8 November 2026 UTC
This report describes the identified attacks, their failure mechanisms, observed asset movements and limits of the financial evidence. It covers the BOB DEX exploit and associated governance attempt, the two Rootstock lending/AMM waves, and the Babelfish reward extraction.
Financial figures refer to the identified transactions and retained accounting checkpoints. They are not a new audit of every current balance or a final allocation of user losses. A shared failure pattern or use of the same infrastructure does not by itself establish common control across incidents.
Containment, service restrictions, recovery decisions, repairs and the conditions for any change to these restrictions are set out separately in the mitigation and recovery manifest.
1. Sovryn DEX on BOB and the subsequent governance attack
What happened
The first identified successful DEX extraction occurred on 18 September 2026 at 02:48:39 UTC. An attacker exploited a rounding discrepancy in concentrated-liquidity accounting to obtain payouts exceeding the corresponding contribution. The exchange held assets for different pools in shared custody, so those excess payouts depleted assets backing legitimate liquidity providers. Visible position records did not mean the underlying assets were still present.
The associated attacker moved SOV to Rootstock and attempted to capture governance. The malicious proposal was defeated before execution. No theft through that unexecuted proposal is counted as a realized loss. The associated sequence is documented in the September governance incident report.
Financial impact and measurement limits
The shared DEX contract held approximately 1,731,080.01 SOV at the pre-drain snapshot. Reconciliation to the later measurement checkpoint shows a net custody decrease of approximately 1,730,800.02 SOV, leaving approximately 279.99 SOV. This is a custody reconciliation across checkpoints, rather than a final sum of individual eligible losses or a transaction-by-transaction attacker-profit measure.
Other assets were also affected. The retained historical balance comparisons estimate the following decreases, using mixed checkpoints:
| Historical asset label | Approximate decrease in token units |
|---|---|
| oUSDT | 65,851.84 |
| USDC | 36,729.66 |
| USDT | 9,415.13 |
| satUSD | 7,845.71 |
| DAI | 869.21 |
| tBTC | 1.7565 |
| wstETH | 0.5425 |
| rETH | 0.2755 |
| xSolvBTC | 0.01502 |
These estimates describe the incident’s scale. They are not a finalized wallet-level loss ledger or a current dollar valuation.
2. Rootstock attack wave one: lending and margin custody
What happened
Three identified transactions on 31 October, at 08:34:25 UTC, 15:50:12 UTC and 15:53:45 UTC, exploited a failure to verify actual token receipt. A malicious conversion route reported swap output that the lending system accepted as collateral even though the corresponding tokens had not arrived. Real assets subsequently left pooled lending custody against those unsupported records. First transaction, second transaction, third transaction.
The resulting bad loan and unsupported collateral are accounting consequences of the same events. Adding those book values to the cash already removed would count the damage twice.
Financial impact and custody boundaries
| Measure | Amount and interpretation |
|---|---|
| Net outflow from the defined lending custody sources | 670,775.465718 XUSD and 4.02792509 WRBTC. The outflow included amounts intercepted in the protocol queue and retained separately as fees. |
| Net attributable XUSD attacker proceeds | 604,575.193896 XUSD, after the attacker’s own contribution and excluding the retained queue cash and exit fees. |
| XUSD intercepted in the Perimeter queue | 66,134.071550 XUSD across seven requests. These funds were not delivered to the attacker and are already excluded from the attacker-proceeds figure above. |
| Retained exit fees | 66.200272 XUSD, held separately and subject to the same provenance and rights reconciliation. |
| WRBTC partition | 4.02606509 WRBTC reached the attacker account; 0.00186 WRBTC was a financing fee. Together they explain the stated WRBTC custody outflow. |
The queued cash and retained fees are components of the measured custody outflow, already excluded from the stated net attacker proceeds. Unsupported loan and collateral records overlap with the cash loss; they are not additional amounts to add to it.
3. Rootstock attack wave two: XUSD/WRBTC AMM reserves
On 1 November at 18:42:46 UTC, a separate identified transaction exploited a related actual-receipt verification failure in AMM fee processing. The fee path accepted an output number without matching delivery. Real WRBTC moved from the genuine pool to the genuine protocol collector, and the resulting reserve distortion enabled a large XUSD withdrawal from the pool. We have not established that this attack and the lending attack were controlled by the same operator. Primary AMM transaction.
The primary transaction produced a net pool-custody decrease of approximately 542,184.024710 XUSD and 6.64633368 WRBTC. This includes protocol-held fee and collector movements. The previously reported 541,455.998472 XUSD payment is one payment within that transaction, not a second loss to add to the custody decrease.
The retained accounting identifies approximately 6.63899210 RBTC as AMM principal in protocol custody. It is part of the incident’s asset-location reconciliation, not an additional amount stolen.
A separate 1.53955613 RBTC was generated as a genuine Zero redemption fee during the subsequent conversion of proceeds. It has a different origin from the AMM principal. Ordinary fees and previously withheld assets have other origins and are outside the captured AMM principal measure.
Converting extracted XUSD through DLLR, ZUSD, RBTC or bridges is the realization of the same proceeds. It is not another amount to add to the theft. The later transactions also do not, by themselves, establish a separate exploit of Mynt or Zero.
4. Babelfish reward-inventory extraction
Between 04:14:50 UTC and 04:59:36 UTC on 4 November, fifteen identified reward-paying transactions extracted 69,381.254896 XUSD from Babelfish’s existing reward inventory. First identified reward extraction.
The reward calculation could pay for an apparent improvement in the asset mix even when the same sequence had first created that imbalance. A sequence could return principal and the reserve mix to their starting state while retaining a reward. Historical parameter checks support a standing economic flaw; they do not establish recent malicious parameter changes.
In the examined transactions, the DOC and DLLR principal used in the sequence returned. The identified loss is the reward inventory paid out. That finding alone does not establish an equal shortfall in remaining XUSD holders’ backing, and it is not a certification of current liquidity or backing elsewhere.
The identified amount is an inventory debit from the examined transaction set. It is not a finalized residual loss, a complete census of all possible activity or a current valuation of XUSD backing.
Accounting and attribution limits
These incidents involve different assets and different custody boundaries. Custody decreases, attacker receipts, assets remaining under protocol control, unsupported receivables and successive conversions of proceeds describe different measures. They must not be added into a single loss figure without reconciliation.
No grand-total dollar loss is presented. Token amounts do not establish current market prices, and nominal stablecoin units do not establish collateral solvency or redemption liquidity. No final individual loss percentage or claim amount follows from this disclosure.
The evidence does not establish one operator behind the lending and AMM waves or behind all the incidents in this report. Later bridge transfers or conversions describe movements of the same proceeds rather than additional theft.