ltin

Cosmos Labs released a technical report, admitting that it previously misjudged an integer underflow vulnerability in the Cosmos EVM, which led to attacks on six blockchain networks between August 20 and 25, resulting in a total theft of approximately $5.7 million in tokens. The attacker exploited the vulnerability to underflow account balances to the maximum value of 2^256-1, then performed a reverse operation to transfer the inflated balance out, thereby stealing tokens from the target accounts without creating tokens out of thin air.The report shows that researchers submitted the defect through a bug bounty program on April 25, but testers were unable to reproduce it on the existing Cosmos chain configuration, so Cosmos Labs silently patched it in May. Independent researchers confirmed in early August that the vulnerability affected all Cosmos EVM chains, and Cosmos Labs released a patch on August 19, but the first attack occurred about 20 hours later.In terms of specific losses, MANTRA lost 720.9 million tokens (approximately $3.6 million), TAC lost nearly 3 billion TAC, and KiiChain lost about 148 million KII. Both MANTRA and KiiChain criticized Cosmos Labs for not notifying the affected chains in advance and suggesting a shutdown, with KiiChain stating that the patch would take several days to deploy while a shutdown would only take a few minutes. Cosmos Labs stated that it has coordinated responses with 40 chains and assisted 13 chains in completing repairs or shutdowns before being attacked.

Ajna stated that the protocol was attacked due to a vulnerability, and they are currently investigating abnormal fund flows. They recommend that users withdraw all funds, repay loans, and suspend interactions with the protocol.This incident involves liquidity pools such as syrupUSDC, wstETH, rETH, cbETH, WBTC, WETH/USDC, sDAI, with losses of approximately $775,000, attributed to a liquidation accounting manipulation attack.

According to monitoring by Onchain Lens, the Hyperliquid trader pension-usdt.eth's short position of $191.6 million in ETH held over the past two months was ultimately liquidated, resulting in a loss of approximately $23.93 million.Nevertheless, the trader has still accumulated an overall profit of about $17.22 million.

The blockchain gaming platform The Sandbox stated that it will compensate users who held bridged SAND on Base or BNB Smart Chain at a 1:1 ratio before the bridge vulnerability attack, with compensation provided in Ethereum-based SAND from the project treasury, and there will be no token issuance. This attack resulted in the theft of approximately 14.744 million SAND from the Ethereum treasury, valued at about $700,000.The application process is expected to open within two weeks and will last for two weeks; over 72% of the balances held by two centralized exchanges that meet the compensation criteria will be directly compensated to affected customers. The Sandbox indicated that the attacker exploited a configuration vulnerability in the SAND contracts on Base and BNB Chain, becoming the sole validator of bridge messages and minting unbacked tokens. Additionally, over 339 trillion unbacked SAND was minted on the two networks but has been isolated and cannot be cross-chain or exchanged; SAND on Ethereum and Polygon remains unaffected, and the compromised bridge contracts will be permanently disabled.

According to TenArmorAlert monitoring, the CCC token on the BSC chain was attacked, resulting in a loss of approximately $117,000.The attack exploited the contract's sell() function to destroy CCC tokens from the LP pool, causing abnormal price fluctuations.

The decentralized lending protocol Moonwell is investigating issues affecting the MAMO Core Market on Base. Security firms CertiK and PeckShield have flagged a multi-million dollar exploit incident, estimating losses of approximately $8.7 million.Moonwell stated on X that as a precaution, the borrowing limit for all Core Markets on Base has been set to 1 wei, and the supply limits for MAMO and WELL have also been set to 1 wei. PeckShield noted that the attacker aggregated stolen funds to an address for the DAI stablecoin; CertiK indicated that the attacker manipulated the collateral price of the low liquidity MAMO token and then borrowed real cbBTC from the mCBTC market to carry out the attack, with Blockaid also identifying the same attack mechanism.As a result, the WELL token dropped about 13% in 24 hours, while MAMO fell about 9%. This exploit incident is part of a period of frequent DeFi vulnerabilities since April, during which multiple protocols have been hacked for over $600 million, with the largest being a $292 million exploit of Kelp DAO.

According to monitoring by Blockaid, its vulnerability detection system has found suspicious activity on the Base chain related to Moonwell. Attackers manipulated the MAMO collateral price to borrow cbBTC from the mCBTC market.The currently observed impact is the transfer of 50.6 cbBTC (worth over 4 million USD).

Enjin's ERC-1155 "Crypto Items" allows each item to route transfers through a dedicated item adapter. Attackers register and use malicious transfer adapters to bypass owner approval checks, allowing their vulnerable contracts to extract ENJ-supported items from about 52 unrelated holder wallets without approval via transferFrom.Subsequently, the attackers call melt() on each stolen item, redeeming 500 ENJ for each item from the platform's reserves.

Famous internet celebrity Di Shi revealed during a live broadcast that he was set up by his friend Sun Zeyu (founder of Genesis Capital), whom he had known for 8 years in the blockchain circle, resulting in cumulative losses of tens of millions of yuan. He stated that he had always regarded the other party as a reliable friend, not only allowing him to buy cryptocurrencies like Bitcoin and Ethereum but also investing in the exchange that the other party operated in South Korea.Investigations found that some of the so-called "Ethereum" he received might actually just be fake chain assets specifically built by the other party. Di Shi claimed that there were only 7 addresses on that chain, 6 of which were related to the other party, and only 1 was his own. During this time, the other party was even able to help him "cash out" hundreds of thousands of yuan, making the scam appear extremely real. This scheme lasted for 8 years, and if it had not been discovered in time, the losses could have reached hundreds of millions of yuan after the price of coins increased.

