Fluid

Tornado Cash

Rewards

A <a href="https://x.com/0xfluid/status/2061124908277538827" rel="noopener noreferrer nofollow">compromise affecting Fluid’s off-chain Merkle rewards distribution infrastructure</a> has exposed a narrow but serious control failure inside one of DeFi’s more closely watched lending and DEX systems.
The loss was roughly $215,000 on Ethereum, according to early forensic tracking. The incident did not hit Fluid’s lending markets, vaults, DEX, liquidity layer or user deposits. Fluid’s core protocol contracts remained unaffected, while the compromised path was tied to rewards distribution rather than the main borrowing, lending or trading system.
That distinction matters for user funds, but it does not make the incident harmless. The exploit shows how a non-core rewards mechanism can still become a direct loss event when privileged operational keys are not properly separated.
<h2 id="how-the-fluid-rewards-drain-happened">How The Fluid Rewards Drain Happened</h2>
The attack was not a typical smart contract bug. Independent <a href="https://x.com/wagmiAlexander/status/2061107910298456447" rel="noopener noreferrer nofollow">forensic tracking of the Fluid rewards drain</a> points to a control-path failure inside a Merkle rewards process.
Fluid’s rewards setup relied on one key to propose a reward list and a second key to approve it. That type of two-step flow is meant to reduce the chance that one compromised signer can push a malicious distribution alone. In this case, the attacker appears to have controlled both roles.
The attacker pushed a reward list that effectively paid only their own wallet, approved the list through the second role, then claimed the rewards using an empty-proof Merkle claim. Once both operational keys were under the same control, the two-person approval model no longer provided real protection.
The direct drain came from three reward distributors and included about 112,883 FLUID, 47,903 GHO and a small amount of cbBTC, according to early tracking. Wider public roundups have put the broader token movement near 125,000 FLUID and 51,900 GHO. The assets were later swapped into ether, with proceeds routed into Tornado Cash.
<h2 id="core-markets-stayed-safe-but-disclosure-drew-scrutiny">Core Markets Stayed Safe, But Disclosure Drew Scrutiny</h2>
Fluid is built around a broader DeFi stack that combines lending, vaults, a liquidity layer and DEX infrastructure. Its <a href="https://docs.fluid.instadapp.io/" rel="noopener noreferrer nofollow">technical documentation</a> describes a system where liquidity supports protocols such as lending and vaults, with the DEX architecture built on top of the same liquidity layer.
Those components were not drained. The incident stayed inside the reward-claiming infrastructure, and Fluid later removed the compromised roles while moving remaining reward funds out of reach. Merkle reward claiming was paused while updates were prepared, with rewards expected to keep accruing retroactively until claiming resumes.
The harder issue is communication. Public messaging initially focused on paused claiming and infrastructure updates, while the key-compromise angle and loss figure became clearer through independent on-chain work. For users, that gap can matter almost as much as the exploit size. When rewards, claiming windows or token incentives are involved, delayed clarity can create uncertainty around eligibility, balances and whether users need to take action.
<h2 id="defi-s-operational-key-problem-keeps-spreading">DeFi’s Operational Key Problem Keeps Spreading</h2>
The Fluid incident fits a broader pattern of DeFi losses where the smart contracts users interact with are not necessarily the broken part. Recent security pressure has repeatedly centered on admin paths, signing systems, bridges, permissions and supporting infrastructure.
A <a href="https://cryptoadventure.com/gravity-bridge-faces-5-4m-drain-after-suspected-contract-key-compromise/" rel="noopener noreferrer nofollow">suspected Gravity Bridge key or signing-path compromise</a> recently triggered a much larger $5.4 million drain across USDC, WETH, USDT and other assets. Alephium’s TokenBridge also faced an <a href="https://cryptoadventure.com/alephium-tokenbridge-hit-by-815k-ethereum-exploit-after-forged-vaa-attack/" rel="noopener noreferrer nofollow">$815,000 Ethereum-side exploit</a> after forged message approval activity, keeping attention on the systems that authorize asset movement rather than only the contracts holding funds.
Fluid’s loss is smaller than those bridge incidents, but the lesson is similar. A protocol can keep user deposits safe and still suffer reputational damage if privileged infrastructure can be used to redirect rewards. Reward systems often sit outside the most heavily marketed “core protocol” security perimeter, yet users still treat those claims as part of the product.
For Fluid, the immediate financial hit appears manageable. The sharper issue is that a two-role rewards control design collapsed once both keys were controlled by the same attacker. A $215,000 drain is not large by DeFi exploit standards, but the path matters: a reward list was changed, approved, claimed and washed through Tornado Cash before users had a full public explanation. That leaves Fluid’s next postmortem carrying more weight than the dollar figure alone.
The post <a href="https://cryptoadventure.com/fluid-rewards-drain-exposes-key-control-failure-after-215k-theft/" rel="noopener noreferrer nofollow">Fluid Rewards Drain Exposes Key Control Failure After $215K Theft</a> appeared first on <a href="https://cryptoadventure.com" rel="noopener noreferrer nofollow">Crypto Adventure</a>.

Fluid Rewards Drain Exposes Key Control Failure After $215K Theft

Table of Contents

Crypto Adventure

Other articles published on Jun 1, 2026

Join our free newsletter for daily crypto updates!