Alex Lab Private Key Compromise - Revision history

Azoundria at 23:56, 28 July 2025

2025-07-28T23:56:21Z

← Older revision		Revision as of 17:56, 28 July 2025
Line 4:		Line 4:
	[[File:Alexlab.jpg\|thumb\|Alex Lab Logo/Homepage]]Alex Lab is an organization creating a protocol for swapping, liquidity, lending, and farming. Unfortunately, it appears that the team did not properly secure the private key for their contracts. Assets were withdrawn, mostly to centralized exchanges. A significant portion of the assets were recovered and plans are being made to distribute them to affected users.		[[File:Alexlab.jpg\|thumb\|Alex Lab Logo/Homepage]]Alex Lab is an organization creating a protocol for swapping, liquidity, lending, and farming. Unfortunately, it appears that the team did not properly secure the private key for their contracts. Assets were withdrawn, mostly to centralized exchanges. A significant portion of the assets were recovered and plans are being made to distribute them to affected users.

	This is a global/international case not involving a specific country.<ref name="rektnews-13901" /><ref name="rekthqtwitter-13902" /><ref name="bscscan-13903" /><ref name="bscscan-13904" /><ref name="alexlabbtctwitter-13905" /><ref name="xlinkbtctwitter-13906" /><ref name="certikalerttwitter-13907" />		This is a global/international case not involving a specific country.<ref name="rektnews-13901" /><ref name="rekthqtwitter-13902" /><ref name="bscscan-13903" /><ref name="bscscan-13904" /><ref name="alexlabbtctwitter-13905" /><ref name="xlinkbtctwitter-13906" /><ref name="certikalerttwitter-13907" /><ref name="alexlablinktree-20173" /><ref name="alexlabhomepage-20174" />

	== About Alex Lab ==		== About Alex Lab ==
Line 20:		Line 20:

	"Through lend/borrow ALEX is establishing a fundamental building block of Bitcoin finance: fixed-yield and fixed-term financial instruments. Unlike most lend/borrow on all the other DeFi protocols, however, ALEX uses dynamic Collateral Rebalancing Pools (CRPs) to avert the risk of forced liquidation."		"Through lend/borrow ALEX is establishing a fundamental building block of Bitcoin finance: fixed-yield and fixed-term financial instruments. Unlike most lend/borrow on all the other DeFi protocols, however, ALEX uses dynamic Collateral Rebalancing Pools (CRPs) to avert the risk of forced liquidation."

	"We want to update our community about a recent exploit involving ALEX liquidity pools where certain assets in certain ALEX liquidity pools are taken by the exploiter(s). We are actively collaborating with exchanges, partners, and ecosystem contributors to address the situation.

	Part of the Misappropriated ALEX Assets have been moved by Exploiter to major exchanges, and such assets are presently frozen by these exchanges following our notification of the ALEX Exploit, thus preventing withdrawal by Exploiter.

	ALEX Lab Foundation is offering Exploiter a bounty equivalent to 10% of Misappropriated ALEX Assets for the return of all Misappropriated ALEX Assets to the wallet address(s) from which Exploiter had taken the same. Subject to Exploiter’s return of the Misappropriated ALEX Assets, ALEX Lab Foundation will discontinue ongoing efforts and outreach to law enforcement for recovery of Misappropriated ALEX Assets.

	The above bounty offer stands until 18 May at 0800 UTC for Exploiter’s acceptance. Exploiter should contact security@alexgo.io to discuss mechanics for bounty settlement and Misappropriated ALEX Users Assets recovery."

	"We have launched a new page for all affected users to verify their LP (Liquidity Provider) positions. This is a crucial step as we prepare for the treasury grant and the distribution of recovered assets taken by the exploiter."

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.
Line 128:		Line 118:

	== References ==		== References ==
	<references><ref name="rektnews-13901">[https://rekt.news/alexlab-rekt/ Rekt - AlexLab - Rekt] (May 21, 2024)</ref>		<references><ref name="rektnews-13901">[https://rekt.news/alexlab-rekt/ Rekt - AlexLab - Rekt] (Accessed May 21, 2024)</ref>

			<ref name="rekthqtwitter-13902">[https://twitter.com/RektHQ/status/1791524404377366772 @RektHQ Twitter] (Accessed May 21, 2024)</ref>

			<ref name="bscscan-13903">[https://bscscan.com/tx/0x94746d33792aeb27d2066b6d8f3c8a8c7410fe15c9500059f35e0b21c9bfb416 BNB Smart Chain Transaction Hash (Txhash) Details - BscScan] (Accessed May 21, 2024)</ref>

