Shalini Nagarajan

<div id="highlights-block_62fa20d3a6af7" class="highlights">
        <ul>
                <li>Hackers attacked Acala&#8217;s new liquidity pool to mint more than one billion aUSD tokens</li>
                <li>aUSD crashed almost immediately but has since rebounded, now trading above $0.90</li>
            </ul>
    
</div>



<p>Polkadot-powered stablecoin acala dollar (aUSD) crashed to below 10 cents on Sunday after hackers minted 1.3 billion of the tokens for free.</p>



<p>The stablecoin’s issuing network Acala voted to suspend functionality to address the situation. In a <a href="https://twitter.com/AcalaNetwork/status/1558642849649856512" target="_blank" rel="noreferrer noopener">tweet</a> on Sunday, Acala said it noticed a configuration issue on its stablecoin protocol Honzon, which directly affects how aUSD operates.</p>



<p>Acala, one of the first Polkadot <a href="https://wiki.polkadot.network/docs/learn-parachains" target="_blank" rel="noreferrer noopener">parachains</a>, styles itself as a “DeFi hub” for the network. It had just launched a yield-bearing liquidity pool for aUSD and a form of wrapped bitcoin, which contained a bug dictating how the pool pays out rewards.</p>



<p>On-chain observers <a href="https://twitter.com/alice_und_bob/status/1558959878475075584" target="_blank" rel="noreferrer noopener">found</a> hackers had exploited the flaw to mint 1.3 billion aUSD, with one <a href="https://acala.subscan.io/account/26JmEcghNmggvT46sojckg34Py9zFRKkCcFy3gr49hrFgT2k?tab=extrinsic" target="_blank" rel="noreferrer noopener">attacker wallet</a> holding about 1.27 billion aUSD.&nbsp;</p>



<p>The incident resulted in aUSD, which had held its soft peg since its February launch, <a href="https://www.kucoin.com/trade/AUSD-USDT" target="_blank" rel="noreferrer noopener">crashing</a> as low as $0.07 on KuCoin, echoing <a href="https://cms.blockworks.co/tag/terrausd/" target="_blank" rel="noreferrer noopener">TerraUSD’s</a> collapse in May.&nbsp;</p>



<p>However, aUSD quickly rebounded and now trades for more than $0.90. Blockchain explorers show aUSD’s official <a href="https://blockscout.karura.network/token/0x0000000000000000000100000000000000000081" target="_blank" rel="noreferrer noopener">supply</a> is almost 4.8 million tokens.</p>



<p>While Acala&#8217;s Honzon protocol manages the stablecoin based on various risk management algorithms, aUSD&#8217;s value is also derived from a basket of reserve assets, mostly Polkadot ecosystem tokens. Users can mint aUSD by sending certain digital assets to the protocol.</p>



<p>“This enables people to transact, trade, and facilitate services using aUSD without price volatility,” it said in aUSD’s announcement post.</p>



<h3 class="wp-block-heading">Polkadot networks handle hackers with governance votes</h3>



<p>Acala has labeled the snafu a “misconfiguration,” saying it had been <a href="https://twitter.com/AcalaNetwork/status/1558785363224604672" target="_blank" rel="noreferrer noopener">rectified</a> the same day and wallet addresses that received the erroneously-minted aUSD had been identified.</p>



<p>The network itself hasn’t disclosed the amount of tokens printed throughout the incident, but said it managed to retain over 99% of the tokens involved. </p>



<p>The remaining illicit aUSD has been locked until a collective governance decision on what to do next has been voted upon, Acala added.</p>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><p lang="en" dir="ltr">Next up, we will continue on-chain activity trace, and share the results with the community to facilitate formulation of community proposal &amp; decision making to resolve the error mint of aUSD &amp; restore aUSD peg. Thanks for your patience &amp; support, will update as we progress<br>8/</p>&mdash; Acala (@AcalaNetwork) <a href="https://twitter.com/AcalaNetwork/status/1558785378101760000?ref_src=twsrc%5Etfw">August 14, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<p>Last October, experimental Polkadot implementation Kusama similarly <a href="https://medium.com/kusama-network/kusamas-governance-thwarts-would-be-attacker-9023180f6fb" target="_blank" rel="noreferrer noopener">voted</a> to manage a security vulnerability involving stolen tokens.</p>



<p>Both Acala Network and co-founder Bette Chen didn’t return Blockworks&#8217; request for comment by press time.</p>



<p>Acala’s ACA has shed about 13% since the attack. Binance CEO Changpeng Zhao said in a <a href="https://twitter.com/cz_binance/status/1558731164558442498" target="_blank" rel="noreferrer noopener">tweet</a> that the exchange was “monitoring” the situation. Binance doesn’t list aUSD but does support ACA trade.</p>



<p><em>David Canellis contributed reporting.</em></p>



<hr class="wp-block-separator has-alpha-channel-opacity"/>



<p><strong>Don’t miss the next big story – join our <a href="https://blockworks.co/newsletter?source=end" target="_blank" rel="noreferrer noopener">free daily newsletter</a>.</strong></p>
