ACryptoS reported that 77 vaults across Arbitrum, BNB Chain, Polygon, Base, and Optimism were exploited on 8 November 2026. SlowMist records a loss of about 665,429 dollars. The project disabled deposits, kept withdrawals open, and said the protocol would be deprecated because it lacked resources to continue.
The flaw distorted vault shares
The incident record attributes the exploit to missing validation in the depositMulti function. An attacker could submit an amount array that did not match the vault's token count, deposit a tiny amount of one token, receive an excessive share balance, and withdraw value from both assets. This is a vault accounting failure rather than a compromise of the underlying chains.
Scope and loss need careful reading
The 77 affected vaults are a subset of the project's 126 vaults. The reported dollar loss excludes about 19,400 ACS without a reliable valuation. Analysts should not add the same withdrawn assets again when they move between attacker addresses or chains.
What users can verify
Remaining users should rely on the official ACryptoS interface and post mortem, verify chain and contract addresses, and treat unsolicited recovery messages as suspicious. Withdrawals remaining open does not guarantee every vault can return the original balance. No public repayment plan was established in the reviewed sources.
What investors should monitor
This report is informational and does not treat a transfer, proposal, scheduled event, or provider label as proof of a trade or a certain market outcome. Readers should verify later updates against the cited primary record and evaluate liquidity, execution, custody, and regulatory risks independently.
For background on custody, transfers, and market risk, see the FOLITIC Crypto Trading Guide.
Sources and methodology
Image credit: United States Air Force, Public domain. The image is illustrative and does not document the reported event.
