Liquid Restaking Protocol Bedrock Hit by $2M Exploit

Bedrock, a multi-asset liquid staking protocol, has confirmed it was targeted in a security exploit involving uniBTC, resulting in the theft of approximately $2 million.

In a September 27 post on X (formerly Twitter), Bedrock acknowledged the security breach involving uniBTC, a synthetic Bitcoin token used in DeFi, which led to the loss of around $2 million in assets. The protocol assured users that the issue had been addressed, steps were being taken to identify the root cause, and all remaining funds were secure. It also announced plans to implement a reimbursement strategy soon for those affected.

Bedrock added that “a comprehensive reimbursement plan is being finalised and will be shared shortly, along with a post-mortem report.”

The protocol clarified that most of the losses occurred in decentralised exchange liquidity pools, while the underlying wrapped BTC tokens and standard Bitcoin (BTC) held in reserves remained secure.

Bedrock offers products like uniBTC, uniETH, and uniIOTX—synthetic versions of major blockchain tokens. These synthetic assets enable users to earn yield through staking while maintaining liquidity across different blockchain networks. Launched in February 2023 by Singapore-based blockchain firm RockX, Bedrock is tailored to attract institutional investors with significant capital by offering liquid staking while adhering to strict KYC and AML compliance measures.

According to DefiLlama data, Bedrock ranks as the eighth-largest liquid staking protocol, with over $240 million in total value locked (TVL) on its platform.

Many organisations have faced exploits in recent months, and recently, the Ronin Network became the latest victim. Attackers successfully withdrew 4,000 ETH and 2 million USDC, worth about $12 million. The incident, reported on August 6, 2024, was first flagged by PeckShield Alert. Shortly after, the Ronin team confirmed the breach, stating that white-hat hackers had alerted them to a vulnerability in the Ronin bridge. The team paused the bridge 40 minutes after detecting suspicious activity, but the attackers still managed to withdraw the maximum allowed amount.

If you want to read more news articles like this, visit DeFi Planet and follow us on Twitter, LinkedIn, Facebook, Instagram, and CoinMarketCap Community.