ln

On August 20, MANTRA Chain released a complete review report of the security incident, confirming that the attacker exploited an unsigned integer underflow vulnerability in the balance accounting layer of the upstream dependency cosmos/evm, unauthorizedly transferring a total of 720,923,967.99 MANTRA from two addresses, valued at approximately 3.6 million dollars based on the price before the attack. Among them, the attacker transferred 600,000,035.56 MANTRA from the on-chain burn address and 120,923,932.44 MANTRA from a genesis-era multi-signature address related to an early incentive program.MANTRA stated that this incident did not involve the leakage of validator keys, administrator privileges, governance control, or multi-signature signers; the attacker did not require privileged access and could complete the attack solely through unauthorized contract deployment and self-funded wallets. The first abnormal transfer occurred at 19:06 UTC on August 20, when the attacker transferred approximately 600 million MANTRA from the burn address; subsequently, at 22:59 UTC, another transfer of approximately 120.9 million MANTRA was made. The chain subsequently stopped operating at 23:13 UTC and resumed after upgrading to v8.4.0. The entire network interruption lasted for 30 hours and 13 minutes.This vulnerability was not an issue with MANTRA's self-developed code but originated from the cosmos/evm module, which is responsible for providing EVM functionality on the Cosmos SDK. The vulnerability allowed the attacker to execute unsigned balance deductions without checking if the balance was sufficient, causing an overflow of values and bypassing normal account authorization logic. MANTRA stated that as of today, no funds have been recovered, with approximately 37.96 million MANTRA (accounting for 5.27% of the total transferred) still remaining in the attacker's address, which has been frozen due to the chain's suspension and v8.4.0 restrictions. The remaining funds have flowed to related trading platforms, and the recovery efforts have entered the law enforcement investigation stage. In the future, monitoring of accounts that cannot normally authorize transfers, burn addresses, and other historically "non-transferable" addresses will be strengthened, and efforts will be made to promote improvements in the security vulnerability disclosure process within the Cosmos ecosystem.

The blockchain gaming platform The Sandbox stated that it will compensate users who held bridged SAND on Base or BNB Smart Chain at a 1:1 ratio before the bridge vulnerability attack, with compensation provided in Ethereum-based SAND from the project treasury, and there will be no token issuance. This attack resulted in the theft of approximately 14.744 million SAND from the Ethereum treasury, valued at about $700,000.The application process is expected to open within two weeks and will last for two weeks; over 72% of the balances held by two centralized exchanges that meet the compensation criteria will be directly compensated to affected customers. The Sandbox indicated that the attacker exploited a configuration vulnerability in the SAND contracts on Base and BNB Chain, becoming the sole validator of bridge messages and minting unbacked tokens. Additionally, over 339 trillion unbacked SAND was minted on the two networks but has been isolated and cannot be cross-chain or exchanged; SAND on Ethereum and Polygon remains unaffected, and the compromised bridge contracts will be permanently disabled.

Yesterday, Ledger disclosed details of the LSB 023 security vulnerability on its official website. Some applications built on the Ledger Secure SDK may still receive new APDU commands during the user screen confirmation, leading to inconsistencies between the parameters displayed on the screen and the final signature parameters.In cases where the attacker controls the APDU communication between the device and the host, after the user confirms the operation shown on the screen, the device may generate a signature with different parameters. Ledger stated that it has fixed the issue through application-level checks and the SDK layer, and released Ledger Secure SDK v26.6.1 on August 21. The relevant applications have been rebuilt and released. Users need to update the applications through Ledger Live; merely updating the device firmware is insufficient to complete the fix. However, Ledger claims there is currently no evidence that the vulnerability has been exploited.

