Thala, a DeFi project in the Aptos ecosystem, suffered a security vulnerability attack on its latest V1 liquidity pool contract, resulting in the theft of assets worth $25 million. Thala has currently suspended all related contracts and frozen Thala token assets ($9 million MOD and $2.5 million THL). With the assistance of other institutions, it has reached an agreement with the attacker to restore all user assets through a $300,000 bounty.
It is important to note that no further action is required by affected users and positions will be 100% restored. However, all related contracts and the Thala frontend will remain suspended until deemed fully secure. Existing positions in the CDP and LST modules are not affected. Currently, the protocol's codebase is undergoing an extensive review and re-audit of all affected and related packages. We will share more details soon.