It’s been a difficult week for Chia’s DeFi protocols. Three separate protocols ran into trouble in quick succession:
- The warp.green ERC-20 bridge was drained for almost all of its bridged USDC ($93,000)
- TibetSwap had a critical bug ethically reported and all of its liquidity proactively rescued by the team.
- Circuit‘s on-chain treasury was drained ($1,000) while the rest of the protocol continues to function.
All while a dust storm continued grinding away at the network. Three unrelated incidents in the same window is alarming, so let’s cover what we know so far.
What happened to warp.green?
warp.green is the cross-chain messaging protocol that bridges assets between Chia, Ethereum, and Base, and its wUSDC.b stablecoin has become a core part of on-chain trading on Chia. On August 23, 2026 the @warpdotgreen account flagged two suspicious transactions, 85,000 wUSDC.b and 8,000 wUSDC, and moved to pause the protocol with validators. These two transactions drained almost all USDC held by the bridge on ETH/Base.
The transactions exploited a bug in the Chia-side portion of the ERC-20 bridge, while the CAT bridge that secures tokens like wXCH were unaffected. Third-party tracker SlowMist described the mechanism as minting worthless CAT tokens, presenting them as burned wUSDC to obtain validator signatures, then draining USDC on the Ethereum and Base side, roughly $93,000 in total, which the attacker converted to ETH. The team made a white-hat offer of a 10% bounty for the return of 90% of the funds, but the attacker instead deposited 10 ETH into Tornado Cash and the protocol remains paused with a post-mortem pending.
A recommendation from the dexie team is to take down any wUSDC/wUSDC.b offers for now.
What happened to TibetSwap?
TibetSwap is the leading AMM on Chia and per the X announcement and notice on the TibetSwap site, a white hat community member (@Ealrann) ethically reported a critical bug in the v2 puzzles that affected all live pools and put the protocol’s entire TVL at risk, and what made it urgent rather than theoretical was that an AI model had found the vulnerability, built a working proof-of-concept and successfully tested it against a pool on mainnet.
Because TibetSwap is permissionless, nobody can pause or upgrade it, so a passive fix wasn’t an option. Acting on advice and support from Chia Network, the team built a rescue tool with additional safety checks and swept protocol liquidity into a secure vault to be distributed back to the community later.
Users are asked not to start new pools, add liquidity, or trade TibetSwap LP tokens while a distribution plan is worked out from on-chain data.
August 26 2026 update: A follow-up on August 26, 2026 provided an update that on-chain analysis showed another party had reached 28 pools before the rescue did, consolidating a 151.8 XCH plus corresponding tokens into another address (0.2% of total protocol liquidity). A further update indicated that party later returned all assets to TibetSwap. It is likely that once a proof-of-concept was carried out on mainnet, it was that much easier for a third party to find and replicate the exploit. All-in-all, the speed at which the TibetSwap and Chia Network team was able to rescue funds in a highly adversarial environment was critical in ensuring the safety of all funds in the protocol.
What happened to Circuit?
Circuit is the collateralized-debt-position protocol behind Bytecash (BYC), a stablecoin pegged 1:1 to the dollar and backed by XCH in on-chain collateral vaults, governed by CRT holders as CircuitDAO. Per the team’s Discord announcement, the on-chain treasury was emptied by an attacker; it held around $1,000 of BYC at the time, of which only 26 BYC was owed to savers, and the team has committed to making all savers whole.
The mechanism, pieced together in community discussion, looks like a savings-vault interaction: create a new savings vault, flash-loan a very large amount of BYC (near 18 quadrillion) to fund savings, then withdraw in the same block so the treasury pays out interest for that short period. Circuit’s own docs had flagged flash-loan governance and treasury edge cases as a risk, and the protocol had been through public audit competitions on Cantina and Immunefi (a reminder that audits reduce risk but don’t eliminate it).
Principal in savings and collateral vaults is believed safe, but users have the option to withdraw anyway, with BYC liquidity available on Dexie for those repaying loans. CRT holders will be distributed a new version of the token.
Despite the announcement that the protocol will need to be relaunched, the team noted there’s a chance the core protocol can actually continue to function but the pending post-mortem and investigation should provide more details.
