affected

Across Protocol released a post-incident report on the Relayer security event. The attacker exploited a vulnerability in the Risk Labs Solana off-chain event reading software to fabricate 1,627 false recharge events with a total face value of approximately $41.7 million.The report states that the Relayer completed 581 reimbursements before pausing Solana services, involving about $4.5 million of its own funds, while the remaining approximately $37 million in false recharges have all been rendered invalid.This incident did not involve any smart contract vulnerabilities, and all user transfers were completed or fully refunded on the same day. Across Protocol stated that the losses were limited to the capital of Risk Labs' own relayers, with a net loss of less than $4 million after deducting approximately $500,000 in attacker funds. Currently, Solana's order flow has been completely routed through CCTP, and the ACX token acquisition plan remains unaffected.

According to Jinshi reports, Mitsubishi UFJ Bank analyst Derek Halpenny stated in a report that the dollar may not be significantly affected by the latest round of trade uncertainties in the U.S. in the short term. He pointed out that the impact of Trump's new tariff plan on exchange rates should be limited.Currently, the market expects the U.S. to raise interest rates and the risks in the Middle East are high, providing some support for the dollar. However, if trade uncertainties escalate, investors' concerns about policy unpredictability and damage to the U.S. economy may lead to a sell-off of the dollar.

Ostium released an update on the attack incident. Its liquidity provider fund was attacked on July 15, resulting in a loss of 23,752,746 USDC. Preliminary investigations indicate that the attacker compromised the off-chain infrastructure that provides price data to the protocol and submitted disguised illegal price reports, extracting artificially generated profits from the fund by quickly opening and closing multiple large positions.Ostium stated that traders' collateral is stored in independently isolated smart contracts and was not affected by this incident, with all trading positions remaining open. The team paused trading and froze all trading contracts within 60 minutes after the first attack transaction occurred. Currently, Ostium is collaborating with Mandiant, zeroShadow, Collisionless, SEAL 911, and law enforcement agencies, coordinating with trading platforms, bridging contracts, and stablecoin issuers to advance the investigation. The engineering team is focused on repairing and strengthening the relevant infrastructure to support the secure resumption of trading.Ostium indicated that it will notify at least 24 hours in advance before unfreezing the trading contracts. After trading resumes, existing positions will be marked at the price at the time of reopening, unaffected by price fluctuations during the pause. Addressing the affected liquidity providers and securely resuming trading remains the current top priority.

According to Bits.media, Kaspersky security researchers have discovered new malware OkoBot, which steals cryptocurrency wallet recovery phrases and credentials through about 20 modules. Attackers use ClickFix social engineering techniques to trick users into executing malicious commands and spread the malware through GitHub repositories disguised as legitimate tools like SQL Server Management Studio.OkoBot's modules include: SeedHunter, which injects into hardware wallets like Trezor and Ledger, displaying a fake interface when recovering recovery phrases; MC Keylogger, which records keyboard and clipboard activity; and OkoSpyware, which tracks wallet passwords and records window videos.Once attackers obtain the recovery phrases, they can gain complete control over the victim's cryptocurrency assets, making it nearly impossible to recover the funds. Kaspersky stated that OkoBot has been active for over a year, with most victims located in Brazil, Vietnam, Canada, Mexico, and Turkey. Attackers have also implemented geographical blocking on IP addresses from Russia and CIS countries.

Bonzo Finance Labs stated on platform X that, in response to the oracle attack on July 11 that affected Bonzo Lend, the Bonzo Finance Foundation will provide full compensation based on the position status prior to the incident, with funds supported by the recovery mechanism promised by the Hedera Foundation.

Robinhood Chain's Pons launchpad officially responded to previous reports regarding a token authorization vulnerability in its frontend, stating that the Pons launchpad trading page does not have any Multicall3 functionality. The Multicall3 functionality mentioned in the tweet comes from the previous version of the Debank Chain cross-chain bridge, which was launched before the Pons launchpad and does not affect launchpad users.Currently, the only confirmed affected asset is 0.6 NOXA tokens, valued at approximately $0.66. As a security precaution, Pons recommends that users who have used the old cross-chain bridge revoke token authorization through revoke.cash. The team is currently working with auditing firms to investigate potential risks and stated that they will restore Pons frontend services once it is confirmed that there are no actual vulnerabilities.

