Trading, deposits, and withdrawals have now resumed on Kuru.
All affected user funds have been made whole. No action is required from users.
There was an exploit on the XAUT0/USDC market involving a rounding error that could be triggered by a maliciously configured market.
We have fixed the underlying vulnerability. The patch has been reviewed by our original auditors, and we completed thorough checks to verify the protocol state before resuming operations.
As an additional safeguard, we have removed permissionless market deployment and restricted active trading to 11 whitelisted markets. All open orders in these markets have been cancelled.
The full list of active markets is provided in the tweet below. All other markets remain in cancel-only mode.
We’ll publish a full incident report shortly covering what happened, the impact, the fix, and the additional safeguards we’ve put in place.
We recognize the disruption this caused and appreciate the community’s patience while we worked through the issue.