Aside: When it rains it pours
Underneath all of these incidents, Chia has also been dealing with a dust storm for the past few weeks, seemingly unrelated to the three exploits. A dust storm is a flood of minimum-sized transactions (as small as 1 mojo) sent to thousands of wallets to strain the network, slow wallet syncs, and potentially knock some farmers on older hardware offline. Chia has seen these before, and the mitigation is the same as it always was: attach a small fee to push your transaction through.
The AI risk is real
One thing to note is that none of these three incidents traces back to issues in Chia’s core primitives. The consensus layer, the coin set model, CATs, NFTs, and Offers all did exactly what they’re supposed to.
What broke were the complex smart-coin protocols built on top. The more moving parts in a protocol, the more surface area there is for these kinds of logic bugs despite human and AI-assisted audits.
The obvious paradigm shift has been the advent of AI models that are highly capable and hyper efficient at finding security bugs and exploits. And while defensive use of AI can be (and has been) a big part of securing these protocols, the permissionless and immutable nature of these protocols add a layer of complexity in defending against new threats. Particularly at risk are software with open codebases and those with valuable assets that can be anonymously stolen — this makes open source permissionless DeFi protocols an obvious target and that’s true on every chain, not just Chia.
There’s also something to be said here about the applications that lean on the primitives directly instead of wrapping them in a stateful protocol. Dexie makes a market entirely out of Offer files where the maker’s coins stay in the maker’s wallet until an offer is taken, at which point the trade settles atomically in a single transaction with no intermediary and no counterparty risk. There is no pool to drain and no protocol TVL to put at risk, because there’s no custodial contract in the middle. MintGarden works the same way for NFTs, building its marketplace on the native NFT and Offer primitives rather than a bespoke exchange contract like other blockchains, so even in a MintGarden auction the NFT never leaves your wallet until you accept the winning offer. The trade either happens exactly as specified or it doesn’t happen at all.
That doesn’t make Offer-based apps bulletproof, and it doesn’t mean AMMs, bridges, and stablecoins are impossible to secure. AMMs solve a real liquidity problem that peer-to-peer offers don’t, and bridges and stablecoins are genuinely useful and should continue to be pursued. But the fact remains, the more logic you add on top of the base layer, the more careful you have to be, and the apps that stay close to the primitives inherit their safety properties by design.
I’m looking forward to intentional and careful improvements to the core primitives, such as partial Offers and on-chain auctions to add flexibility to what the core chain can directly support.
AI is coming for the whole industry
The AI-powered security problem isn’t unique to Chia. Over on Cosmos, a cluster of chains running the shared Cosmos EVM module went offline in quick succession after an attacker exploited a vulnerability in that common code rather than in any single chain’s own logic. MANTRA halted on August 21, KiiChain reported an attacker repeating the same technique 18 times to drain over 148 million KII, and TAC halted after a single account was drained, with Cosmos Labs advising every Cosmos powered EVM chain to halt validators while it responded.
In June, a researcher at Shielded Labs used an agent built on Claude Opus 4.8 to uncover a four-year-old soundness bug in Zcash’s Orchard shielded pool that could have minted undetectable counterfeit ZEC, a flaw that had survived years of expert cryptographic review.
CertiK’s mid-year data recorded over $150 million lost across 200-plus code vulnerability exploits, with automated tooling driving a rise in attacks on older contracts. The cost of finding bugs is dropping fast, which cuts both ways: defenders and attackers are both getting the same tools.
What this means for Chia DeFi
I have no doubt Chia DeFi will overcome this difficult week and continue forward. Relatively speaking as far as DeFi hacks go, the amount lost in these three events are minuscule due to the limited size of the current ecosystem. This shouldn’t however, minimize the significance of these incidents, and should be taken as a big learning opportunity for future projects.
As for what’s next, I expect rescued assets from TibetSwap pools will be redistributed to the community. We’ll see detailed post-mortems about all three incidents. Protocols will relaunch with fixes after some heavy human+AI scrutiny. And meanwhile, Chia Offers still work as intended and apps like dexie and MintGarden can continue to drive a lot of the volume and activity in the rest of the ecosystem.
Shout out to the developers and response teams here in how they handled the investigation, technical response, and communication transparently and professionally. We will all learn from this and I’m confident we will come out the other side better, stronger, and more secure.
