originate

The cross-chain protocol Axelar Network released a statement regarding the recent security incident related to Secret Network, stating that there is a misunderstanding within the community about the event. Both Axelar and the Inter-Blockchain Communication Protocol (IBC) were not attacked or compromised. The affected token smart contracts were neither developed, deployed, nor maintained by Axelar, and Axelar's firewall mechanism also prevented the impact from spreading to other chains.It is reported that the exploited contract is a forked version based on CW20-ICS20, but the developers removed two core security checks, resulting in an "infinite minting" vulnerability. By deleting the verification mechanisms originally used to prevent such issues, this fork altered the original trust model of the contract and did not undergo a new security audit.Axelar Network explained that anyone can deploy contracts for cross-chain asset wrapping through IBC, and similar contracts have also been used to wrap tokens from other chains into Secret Network. However, the Secret side fork version in this incident has vulnerabilities due to the removal of key security checks. This incident is not a unique logical flaw, nor is it an issue with the IBC protocol itself, but rather a security risk introduced by modifications to third-party contracts.

Syndicate has released an update regarding the recent security incident, stating that the leakage of private keys led to the malicious upgrade of bridging contracts on two chains, resulting in the theft of approximately 18.5 million SYND (about $330,000) and around $50,000 in customer tokens. Affected users will receive full compensation, and SYND holders will receive additional compensation.The attack involved multi-stage reconnaissance, infrastructure mapping, vulnerability exploitation development, and precise timing, ruling out the possibility of insider involvement. The root cause of the vulnerability was the storage of private keys in a password manager, and the upgrade process did not utilize multi-signature or hardware signing. Syndicate is strengthening security measures, including adding an encryption layer outside the password manager and implementing multi-signature or hardware signing for the upgrade path.

The blockchain interoperability protocol Hyperbridge disclosed details of the previous DOT attack incident, resulting in a loss of approximately $237,000. The root of the vulnerability lies in the HandlerV1 contract's VerifyProof() function, which lacks input validation and does not verify the leaf_index leafCount, allowing attackers to forge Merkle proofs.Using this, the attacker gained administrator privileges for the DOT token bridging contract on Ethereum, subsequently minting 1 billion bridged DOT (which is about 2800 times the legitimate circulation of approximately 356,000) and cashing out on decentralized exchanges. Hyperbridge stated that it is currently working with security partners to trace the funds, and cross-chain functionality will remain suspended until the investigation is completed.

Venus Protocol released a statement regarding the THE market event, stating that this incident was not a flash loan attack, but rather a result of the attacker exploiting a supply cap vulnerability in the old code of the protocol. The team indicated that the attacker had been accumulating THE tokens for about 9 months, gradually establishing a dominant supply position on Venus.The announcement pointed out that the attacker bypassed the normal deposit process by directly transferring THE tokens into the protocol contract, thereby breaking through the supply cap limit of 14.5 million THE. They manipulated DEX prices by taking advantage of the low on-chain liquidity. As the external price was gradually reflected by the TWAP oracle, the attacker borrowed assets (such as CAKE, BNB, etc.) against the inflated collateral value, then bought more THE to drive up the price, and continuously transferred THE into the vTHE market to increase the collateral value. This cycle once pushed the price from about $0.27 to about $0.53, ultimately leaving bad debt in the protocol after the positions were liquidated.Venus stated that it has currently suspended the THE market, reduced its collateral factor to 0, and suspended withdrawals. Additionally, as a precautionary measure, the collateral factors for 8 markets including BCH, LTC, AAVE, POL, FIL, TWT, UNI, and lisUSD have also been reduced to 0. The team and security partners are continuing to investigate and will release a complete post-analysis report in the future.

According to BlockSec monitoring, Inverse Finance is suspected of suffering a loss of approximately $240,000 due to an attack. YAM Finance responded in a post on platform X, stating that this incident is not a vulnerability in the Inverse contract, but rather related to the LlamaLend mechanism.According to their explanation, the attacker initiated a "donation attack" on sDOLA on LlamaLend, driving the price from about 1.188 sDOLA = 1 DOLA up to about 1.358 sDOLA = 1 DOLA, and subsequently liquidated almost all user positions that had crvUSD borrowed against sDOLA as collateral. It is still unclear why the increase in collateral value triggered liquidations, as it should logically keep users away from the liquidation line rather than bring them closer.It is worth noting that the "secondary effects" of this price anomaly are still ongoing. As a result, users who did not engage in leveraged operations on LlamaLend and only held sDOLA have seen their paper profits increase by about 14%. Additionally, DOLA is currently trading at about a 1% discount in the secondary market compared to its pegged value, and some community members suggest that borrowing users consider repaying their DOLA debts during this discount phase.

BNB Chain's Chief Growth Officer Nina Rong posted that the theft of the BNB Chain Coinmarketcap account was due to a vulnerability that previously existed on the Coinmarketcap community platform. Immediate measures have been taken to ensure account security, and additional security measures have been implemented to prevent similar incidents from occurring again.

