Emre Yumlu 
Decentralized finance platform KiloEx has announced a full compensation plan for users affected by a $7.5 million exploit that occurred earlier this month. In addition to refunding impacted traders, the protocol will also provide extra incentives to stakers.
Full Refund for Affected Traders
In a statement released on April 24, KiloEx confirmed that traders with open positions during the downtime will be fully reimbursed for any increased losses or missed profits. The platform encouraged users to close their positions promptly once operations resume, as compensation calculations will be based on the time the platform becomes active again.
“Please close your position as early as possible once we go live again. Reimbursement amounts will reflect that timing,” the team emphasized.
Extra APY for Hybrid Vault Stakers
All funds drained from the Hybrid Vault were successfully restored, meaning stakers’ principal and earnings remain intact. Still, KiloEx will grant an additional 10% annual percentage yield (APY) as a goodwill reward. This bonus will be available to users who had capital in the vault before the platform resumes activity.
Agreement Reached With Attacker
On April 15, KiloEx extended a bounty offer to the individual behind the attack: if the hacker returned 90% of the funds, they could retain the remaining 10%—approximately $750,000—as a white hat reward. Failure to comply would have resulted in legal action and a possible public identity reveal.
Shortly after, blockchain analysts observed transactions indicating the stolen funds had been returned. KiloEx later confirmed the return and dropped all legal threats, officially awarding the attacker the promised bounty on April 18.
Exploit Origin: Oracle Vulnerability
The breach occurred on April 14 and led to a temporary suspension of the platform. According to security audits, the hacker abused a vulnerability in the platform’s price oracle, manipulating asset prices to generate fraudulent profits.
KiloEx’s post-mortem revealed that the attacker accessed a function meant for authorized use only, allowing them to open a position at an artificially low value and close it at a much higher price, exploiting the protocol’s logic for financial gain.
You can also freely share your thoughts and comments about the topic in the comment section. Additionally, don’t forget to follow us on our Telegram, YouTube, and Twitter channels for the latest news and updates.