- On Sunday, Polkadot’s DeFi Hub Acala Network suffered an exploit that saw its original over-secured stablecoin aUSD plummet to zero.
- The exploit was due to a “misconfiguration issue” in the recently launched iBTC/aUSD liquidity pool that allowed users to create unlimited aUSD out of thin air.
- After the incident, Acala immediately halted cross-chain exchanges and transfers, leaving exploiters stuck with around 99% of the falsely minted USD on the parachain.
Share this article
Acala quickly put the network into maintenance mode, pausing chain swaps, Polkadot cross-chain communication, and oracle price feeds to prevent the stolen funds from leaving the parachain.
Acala USD Depegs
Acala Network’s original stablecoin, Acala USD (aUSD), has collapsed to zero.
We have identified the issue as a misconfiguration of the iBTC/aUSD liquidity pool (which was published earlier today) which resulted in a significant amount of USD being reported incorrectly
— Acala (@AcalaNetwork) 14 August 2022
On Sunday, Polkadot’s decentralized finance hub, Acala network, suffered a severe exploit that saw its native stablecoin aUSD collapse from its targeted $1 peg to effectively zero. “We have identified the issue as a misconfiguration of the iBTC/aUSD liquidity pool (which went live earlier today) which resulted in a significant amount of USD being mis-messaged,” Acala said yesterday on Twitter.
In accordance on the chain data, a hacker mistakenly minted around 1.28 billion USD tokens and then exchanged a small fraction for Acala’s original token ACA and four other tokens. Shortly after the incident, Acala put para-chain in maintenance mode and temporary swaps, cross-chain transactions and oracle price feeds, leaving the hacker stranded with around 1.27 billion worthless USD tokens on the network.
The on-chain data also revealed that several other users impersonated the original hacker and exploited the flaw for themselves, staking between US$80 million and US$25,000 each, stealing thousands of dollars from the liquidity pool. The total sum of the stolen funds is estimated to be less than $10 million, not including the value lost in the USD depeg.
The Acala Network is an Ethereum-compatible Polkadot parachain – a modular and customizable independent chain built on top of the Polkadot Relay Chain – that has self-branded as a specialized decentralized finance hub for the Web3. The ecosystem is centered around the MakerDAO-inspired, over-secured stablecoin Acala USD.
In March, Acala teamed up with Polkadot parachains to launch one 250 million dollars ecosystem fund to support builders driving USD demand. However, yesterday’s incident, which caused the stablecoin to collapse to practically zero, has raised serious concerns about the parachain’s path forward in the community.
Nearly 24 hours after the incident, most Acala network functions are frozen, with few updates from the project on next steps. Following the news, the network’s native token, ACA, fell by around 7%, from around $0.29 to $0.26.
Disclosure: At the time of writing, the author of this piece owned ETH and several other cryptocurrencies.