BTC $81,546.50 -0.66%
ETH $2,431.33 -0.84%
BNB $721.22 -1.18%
XRP $1.30 -2.66%
SOL $104.93 -1.55%
TRX $0.3355 +0.12%
DOGE $0.0801 -2.39%
ADA $0.2228 -3.59%
BCH $276.17 -2.15%
LINK $12.25 -2.85%
HYPE $80.02 -1.76%
AAVE $155.82 -3.41%
SUI $1.00 -3.83%
XLM $0.1791 -2.52%
ZEC $1,175.35 -4.28%
AAPL $343.01 +0.06%
AMZN $249.86 -2.17%
GOOGL $340.04 -2.94%
MSFT $528.99 -2.23%
META $708.39 -4.29%
NVDA $214.96 -1.57%
TSLA $353.29 -7.49%
SNDK $1,299.74 -5.87%
INTC $89.87 -5.39%
SPCX $145.83 -4.18%
MU $882.32 -4.14%
AMD $532.03 -4.33%
BTC $81,546.50 -0.66%
ETH $2,431.33 -0.84%
BNB $721.22 -1.18%
XRP $1.30 -2.66%
SOL $104.93 -1.55%
TRX $0.3355 +0.12%
DOGE $0.0801 -2.39%
ADA $0.2228 -3.59%
BCH $276.17 -2.15%
LINK $12.25 -2.85%
HYPE $80.02 -1.76%
AAVE $155.82 -3.41%
SUI $1.00 -3.83%
XLM $0.1791 -2.52%
ZEC $1,175.35 -4.28%
AAPL $343.01 +0.06%
AMZN $249.86 -2.17%
GOOGL $340.04 -2.94%
MSFT $528.99 -2.23%
META $708.39 -4.29%
NVDA $214.96 -1.57%
TSLA $353.29 -7.49%
SNDK $1,299.74 -5.87%
INTC $89.87 -5.39%
SPCX $145.83 -4.18%
MU $882.32 -4.14%
AMD $532.03 -4.33%

eve

All
Article
Flash

first_img NEAR Intents released a post-mortem report, revealing that the $3.8 million vulnerability originated from a deposit notification flaw

The cross-chain exchange protocol NEAR Intents released a post-mortem report attributing a $3.8 million vulnerability to a flaw in the deposit notification feature. The protocol deploys a public settlement contract on NEAR that maintains an internal ledger of deposited tokens, while withdrawals transfer tokens out via a cross-chain bridge. The report was published by NEAR Intents General Manager Alex Shevchenko on October 16, stating that the attacker withdrew $3.8 million before the protocol was shut down on October 1 and returned all funds within 36 hours of detection, with all affected users fully compensated.The report indicates that the feature notifies third-party contracts when tokens are deposited. The attacker created a contract that intentionally caused the notification to fail, allowing the token contract to refund the deposit while NEAR Intents retained the corresponding ledger credit. Through 23 failed deposit transactions, the attacker accumulated $3.8 million in unsupported balance, referred to in the report as ghost funds, and subsequently withdrew real tokens based on this and transferred them to other chains via the Omni infrastructure. Shevchenko stated that this was a vulnerability in the NEAR Intents contract, not in the Omni infrastructure.Withdrawals occurred between September 29 and October 1. The settlement contract was paused and reopened on October 1, with affected routes gradually restored, and contract-side deposits resumed on October 2. The report noted that the vulnerability went undetected because monitoring only compared the original chain assets with the total balance of NEAR side tokens, without comparing the total internal user balances with the actual tokens held by the contract; the team has since added this check and will automatically pause the contract when there is a balance inconsistency. The fix for the October vulnerability was deployed on October 2, but another serious vulnerability report regarding the same feature prompted its complete removal on October 7, with the relevant researcher receiving a $300,000 reward.

Circle: Revenue in the first half of the year was 1.4 billion USD, with nearly 60% used for partner and transaction costs

On October 16, Circle announced that in the first half of 2026, the on-chain settlement amount of USDC exceeded $36 trillion, and Circle minted and redeemed over $315 billion of USDC during the same period, averaging about $1.7 billion per day. The company stated that as of June, USDC accounted for approximately 77% of the global stablecoin trading volume, an increase from 60% a year ago.More attention from the market is focused on the income distribution of USDC. Circle disclosed that the company generated approximately $1.4 billion in revenue in the first half of the year, of which about $819 million was allocated to USDC distribution partners and transaction costs, accounting for about 59% of the revenue; another approximately $473 million was invested in licensing, banking partnerships, settlement liquidity, compliance systems, product development, and multi-chain deployment, accounting for about 34%. According to the announcement, for every $1 of revenue Circle earns, it ultimately retains only about 7 cents in net profit.This announcement may be in response to market concerns regarding "the monopolization of reserve income by stablecoin issuers." Circle stated that partners can share corresponding reserve income by holding and expanding their USDC balances on their platforms; currently, more than 150 trading platforms, wallets, banks, fintech companies, payment platforms, and enterprises have formed economic interests tied to the growth of USDC. Circle also mentioned that Binance signed a five-year commercial agreement with it in September and invested $100 million in Circle.On the product side, Circle announced the expansion of its free redemption mechanism: all Circle customers can still redeem USDC for free through traditional banking channels, with the funds typically arriving within two business days; customers who make payments through the Circle Payments Network or use eligible products such as Arc, Circle Mint, and Circle Wallets will be able to enjoy free, near-real-time redemption capabilities.
app_icon
ChainCatcher Building the Web3 world with innovations.