	<ref name="~~rekthqtwitter~~-~~13902~~">[https://~~twitter~~.com/~~RektHQ~~/~~status/1791524404377366772 @RektHQ Twitter~~] (May 21, 2024)</ref>		<ref name="bscscan-13904">[https://bscscan.com/tx/0x47e123af93add709bc2516f6a5db057dfbb1d66a75b693cd7980cd3eb28c7357 BNB Smart Chain Transaction Hash (Txhash) Details - BscScan] (Accessed May 21, 2024)</ref>

	<ref name="~~bscscan~~-~~13903~~">[https://~~bscscan~~.com/tx/~~0x94746d33792aeb27d2066b6d8f3c8a8c7410fe15c9500059f35e0b21c9bfb416 BNB Smart Chain Transaction Hash (Txhash) Details \| BscScan~~] (May 21, 2024)</ref>		<ref name="alexlabbtctwitter-13905">[https://twitter.com/ALEXLabBTC/status/1790222893122535428 @ALEXLabBTC Twitter] (Accessed May 21, 2024)</ref>

	<ref name="~~bscscan~~-~~13904~~">[https://~~bscscan~~.com/tx/~~0x47e123af93add709bc2516f6a5db057dfbb1d66a75b693cd7980cd3eb28c7357 BNB Smart Chain Transaction Hash (Txhash) Details \| BscScan~~] (May 21, 2024)</ref>		<ref name="xlinkbtctwitter-13906">[https://twitter.com/XLinkbtc/status/1790708547254165746 @XLinkbtc Twitter] (Accessed May 21, 2024)</ref>

	<ref name="~~alexlabbtctwitter~~-~~13905~~">[https://twitter.com/~~ALEXLabBTC~~/status/~~1790222893122535428~~ @~~ALEXLabBTC~~ Twitter] (May 21, 2024)</ref>		<ref name="certikalerttwitter-13907">[https://twitter.com/CertiKAlert/status/1790432967422083329 @CertiKAlert Twitter] (Accessed May 21, 2024)</ref>

	<ref name="~~xlinkbtctwitter~~-~~13906~~">[https://~~twitter~~.~~com~~/~~XLinkbtc/status/1790708547254165746 @XLinkbtc Twitter~~] (~~May 21~~, ~~2024~~)</ref>		<ref name="alexlablinktree-20173">[https://linktr.ee/alexlab Alex Lab LinkTree] (Accessed Jun 11, 2025)</ref>

	<ref name="~~certikalerttwitter~~-~~13907~~">[https://~~twitter~~.~~com~~/~~CertiKAlert/status/1790432967422083329 @CertiKAlert Twitter~~] (~~May 21~~, ~~2024~~)</ref></references>		<ref name="alexlabhomepage-20174">[https://alexlab.co/ Alex Lab Homepage] (Accessed Jun 11, 2025)</ref></references>

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/alexlabprivatekeycompromise.php}} {{Unattributed Sources}} Alex Lab Logo/HomepageAlex Lab is an organization creating a protocol for swapping, liquidity, lending, and farming. Unfortunately, it appears that the team did not properly secure the private key for their contracts. Assets were withdrawn, mostly to centralized exchanges. A significant portion of the assets were..."

2024-09-17T01:34:45Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/alexlabprivatekeycompromise.php}} {{Unattributed Sources}} thumb|Alex Lab Logo/HomepageAlex Lab is an organization creating a protocol for swapping, liquidity, lending, and farming. Unfortunately, it appears that the team did not properly secure the private key for their contracts. Assets were withdrawn, mostly to centralized exchanges. A significant portion of the assets were..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/alexlabprivatekeycompromise.php}}
{{Unattributed Sources}}

[[File:Alexlab.jpg|thumb|Alex Lab Logo/Homepage]]Alex Lab is an organization creating a protocol for swapping, liquidity, lending, and farming. Unfortunately, it appears that the team did not properly secure the private key for their contracts. Assets were withdrawn, mostly to centralized exchanges. A significant portion of the assets were recovered and plans are being made to distribute them to affected users.

This is a global/international case not involving a specific country.<ref name="rektnews-13901" /><ref name="rekthqtwitter-13902" /><ref name="bscscan-13903" /><ref name="bscscan-13904" /><ref name="alexlabbtctwitter-13905" /><ref name="xlinkbtctwitter-13906" /><ref name="certikalerttwitter-13907" />

== About Alex Lab ==
"Governing DeFi on Bitcoin. The ALEX Lab Foundation ("the Foundation") is a non-profit organization supporting the governance and growth of the ALEX DeFi protocol."

"ALEX (Automated Liquidity Exchange) is the first complete DeFi platform built for Bitcoin through Stacks smart contracts. Bring your Bitcoin to life: launch new projects, earn interest, swap tokens, rewrite finance, reinvent culture."

