An attacker compromised operational keys used exclusively by Fluid’s Merkle rewards distribution infrastructure. The attacker used these permissions to submit and approve fraudulent reward allocations, allowing them to claim approximately 125,109 FLUID, 51,946 GHO, and a small amount of cbBTC. The incident was isolated to reward distribution contracts and did not compromise Fluid’s core protocol contracts, lending markets, or user deposits