BitoPro Exchange Belatedly Discloses $11.5 Million Hack as ALEX Protocol Suffers Simultaneous $8.3M Exploit

June 6, 2025 will be remembered as one of the most consequential days in recent cryptocurrency security history. Two major incidents struck within hours of each other — a belated disclosure from Taiwanese exchange BitoPro and a sophisticated exploit targeting Bitcoin DeFi protocol ALEX Lab on the Stacks blockchain. Together, the incidents drained over $19 million in digital assets, exposing persistent vulnerabilities in both centralized and decentralized crypto infrastructure.

The Exploit Mechanics

The ALEX Protocol attack demonstrated a level of sophistication that has become increasingly common in DeFi exploits. The attacker began by creating a fake token named ssl-labubu-672d3, which contained a malicious transfer function hidden within its smart contract code. This token was then paired with legitimate assets like Stacks (STX) in a liquidity pool on the ALEX platform.

The core vulnerability lay in ALEX Protocol’s self-listing verification logic — the system that allows new tokens to be added to the platform. Due to insufficient verification controls, the attacker was able to exploit the set-approved-token function, which unintentionally granted their malicious contract vault-level access to the protocol’s treasury. Once permissions were established, the attacker activated the set-enable-farming function, enabling the hidden malicious transfer capability.

During routine token swap operations (swap-x-for-y), the legitimate ALEX Protocol contracts inadvertently triggered the attacker’s malicious transfer function. Weak internal checks caused the protocol to misidentify the vault itself as the initiator of transfers, allowing the attacker to systematically drain funds. The stolen assets included approximately 8.4 million STX tokens worth roughly $5.69 million, 21.85 Stacks Bitcoin tokens valued at about $2.24 million, stablecoins totaling around $149,850, and 2.8 Wrapped Bitcoin tokens worth approximately $287,000. Some reports indicated total losses could reach as high as $16.18 million when accounting for additional stolen tokens.

Meanwhile, BitoPro, a Taiwan-based cryptocurrency exchange, belatedly disclosed that it had suffered an $11.5 million hack. The delayed disclosure raised serious concerns about transparency standards among centralized exchanges and whether regulators would push for mandatory incident reporting timelines.

Affected Systems

The ALEX Protocol exploit specifically targeted the protocol’s self-listing verification system — a component designed to allow permissionless token additions to the platform. Built on the Stacks blockchain, which enables smart contracts on Bitcoin, ALEX Lab had positioned itself as a gateway for Bitcoin DeFi. This incident marks the protocol’s second major breach, following a $4.3 million hack in May 2024 that was attributed to the North Korean Lazarus Group.

The BitoPro breach affected the exchange’s hot wallet systems, though full technical details remained sparse given the belated nature of the disclosure. The exchange’s handling of the incident drew criticism from security researchers who noted that timely disclosure is critical for enabling other platforms to detect and prevent similar attacks.

The Mitigation Strategy

In response to the ALEX Protocol exploit, the ALEX Lab Foundation moved swiftly, pledging full reimbursement to all affected users using USDC from its treasury. Reimbursement amounts were calculated based on average on-chain exchange rates recorded between 10:00 AM and 2:00 PM UTC on the day of the exploit. Users received on-chain notifications regarding claim submissions by June 8, 2025, with a submission deadline of June 10. Reimbursements were distributed within seven business days after verification.

The broader DeFi community responded with renewed calls for enhanced token listing verification processes. Security firms recommended implementing multi-layer verification that includes static code analysis of token contracts before listing, real-time monitoring of unusual permission changes, and automated alerts when new tokens interact with treasury-level functions.

Lessons Learned

These dual incidents underscore several critical lessons for the cryptocurrency ecosystem. First, self-listing mechanisms — while important for permissionless innovation — require robust verification frameworks that can detect malicious contract logic before it reaches production systems. Second, the BitoPro case highlights the ongoing need for mandatory disclosure timelines, as delayed reporting prevents the broader community from taking defensive action. Third, protocols that have been previously exploited face heightened scrutiny and must demonstrate that systemic security improvements have been implemented, not just patches for the specific vulnerability that was exploited.

User Action Required

For users affected by the ALEX Protocol exploit, claims should be submitted through official ALEX Lab channels. All users interacting with DeFi protocols should verify that their funds are not exposed to self-listing token risks, and anyone with balances on centralized exchanges should ensure they maintain only what is necessary for active trading, keeping the majority of funds in self-custody wallets. As Bitcoin trades at approximately $104,390 and Ethereum at $2,477 at the time of these incidents, the stakes for proper security practices have never been higher.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before engaging with any cryptocurrency platform.