Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·25TqEL…qDHfSummary
ThalaSwap is the decentralized exchange component of Thala Labs, an Aptos-based DeFi protocol offering an AMM, the Move Dollar (MOD) overcollateralized stablecoin, liquid staking, and a launchpad. On November 15, 2024, an input-validation bug introduced in a two-line patch to the v1 farming contract allowed an attacker to drain $25.5 million in liquidity pool tokens; funds were fully recovered within hours after SEAL 911 identified the exploiter via on-chain evidence and the attacker returned assets in exchange for a $300,000 bounty.
Connected Entities
4 entities · 51 linked investigations- ThalaSwap→mentioned with→Amazon(60%)
- ThalaSwap→mentioned with→Aptos(70%)
- ThalaSwap→mentioned with→Terraform Labs(80%)
Connected Through
3 shared actors · 51 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Amazonorganizationalso inNicolo Nourafchan / Robert Yadgarov (SEC/DOJ Insider Trading Ring)·0Faris Ali / UK Crypto Home Invasion Ring·0ClickFix BNB Chain EtherHiding Malware Campaign·0Faris Ali·2GAW Miners / Josh Garza·2Mining Automatic (Zan Shaikh / Bright Vision Distribution LLC)·2Unicoin Inc.·4Grand Base·5Saddle Finance·10MELANIA Memecoin·12ShipMonk·16Term Labs·17Term Finance·22Roman Storm·22YO Protocol·42CoW Swap (CoW Protocol)·50HEEBOO·54Injective Protocol·55Scroll·58Amazon·65Amazon Web Services·65Crossmint·70Orca·80
- □Terraform Labsorganizationalso inTerraform Labs·0keyv / cacheable npm Supply Chain Attack — TeamPCP Mini Shai-Hulud (August 2026)·0Luna Yield·2Do Kwon·2Terra/Luna·2Kyle Davies·3Su Zhu·3Anchor Protocol·4Mirror Protocol·4Mirror Protocol·5luna·5Terra 2.0·7Axiom DEX Insider Trading (Broox Bauer)·8Warp Protocol·22BFUSD·40Jump Trading·42Inertia Protocol·42Leap Wallet·52Wormhole·62
- □Aptosorganization
Timeline(9 events)
25 October 2022
Thala Labs raises $6 million seed round co-led by ParaFi Capital, White Star Capital, and Shima Capital
6 April 2023
Thala protocol launches on Aptos mainnet; reaches $10M TVL within days
November 2024
Two-line patch deployed to v1 farming contract, introducing the unstake_max input-validation bug that bypassed standard security review
15 November 2024
Exploit begins at 4:46 AM PST from address 0xf7…; second larger drain completed at 7:10 AM PST from address 0x80…; total $25.5M in LP tokens stolen
15 November 2024
TVL alerts trigger at 5:12 AM PST; vulnerability identified by 7:30 AM PST; all relevant contracts paused; $11.5M in Thala assets frozen
15 November 2024
SEAL 911 and Ogle identify attacker via on-chain evidence within minutes; on-chain message sent to attacker at 9:34 AM PST
15 November 2024
Attacker agrees to return all funds by 10:13 AM PST in exchange for $300,000 protocol bounty and $40,000 personal payment; full recovery confirmed by 11:13 AM PST
16 November 2024
Thala Labs publishes post-mortem on Medium detailing root cause, timeline, and remediation steps including OtterSec re-audit and withdrawal rate limits
2025
ThalaSwap V3 (CLMM concentrated liquidity) becomes primary liquidity venue; protocol remains operational with $2.23M TVL as of mid-2026
Decision Log
- hash: 5Ewdxd6c6R3Q3DivXwPSCEYDbEMeTwHPibh1b21o5Hhe
- hash: 7RtzThQaLGqWXuiHYfK3RJ5NScY8fpxgP95J5mP1ZXB4
- hash: BXyWJW1S6Kp7mzTbGwJtc5FSoEVb4DSQu1TChMo9do4w
- hash: D3SExuLJdW5KkuZWNsjuEkBPyULhCAW4QwRQvQ2MJpq6
- hash: A7HPJvsFmATq6G5qJxEtTEYPtUMqhHc1C4AdTxv8amYV
- hash: HALS5dXKqGfBFLNxGvqNbUAP2cacfZYnjQnuECj4r5FA
This investigation is cryptographically anchored to the Solana blockchain (6 events). 8 of 12 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:27 AM
last updated: 8/29/2026, 11:26:13 PM
5 viewsavoid.net — verified advice for a post-truth world