Between September 30 and October 16, approximately 782 thousand Gram and 13.8 thousand USDT were drained from two of Affluent's lending vaults on the TON network — the TON Lending Vault and the USDT Lending Vault. This amounts to about $1.17 million at the exchange rate at the time of the draining. Depositors of these vaults are unable to withdraw their funds: as of November 4, the USDT vault's wallet holds 0.5 USDT, and the TON vault's wallet holds 82.8 Gram, with no payouts for other positions. Affluent has not issued any public statement, incident report, or compensation plan.
Holders of affTONl (42 addresses as of November 4), affUSDTl (81 addresses), and affUSDTm (70 addresses) share tokens are affected.
What Happened to Depositors' Funds
| Vault | Share Token | Status as of November 4 |
|---|---|---|
| TON Lending Vault | affTONl | 82.8 Gram in wallet; app shows $136,606 in pools; deposits and withdrawals disabled |
| USDT Lending Vault | affUSDTl | 0.5 USDT in wallet; approximately 17.1 thousand USDT attributed to the vault in pools; deposits and withdrawals disabled |
| USDT Multiply Vault | affUSDTm | approximately $197 thousand in assets, deposits and withdrawals disabled, 3 withdrawal requests for 113,076 USDT in queue |
| Ethena Vault, Gold Multiply Vault, Sentora Vault, GRAM Multiply Vault | — | app shows $274 thousand, $239 thousand, $533 thousand, and $643 thousand in assets |
For both lending vaults, the minimum fee for deposits and withdrawals is set to 10 billion Gram, effectively closing these operations. On paper, they still hold positions in lending pools — approximately 108 thousand Gram and 17.1 thousand USDT — but since October 19, no share token burning has resulted in payouts for these positions. The USDT Lending Vault card on the app.affluent.org/earn page shows a Net Asset of approximately $999 billion, which is a consequence of a corrupted fund accounting field in the contract, not a real amount.
On October 7, the price of an affUSDTl share token was 1.068 USDT: in a transaction, 5,340.12 USDT were paid for 5,000 share tokens. After October 16, a share token is worth approximately 0.0000032 USDT: on October 19, 1,500.95 USDT were paid for 466,366,695 share tokens.
How the Vaults Work
Affluent, formerly known as Factorial Finance, is a lending protocol on TON: its website is affluent.org, and its application is app.affluent.org. A vault accepts deposits and distributes them across Affluent's own lending pools, issuing share tokens to the depositor. The share token's value increases as the pools earn interest; upon withdrawal, the share token is burned, and the depositor receives their portion of the vault's assets.
The vault contract simultaneously mints share tokens: the vault's address is also the master contract for the affUSDTl or affTONl token. Therefore, minting excess share tokens and withdrawing funds are the same operation.
How the Funds Were Drained
Transactions reveal the following: The Affluent lending pool accepted fake notifications of token receipts as genuine and forwarded them to the vault. The vault then minted share tokens for which nothing had been deposited. These share tokens were subsequently burned, and the vault paid out real Gram and USDT belonging to depositors. Neither Affluent nor an auditor has explained the cause.
| Date (UTC) | What Happened | Received |
|---|---|---|
| September 30, 04:36–05:21 | minting of 3,556,217 affTONl, 45 burnings | ≈505 thousand Gram |
| October 12, 10:02–10:21 | 24 affTONl burnings by the same wallet | ≈126.8 thousand Gram |
| October 16, 20:36–20:48 | minting of 10 billion affUSDTl and 10 million affTONl, burning of share tokens | 13,824.93 USDT and 150,041 Gram |
In total, the vaults paid out approximately 781.6 thousand Gram and 13.8 thousand USDT. At the Gram exchange rate during each wave ($1.52, $1.42, and $1.35), this amounts to about $1.17 million. At the November 4 rate ($1.18), it is about $0.93 million. Immediately after the draining, the funds were dispersed to other addresses: on September 30, 504.8 thousand Gram were sent in one transfer, and on October 16, 12,824 USDT were sent to the Symbiosis bridge.
From October 19 to November 4, minting and burning were repeated from six new wallets, and on November 3, from the two original ones as well, but no further payouts were received. The last such minting operations occurred on November 4 at 00:05 and 00:07 UTC, indicating that the vulnerability in the contracts was not closed as of that date.
Who Reported This and What the Project Responded
An analysis of the three waves — including transaction hashes for the October 16 wave — was published on October 19. An independent investigation, estimating losses at "~$1.1M", was released on October 28. According to the author of the investigation, community members shared their findings with the Affluent team on October 19, but there has been no public report or compensation plan.
As of November 4, the Affluent website and application are operational; there are no statements about the incident on the website, in the documentation, or in available publications from the @AffluentOrg account. Furthermore, the link to the project's Telegram channel from the website opens an empty card without a feed.
This is not the only such incident on TON this autumn: in late October, anomalous withdrawals were observed from the BabyDoge bridge.
Questions
Can funds be withdrawn from Affluent?
From TON Lending Vault and USDT Lending Vault — no: there is almost nothing in the vault wallets, no payouts for positions in the pools, and operation fees are prohibitively high. In USDT Multiply Vault, withdrawals are disabled, and requests are queued. Other vaults in the application show assets.
How much was drained from Affluent's vaults?
Approximately 781.6 thousand Gram and 13.8 thousand USDT across three waves on September 30, October 12, and October 16 — roughly $1.17 million at the exchange rate at the time of the draining.
