ACryptoS' vaults had one bug since day one. On Sunday, 135 addresses found it.
The concentrated-liquidity vaults never checked that a deposit listed an amount for each token. Send one number instead of two, and the vault valued its own holdings in token0 only. On one Polygon vault, a 10 USDC deposit minted 66.84% of the shares and walked out with 48,634 USDT0.
About $665K left 77 of 126 vaults across Arbitrum, BSC, Polygon, Base and Optimism, and 100+ copycats joined in. The exploit hit the project's Telegram at 09:34 UTC. The developer heard at 14:19. Every chain was closed by 16:40, and ACryptoS is now being deprecated. Withdrawals stay open.
The first fix shipped in 80 minutes. The message took almost five hours.
Source: ACryptoS post-mortem