ACryptoS exploit reports point to a share-accounting flaw across 77 vaults
Reports say a flaw in ACryptoS’s multi-token deposit function may have let an attacker mint too many vault shares and redeem them for assets already held by affected vaults. SlowMist reportedly estimated losses at $665, 429, but the figure and the impact on each vault have not been independently reconciled.
- Reports name 77 vaults across Arbitrum, BNB Chain, Polygon, Base and Optimism.
- The reported bug involved missing input validation in
depositMulti. - Deposits were reportedly disabled while withdrawals remained open, but that does not guarantee full recovery.
- A reported 10% bounty does not show that funds have been returned or users reimbursed.
What the reports say happened
Crypto.news reported that SlowMist blamed the incident on missing input validation in ACryptoS’s depositMulti function. The function allegedly accepted an incomplete list of token amounts, causing the share calculation to overlook part of a vault’s assets. The resulting shares could then be redeemed for assets held by the vault.
Vault shares generally represent a proportional claim on the assets a vault controls. If a deposit leads a vault to issue more shares than the contribution warrants, existing holders’ proportional claims shrink. Redeeming those newly issued shares can then remove assets from the vault, leaving less for other holders.
That describes the reported mechanism, but the available accounts don’t include the contract addresses, exploit transactions or full technical analysis needed to verify each step independently. They also don’t show that every affected vault was exploited in the same way or lost the same proportion of its assets.
The reports describe a vault-accounting issue. They do not establish that the underlying liquidity pools were compromised. A vault can miscalculate or mishandle its claim on a pool even while the pool continues to operate under its own rules.
Coverage also uses conflicting terminology. A KuCoin headline calls the incident a “reentrancy attack, ” while its explanation describes missing input validation and excessive share issuance. The available technical details don’t confirm reentrancy, so that label should be treated cautiously.
The reported loss and timeline remain unclear
Crypto.news attributed the $665, 429 estimate to SlowMist. KuCoin rounded the figure to about $665, 000. Neither account breaks down the token amounts taken from each vault, so the exact figure remains a reported aggregate estimate, not a completed, independently verified accounting.
To confirm the total, investigators would need to identify the assets and quantities that left each vault, the relevant transactions, and the pricing method and time used to convert those assets into dollars. A token’s market price can change the dollar estimate without changing the number of tokens involved.
Reports place the incident on 8 November, but coverage does not consistently state the year. Crypto.news’s cited tracker link includes a 2026 date, while KuCoin refers to action on November 9 in UTC+8. Without a clear primary timeline, neither the date nor the year is definitively established.
Open withdrawals do not mean full recovery
Incident reports said ACryptoS disabled deposits but left withdrawals open, and later moved to deprecate the protocol. They don’t establish that every withdrawal route is still available, that every user can withdraw immediately, or that users can recover their pre-incident value.
What a user can redeem depends on the assets left in their specific vault and the number of shares outstanding. Some strategies may also need to unwind positions before paying out. An unchanged share count in a wallet doesn’t show how much backing remains or what those shares can currently redeem for.
ACryptoS reportedly offered a 10% bounty for returned funds. That’s an offer to whoever returns the proceeds, not a promise to reimburse depositors. The available reports don’t confirm that funds were returned, identify a recovery address or explain how any recovered funds would be distributed.
Deprecation creates another practical concern: an interface or support service may change even if the contracts remain on-chain. The reports don’t specify which interfaces, support channels or withdrawal routes will stay available.
Users checking a position should start with the official ACryptoS channels they already trust and verify the relevant network and vault before acting. A public block explorer can help confirm wallet balances and transactions, but it can’t guarantee what a strategy can pay out. Don’t trust unsolicited links or contract addresses, and don’t sign unfamiliar transactions to try to “recover” funds.
Questions ACryptoS users should ask
-
How much was reportedly lost?
SlowMist was reported to estimate $665, 429 across 77 vaults. The figure has not been independently reconciled for each vault.
-
Which networks were affected?
Reports named Arbitrum, BNB Chain, Polygon, Base and Optimism.
-
Can users still withdraw?
Reports said withdrawals remained open, but they don’t confirm whether they are currently available or how much any particular user can recover. The amount depends on the remaining assets and shares in that user’s vault.
-
Does an unchanged share balance mean funds are safe?
No. A share count doesn’t show the value of the assets backing those shares or what the vault can pay out.
-
Have bounty funds been recovered?
The available reports don’t confirm a recovery. A bounty offer alone doesn’t show that funds reached a recovery address.
-
How can users establish what they may be able to withdraw?
They need information specific to their vault and network, including its remaining assets, share supply and relevant transactions. The reported protocol-wide estimate can’t determine an individual user’s recoverable amount, and a block explorer alone may not provide a complete valuation.
The central issue is the relationship between a vault’s shares and the assets backing them. Until ACryptoS or an independent analysis provides a verified accounting for each vault, users can’t infer their recoverable balance from the reported total, an unchanged share count or an open withdrawal route. Any returned funds would also need a separate, documented plan explaining how they would be allocated.
