On October 20, an exploiter took advantage of a vulnerability in a legacy function of Slice's settlement contract, taking about $41k in store earnings that hadn't yet been withdrawn. Most of these funds were Slice's or tied to past partner initiatives; fewer than 10 user stores were affected according to our initial review.
Within an hour of being alerted, we paused the contracts and fixed the vulnerability. We also contacted incident response teams and traced the stolen funds, which we're actively monitoring. Funds in users' wallets were never at risk.
Use of the Slice protocol is temporarily paused out of an abundance of caution while we complete our review. If your store was one of the few affected, you'll see a notice in your Slice dashboard with next steps.
To the exploiter: return the funds by Friday, October 23, 17:00 UTC and keep 10% as a white-hat bounty, and we'll treat this as a white-hat recovery. After that, we will pursue all available options to recover them.
To our users: sorry for the inconvenience, and thank you for your patience. We take security seriously and have already taken steps to prevent similar attacks, which we'll share more about soon. We expect Slice to be back up and running within 24 to 48 hours, and we'll keep you updated here until then.