The decentralized lending protocol Moonwell is investigating issues affecting the MAMO Core Market on Base. Security firms CertiK and PeckShield have flagged a multi-million dollar exploit incident, estimating losses of approximately $8.7 million.Moonwell stated on X that as a precaution, the borrowing limit for all Core Markets on Base has been set to 1 wei, and the supply limits for MAMO and WELL have also been set to 1 wei. PeckShield noted that the attacker aggregated stolen funds to an address for the DAI stablecoin; CertiK indicated that the attacker manipulated the collateral price of the low liquidity MAMO token and then borrowed real cbBTC from the mCBTC market to carry out the attack, with Blockaid also identifying the same attack mechanism.As a result, the WELL token dropped about 13% in 24 hours, while MAMO fell about 9%. This exploit incident is part of a period of frequent DeFi vulnerabilities since April, during which multiple protocols have been hacked for over $600 million, with the largest being a $292 million exploit of Kelp DAO.

According to CoinDesk, the developers of the Bitcoin Lightning Network payment software Core Lightning (CLN) issued an urgent warning to node operators after the team received a large number of AI-generated security reports, revealing several real vulnerabilities. The development team advised operators not to directly shut down the machine power but to restart the software in "--offline" mode, which stops communication with other Lightning Network nodes while still keeping it operational to continuously monitor the Bitcoin blockchain and protect the funds in the payment channels.The Core Lightning team began receiving a large number of AI-generated vulnerability reports since early August, some of which have been confirmed to be valid. Developers will keep the details confidential for two weeks to complete the patch development and plan to release a signed patch version for operators to verify the source. The source code and vulnerability details will be made public after the confidentiality period ends.This is the second AI-related security incident in the Lightning Network this month. Earlier in early August, BTCPay Server experienced a vulnerability that led to the leakage of credentials for some Lightning Network nodes and theft of funds. Additionally, the "Bitcoin Red Team," composed of 16 developers, used AI models to scan 390 Bitcoin code repositories at the end of July, discovering nearly 5,000 issues, 85 of which were rated as critical.

The Sandbox released an incident analysis report on the vulnerability on August 22. The report shows that attackers exploited vulnerabilities in cross-chain configuration contracts on the Base and BNB Smart Chain (BSC) to steal 14,742,341.84 SAND from the Ethereum treasury, accounting for approximately 0.5% of the maximum supply, with an estimated economic impact of about $1.4968 million, of which approximately $987,000 was actually intercepted by the attackers. The Ethereum mainnet and Polygon network were not affected.Please do not purchase or send SAND on Base or BNB Smart Chain until further notice. The contracts deployed on Base and BNB Smart Chain have been permanently disabled and will not be reopened. The Sandbox stated that the team has reported the attackers' wallet addresses to blockchain analysis companies TRM Labs and Chainalysis and is in direct communication with relevant exchanges.The Sandbox also announced a compensation plan, which will compensate wallets that legally held cross-chain SAND on Base or BSC before the incident at a 1:1 ratio with Ethereum SAND. The compensation funds will come from The Sandbox treasury, and no new tokens will be issued. The application process will open in the next two weeks and will remain open for two weeks.

Enjin's ERC-1155 "Crypto Items" allows each item to route transfers through a dedicated item adapter. Attackers register and use malicious transfer adapters to bypass owner approval checks, allowing their vulnerable contracts to extract ENJ-supported items from about 52 unrelated holder wallets without approval via transferFrom.Subsequently, the attackers call melt() on each stolen item, redeeming 500 ENJ for each item from the platform's reserves.

Ledger's Chief Technology Officer Charles Guillemet stated that there has recently been "FUD" targeting Ledger in the market, as a smart contract security company claimed to have discovered vulnerabilities in the Ledger Ethereum application. Guillemet mentioned that there indeed were vulnerabilities related to certain Clear Signing processes in the Ledger Ethereum application, but these vulnerabilities were discovered by Ledger's security research team Donjon using AI-driven vulnerability research tools, and the fixes were completed and deployed two weeks ago. Users can obtain protection by timely updating their Ledger device firmware and applications.The relevant security company contacted Ledger's bug bounty program only after the fixes were completed, did not follow responsible disclosure processes, and did not communicate with the bug bounty team, yet implied in subsequent content that the issue had not been resolved. This approach is not true security research but rather a way to create panic for attention. AI is changing the cybersecurity landscape, and both attackers and defenders can enhance efficiency with AI, but AI-driven security research can only truly enhance the security of the entire ecosystem when basic security principles such as responsible disclosure and pre-release verification are followed.Guillemet finally reminded Ledger users to keep their device firmware, Ledger applications, and related software up to date to automatically receive the latest security fixes and research results. Users should not be influenced by the related "FUD" and should timely update their software and maintain safe habits.

