Crypto platform loses $6 billion in single-day attack

A cryptocurrency exchange known as Vaultex lost 6 billion dollars in a single coordinated attack, leaving investors unable to access their digital assets for more than 48 hours. The breach, which occurred on the evening of October 28, represents one of the largest single-day losses in the history of decentralized finance. The incident has intensified scrutiny over how platforms secure user funds while promising high yields.

The attack began when unknown actors exploited a vulnerability in the platform's smart contract code. According to a technical report released by the company, the exploit allowed the attackers to mint and withdraw tokens that did not correspond to actual user deposits. Within three hours, the attackers moved the stolen assets to over 200 different wallet addresses, complicating the process of tracing the funds. The platform's internal risk management system detected the anomaly at 2:14 a.m., but the damage was already extensive.

The platform first went live in 2023, initially raising 400 million dollars in a private funding round led by three major venture capital firms. By early 2025, it had grown to manage over 12 billion dollars in total value locked by its users. The company marketed itself as a low-risk alternative to traditional banking, emphasizing its automated interest generation. Investors included both individual retail customers and several institutional hedge funds that had allocated between 50 million and 200 million dollars each to the platform.

Following the breach, the CEO, Elena Ross, issued a public notice on the company's website at 5:00 a.m. on October 29. She confirmed the loss of 6 billion dollars and stated that all withdrawal requests were paused to prevent further outflows. Ross said the engineering team was working on a patch to fix the smart contract bug while a third-party auditing firm reviewed the incident. She added that the company had not lost the underlying collateral assets, which were held in separate cold storage wallets.

The Securities and Exchange Commission opened a formal inquiry on October 30 to determine whether the platform met the regulatory requirements for a public utility. The SEC's statement indicated that the agency was reviewing the company's disclosure of risks to investors and its internal controls over digital assets. Regulators are also examining whether the platform should have required insurance for its smart contracts, a common practice in the banking sector but not yet standardized in crypto.

On October 29, the platform's board of directors met in an emergency session to decide on a compensation plan for affected users. The board approved a proposal to issue recovery tokens that would represent a claim on the company's remaining assets. These tokens are expected to be distributed to all affected accounts by November 15. The company also announced it would hire a forensic accounting firm to trace the stolen funds across the blockchain.

Investors have reacted with mixed emotions. Some retail users have filed complaints with consumer protection agencies, arguing that the platform did not clearly explain the risks of smart contract failures. Institutional investors have demanded a detailed audit report by the end of November. The company's stock token, which trades on a secondary market, dropped by 45 percent in the 24 hours following the announcement of the loss.

The next major development is scheduled for November 5, when the platform plans to release its full technical post-mortem. This document will detail the specific lines of code that were exploited and the steps taken to prevent a similar breach in the future. The company will also hold a virtual town hall with its top engineers to answer questions from the community. Until then, withdrawals remain paused, and the 6 billion dollar gap in the balance sheet remains unresolved.