Nitron Exploit Update: Recovery, Restitution & Next Steps

Since the Nitron lending market exploit, we've been working tirelessly on recovery, and formulating a fair restitution plan.

Here’s a comprehensive update on what we’ve done so far, how we plan to compensate affected users, and what we’re building next to ensure this never happens again.

✅ What We've Done So Far

🚓 1. Reached Out to the Attacker

• We sent an on-chain message offering a $120,000 bounty in exchange for the safe return of funds. You can view the message here: View Transaction.
• This was sent 72 hours ago. If no contact is received within the next 24 hours, we will proceed with further criminal procedures and law enforcement escalation.

🔐 2. Recovered a Portion of the Funds

• We are actively coordinating with multiple partners which include infrastructure providers and exchanges to recover funds.
• With support from these partners, we have managed to recover $78,066, which is 8.2% of the stolen amount. To avoid giving information to the exploiter, we will refrain from publicly crediting our partners at this time. We’ll share full acknowledgements at a later date.
• We anticipate further recovery of funds.

💙 Our Restitution Plan

To ensure fairness for affected lenders while preserving the long-term health of the platform, we are introducing a recovery token system as a flexible and transparent solution within 30 days.

🎟️ Introducing: nLEND – The Nitron Lender Recovery Token

• nLEND is a token that represents a $1 claim on unrecovered funds (1 nLEND = $1 claim).
• It will be distributed to users who lent tokens on Nitron that were partially or fully lost during the exploit.
• The conversion price used for each asset lost will be that of the exploit date, and fixed using the same table we used in our previous post:

🔄 How It Works

• For any token with a shortfall, the unrecovered portion of each user's lent position will be converted to nLEND.
• The remaining intact portion of lending will remain as-is and continue to be reflected in their balance.

Example:

Let’s say:

• $100,000 of a token was lent in total.
• $40,000 was borrowed before the exploit and remains unaffected.
• $60,000 was stolen.

In this case:

• The $40,000 will remain as active lending.
• The $60,000 will be distributed as nLEND tokens.
• A user who lent $1 will now have $0.40 of active lending and $0.60 of nLEND tokens.

🔁 Redemption of nLEND

nLEND will be redeemable for USDC via a redemption pool at the following dynamic rate:

Redemption Price = (RecoveredAmount + TopUpAmount - RedeemedAmount) / (950,5566 - nLENDTotalSupply)

• This redemption rate remains the same for all users regardless of who redeems first, as long as no new funds are recovered or topped up.
• At launch, based on the frozen $78,066, redemption starts at ~$0.082 per nLEND.
• Once nLEND is redeemed by a user, they are relinquishing further claims on recovery for that amount (1 nLEND redeemed = $1 of claim relinquished).
  • This means that redeeming early is may result in a lower value redeemed that what is possible later.
• Redemptions will be paused during any recovery or top-up event to update the pool and announce the new redemption rate before reopening.
  • Other than that, redemptions can be done at any time after launch, even if every user redeems.

Example:

• If 50% of users redeem immediately at $0.082, and full recovery or top-up is achieved right after, the remaining users will have a redemption rate of: (950,556 * 0.918) / (950,556 - 475,278) ≈ $1.836
• i.e. the remaining users would be able to redeem at 1.836x of their initial claim value.

💰 Top-Up Commitment

• Until full recovery, we are committed to topping up at least 25% of any fundraising efforts secured.
• This ensures that even if legal recovery efforts stall, nLEND retains real, redeemable value.

📈 Upside Path via DMX if Recovery Falls Short

If full recovery is not achieved after 12 months, any remaining nLEND will be converted to DMX at a 150% redemption rate.

• The DMX price used will be the lower of:
  • DMX launch price, or
  • DMX price after 1 year

Example Scenarios:

• If DMX launches at $1 and is worth $10 in a year → each nLEND = $15 of DMX (15x rate).
• If DMX launches at $1 and is worth $0.10 in a year → each nLEND = $1.50 of DMX (1.5x rate).

This offers users the option to wait for possible improved redemption without being losing out entirely if recovery falls short.

This also means that redeeming earlier will always result in a lower redemption face value.

⚖️ Why We’re Taking This Path

We want to be clear: we take full responsibility for this incident. This exploit happened due to a vulnerability that should have been prevented, and it impacted one of our most valuable communities — the lenders who trusted Nitron and Demex.

This approach ensures that all stakeholders, including both supporters of the platform as well as lenders, have the best possible path to recovery and long-term value creation.

We believe that protocol risk should be balanced between the various stakeholders at the end of the day, and this recovery approach reflects that.

❌ Immediate Repayment

An immediate repayment using all treasury reserves would:

• Eliminate the funds needed to support protocol recovery efforts and legal actions, which would doom the recovery efforts entirely — removing any chance of catching the attacker and making lenders whole.
• Force a wind-down of the platform, undermining the value of all protocol stakeholders, effectively zeroing out all SWTH and DMX points holders, including those who contributed time, capital, and effort to build and support the ecosystem.

✅ The Hybrid Recovery Approach

Instead of that zero-sum outcome, we are introducing a recovery structure that:

• Balances the interest of platform supporters vs lenders
• Protects remaining contributors and the future of the platform
• Ensures lenders get a fair, transparent, and potentially increasing recovery
• Allows lenders to exit anytime if they feel the compensation is sufficient
• Shares upside with those who wait, possibly even converting them into supporters of the protocol in time

Everyone shares the burden in this approach, but everyone also shares in the potential upside. It gives us a real shot at making lenders whole without destroying the platform that has powered so much for so long.

This plan is not about avoiding responsibility. We’ve already recovered a portion of funds, and we are committing to keep recovery as our top priority, while channeling top-ups from various sources.

This plan is truly about ensuring we act as fairly as possible to all stakeholders in a fashion that still promotes growth.

🛠 What’s Coming within the Next 30 Days

• ⚙️ Launching an on-chain upgrade to handle token migration and nLEND issuance
• 💱 Rolling out the nLEND-to-USDC redemption facility
• 🛡 Adding global withdrawal rate limiters to the Demex chain
• 📊 A very safe launch of cross-margin trading alongside the new safeguards and limits

🌀 What’s Next for Nitron

• Nitron lending will remain in non-borrow mode for now.
• If and when we re-enable lending, it will be through a redeployment via Nitron v2 with:
  • Stricter supply and borrow caps
  • Better oracle protection mechanisms
  • Tighter review processes

🙏 Final Words

We’re deeply sorry to all users impacted by this exploit. This has been a difficult but clarifying moment for the team, and we’re more committed than ever to building a platform that is both resilient and fair.

Thank you for bearing with us — your trust matters, and we’re working hard to earn it back.

— The Demex Team