Sovryn reports Rootstock lending and AMM attacks; withdrawals remain paused
Sovryn confirms lending/margin outflows of 604,575.19 XUSD and 4.02792509 WRBTC, plus a separate AMM payout of 541,455.998472 XUSD. Blocked escrow and treasury-held assets are not recovered attacker funds. Do not interact with contracts, including alternate interfaces; withdrawals remain paused and final losses are unreconciled.
- Disclosed
- Nov 3, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Sovryn lending, borrowing, margin and XUSD/WRBTC AMM users on Rootstock; technical prerequisites remain unpublished
- crypto
- In the wild
- Yes
- Sovryn confirms attacker payouts and pauses; final user losses remain unreconciled.
What happened
Sovryn’s November 3 report confirms attacks on Rootstock lending/margin contracts on October 31 and a separate XUSD/WRBTC AMM incident on November 1. The disclosure date here is the readable project report, not the attack date. Technical entry conditions are withheld while protective work continues; no CVE, completed fix or shared attacker is established. Confirmed protocol payouts support L4. This is separate from the older BOB staking-contract incident.
The first incident’s net outflow is 604,575.19 XUSD plus 4.02792509 WRBTC, including a 0.00186 WRBTC financing fee and excluding 66,134.071550 XUSD blocked in seven delayed withdrawals. The project values that defined outflow at about $914,000 using XUSD=$0.995 and BTC=$77,500, not live prices. The second incident’s 541,455.998472 XUSD payout is a different accounting measure; their sum is not a finalized user-loss allocation.
The blocked escrow remains unpaid at the November 3, 13:54:11 UTC check. Transfers of 9.030667 RBTC and 14,085.357109 ZUSD into Exchequer custody preserved assets already controlled by the protocol; they are not recovered stolen funds or distributed compensation. A downstream 5.1 BTC payout at block 974167 (November 1, 19:33:54 UTC) and 0.136089812171370854 ETH are conversions of earlier proceeds, not additional losses; a later bridge-liquidity reimbursement is not a second attacker payment.
Lending, borrowing, margin and lending-pool withdrawals remain paused, and the interface is in maintenance. Independent security review, corrective work and loan/collateral/pool reconciliation precede reopening. The report publishes no recovery formula or reopening date; treasury custody does not settle final allocation.
Crime-scene timeline
Oct 31, 08:34 UTC
First identified lending/margin attack transaction
The report records additional transactions at 15:50–15:53 UTC; final user losses remain unreconciled.
Oct 31, 19:52 UTC
Team learns of the first incident
Core paused at 20:10 UTC, lending pools at 20:17–20:19; at 21:39 UTC two accounts were blocked, preserving seven delayed withdrawals.
Nov 1, 18:42 UTC
Separate XUSD/WRBTC AMM incident
The observed payout is separate from the first incident; the report does not establish a common operator.
Nov 1, 20:42:39 UTC
Emergency fee changes completed
At 22:06–22:07 UTC, already controlled RBTC/ZUSD moved to Exchequer custody, not recovery from the attacker.
Nov 2, 14:32 UTC
Affected AMM pool delisted
Nov 3, 2026
Project publishes its incident and recovery report
Protective work and independent review continue; no distribution formula or reopening date is announced.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Sovryn November 3 original incident reportPrimaryFull project report: distinct outflow/payout measures, blocked escrow, protocol custody, pauses, tracing addresses and no final loss allocation or reopening date. Publication time lacks timezone; date only.