On May 19, 2026, HermesVault, an Algorand privacy protocol, was exploited when an attacker bypassed ZK proof verification via a flaw in the withdrawal verification script's key reset defense logic, stealing 261,000 ALGO (~$29.5K).

HermesVault, an Algorand-based privacy protocol using zero-knowledge proofs for private transactions, was exploited. The attacker exploited a flaw in the key reset defense logic within the withdrawal verification script. This allowed bypassing the zero-knowledge (zk) verification process and unauthorized withdrawal of funds. The protocol permanently shut down operations following the incident. Lead engineer Giulio Pizzini confirmed that the core zk circuit remained secure, but the auxiliary withdrawal script had a vulnerability. The team patched the issue, refunded a large portion of the funds, and initiated a full refund process for affected users.