Fluid: The attack only affected back-end automation systems, and the team will fully cover the losses

Foresight News reports that the DeFi protocol Fluid has released an incident report on the recent attack. The attacker exploited a vulnerability in components related to the Merkle reward distribution system, stealing approximately 163,706 FLUID and 49,526 GHO tokens. This incident only affected the backend automation systems; the core protocol, smart contracts, and user funds were not impacted. The attacker leveraged a remote code execution vulnerability present in their internally migrated Livewire library to obtain operational keys and submitted a fraudulent Merkle root.

The team took swift action, including rotating keys, transferring remaining funds, and isolating affected systems. Efforts are ongoing to recover the stolen funds, and the team has pledged to fully cover all losses. The Merkle reward claim functionality is expected to be restored within 10 days; during this period, rewards will continue to accumulate normally and users do not need to take any action.