Staking Protocol Bedrock Suffers Security Breach Due to uniBTC Bug

Staking Protocol Bedrock Suffers Security Breach Due to uniBTC Bug

Bedrock, a prominent liquid staking protocol, recently confirmed that their platform was compromised by a bug involving uniBTC, a synthetic Bitcoin token. This vulnerability allowed users to exchange uniBTC for ETH tokens, leading to unintended token swaps.

In an official announcement on X (formerly Twitter) dated September 27, Bedrock acknowledged the security breach and assured users that their team had the issue under control. They also emphasized that the remaining funds on the platform were secure and outlined plans to implement a reimbursement strategy. The estimated total loss from the breach stands at approximately $2 million in digital assets.

One user of the platform revealed that the bug enabled them to swap Bitcoin for Ethereum, explaining that the exploit likely stemmed from residual code related to the implementation of uniETH, another token on the platform.

At the time of writing, Bitcoin is valued at $65,449 per token, while Ethereum’s price sits at $2,659, according to data from crypto.news.

Bedrock clarified that the majority of the losses occurred in decentralized exchange liquidity pools, but reassured users that the underlying wrapped Bitcoin tokens and standard Bitcoin reserves remain untouched and secure. The platform also confirmed that no immediate action is required from users, and all uniBTC holdings are safe. A full post-mortem report will be released soon, detailing the breach and next steps.

The Bedrock team has identified the root cause of the exploit and is actively working with audit teams to recover the lost funds.

Launched in February 2023 by Singapore-based blockchain firm RockX, Bedrock aims to make liquid staking appealing to institutional investors by focusing on compliance with know-your-customer (KYC) and anti-money laundering (AML) regulations.

Currently, Bedrock ranks as the eighth-largest liquid staking protocol with a total value locked (TVL) exceeding $240 million, according to DeFiLlama.