Today at 07:21 UTC an unauthorized withdrawal occurred from the RWA strategy associated with the XLP vault. The issue has been patched and XLP depositors have been made whole, with the full amount covered by a portion of the fees generated in July on RISEx.
XLP depositors’ funds are not affected by this event. RISEx is entirely independent and is operating as normal. More below:
The withdrawal of 673,011.56 USDC was caused by a misconfiguration in the RWA strategy, present since its deployment on July 13. We detected the issue within minutes of the withdrawal, patched it by 08:09 UTC, and covered the full amount. This was not a novel attack or a dependency failure.
Transaction in question:
explorer.risechain.com/tx/0x…
We have reviewed every transaction and deployment and this is the only unauthorized withdrawal in that period. We have also reviewed the configuration of every other strategy in the vault and found no equivalent issue. A postmortem will be published.
The RISE bridge, RISEx and the XLP vault each have withdrawal throttles to reduce the impact in an exploit event. However, in this circumstance the amount was below the throttling thresholds.
We are engaging SEAL 911 and tracing is underway. We are attempting to make contact with the address involved regarding a return of funds.
@risextrade is the only official source of information. We will never DM you first. There is no recovery form and no claim process. Do not connect your wallet to any link about this incident.