Fluid Protocol Reward Contract Exploited for $200,000 via Key Leak

The decentralized finance project Fluid, operating on the Ethereum network, has fallen victim to a security breach involving its reward distribution mechanism. According to reports from security firm BlackHart, an attacker gained control of critical operational private keys, leading to the unauthorized transfer of approximately $200,000 in digital assets. While the protocol's core lending and exchange functions remain secure, the incident highlights ongoing vulnerabilities related to private key management in the DeFi ecosystem.

Mechanism of the Exploit and Compromised Assets

The breach targeted Fluid's Merkle reward list system, a protocol designed to distribute incentives to users. This mechanism typically requires a dual-authorization process: a Merkle root is initiated by one administrative key and subsequently approved by a second key. On June 1, 2026, the attacker successfully acquired both private keys, allowing them to bypass the intended security checks. By submitting a manipulated reward list that exclusively favored their own address and approving it simultaneously, the actor was able to finalize the claim process using an empty proof.

The stolen funds were drained from three separate reward distributors and included the following assets:

• 112,883 FLUID tokens
• 47,903 GHO (Aave's stablecoin)
• A fractional amount of cbBTC (Coinbase Wrapped BTC)

Following the exploit, the perpetrator converted the assets into ETH and utilized the privacy protocol Tornado Cash to obfuscate the transaction trail. The use of mixing services like Tornado Cash is a common tactic used by malicious actors to prevent the tracking of stolen funds on public ledgers.

Project Response and Current Security Status

In the immediate aftermath of the detection, the Fluid team took corrective measures within a 10-hour window. These actions included replacing the compromised operational keys and securing the remaining funds within the reward contracts to prevent further leakage. Despite the loss in the incentive layer, the developers have confirmed that the Fluid lending market, the treasury, the decentralized exchange (DEX), and all primary user deposits were unaffected by this specific vulnerability.

However, industry observers have noted a lack of transparency in the initial public communications. While the team officially announced a pause in reward claim updates, the statement did not explicitly detail the private key compromise or the specific financial impact of the event. Internal security audits and key rotation policies are essential components for decentralized protocols to mitigate the risk of "single point of failure" administrative breaches.

In conclusion, the Fluid exploit serves as a reminder of the risks associated with centralized administrative controls within decentralized applications. While the financial loss was limited to the reward distribution pool and did not impact the protocol's core liquidity, the incident underscores the necessity for robust multi-signature configurations and transparent disclosure practices. As of the latest updates, the project has stabilized its reward infrastructure, though the recovery of the laundered assets remains unlikely.