ACryptoS vaults exploited for about $665K across 77 vaults on five chains; protocol deprecated, users told to withdraw

Summary

ACryptoS announced on 8 November 2026 that its vaults were exploited. SlowMist records a loss of about $665,429 across 77 vaults on five chains, caused by missing input validation in the depositMulti function: an attacker could deposit a tiny amount of one token, receive most of a vault's shares, and then withdraw a large share of both tokens. ACryptoS deployed an emergency fix that disables deposits, kept withdrawals open, and declared the protocol deprecated.

Affected

• ACryptoS vaults (77 vaults) on Arbitrum, BNB Chain, Polygon, Base and Optimism (chain list per incident trackers)
• Fixed in: no code fix; deposits disabled and the protocol is deprecated

Impact

Exploitation in the wild is confirmed by ACryptoS. Remaining depositors can only withdraw what each vault can still pay. Incident trackers report that ACryptoS offered a 10% bounty for returned funds. No attacker addresses or transaction hashes have been published by ACryptoS or SlowMist at the time of publication, so none are listed.

Recommended actions

• ACryptoS depositors: withdraw remaining funds as soon as possible, using only the official ACryptoS interface or the contracts directly.
• Do not deposit into ACryptoS vaults; the protocol is no longer maintained.
• Beware of fake "recovery" or "compensation" sites and DMs.
• Vault developers: validate that multi-token deposit inputs match the vault's token count before minting shares.

Source & attribution

This 0xCERT advisory summarises the ACryptoS statement (https://x.com/acryptosdao/status/2119479478749667555) and SlowMist's incident record (https://hacked.slowmist.io/). Details may change; refer to the original sources for the authoritative record.