The DeFi project Fluid on Ethereum suffered a security breach, resulting in the theft of approximately $215,000. The attack targeted Fluid's reward distribution mechanism, which uses a Merkle reward list requiring two private keys for operation. The attacker managed to obtain both keys, allowing them to submit and approve a reward list that directed funds solely to themselves. The stolen assets included 112,883 FLUID, 47,903 GHO, and a small amount of cbBTC, which were converted to ETH and laundered through Tornado Cash. Fluid's core systems, including its lending market, vault, DEX, and user deposits, remained secure. The team responded by replacing the compromised key and securing the remaining funds within 10 hours. However, their public statement only noted a temporary suspension of reward claims, omitting details about the key compromise and the financial loss.