How small deposits drained 77 ACryptoS vaults and what users can still withdraw

ACryptoS reportedly lost about $665,000 across five chains after its vaults issued attackers shares out of proportion to what they deposited. The yield aggregator stopped accepting deposits and urged users to withdraw the assets still available. For affected depositors, the amount left in their vault is a separate question from whether the project can recover funds taken from it. Summary Security firm SlowMist recorded approximately $665,000 in losses from an 8 November ACryptoS exploit affecting 77 vaults across Arbitrum, BNB Chain, Polygon, Base and Optimism. A missing input check in the multi-token deposit function reportedly let an attacker submit an amount for one token in a vault that accounted for two, distorting the share calculation. Attackers could redeem the newly minted shares against both assets. Existing shares could still appear in a wallet even after the underlying assets available to their holders had fallen. Incident trackers say ACryptoS disabled deposits, kept withdrawals open and subsequently moved to deprecate the protocol. An open withdrawal route only allows a user to redeem against what the vault can still pay. The project reportedly offered a 10% bounty fo...