Fluid lost 125k FLUID and 51.9k GHO due to a key compromise. A wallet was able to claim rewards from multiple Fluid Merkle distributors using empty-proof Merkle claims, then swap funds and route ETH into Tornado Cash.
The timeline on Ethereum was very tight: proposer submits root, approver approves it, exploiter claims FLUID ~24 seconds after proposal. The GHO claim followed minutes later. The same wallet then swapped the claimed GHO and FLUID, bridged some Base/Arbitrum proceeds out, and later deposited ETH into Tornado Cash Router.
Several hours later, an admin-style batched tx removed the old proposer/approver roles across multiple Fluid rewards contracts.
Fluid has told users that Merkle reward claiming is temporarily paused for a few days, potentially up to a week, while updates are made. Rewards will continue accumulating retroactively and claiming will resume once updates are complete. No communication about a key compromise or loss of funds.
