On June 6, 2025, ALEX Protocol suffered an $8.37M exploit. Attacker deployed a malicious token with custom transfer logic, used it to spoof as-contract origin and masquerade as the vault, draining 8.4M STX, 21.85 sBTC, and stablecoins due to failed access control verification.