkgFUWQoAwHzo
- slot 445506900 · hash 5Ewdxd6c6R3Q3DivXwPSCEYDbEMeTwHPibh1b21o5Hhe
- slot 443520292 · hash 7RtzThQaLGqWXuiHYfK3RJ5NScY8fpxgP95J5mP1ZXB4
- slot 443520288 · hash BXyWJW1S6Kp7mzTbGwJtc5FSoEVb4DSQu1TChMo9do4w
- slot 443509197 · hash D3SExuLJdW5KkuZWNsjuEkBPyULhCAW4QwRQvQ2MJpq6
- slot 443509098 · hash A7HPJvsFmATq6G5qJxEtTEYPtUMqhHc1C4AdTxv8amYV
- slot 420905951 · hash HALS5dXKqGfBFLNxGvqNbUAP2cacfZYnjQnuECj4r5FA
This investigation is cryptographically anchored to the Solana blockchain (7 decisions). 8 of 12 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:27 AM
last updated: 10/27/2026, 6:04:16 AM
5 viewsavoid.net — verified advice for a post-truth world