uniBTC
Last changed 2026-11-03 · Fact-check review — Fact-check review (verdict: revise): the reviewer checked the page's claims against its sources; the trust score was recalculated from the page's findings, 54 → 55. Version history →
Why this score
| Every page starts at | 65 |
| Concerns that are not fraud | -3.2 |
| Incidents it suffered (e.g. hacks) | -6.4 |
| Problems around it, caused by others | -2.4 |
| Long-running | +2 |
| Sum | 55 |
- 1 section set aside: the claims did not hold up in a fact-check, pending correction.
Score: 55/100 (kept between 0 and 100)
How scoring works →Page reliability: Fact-checked 2026-11-03 · 3 of 7 claims confirmed · 2 need better sources · 2 disputed
anchored·2kDdAx…HeUpSummary
uniBTC is a synthetic Bitcoin liquid restaking token issued by Bedrock protocol, enabling wBTC holders to earn BTC-native yield via the Babylon staking protocol while retaining liquidity. In September 2024, a critical minting vulnerability in multiple uniBTC vault smart contracts across eight blockchains was exploited for approximately $2 million after a third-party security firm disclosed the flaw hours before the attack. Post-incident forensics by Fuzzland, disclosed in June 2025, attributed the exploit to an insider threat — a former employee who embedded malware into Fuzzland's internal codebase and used privileged access to execute the attack; Bedrock has since integrated Chainlink Proof of Reserve and expanded to multiple new chains.
Connected Entities
13 entities · 60 linked investigations- Ethereum→mentioned with→Bitcoin(60%)
- Mantle→mentioned with→Ethereum(80%)
- Aptos→mentioned with→Ethereum(80%)
- Aptos→mentioned with→Binance(70%)
- Optimism→mentioned with→Arbitrum(65%)
- Aptos→mentioned with→Bitcoin(70%)
- ZachXBT→mentioned with→Ethereum(70%)
- Optimism→mentioned with→Ethereum(80%)
- ZachXBT→mentioned with→Bitcoin(65%)
- Bedrock Protocol→mentioned with→Ethereum(70%)
- + 32 more
Timeline(15 events)
12 June 2024
Blocksec conducts initial audit of uniBTC contracts.
4 September 2024
Alleged insider (later identified as a former Fuzzland employee) modifies Cargo.toml to include malicious Rust crate 'rands', embedding malware in Fuzzland workstations.
25 September 2024
Vulnerable uniBTC vault contract deployed approximately 36 hours before the exploit.
26 September 2024
16:00 UTC — Dedaub discovers and confirms the critical infinite-mint vulnerability in uniBTC vault contracts across 8 chains.
26 September 2024
16:27 UTC — Dedaub reports vulnerability to Bedrock via Twitter. 16:41 UTC — SEAL 911 war room created.
26 September 2024
Emergency call held between Fuzzland and relevant parties to discuss the Dedaub-identified vulnerability. Insider with privileged access participates.
26 September 2024
18:28 UTC — First exploit transaction executes on Ethereum. Attacker mints ~30.8 uniBTC, swaps to WBTC via Uniswap, converts to ~680 WETH, nets ~649.6 WETH (~$1.7M) after repaying flash loan.
26 September 2024
Bedrock coordinates with Pendle Finance to disable uniBTC exposure, protecting over $30M in liquidity. Vulnerable vaults paused across 8 chains.
27 September 2024
Bedrock publicly acknowledges exploit. Estimates total losses at approximately $2 million, primarily in DEX liquidity pools. Announces reimbursement plan.
27 September 2024
Stolen funds routed through Tornado Cash mixing service.
28 September 2024
Bedrock publishes post-mortem report via X (@Bedrock_DeFi). Extends job offer to attacker; no response publicly reported.
29 September 2024
Bedrock announces Chainlink Proof of Reserve Secure Mint integration as primary security remediation. PeckShield conducts post-incident audit (completed October 1, 2024). Blocksec conducts second audit (completed October 30, 2024).
5 February 2025
Bedrock contributes approximately 1,000 uniBTC to Berachain's Boyco campaign; Boyco TVL reaches $3 billion.
26 June 2025
Fuzzland publishes transparency report disclosing that a former employee was behind the September 2024 exploit using supply chain malware, social engineering, and privileged access. Fuzzland accepts full responsibility and states all affected parties were reimbursed.
4 September 2025
Bedrock launches uniBTC and brBTC on the Aptos blockchain, reporting nearly $700M in TVL and over 5,000 BTC staked across 15+ chains.
Decision Log
- slot 465085398 · hash AyRWEVozDtyybMVjZ42ivGpLkTXU7h18PwysXE5wfBGS
- slot 465085393 · hash 9sNDZ794WkYCdSku67WLeBB4CQihyaAFQcYtysm9oLsF
- slot 465085387 · hash 9EFE2x8z2FRE4ApoavksbYFhpck56wUBNq4aXxaap3dz
- slot 455364449 · hash CDtmvboe72aT8ZXkPZ7N7k3bmbUZcduthBjYSugtZg1X
- slot 422638459 · hash Jfvm3mfnou3twAqyqFTUkjKW6frety37kV4xZwpXhzi
This investigation is cryptographically anchored to the Solana blockchain (5 decisions). 20 of 23 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:28 AM
last updated: 11/3/2026, 11:35:07 PM
5 viewsavoid.net — verified advice for a post-truth world