Key facts
- Fluid lost $215,000 in an exploit involving its Merkle rewards system.
- An attacker controlled both operational signing keys for Fluid's reward distributors.
- The exploit occurred on Ethereum, Base, and Arbitrum chains.
- The attacker used a fake reward list and an empty Merkle proof to claim tokens.
- Stolen FLUID and GHO tokens were swapped for approximately 103 ETH.
- About 142.6 ETH was laundered through Tornado Cash.
Fluid, an Ethereum-based DeFi protocol, suffered a $215,000 loss due to an exploit where a single attacker controlled both operational signing keys for its Merkle reward distributors on Ethereum, Base, and Arbitrum. The attacker proposed a fake reward list and approved it using the second key, then claimed tokens with an empty Merkle proof. This allowed the attacker to steal approximately 125,109 FLUID and 51,946 GHO tokens. These were swapped for about 103 ETH, with roughly 142.6 ETH ultimately laundered through Tornado Cash. Fluid confirmed that its core lending markets and vaults were unaffected, and user funds were not at risk from this specific incident. The exploit occurred rapidly, within 24 seconds, due to the lack of a delay between key approval and payout. Following the incident, a significant withdrawal of funds by depositors occurred, which Fluid stated was unrelated to the theft itself but possibly influenced by the disclosure timing. The Fluid team later moved remaining reward balances to a safe address, initially communicating only a pause on reward claiming for updates.