DeFi Protocol Cork Halts Smart Contract Following $12M Exploit

Cork Protocol has halted all smart contracts following a security breach that resulted in the loss of nearly $12 million worth of wrapped staked ETH (wstETH). According to blockchain security firm Cyvers, the attacker used a malicious contract to extract 3,761.87 wstETH.

🚨ALERT🚨Our system has identified a $12M smart contract exploit, with @CorkProtocol potentially the victims.

A malicious contract was deployed on May 28, 2025 at 11:23:19 UTC by an address funded by 0x4771…762B (likely a service provider).
Just 16 minutes and 45 seconds… pic.twitter.com/72ScizbJPZ

— 🚨 Cyvers Alerts 🚨 (@CyversAlerts) May 28, 2025

The stolen assets have only been swapped for ETH and remain in a single wallet, with no signs yet of being split across multiple addresses.

Cork Halts Smart Contracts

Cork founder Phil Fogel confirmed the breach on X, stating that the team is actively investigating the incident. He also noted that all smart contracts have been paused.

“We are investigating a potential exploit and are pausing all contracts. We will report back with more information as soon as possible” Fogel tweeted.

The incident comes shortly after the Cork Protocol gained significant attention since its launch in March. The platform introduced a novel decentralized finance (DeFi) concept that enables users to speculate on depeg events, which occur when an asset’s market price deviates from its peg.

Notably, its innovative approach attracted support from investors, including a16z Crypto, OrangeDAO, and Steakhouse Financial. These entities provided funding in September 2024. Cork also participated in a16z Crypto’s CSX Fall 2024 accelerator program.

Cetus Protocol Loses Over $220M in Separate Breach

In a separate incident, Cetus Protocol, a decentralized exchange built on the Sui Network, suffered a security exploit that drained over $220 million. The attacker converted the stolen funds into USDC and bridged them to Ethereum. Next, they swapped more than $58 million for 21,938 ETH, averaging $2,658 per ETH.

Cetus responded by pausing its smart contracts and said $162 million of the affected assets have been frozen. The Sui Foundation and OtterSec will jointly manage the paused funds by moving them to a shared multisig wallet.

According to a CoinTab report, Cetus has offered the exploiter a settlement: return 20,920 ETH (worth about $56.3 million) and all frozen Sui-based assets. In exchange, the exploiter would receive a 2,324 ETH bounty, approximately $6 million. The protocol also pledged to drop all legal, public, or intelligence actions if the offer is accepted.

The post DeFi Protocol Cork Halts Smart Contract Following $12M Exploit appeared first on Cointab.