Coinkite's hardware wallet Coldcard has been exposed for a serious entropy vulnerability, which has gone undetected since 2021, resulting in over $100 million in Bitcoin being stolen, with victims mostly being users of single mnemonic wallets. The weak entropy allowed attackers to guess private keys through customized means, prompting the Bitcoin community to reassess the reliability of single-signature self-custody.Against this backdrop, multi-vendor multisig solutions are becoming the new custody baseline recommended by long-term holders. This solution requires users to construct multisig addresses using keys from different wallet vendors, such as Trezor Safe 7, Ledger Nano, and Casa recovery keys to form a 2-of-3 multisig, thereby reducing reliance on a single hardware vendor. Multisig can also defend against wrench attacks and has given rise to Bitcoin insurance services priced in BTC, such as AnchorWatch.However, multisig also has its drawbacks; users not only need to keep threshold keys but also need to save copies of the multisig script or template to independently recover funds when the wallet service is offline.

Bitcoin News posted on the X platform that BTC Sessions stated their team spent several weeks assisting Bitcoin holders affected by the Coldcard vulnerability in transferring their funds to safety, estimating that they protected Bitcoin worth tens of millions of dollars during this period. However, for many, it was too late.A member of the local Bitcoin community lost 90% of their Bitcoin, while another woman who spoke with them lost all of her Bitcoin. BTC Sessions stated that this could be the most severe self-custody incident in Bitcoin history. BTC Sessions indicated that this experience prompted them to rethink asset custody, with diversified security measures becoming a key lesson.

The real-time market application underlying protocol Linera announces the opening of pre-registration for the $LNRA community round, aimed at traders, badge recipients, community members, and external participants, allowing for token purchases before Season 1 and TGE. Pre-registration is open from now until September 1 UTC, with the subscription period from September 1 to 8 UTC. Participants can join at a fixed price / FDV using USDC on Base through sale.linera.net, with round pricing and scale to be announced on August 28.This round is divided into a reserved pool for badge holders and an open pool for all registered users. Badges can be earned daily through trading and social activities on app.linera.xyz and claimed at portal.linera.net. Higher levels and points determine the priority order for the reserved pool; the open pool is allocated proportionally, with a single wallet limit of $100,000. For every $1 committed, 1 Commitment Credit is earned, which can be used for fee-free trading volume in Season 1 on app.linera.xyz, with refunds also counted.It is reported that 65% of the total supply belongs to the community (including reserves and this pre-sale), while investors and early contributors hold a total of 25%, with a three-year vesting period from distribution. Linera claims there are currently about 50,000 traders, over 80 million predictions, and over 2 billion test trades, nearing the launch of the mainnet.

Decred, a blockchain, stated that between August 16 and 17, its mainnet inflation vulnerability was exploited, resulting in the generation of approximately 2077.97 DCR. This vulnerability has existed in the consensus code since the mainnet launch in February 2016, stemming from improper edge case handling during the interaction between the regular transaction tree and the stake transaction tree, allowing double-spending inputs.The vulnerability was reported on August 12 through a bounty program but was exploited before a fix could be implemented. Decred has decided not to roll back to minimize the impact on users. The issuance of approximately 2000 additional DCR does not affect the hard cap of 21 million coins and is far below the historical subsidies lost due to underissuance, which exceeded 215,000 coins. Currently, the team has developed additional double-spending monitoring services and plans to improve the emergency upgrade signaling mechanism.

JPMorgan Chase and Santander Bank will lead the financing support of up to $15 billion for the Argentine liquefied natural gas project.

