An Update on Giddy: Vault Exploit and Wind-Down

We're sharing difficult news with our community today. Yesterday, Giddy's earning vaults were exploited, and after careful consideration, we have made the decision to wind Giddy down. This post walks through what happened, the current status of user funds, and the steps every Giddy user should take in the coming weeks.

What happened

Early yesterday morning, Giddy's earning vaults came under active exploitation by an attacker. Six vaults were targeted. Our team was able to emergency-pause the vaults within approximately an hour of the first exploited transaction, which prevented any further vaults from being drained.

Because the attacker started with the highest-value vaults, the exploit resulted in a roughly 75% aggregate loss of vault balances across all vaults.

How the exploit worked

At a high level, the attacker used a sophisticated, multi-step exploit that took advantage of a vulnerability in our vault signature flow. They initiated a valid vault deposit from the mobile app, intercepted the transaction so it never executed on-chain, and then used the extracted signature to authorize a malicious transaction that swapped the vault's underlying value through malicious swap routes they had pre-positioned.

The status of your funds

The vaults remain paused to safeguard against any further losses. Funds held in your Giddy wallet outside of vaults are not affected and remain under your control.

What happens next

1. Emergency withdrawals from unexploited vaults. If you have funds in a vault that was not exploited, we will be sending those funds safely to your wallet via an emergency withdrawal. You do not need to take any action — the funds will appear in your Giddy wallet.

2. Full mobile app functionality through May 15th. The Giddy app will remain live with full functionality (minus vaults) through May 15th. During this window, you can off-board all of your funds to a wallet or exchange of your choice.

3. Offline mode after May 15th — please read carefully. After May 15th, the Giddy app will no longer be available on the App Store, and Giddy's services will transition to an offline-only experience. This offline mode will only work if the Giddy app is already installed on your device and you are already logged in. After May 15th, you will not be able to install the app, and you will not be able to recover your wallet through Giddy. In offline mode, you will be able to export your private keys as needed so you retain full control of your wallet.

The safest path is to off-board your funds before May 15th. If you wait, you will need to rely on the offline mode described above, which requires the app to already be installed and your session to already be active on your device.

Winding down Giddy

We are winding Giddy down. The right path forward is to help every user off-board their funds safely over the coming weeks.

If you need help off-boarding your funds or have questions about your account, please contact us at support@giddy.co or through the in-app chat. Both will be available through May 15th.

This was not the outcome we were working towards. Thank you for being part of the Giddy journey.