Fluid (FLUID)

Last week's Issues⚠️:

- @0xfluid loses funds via compromised key
- @gravity_bridge suffers $5.4M exploit
- @alephium lost $815K after a backend compromise

Full details and more news in our weekly recap:
https://t.co/duT0AYYyQw

Last week's Issues⚠️:

- @0xfluid loses funds via compromised key
- @gravity_bridge suffers $5.4M exploit
- @alephium lost $815K after a backend compromise

Full details and more news in our weekly recap:
https://t.co/duT0AYYyQw

Fluid lost 125k FLUID and 51.9k GHO due to a key compromise.

A wallet was able to claim rewards from multiple Fluid Merkle distributors using empty-proof Merkle claims, then swap funds and route ETH into Tornado Cash.

Exploiter: https://t.co/7xhmZpwqE3

The timeline on Ethereum was very tight: proposer submits root, approver approves it, exploiter claims FLUID ~24 seconds after proposal. The GHO claim followed minutes later. The same wallet then swapped the claimed GHO and FLUID, bridged some Base/Arbitrum proceeds out, and later deposited ETH into Tornado Cash Router.

Several hours later, an admin-style batched tx removed the old proposer/approver roles across multiple Fluid rewards contracts:
https://t.co/Gx4G8uPdTg

Fluid has told users that Merkle reward claiming is temporarily paused for a few days, potentially up to a week, while updates are made. They also said rewards will continue accumulating retroactively and claiming will resume once updates are complete. No communication about a key compromise