ORE price fell roughly 15% after the Solana-based proof-of-work crypto mining project disclosed a staking contract exploit that allowed an attacker to "unfairly skew" yield rewards and forced stakers to migrate to a new contract.
In a June 17 security update on X, ORE developers said they discovered an attack on the protocol's staking program on June 15.
The attacker exploited a missing account check that allowed them to inflate their recorded staking balance without actually depositing tokens.
The team reassured user deposits weren't at risk and that the vulnerability only affected reward distribution.
- According to the project, the attacker collected about 25.5 ORE, worth roughly $2,125 at the time, before developers halted reward transfers.
"All user deposits are safe. There is no risk of loss of funds," the team wrote.
ORE said the staking contract can't be patched directly because it was launched without upgrade authority.
- Instead, users must migrate their stake to a newly deployed contract to continue earning rewards.
The project has already launched a one-click migration tool and expects staking rewards to resume within 24 to 48 hours.
The incident also affects stORE, ORE's liquid staking token. Users holding stORE will need to migrate to a new token contract as part of the process.
- PrivacyCash, the privacy-focused protocol that maintains the largest stORE shielded pool, agreed to waive its 0.35% withdrawal fee for one week to help users migrate.
The team emphasized that the attacker never gained access to other users' deposits because each staking account maintains its own isolated token account.
According to ORE, the exploit only altered the attacker's share of the reward pool rather than allowing theft of customer funds.
- ORE was created in 2024 by pseudonymous developer Hardhat Chad and later spun out into Regolith Labs.
- The company raised a $3 million seed round led by Foundation Capital, with backing from Solana Ventures and other investors.
- Shortly after the news broke, ORE plunged 15%, per data from CoinGecko.