How Does ALEX Lab Work?
A decentralized exchange built on Stacks (a Bitcoin layer). It holds under $1M in deposits after a $4.3M hack in May 2024 attributed to North Korean hackers who compromised the deployer keys. Its C- grade reflects the severe exploit history and ongoing bridge security concerns.
TVL
$907,000
Sector
DEX
Risk Grade
C-
Value Grade
D
Core Mechanisms
DEX/AMM
Fixed-weight AMM pools on Stacks (Clarity-based)
Standard AMM pattern implemented in Clarity on Stacks.
DEX/Orderbook
On-chain order book matching on Stacks
Standard order book pattern.
Bridge/Cross-Chain
NovelXLink cross-chain bridge connecting Bitcoin/Stacks to EVM chains
Novel cross-chain bridge connecting Bitcoin ecosystem to EVM. Single point of failure for wrapped asset backing.
Yield/Farming
Liquidity mining with ALEX token rewards
Standard yield farming pattern.
Governance/DAO
ALEX token governance
Standard governance token.
Token/Launchpad
Token launchpad for Stacks ecosystem projects
Standard launchpad pattern.
Lending/Pool-Based
Lending pools on Stacks
Standard lending pool pattern on Stacks.
How the Pieces Interact
Compromised deployer keys (Lazarus Group, May 2024) enabled $4.3M drain. Root cause was insufficient key management practices, not smart contract bugs.
XLink bridge failure would leave wrapped assets on Stacks unbacked, causing immediate depeg and liquidity collapse across ALEX's orderbook and AMM.
Stacks consensus depends on Bitcoin miners. Miner censorship or regulatory action could break the Bitcoin-Stacks relationship.
Thin liquidity on Stacks-based pools enables price manipulation and high slippage on moderate-sized trades.
Launchpad-listed tokens may have poor fundamentals, creating reputational risk and potential rug pull exposure for participants.
What Could Go Wrong
- Exploited for $4.3M in May 2024 via compromised deployer keys attributed to Lazarus Group. Key management practices were the root cause, a protocol-level infrastructure failure.
- XLink cross-chain bridge is a single point of failure. Another bridge exploit would leave wrapped assets on Stacks unbacked, causing immediate depeg across ALEX's DEX.
- Stacks PoX (Proof of Transfer) dependency on Bitcoin miners creates centralization risk; regulatory action against miners could break the Bitcoin-Stacks peg.
XLink Bridge Exploit and Wrapped Asset Depeg
ElevatedTrigger: XLink bridge is compromised via key theft or smart contract exploit, unbacking wrapped assets on Stacks
- 1.Attacker exploits XLink bridge to drain backed assets — Wrapped tokens on Stacks become unbacked and immediately depeg
- 2.Panic selling of wrapped assets crashes ALEX DEX pools — AMM and orderbook liquidity evaporates as traders flee
- 3.ALEX token crashes as protocol viability is questioned after second major exploit — Governance credibility destroyed; treasury insufficient for another reimbursement
Risk Profile at a Glance
Overall: C- (55/100)
Lower score = safer