RISEx XLP Vault exploited on August 3rd for ~$673k USDC; team offering whitehat deal to return 80% by September 23 deadline in exchange for treating incident as disclosure.
Security & Exploits ·
The RISEx XLP Vault was exploited on August 3rd for approximately $672,831 in USDC. In a message posted via Blockscan Chat, the vault's team contacted the address responsible for the exploit, offering a partial recovery deal: the exploiter may retain $134,566 (20% of the total) while returning the remaining $538,265 (80%) in USDC or ETH equivalent to a specified Ethereum or Base address. The deadline for this arrangement is 12pm AEST on September 23.
The team framed the offer as conditional on treating the exploit as a responsible disclosure, effectively incentivizing the return of the majority of stolen funds in exchange for legal clemency or a non-adversarial resolution. Evidence suggests the exploited funds have begun moving on-chain, prompting the team to make this improved offer before further dispersal occurs.
It remains unclear whether the exploiter will accept the deal, whether the funds will be successfully recovered by the deadline, or what enforcement mechanisms exist if the deadline passes without compliance. The nature of the underlying vault vulnerability that enabled the exploit has not been disclosed.