-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0329
============================================================

Advisory-ID:  0xCERT-2026-0329
Severity:     Medium
Published:    2026-11-08T17:17:40.000Z
Updated:      2026-11-09T16:43:33.158Z
Chains:       Arbitrum, BNB Chain, Polygon, Base, Optimism
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0329

Title: ACryptoS vaults exploited for about $665K across 77 vaults on five chains; protocol deprecated, users told to withdraw

Summary
- -------
A missing input check in ACryptoS's depositMulti function let an attacker mint most of a vault's shares with a tiny deposit, draining about $665K from 77 vaults. Deposits are disabled and the protocol is deprecated; users should withdraw remaining funds as soon as possible.

Details
- -------
Summary
ACryptoS announced on 8 November 2026 that its vaults were exploited. SlowMist records a loss of about $665,429 across 77 vaults on five chains, caused by missing input validation in the depositMulti function: an attacker could deposit a tiny amount of one token, receive most of a vault's shares, and then withdraw a large share of both tokens. ACryptoS deployed an emergency fix that disables deposits, kept withdrawals open, and declared the protocol deprecated.

Affected
- - ACryptoS vaults (77 vaults) on Arbitrum, BNB Chain, Polygon, Base and Optimism (chain list per incident trackers)
- - Fixed in: no code fix; deposits disabled and the protocol is deprecated

Impact
Exploitation in the wild is confirmed by ACryptoS. Remaining depositors can only withdraw what each vault can still pay. Incident trackers report that ACryptoS offered a 10% bounty for returned funds. No attacker addresses or transaction hashes have been published by ACryptoS or SlowMist at the time of publication, so none are listed.

Recommended actions
- - ACryptoS depositors: withdraw remaining funds as soon as possible, using only the official ACryptoS interface or the contracts directly.
- - Do not deposit into ACryptoS vaults; the protocol is no longer maintained.
- - Beware of fake "recovery" or "compensation" sites and DMs.
- - Vault developers: validate that multi-token deposit inputs match the vault's token count before minting shares.

Source & attribution
This 0xCERT advisory summarises the ACryptoS statement (https://x.com/acryptosdao/status/2119479478749667555) and SlowMist's incident record (https://hacked.slowmist.io/). Details may change; refer to the original sources for the authoritative record.

References
- ----------
- - https://x.com/acryptosdao/status/2119479478749667555
- - https://hacked.slowmist.io/
- - https://thecryptoguardian.com/crypto-incidents/acryptos-2026-11-08/

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrzwT4JEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmfq0pxU0acegapIW54xyiw3AEYyB8AmtnPQgi+Y
ytsH1hYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAAAjoAD+OlJPF8nEOneg5Yfq
mwQ/Zi4OMF1kKOAWxKjzprinz/YA/jsFrx1uhRkxNXVwh8v3JdYPWNRP6axp
/m+G5wK9x/AI
=q3gl
-----END PGP SIGNATURE-----