ACryptoS, a multi-chain DeFi yield aggregator that launched in 2020, said Sunday it is ceasing operations after an attacker exploited a missing input check to drain about $665,000 from 77 vaults across five blockchains. The team has disabled deposits but left withdrawals open, and it is urging users to pull remaining funds out as soon as possible.
Every detail of the cause, the amount and the scope comes from ACryptoS’s own announcement on X as relayed by news outlets. The reports rest on that single post and cite no independent security firm. Depositors face a practical question now: whether to leave money in contracts that nobody will maintain.
ACryptoS Says Withdrawals Stay Open While Deposits Close
The team told users it no longer has enough resources to maintain the protocol, according to Wu Blockchain. The project did not name the five affected chains, and it said the stolen funds have since moved through several cross-chain protocols, which it also did not name. It offered the attacker a 10% bounty in exchange for returning the rest.
The protocol had already shrunk far from its peak. DefiLlama shows ACryptoS held $482.28 million in total value locked on May 18, 2021, against $10.53 million as of Nov. 6, across 17 listed chains. About $9.42 million of that, roughly 90%, sat on BNB Chain. Measured against that Nov. 6 snapshot, the claimed $665,000 loss equals about 6% of locked value. That ratio is a TechTimes calculation, not a figure from the team, and DefiLlama’s snapshot predates the announcement.
How Can Missing Input Validation Let One Small Deposit Capture Most Vault Shares?
A yield vault issues shares that represent a claim on its pooled assets. In common ERC-4626 vault implementations, the share count a depositor receives equals the deposit multiplied by total shares outstanding, divided by total assets held. If code does not check the values feeding that math, a tiny deposit could be credited with an outsized share of the vault, and the shares could then be redeemed for most of the assets. ACryptoS describes that kind of outcome: a very small deposit of one token able to mint most of a vault’s shares.
Because the attack reportedly hit 77 vaults, one technique appears to have been repeated across the platform. The reports do not say whether ACryptoS vaults follow ERC-4626, so the exact mechanism is not established.
The better-known “inflation attack” is a related but distinct trick, in which an attacker manipulates the share-to-asset ratio, often through a direct donation of assets to the vault. OpenZeppelin’s standard defense adds a virtual offset to the share math so such attacks become unprofitable. The reports describe a missing input check rather than that donation pattern, and without a technical write-up the two cannot be told apart.
Deployed Contracts Keep Running After Team Stops Maintaining Them
A shutdown announcement does not turn the contracts off. Smart contracts run as written once deployed and generally cannot be changed by the team that published them. Anyone who leaves funds in an abandoned vault holds a claim on code with no one watching it, and the same missing input check could be reused by a second attacker if it exists in any vault the first attacker did not reach.
ACryptoS’s own documentation adds a wrinkle. The project’s docs page, as of Nov. 8, still says the platform has seen “no code exploits ever”. That statement contradicts the shutdown announcement, or it simply has not been updated since the incident.
Three Earlier Shutdowns Show Teams Walking Away From Live Contracts
ACryptoS is not the first vault operator to close under financial strain. Term Finance permanently shut its Meta Vaults after an estimated $8.5 million governance exploit in August, while keeping withdrawals available. Summer.fi announced its wind-down on July 15 after a July 6 share-price manipulation exploit and said its interface would stay available only until Aug. 31. Bunni shut down in October 2025 for lack of funds, according to The Block.
Regulators have taken notice of vault operators more broadly. Then-SEC Commissioner Hester Peirce issued a warning to DeFi vault operators on July 22 in a statement under her own name.
Withdraw First, Then Revoke Token Approvals After Exiting ACryptoS Vaults
Depositors who want out should withdraw while the team keeps the option open, using ACryptoS’s official interface and checking that the address is the project’s own. A withdrawal does not cancel the permission you gave a vault contract to move your tokens. Token approvals persist on-chain until the wallet owner revokes them, so check your wallet’s approvals afterward and revoke any still pointing at ACryptoS contracts.
Cross-Chain Fund Movement Complicates Recovery, and Recovery-Service Pitches Are Common Scams
Once stolen funds hop across bridges and protocols, tracing them becomes harder, according to 2022 Elliptic research, and the unnamed cross-chain routes ACryptoS cites could make recovery harder still. Victims of fraud and theft are routinely targeted by services claiming they can retrieve lost crypto for a fee, a pattern the FBI warns about. ChainCatcher’s report does not say whether the attacker accepted the 10% offer.
The takeaway for ACryptoS depositors is a three-part decision: withdraw while exits are open, revoke approvals afterward, and treat the claimed cause and $665,000 loss as the project’s own unverified account until a security firm or on-chain data confirms them.
Frequently Asked Questions
Can I still withdraw my funds from ACryptoS?
ACryptoS says withdrawals remain open and deposits are disabled, and it asks users to withdraw as soon as possible. Confirm the current status through the project’s official channels, since the status could change.
What happens to ACryptoS vault contracts if the team stops maintaining them?
They keep running. Deployed smart contracts generally cannot be altered by their authors, so unpatched vaults stay live and any remaining funds sit in code with no maintainer.
What is input validation in a DeFi vault?
It is the set of checks that confirm the numbers entering a contract, such as deposit amounts and share counts, are sensible before the contract acts on them. ACryptoS attributes the exploit to missing input validation that let a very small deposit earn most of a vault’s shares.
Will the stolen ACryptoS funds be recovered?
Recovery is uncertain. The team says the funds moved through several cross-chain protocols and has offered the attacker a 10% bounty for returning the rest. ChainCatcher’s report does not say whether the attacker accepted.