A missing array length check in the depositMulti function let a 10 dollar deposit mint two thirds of one Polygon vault's shares, and about $665,429 left 77 of the protocol's 126 vaults on November 8. ACryptoS has closed every vault, ruled out reimbursement and left withdrawals as the only option for depositors.
ACryptoS has closed all 126 of its vaults and is winding the protocol down after attackers took about $665,000 from 77 of them on November 8, according to an incident analysis that reproduced the bug. The yield aggregator, which launched in 2020, has disabled deposits and left withdrawals open. The same analysis records the project telling depositors it will not reimburse them and will not reopen the vaults.
The flaw sat in depositMulti, the function that took deposits of more than one token into a vault. It did not check that the array of amounts a depositor passed in matched the number of tokens the vault actually held. SlowMist described it as missing input validation: supply a single amount and the contract valued both the incoming deposit and the vault’s existing assets using only the first token, ignoring the second entirely.
That mattered most in vaults holding almost none of the first token. The affected products were concentrated liquidity vaults built on Uniswap V3, SushiswapV3, PancakeSwap v3 and Biswap v3, where a position that drifts out of range ends up weighted into one side of the pair. In a reproduction on a Polygon USDC/USDT0 vault holding about 4.96 USDC and 72,825.21 USDT0, a depositMulti call carrying 10 USDC returned 66.84% of the vault’s outstanding shares. The same call with a correctly sized array returned 0.01%. A withdrawal then paid those shares out against both tokens, turning 10 USDC into about 9.99 USDC and 48,634.26 USDT0.
Each pass took a fixed proportion of whatever was left, so a vault could be hit repeatedly. The first Polygon vault gave up 67%, then 67% again, then 90%. The analysis counted 135 addresses involved over the course of the day, with more than 100 of them arriving after the bug had already been reported to the project. Some of the later ones used EIP-7702 delegated wallets.
The first exploit landed at 02:02 UTC on November 8 on Arbitrum, and activity continued until 16:22. Someone reported it to the project through Telegram at 09:34. Developers were contacted at 14:19, and between 15:38 and 16:40 eleven beacon contracts were updated to halt deposits and all 126 vaults were closed. ACryptoS announced the attack and the shutdown on X at 17:17, from its acryptosdao account. Roughly six hours passed between the Telegram report and the first contract change.
Arbitrum accounted for the largest share of the losses, about $230,213 across 28 of its 40 vaults. BNB Chain lost about $190,845 from 12 of 33, Polygon about $134,686 from 11 of 16, Base about $69,813 from 13 of 18 and Optimism about $39,871 from 13 of 16. Three vaults on Linea were untouched. The analysis puts the total at $665,429, and that figure excludes roughly 19,400 ACS taken from a BNB Chain ACS/WBNB vault, which had no price available to value it at.
The sums are small against what ACryptoS once held. DefiLlama put the protocol’s total value locked at $10.53 million across 17 chains on November 6, two days before the attack, against a peak of $482.28 million in May 2021. The loss is about 6% of the November 6 figure, and withdrawals are the only route left for the rest of it.
The project offered the attackers a 10% bounty to send the rest back. None of the published accounts describe the terms, the addresses involved or a distribution plan, and there is no public record of whether anything has been returned. The team said it no longer has the resources to keep the protocol running, and the stolen funds moved through several cross-chain protocols it has not named. As of November 8 the ACryptoS documentation still stated that the platform had seen no code exploits.
Other protocols have hit accounting failures in their own contracts in recent weeks. NEAR Intents traced $3.8 million of ghost funds to a failed callback, and Cysic’s blacklist caught 28% of an unauthorized 10 million token mint before it could be sold. Qubic went as far as halting its own chain to freeze 87% of a wallet drain, a lever ACryptoS never had, because its vaults were contracts deployed on six chains it does not control. What separates ACryptoS is the decision that followed. Closing all 126 vaults and ending the protocol, rather than patching and reopening, leaves depositors pulling funds out of contracts nobody intends to maintain.
