Bedrock Protocol Loses $2M in Security Exploit Involving uniBTC

Bedrock, a prominent multi-asset liquid staking protocol, has confirmed the loss of approximately $2 million due to a “security exploit.” The breach, which targeted its synthetic Bitcoin token, uniBTC, was disclosed by the company in a post on X (formerly Twitter) on September 27.

⚠️Important Announcement from the Bedrock Team

We want to inform you that the Bedrock team is aware of a security exploit involving uniBTC. The issue has been handled and funds are SAFU.

We want to reassure everyone that the underlying wrapped BTCs and BTCs in reserves are…

— Bedrock | Bitcoin Restaking LIVE (@Bedrock_DeFi) September 27, 2024

Details Unfolding Show Only Decentralized Exchange Liquidity Pools Were Affected 

The exploit specifically impacted uniBTC, a token used across various decentralized finance (DeFi) platforms. Bedrock assured users that the situation had been managed and that immediate steps had been taken to resolve the root cause of the vulnerability. The protocol emphasized that all remaining assets on the platform are secure.

In its statement, Bedrock announced plans for a comprehensive reimbursement strategy aimed at compensating affected users. “A comprehensive reimbursement plan is being finalized and will be shared shortly together with a post-mortem report,” the team revealed.

According to Bedrock, the bulk of the losses occurred within decentralized exchange liquidity pools, though the protocol clarified that neither the wrapped Bitcoin (BTC) tokens nor the standard Bitcoin reserves were compromised. Both remain secure and unaffected by the attack.

Bedrock, launched in February 2023 under the Singapore-based blockchain firm RockX, is known for its liquid staking products, including uniBTC, uniETH, and uniIOTX. 

Bedrock's BTC Liquid Staking protocol built on @babylonlabs_io is LIVE! Restake your #Bitcoin and earn yield & diamonds.

🟠 Now 69% filled, this cap ensures all uniBTC users earn their deserved rewards. Stake before it's too late!https://t.co/7EbhKIfO7K pic.twitter.com/dplNUzJBnh

— Bedrock | Bitcoin Restaking LIVE (@Bedrock_DeFi) August 8, 2024

These synthetic assets allow users to earn yields through staking major blockchain tokens. The protocol, which is designed to attract institutional investors, places a strong emphasis on Know Your Customer (KYC) and Anti-Money Laundering (AML) compliance.

🚀 Bedrock is thrilled to be part of @eigenlayer's cryptoeconomic primitive concept of restaking, and we're delighted to announce that uniETH is now officially a Liquid Restaking Token! Here’s what we’re excited about:

1️⃣ Simple UX: Stakers seamlessly continue minting uniETH on… pic.twitter.com/A3HGvI3Q11

— Bedrock | Bitcoin Restaking LIVE (@Bedrock_DeFi) January 30, 2024

Liquid Restaking Sector Still Blossoming Despite 

Despite the security incident, Bedrock stands tall as the eighth-largest liquid staking protocol, with just over $240 million in total value locked (TVL) on its platform, according to data from DefiLlama.

Bedrock boasts over $240 million in TVL. Source: DeFiLlama

The liquid restaking sector has experienced significant growth in recent months. Since the launch of EigenLayer’s Ethereum restaking protocol in April 2024, the market has expanded rapidly. Data from DefiLlama shows that liquid restaking protocols now account for over $11.4 billion in total value locked, while EigenLayer itself boasts more than $12.1 billion in TVL on its mainnet, cruising an 11% uprise from $11.6 billion one week prior — per IntoTheBlock (ITB) data — a show of growth in the restaking sector.

Still, according to ITB data, Symbiotic and Karak, two recent newbies to the restaking market platform built on Ethereum, also seized $1.07 billion and $826 million in TVL sometime in August, respectively, with Symbiotic’s Wrapped Staked ETH (WSTETH), making up 63% of its assets while around 27% of holdings on the Karak platform consisted of WETH.