On August 18, 2023, Exactly Protocol suffered a cross-chain bridge attack due to insufficiently validated input parameters, resulting in a loss of $12.04 million. Exactly Protocol took to Twitter to announce that they are actively investigating the security issue within the protocol. In order to ensure user safety, the protocol has been temporarily paused (users can still withdraw their assets). The team is currently addressing the situation and will share more detailed information as soon as possible.
On August 21st, Exactly Protocol announced that the protocol's suspension has been lifted, and users are now able to perform all operations without any issues. No liquidations occurred during the incident. Exactly Protocol further clarified that the hacker attack only impacted users who utilized the peripheral contract (DebtManager), while unaffected users remain unharmed. The protocol is still operating normally.
Regarding the hacker incident and fund recovery efforts, the team is actively engaged in multi-faceted work, with ongoing updates being communicated and decided upon through DAO voting. Currently, the team is in the process of compiling a post-mortem report, which will be shared with the community in the coming days.
According to Defillama data, Exactly's TVL has decreased from its peak of 39.5 million USD to 8 million USD.