ChainCatcher news, according to SlowMist's cosine analysis, the attack on the cross-chain bridge project 402Bridge originated from a private key leak, and the possibility of insider involvement cannot be ruled out.The domain 402 bridge.fun was registered only two days before ceasing operations, and there has been no further movement of the stolen funds. This is the first public security incident related to the 402 protocol services, and SlowMist's cosine stated that this incident is not a typical case of collective wrongdoing by the project team.

ChainCatcher news, on the X platform, on-chain detective ZachXBT pointed out that the wallet addresses corresponding to the approximately 127,000 bitcoins (worth about $14 billion) announced for seizure by the U.S. government had been identified two years ago in a security research report (Milky Sad Report) as having private key vulnerability risks.ZachXBT stated that these addresses are now claimed by the U.S. government to be "under their control and custody," raising concerns about how they were obtained. When a user asked, "Is it transferred to a more secure wallet?" ZachXBT responded, "Not likely, it’s more like someone helped the U.S. government 'hack' it back." This statement implies that the related BTC may not have been obtained through conventional judicial means.

ChainCatcher message, the DeFi protocol Nemo on Sui has released an incident report stating that due to a security vulnerability in the flash_loan and get_sy_amount_in_for_exact_py_out functions in the contract, it was exploited by attackers, resulting in an asset loss of approximately 2.59 million USD.The attack originated from the developers launching new features without sufficient auditing and failing to promptly address known risks. The main funds were transferred to Ethereum via a cross-chain bridge, and the core functions of the protocol have currently been frozen. A vulnerability patch has been submitted for emergency auditing, and the team is formulating user compensation and asset tracking plans.

ChainCatcher news, according to official sources, the Cardano Foundation has officially launched the open-source traceability infrastructure Originate, aimed at verifying product authenticity and supporting industry certification. This solution will reshape product processes and enhance consumer trust.It is reported that Originate is suitable for multiple industries and application scenarios, with advantages such as scalability, low cost, and high customizability, providing a solid foundation for authenticity verification, trust building, and market expansion.

ChainCatcher news, according to Cointelegraph, the WAP token promoted by the famous American rapper Cardi B on the social platform X has sparked controversy. Blockchain analyst Wazz's preliminary investigation shows that the wallet address disclosed by Cardi B is associated with multiple rug pull projects. Blockchain security company PeckShield suspects that Cardi B's X account may have been hacked.However, Wazz refuted PeckShield's speculation, stating that her account has not been compromised, "This is a planned action, with multiple promotions, cartoons, and previous tweets as evidence. Additionally, you misread the liquidity pool; the actual liquidity is $700,000."Blockchain data visualization platform BubbleMaps found that 60% of the WAP token supply was bundled at the time of issuance. Furthermore, within 10 hours of the project's launch, approximately $500,000 worth of tokens had been sold off. BubbleMaps also pointed out, "To evade tracking, all wallets involved in the bundling transferred their tokens one-to-one to brand new addresses 4 hours ago."

ChainCatcher news, on-chain data analyst @ai_9684xtpa posted that smart money arthurgayes.eth deposited 20 trillion MOG into Bybit and Gate 10 hours ago, worth 4.34 million USD. If sold entirely, it would yield a profit of 4.28 million USD. This address previously purchased 82.5 trillion MOG in September 2023 at an average price of 0.0000000301 USD, spending 248,000 USD; currently, it still holds 62.5 trillion tokens, with an unrealized profit of up to 13.4 million USD.According to analysis, the miner fees for the address starting with 0x5041 used by arthurgayes.eth for offloading come from the "PORTAL market maker address," which is suspected to belong to DWF Labs. (Although there is currently no public cooperation information between DWF and the meme token MOG)

ChainCatcher message, regarding the wallet attack incident on the Bittensor chain, on-chain detective ZachXBT monitored and discovered that an address starting with 5FbWTr had 32,000 TAO (worth 8 million USD) stolen.ZachXBT stated that the attack incident faced by Bittensor originated from a stolen private key.

ChainCatcher message, cross-chain bridge Meson Finance tweeted that it has deleted the phishing tweet, confirming that the issue originated from a third-party API and not a direct attack on its account. Its account has now been restored to normal.

Chain Catcher news, the on-chain liquidity protocol Kyber Network stated that the attack vector has been successfully identified and removed. The KyberSwap smart contracts, aggregator, and API have remained secure. This attack originated from a front-end vulnerability and is unrelated to the smart contracts of Kyber Network.According to previous reports, KyberSwap announced on September 2 that its front end had been attacked, resulting in a total loss of $265,000 from two addresses. The Binance security team stated on September 3 that they had identified two suspects involved in the attack on KyberSwap. Yesterday, Kyber Network announced that the attackers could receive a 15% bounty for returning the funds before September 6, or further actions would be taken. (CoinDesk)