Multi-chain yield platform ACryptoS is permanently shutting down after attackers drained roughly 665,000 USD from 77 of its savings vaults, forcing everyday depositors to pull any remaining funds out as quickly as possible.
By Priya Sharma | November 15, 2026
For regular crypto investors who kept tokens parked in ACryptoS to earn automated interest, the immediate priority is simple: check your wallet balances across supported networks and withdraw whatever assets remain. The six-year-old decentralized finance (DeFi) platform — launched in 2020 — locked new deposits after the breach and announced it can no longer sustain ongoing maintenance, leaving users responsible for moving their own money out of its smart contracts.
The Incident: 77 ACryptoS Vaults Hit Across Five Blockchains
The attack unfolded on November 8, 2026, between 02:02 UTC and 16:22 UTC, before the ACryptoS team paused deposits worldwide at 16:40 UTC the same day, according to project post-mortem records and blockchain security firm SlowMist. In total, automated scripts exploited 77 out of 126 vaults, stealing approximately 665,429 USD (widely reported as 665,000 USD) across five blockchains while leaving vaults on the Linea network untouched.
Rather than pulling off a single dramatic heist, the attackers systematically hit pools one after another using matching transaction instructions across multiple networks. Project post-mortem figures priced around the day of the breach show how those losses split across chains:
- Arbitrum — 230,213 USD drained across 28 of 40 vaults on the Ethereum express-lane network.
- BNB Chain — 190,845 USD taken from 12 of 33 vaults, excluding an unpriced amount of the platform’s native ACS token.
- Polygon — 134,686 USD lost across 11 of 16 vaults.
- Base — 69,813 USD drained from 13 of 18 vaults.
- Optimism — 39,871 USD removed across 13 of 16 vaults.
To soften the blow for affected savers, ACryptoS left withdrawal doors open for untouched funds and offered the attacker a 10 percent bounty in exchange for returning the stolen crypto. Reports from Crypto.news and TokenPost noted that the stolen assets were quickly moved across blockchain bridges, leaving little certainty over whether any funds will come back.
Technical Post-Mortem: How a Missing Array Check Broke Vault Math
Unlike many high-profile crypto hacks, this breach did not rely on borrowed flash loans or rigged price feeds. According to SlowMist and the project’s post-mortem analysis, the flaw sat inside a single smart contract doorway called depositMulti — a piece of automated vending-machine code that lets users deposit two tokens at once into a shared piggy bank.
ACryptoS ran concentrated-liquidity vaults built on top of major decentralized exchanges such as Uniswap V3, PancakeSwap V3, SushiSwap V3, and Biswap V3. Concentrated-liquidity vaults act like managed savings pots that keep two paired tokens working inside an active trading range to collect fees. Normally, when a user puts two tokens into that pot, the contract hands back vault shares — digital deposit receipts proving what slice of the shared piggy bank belongs to them.
The bug boiled down to a missing input-validation check — essentially forgetting to verify that a two-item deposit form actually contained two numbers. By sending a list with only a single token amount instead of a pair, an attacker tricked the two-token vault into valuing itself as if it only held one asset. Depositing pocket change then minted roughly 66 percent or more of the vault’s total shares, which the attacker immediately cashed out through the withdrawal function to claim a massive cut of both real tokens inside.
Because each drain left the affected vault skewed and depleted, copycat bots could repeat the same trick over and over during the 14-hour attack window until deposits were shut off. I checked the protocol’s historical audit trail against the post-mortem: earlier security reviews by CertiK and Hacken covered older yield optimization and StableSwap components, leaving this input-validation gap in the concentrated-liquidity deposit function unexposed.
Governance Impact: Protocol Shutdown Over a DAO Relaunch
When a major lending market gets hacked, token holders often vote through a decentralized autonomous organization (DAO) — an online member ballot — to patch the code or cover losses from a treasury fund. ACryptoS took the opposite route, announcing shortly after the breach that it would permanently wind down and deprecate the entire platform.
According to statements tracked by Blockhead, KuCoin News, and RootData, the team cited both the financial hit and an inability to keep paying for ongoing maintenance and security oversight. Deposits remain permanently disabled, no replacement contracts are planned, and liquidity for the native ACS governance token fell sharply following the closure notice.
For everyday investors, this highlights a governance risk that rarely shows up on yield dashboards. When a protocol relies on a small core team rather than deep reserve treasuries, a modest six-figure bug can end the entire service overnight instead of triggering an orderly recovery vote.
TVL Shifts: From 482.28 Million USD Peak to a 10.53 Million USD Wind-Down
Numbers from DefiLlama put the scale of the exit in sharp perspective. As of November 2026, total value locked (TVL) — the combined dollar value of user crypto sitting inside the protocol’s vaults — stands near 10.53 million USD, with roughly 89 to 90 percent of those remaining deposits concentrated on BNB Chain.
That current footprint is a fraction of where ACryptoS once stood. DefiLlama historical records show the platform peaked at 482.28 million USD in TVL on May 18, 2021, during the height of the last yield-farming boom. Even though the 665,429 USD theft represented a relatively small slice of total platform deposits, the combination of shrinking fee revenue, fragmented liquidity across five chains, and rising security costs left too little margin to rebuild.
ACryptoS is not alone in calling it quits this season. On the Algorand network, swap platform Vestige recently announced plans to shut down its main website and developer tools by late December 2026 after thin trading volumes failed to cover operating bills. Meanwhile, data from DefiLlama and ARK Invest cited by Cointribune shows estimated 2026 crypto hack losses reaching 8.7 billion USD — outpacing an estimated 5.6 billion USD in total on-chain protocol revenue across the sector.
Long-Term Prognosis: What Everyday DeFi Investors Should Do Next
With Bitcoin trading at 64,575 USD and Ethereum at 1,813 USD, sluggish market conditions leave smaller yield platforms with almost no cushion when smart contract bugs strike. Multi-chain deployment once looked like an easy growth shortcut, yet running dozens of vaults across five networks multiplies the surface area that bots can scan and exploit in minutes.
If you hold funds in any legacy DeFi yield aggregator, treat this shutdown as a checklist item for your own wallet. Verify that past security audits actually match the current vault version holding your coins, avoid leaving savings in unattended pools with shrinking deposits, and revoke old token permissions once you withdraw your assets.
Priya Sharma’s take
Letting a six-year-old yield manager fold over a 665,429 USD validation slip shows how thin operational buffers have grown when fees no longer cover basic maintenance. Whether the attacker accepts the 10 percent bounty — and whether BNB Chain depositors withdraw the remaining 10.53 million USD without interface failures — is the ledger item ahead. Stranded collateral inside orphaned vault contracts would convince me legacy aggregators still lack safe exit guardrails.
The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.
six years live then one deposit with a single-asset list nukes 77 of 126 vaults. 665k gone because the vault never checked it got two numbers. brutal
exactly. pocket change in, two thirds of the vault out. feels like nobody ever tested the unhappy path, just the happy one
A one-element array instead of a pair let the attacker mint 66% of the shares with pocket change. For a platform running since 2020, that is a basic input validation miss.
Interesting that the Linea vaults were left untouched. Maybe that integration shipped later with the pairing check already fixed, who knows