The decentralized finance protocol Fluid suffered an exploit of its rewards distribution system on Ethereum, resulting in the loss of roughly $215,000 in digital assets. According to the security researcher BlackHart, the attacker gained simultaneous control over the two private keys that manage the project's reward approval process, allowing them to unilaterally submit and approve a malicious rewards list payable only to their own address, and then claim the funds using an empty Merkle proof.
Fluid's rewards mechanism relies on a dual-signature scheme: one key initiates a rewards roster, and a second key must approve it before distribution can occur. The attacker's possession of both keys effectively neutralized this two‑step check. The stolen assets were drawn from three separate reward dispensers and included 112,883 FLUID tokens, 47,903 GHO stablecoins, and a small amount of cbBTC. All were promptly converted to ETH and laundered through the Tornado Cash mixing service, obscuring the trail.
Attack Vector and Asset Movement
To carry out the exploit, the attacker crafted a rewards list containing only their own wallet address, signed it with the first compromised key, and then used the second key to approve the list. With the malicious list now validated, the attacker supplied an empty Merkle proof—typically a cryptographic demonstration of entitlement—to trigger the distribution, draining the designated rewards from the dispensers. This incident underscores a critical failure in key management rather than a flaw in the underlying smart contracts.
On‑chain records show that the stolen tokens were rapidly swapped for ETH and passed through multiple Tornado Cash cycles to hinder tracing. No further movement from the associated addresses has been detected at the time of reporting. Critically, Fluid's core infrastructure—including its lending markets, vault, decentralized exchange, and user deposits—remained untouched, indicating that the vulnerability was isolated to the rewards module.
Team Response and Disclosure Gaps
Within roughly ten hours of the incident, Fluid's team rotated the compromised private keys and moved the remaining reward funds to a secure address. However, the project's public statement merely noted that reward claims were temporarily paused for an update, without disclosing the private key breach or the exact financial impact. This limited disclosure stands in contrast to the swift technical remediation and has raised questions about transparency, though no damage has spread to the protocol's core operations.