"Use the ALEX Decentralized Exchange (DEX) for trustless swaps. Everything done on the app is routed directly through your wallet so you always have custody of your tokens."

"You can become a liquidity provider by submitting two tokens to the liquidity pool to begin earning a share of the trading fees."

"ALEX staking involves “locking up” your $ALEX token on the platform for an amount of time (”rewards cycles”) in exchange for earning protocol rewards."

"By farming (staking/locking up) LP tokens, in addition to receiving liquidity pool transactions fees, you also earn $ALEX and APower rewards."

"Through lend/borrow ALEX is establishing a fundamental building block of Bitcoin finance: fixed-yield and fixed-term financial instruments. Unlike most lend/borrow on all the other DeFi protocols, however, ALEX uses dynamic Collateral Rebalancing Pools (CRPs) to avert the risk of forced liquidation."

"We want to update our community about a recent exploit involving ALEX liquidity pools where certain assets in certain ALEX liquidity pools are taken by the exploiter(s). We are actively collaborating with exchanges, partners, and ecosystem contributors to address the situation.

Part of the Misappropriated ALEX Assets have been moved by Exploiter to major exchanges, and such assets are presently frozen by these exchanges following our notification of the ALEX Exploit, thus preventing withdrawal by Exploiter.

ALEX Lab Foundation is offering Exploiter a bounty equivalent to 10% of Misappropriated ALEX Assets for the return of all Misappropriated ALEX Assets to the wallet address(s) from which Exploiter had taken the same. Subject to Exploiter’s return of the Misappropriated ALEX Assets, ALEX Lab Foundation will discontinue ongoing efforts and outreach to law enforcement for recovery of Misappropriated ALEX Assets.

The above bounty offer stands until 18 May at 0800 UTC for Exploiter’s acceptance. Exploiter should contact security@alexgo.io to discuss mechanics for bounty settlement and Misappropriated ALEX Users Assets recovery."

"We have launched a new page for all affected users to verify their LP (Liquidity Provider) positions. This is a crucial step as we prepare for the treasury grant and the distribution of recovered assets taken by the exploiter."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:
* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - Alex Lab Private Key Compromise
!Date
!Event
!Description
|-
|May 13th, 2024 9:29:00 PM MDT
|Protocol Promotion Video
|Alex Lab posts a promotional video.
|-
|May 14th, 2024 10:44:03 AM MDT
|Second Attack Transaction
|The first attack transaction on the Binance Smart Chain.
|-
|May 14th, 2024 10:57:30 AM MDT
|Second Attack Transaction
|The second attack transaction on the Binance Smart Chain.
|-
|May 14th, 2024 11:24:00 AM MDT
|CertiK Tweet Posted
|CertiK posts a tweet about the incident.
|-
|May 15th, 2024 12:45:00 PM MDT
|Security Update Tweet
|AlexLab posts a security update with an overview of assets sent to centralized exchanges and their 10% offer of bounty to the attacker.
|-
|May 17th, 2024 5:07:00 AM MDT
|Further Security Update
|Another tweet with further updates is posted.
|}

== Technical Details ==
This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

== Total Amount Lost ==
The total amount lost has been estimated at $4,300,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
The total amount recovered is unknown.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="rektnews-13901">[https://rekt.news/alexlab-rekt/ Rekt - AlexLab - Rekt] (May 21, 2024)</ref>

<ref name="rekthqtwitter-13902">[https://twitter.com/RektHQ/status/1791524404377366772 @RektHQ Twitter] (May 21, 2024)</ref>

<ref name="bscscan-13903">[https://bscscan.com/tx/0x94746d33792aeb27d2066b6d8f3c8a8c7410fe15c9500059f35e0b21c9bfb416 BNB Smart Chain Transaction Hash (Txhash) Details | BscScan] (May 21, 2024)</ref>

<ref name="bscscan-13904">[https://bscscan.com/tx/0x47e123af93add709bc2516f6a5db057dfbb1d66a75b693cd7980cd3eb28c7357 BNB Smart Chain Transaction Hash (Txhash) Details | BscScan] (May 21, 2024)</ref>

<ref name="alexlabbtctwitter-13905">[https://twitter.com/ALEXLabBTC/status/1790222893122535428 @ALEXLabBTC Twitter] (May 21, 2024)</ref>

<ref name="xlinkbtctwitter-13906">[https://twitter.com/XLinkbtc/status/1790708547254165746 @XLinkbtc Twitter] (May 21, 2024)</ref>

<ref name="certikalerttwitter-13907">[https://twitter.com/CertiKAlert/status/1790432967422083329 @CertiKAlert Twitter] (May 21, 2024)</ref></references>