Staking protocol Bedrock confirmed their platform was infiltrated by a bug involving uniBTC, which allowed users to exchange a uniBTC with an ETH token.

Bedrock announced through an X post on Sept. 27 that they are aware of the security breach and the issue is currently “handled” by their team.

They also assured users that the remaining funds were safe and they plan to launch a reimbursement plan in the near future, estimating the total loss to be approximately $2 million in digital assets.

That being said, a user on the platform found that the bug allowed for them to exchange their Bitcoin (BTC) with Ethereum (ETH). This is because the security exploit directly affected the platform’s uniBTC, a synthetic Bitcoin token used in DeFi.

“This function was likely leftover from the uniETH implementation,” the user remarked.

According to data from crypto.news, Bitcoin is sold at $65,449 per token while Ethereum’s price stands at $2,659 at the time of writing.

Bedrock claimed most of the losses were from decentralized exchange liquidity pools and clarified that the underlying wrapped Bitcoin tokens and standard Bitcoin that are held in reserves were secure. 

“At this time, no extra actions are required from our community. Rest assured that all uniBTC held by users are safe,” said Bedrock, adding that the platform will release a post-mortem report shortly.

As of right now, the protocol’s team has identified the root cause of the security exploit and are working closely with their audit teams to recover the lost funds.

Bedrock was launched in February 2023 by Singapore-based blockchain firm RockX. The protocol was designed to make liquid staking attractive for institutional investors by prioritizing compliance with know-your-customer and anti-money laundering regulations.

Bedrock is ranked as the eighth-largest liquid staking protocol according to DefiLlama, worth over $240 million in total value locked on its platform.