3 November 2026
On 31 October, two attack sequences affected Sovryn’s lending and margin contracts on Rootstock. On 1 November, a further incident affected the XUSD/WRBTC AMM pool. This report sets out the confirmed asset movements, containment actions and recovery work. Technical details are being withheld while protective measures and repairs are completed.
Current status and user guidance
Lending, borrowing and margin trading remain paused, including withdrawals from the lending pools. The Sovryn interface is in maintenance. Further emergency restrictions are being prepared through governance.
We recommend that users do not use Sovryn or interact with its contracts until further notice, including through alternative interfaces. We recognize that these restrictions limit users’ ability to manage positions while market prices and time continue to move. We will publish further instructions through Sovryn Discord’s #announcements channel.
The named on-chain containment states in this report were checked at 13:54:11 UTC on 3 November 2026. Seven withdrawals associated with the first incident remain blocked, holding 66,134.071550 XUSD in escrow. Those funds have not been paid to the attackers or distributed as recovery funds.
Confirmed financial picture
31 October – lending and margin
The three identified transactions produced a reconciled net outflow of 604,575.19 XUSD and 4.02792509 WRBTC. The XUSD amount is net of the attacker’s starting capital. The WRBTC figure includes a 0.00186 WRBTC financing fee. These figures exclude the 66,134.07 XUSD held in the Perimeter withdrawal queue and exclude the 1 November incident.
At the report’s valuation assumptions of XUSD = $0.995 and BTC = $77,500, the first incident’s defined net outflow is approximately $914,000. These are valuation assumptions, not current market quotations.
Loan, collateral and pool accounting are being reconciled before any final allocation of losses.
1 November – XUSD/WRBTC AMM
The identified AMM transaction included a payment of 541,455.998472 XUSD to an attacker-controlled wallet. Other assets associated with the incident remained under protocol control. The resulting changes to pool backing, retained assets and eventual LP losses require separate reconciliation.
The first incident’s reconciled outflow and the second incident’s observed payout describe different accounting measures. We are not presenting their sum as a finalized allocation of losses to users.
Funds subsequently converted into RBTC, BTC, ETH or other assets are movements of the same proceeds, not additional losses.
Containment and preservation of funds
The Contracts Guardians Safe paused the core protocol at 20:10 UTC on 31 October and the lending pools at 20:17–20:19 UTC. At 21:39 UTC, the Exchequer multisig blocked the two accounts associated with the seven delayed withdrawals.
The 24-hour withdrawal delay held 66,134.07 XUSD long enough for those account restrictions to be applied. The seven requests remain in escrow and blocked. They are excluded from the first incident’s extracted total.
Following the AMM incident, emergency fee-control changes were completed by 20:42:39 UTC on 1 November. The affected XUSD/WRBTC pool was delisted on 2 November. Additional temporary restrictions are being prepared through governance.
For preservation, 9.030667 RBTC was transferred from the Fee Sharing Collector’s withheld ledger to the Exchequer multisig at 22:06:36 UTC on 1 November, followed by 14,085.357109 ZUSD at 22:07:34 UTC. These transfers moved assets already under protocol control into temporary treasury custody. They were not funds recovered from attacker control and do not determine their final allocation.
The amounts held in custody include assets with different origins. They must be reconciled separately from attacker receipts, ordinary revenue and any future distribution to affected users.
Funds tracing
The investigation covers the identified Rootstock transactions and subsequent transfers to other chains. For the second incident, a 5.1 BTC payout is confirmed in Bitcoin block 974167, whose timestamp is 19:33:54 UTC on 1 November. A separate payout of 0.136089812171370854 ETH is also confirmed.
The later Rootstock settlement associated with the Bitcoin transfer reimbursed the bridge’s liquidity provider. It was not a second payment to the attacker. These downstream payouts are conversions of the earlier proceeds and must not be added to the original XUSD payout as separate losses.
We have not established whether the 31 October and 1 November incidents were carried out by the same operator.
Recovery and next steps
Work is focused on completing corrective changes, independent security review and reconciliation of affected loans, collateral, lending pools and AMM balances. Normal service will be restored only after the required security and accounting checks are completed.
Assets blocked in escrow and assets held in Exchequer custody are being accounted for separately. The recovery plan will be communicated after that work is validated. This report does not announce a distribution formula or reopening date.
Further technical details will be released after protective measures are in place. Until then, updates will focus on confirmed facts, user guidance and recovery progress.
Incident timeline
All times below are UTC.
| Date and time | Confirmed event |
|---|---|
| 31 October, 08:34 | First identified attack transaction. |
| 31 October, 15:50–15:53 | Further identified transactions in the lending and margin incident. |
| 31 October, 19:52 | The team learned of the first incident. |
| 31 October, 20:10 | Core protocol paused. |
| 31 October, 20:17–20:19 | Lending pools paused. |
| 31 October, 21:39 | Accounts associated with seven delayed withdrawals blocked. |
| 1 November, 18:42 | Identified AMM incident. |
| 1 November, 20:42:39 | Emergency fee-control changes completed. |
| 1 November, 22:06–22:07 | Withheld RBTC and ZUSD transferred to Exchequer custody. |
| 2 November, 14:32 | Affected XUSD/WRBTC pool delisted. |
Addresses identified for funds tracing
These addresses identify wallets associated with the observed transactions. Their inclusion does not establish that one operator controls every address or both incidents.
| Network | Address |
|---|---|
| Rootstock – first incident | 0x740a2ecba7c291473d88ed8ae7a310c3c32d8d4a |
| Rootstock – first incident | 0x643234de31619ded5496ba30d0b6b97791e959fd |
| Rootstock and Ethereum – second incident | 0x101d1dc6e2164d6091ace64701e301f4535665ba |
| Bitcoin – second incident payout | bc1qtzt5vy5qssteyn2ky7u472754a8jgtx9cxzs9m |
Official communications
Beware of scams. No one from Sovryn will message you first, ask for your seed phrase, or ask you to approve a “refund” or “migration” contract.
Official updates appear on Sovryn Discord’s #announcements channel. Questions should be posted in Sovryn Discord’s #general channel. We will not reply to questions in direct messages.