TAC posted on platform X that an attacker exploited a vulnerability in the Cosmos EVM precompiled layer to transfer 2,985,651,403 TAC from a single account on the TAC network.The project team subsequently paused the network at block height 24,671,475 to prevent the attack from continuing.

According to monitoring by Galaxy's research director, the Coldcard vulnerability incident involved 8,865 addresses, resulting in a total loss of 1,789.28 BTC, valued at $114.7 million at the time of theft, currently worth $138.8 million.By address statistics, the median loss per address was 0.00152 BTC, with an average of 0.20184 BTC; the median dormancy period was 3.2 years, with an average of 3.6 years. In 221 victim reports, the median loss was 1.04272 BTC, with an average of 3.57792 BTC; the median dormancy period was 3.25 years, with an average of 2.99 years. The losses reported by victims amounted to 790.72 BTC, accounting for 44.2% of the total loss. If medium-confidence losses are included, and the related losses have not yet been confirmed, the total loss will reach 1,824 BTC, valued at $140 million based on the price at the time of loss.

The Ethereum client Besu has fixed five security vulnerabilities discovered by the blockchain security company CertiK in version 26.7.1 released on July 27, and published four detailed security announcements on August 14. The details of the vulnerabilities were disclosed later to allow node operators to complete the upgrade deployment.Jialiang Chang, CertiK's Director of Security Engineering and Senior Audit Partner, stated that the arrangement of releasing patches first and details later provides an 18-day buffer period, allowing node operators to identify affected deployments, test the new version, and coordinate with validators or consortium participants to complete the upgrade. The relevant vulnerabilities involve block broadcasting processing, future height consensus proposal caching, WebSocket subscription limits, and JSON-RPC filter creation. If not fixed, attackers could exhaust node memory or thread resources, affecting node availability and consensus processing.CertiK conducted adversarial testing on peer-to-peer, HTTP RPC, WebSocket RPC, and consensus interfaces in a private multi-node test network using the Chain Scan method, and provided reproducible testing tools to the Besu team. CertiK is updating Chain Scan to expand around-the-clock multi-node testing for public chain networks.

In response to the recent rumors about "vulnerabilities in the Ledger Ethereum application," Ledger's Chief Technology Officer Charles Guillemet tweeted that there was indeed a bug related to a specific clearance process, which was discovered by Ledger's security team Donjon using AI vulnerability research tools.The vulnerability has been fixed and deployed two weeks ago. Users just need to keep the Ledger application updated to be protected.

According to TAC monitoring, TAC stated that it is investigating a vulnerability attack incident targeting its EVM side based on Cosmos, which only affects the TAC token supply.The team is collaborating with TAC validators to temporarily suspend blockchain operations and will provide timely updates on the investigation results and chain recovery plans. Users are advised to obtain the latest news only through official channels.

The Sandbox official stated that the team has confirmed and fully controlled the recent SAND cross-chain bridge vulnerability incident, involving the Base and BNB Smart Chain (BSC) networks.The official said that the impact of this incident is limited, involving less than 0.01% of the total supply of SAND tokens. SAND on Ethereum and Polygon is unaffected, and user wallets have not been compromised; related token holders and liquidity providers do not need to take action.According to disclosures, the attacker minted uncollateralized SAND tokens on the Base and BSC networks through the vulnerability. Currently, The Sandbox has disabled the SAND cross-chain functionality on both networks, and SAND on Base and BSC has been isolated, temporarily unable to be transferred or exchanged.The Sandbox reminds users not to buy, sell, or trade SAND on the Base and BSC networks, as liquidity on these networks has been affected.The team stated that they have completed a snapshot before the incident and are formulating a compensation plan for affected liquidity pool (LP) users, while continuing to investigate the scope of the vulnerability's impact. A complete incident report and technical review will be released subsequently.

According to on-chain analyst Onchain Lens (@OnchainLens), Grayscale's GLNK ETF received 132,950 LINK from Coinbase Prime 6 hours ago, worth approximately $1.53 million.Currently, the ETF holds a total of 10.66 million LINK, with assets under management (AUM) of approximately $124.16 million.