According to TenArmorAlert monitoring, the FH token on the BSC chain was attacked, resulting in a loss of approximately $20,000.

The development team of Term Finance, Term Labs, announced that after the governance attack incident, all Term Meta Vaults have been permanently closed, DAO governance rights have been revoked, but the withdrawal channel remains open. In an update on August 23, Term stated that this closure is irreversible and permanently prevents subsequent deposits, but did not disclose the scale of the remaining assets in the vault, only indicating that it will "explore pathways" to address any gaps, and the amount that depositors can recover remains undecided.Blockchain security company PeckShield estimates that the attacker stole approximately 2,843 ETH (worth about $6.87 million at the time) and 1.68 million USDC (which was later exchanged for about 1.68 million DAI), with total losses estimated at around $8.5 million. On-chain records confirm the related transfers: one transaction transferred 2,841.74 WETH to an address labeled "Term Finance Exploiter 1" by Etherscan, while another transaction transferred 1.68 million USDC to an address labeled "Term Finance Exploiter 2".Yearn stated that Term's vault contract uses its V3 architecture, but the attack occurred on Term's custom governance wrapper, which is not applicable to standard Yearn vaults. Term indicated that, according to the current investigation, its underlying protocol and direct lending market were not affected and is working with external security teams for remediation and recovery, but did not provide any compensation commitments or timelines.

According to AI Aunt (@ai_9684xtpa), "Set 10 big goals first" has stopped losses and exited the market. The additional short positions added by the relevant account have all been closed; thus, the total of the three trades after this "comeback" is in a loss state, but it is just a profit withdrawal (it was previously disclosed that the total profit was around 70 million USD).In terms of specific gains and losses, the long position made a profit of 20 million USD; the first short position incurred a loss of 6.283 million USD; the first half of the second short position had a certain loss of 10.158 million USD, while the loss amount for the second half is unknown, expected to be around 9 million USD.

The Responsible Fintech Institute (RFI) and the cryptocurrency asset custody infrastructure provider Safeheron announced the launch of a pilot program for quantum-resistant digital asset wallets and on-chain transfers, with participants from Europe, the Middle East, and Asia. The pilot operates on the quantum-resistant NEAR testnet and uses a multiparty computation protocol that supports the ML-DSA-65 standard.Participating regulatory bodies include the Abu Dhabi Global Market, Bhutan's Gelephu Financial Services Office, and Malta's Financial Services Authority, with Bison Bank and DK Bank participating as financial institutions. The banks will test wallet generation and transfers in a shared application environment, while regulatory bodies will observe in the initial phase and later participate in governance workflows. The organizers plan to release a white paper covering research, protocol design, and testing results, and gradually open-source the underlying technology. The Hong Kong Monetary Authority plans to prepare the Hong Kong banking sector to fully address quantum security risks by 2030, while a report from the Bank for International Settlements published in 2025 suggests that financial institutions should migrate to quantum-resistant systems in phases.

According to CertiK monitoring, Term Labs suffered a governance attack, resulting in a loss of approximately 8.5 million dollars in assets. Currently, the attacker's address holds 2,843 ETH (approximately 7.1 million dollars) and about 1.6 million DAI.

According to monitoring by PeckShieldAlert, the address marked as Bofur Capital suffered an address poisoning attack after withdrawing from Compound, resulting in a loss of approximately 2 million USD.The phisher sent a dust transaction of 0.0002 USDC, forging a similar address. The victim mistakenly used the wrong address when copying and pasting, leading to the theft of funds. The stolen funds have been exchanged for approximately 2 million DAI.

According to Forbes, Anthropic, Blackstone, and Goldman Sachs have jointly established an AI-native enterprise service company called "Ode," with an investment of $1.5 billion.Ode is positioned as an AI implementation consulting firm, with core services including identifying business processes suitable for AI transformation, deploying AI engineers, developing customized applications and agents, automating task processes, and assisting companies with regulatory compliance issues. The company will focus on helping client enterprises implement the Claude model under Anthropic.

According to Onchain Lens monitoring, the ETH short position of Hyperliquid trader pension-usdt.eth was liquidated, involving an exposure of approximately $108.18 million.On-chain data shows that this liquidation resulted in a loss of about $26.66 million for the trader, but their historical cumulative earnings remain positive, with a total profit of $17.76 million. Previously, this address held approximately 50,000 ETH short positions, valued at around $85 million. The trader's address is: 0x0ddf9bae2af4b874b96d287a5ad42eb47138a902.

According to on-chain analyst @ai_9684xtpa, a rolling short position of $117 million in BTC whales has been completely liquidated, resulting in a final loss of $2.92 million.

Maya Protocol founder AaluxxMyth disclosed that the protocol was attacked, resulting in approximately 20 BTC (about 1.4 million USD) and other assets (about 300,000 USD) being stolen. The team has suspended global operations to control losses and is working to fix vulnerabilities to restore trading.Most of the losses came from arbitrage and pool fees caused by extreme slippage. The team is communicating with relevant parties and plans to recover funds through investments such as those in Aztec Chain. If 20 BTC is returned to the pool, the price of CACAO tokens will return to 0.115 USD. The team also hopes the attacker will accept the bug bounty and return the funds.

The pricing logic in the ethFromDefund() redemption function of the USM contract defund() has flaws. This function calculates the consideration for a single redemption using the arithmetic average of the current FUM selling price and the estimated terminal FUM selling price, but this algorithm lacks split invariance.After adding the state contraction coefficient adjShrinkFactor associated with a single redemption and the integer rounding mechanism, the total amount of Ethereum that can be extracted from splitting an equal amount of FUM assets into 64 small redemption operations will be significantly higher than that obtained from a one-time large redemption.