A security mechanism that requires a 24-hour waiting period for withdrawals prevented the completion of seven withdrawals associated with an attack on the Sovryn decentralized finance (DeFi) protocol. The measure kept 66,134.07 XUSD blocked after incidents recorded on October 31 and November 1, 2026, according to an official report released on Tuesday (3).
The protection system, called Perimeter, established an interval between the request and the release of funds. This period allowed those responsible for the protocol's security to identify and block two accounts related to the seven withdrawals before the amounts were transferred.
The restrictions were applied at 21:39 UTC on October 31, after the team suspended operations of the lending contracts and margin trading on the Rootstock network.
Despite the containment, the attacks caused losses of funds. The three transactions identified in the first incident resulted in a net outflow of 604,575.19 XUSD and 4.02792509 WRBTC, according to the amounts reconciled by Sovryn.
A separate incident, which occurred on November 1, hit the XUSD/WRBTC liquidity pool and involved a payment of 541,455.998472 XUSD to a wallet controlled by the attacker.
The two episodes involve different accounting measures. Therefore, the amounts do not represent a definitive consolidated loss, and it has not yet been established whether those responsible for the attacks are the same.
Blocked funds were not recovered from the attackers
The 66,134.07 XUSD preserved by the waiting mechanism remain in custody, without having been transferred to the attackers. Sovryn emphasizes that these assets should not be classified as recovered funds, since the withdrawals were never completed.
The protocol also transferred other assets that were already under its control to a temporary custody wallet, without characterizing these movements as recovery of stolen funds.
According to the report, loans, credit operations and margin trading remain suspended, including withdrawals from the lending pools. The platform interface is under maintenance, and the affected XUSD/WRBTC pool was removed on November 2.
Sovryn advises users not to interact with its contracts until further notice. The resumption of operations depends on fixes, an independent security review and reconciliation of the affected balances. There is still no reopening date nor a definition on the final distribution of losses.