According to official news, the stablecoin protocol Reflect, supported by a16z, announced the launch of an independent voluntary recovery plan for USDC+ position holders affected by the Drift (now Velocity) April hacking incident: a 180-day window is now open, during which holders can voluntarily sell their positions to Palindrome Engineering at a price of 0.2 USDC + 80 Reflect Credit (RC) per unit, with complete on-chain settlement.The plan is funded in advance by Palindrome and is completely independent of the Drift recovery process. Participation means waiving the right to pursue claims against Drift in exchange for immediate certainty of liquidity; those who do not participate can still support Drift's DFX recovery channel.

Cardano wallet service provider SecondFi released the latest update on the theft incident, stating that the team has completed the final balance snapshot of affected users' assets. Previously, multiple snapshots were continuously recorded during the incident response as a basis for subsequent asset recovery and verification.SecondFi stated that the engineering and security teams are advancing the asset recovery plan, with the expectation that asset returns could begin in about two weeks. One week will be used to reach a feasible technical solution, and one week will be used for testing and review, with specific timing potentially adjusted as progress is made. The platform will resume operations only after passing a comprehensive security review. Currently, users only need to submit support requests through the official website ticketing system, with no additional actions required.

According to Jinshi reports, Federal Reserve's Williams stated that the inflation level is "undoubtedly high and far exceeds" the target, reflecting the impact of tariffs, energy prices, and the demand for technology products related to artificial intelligence (AI).

Cardano wallet service provider SecondFi stated that it has identified the root cause of the recent security incident and has deployed patches for the unaffected wallets, and will soon resume normal operations. SecondFi disclosed that there were a total of 4 incidents of funds being transferred out, of which 3 were carried out by external attackers, resulting in approximately 16 million ADA being transferred from 374 addresses. To reduce further losses during the ongoing attacks, SecondFi initiated an emergency transfer, moving approximately 129 million ADA to an independent third-party custodian for safekeeping, and has hired an external accounting firm for a special audit to facilitate subsequent verification and return assets to the affected addresses. SecondFi advises affected users to submit claims through the official support page and currently not to import their mnemonic phrases into other Cardano wallets, as the security risk occurs at the address and signature level.

The cross-chain protocol Axelar Network released a statement regarding the recent security incident related to Secret Network, stating that there is a misunderstanding within the community about the event. Both Axelar and the Inter-Blockchain Communication Protocol (IBC) were not attacked or compromised. The affected token smart contracts were neither developed, deployed, nor maintained by Axelar, and Axelar's firewall mechanism also prevented the impact from spreading to other chains.It is reported that the exploited contract is a forked version based on CW20-ICS20, but the developers removed two core security checks, resulting in an "infinite minting" vulnerability. By deleting the verification mechanisms originally used to prevent such issues, this fork altered the original trust model of the contract and did not undergo a new security audit.Axelar Network explained that anyone can deploy contracts for cross-chain asset wrapping through IBC, and similar contracts have also been used to wrap tokens from other chains into Secret Network. However, the Secret side fork version in this incident has vulnerabilities due to the removal of key security checks. This incident is not a unique logical flaw, nor is it an issue with the IBC protocol itself, but rather a security risk introduced by modifications to third-party contracts.

Humanity released an independent investigation report by Quantstamp, which disclosed that in the H token security incident, the attacker used tools and methods characteristic of North Korean hackers, disguising themselves as communication from the Bithumb exchange through phishing emails, inducing project directors to click on malicious attachments, thereby deploying a remote control Trojan on their devices, ultimately gaining full desktop control and wallet private keys. Subsequently, on Ethereum and BNB Chain, they launched on-chain attacks: on the Ethereum side, by stealing keys to upgrade contracts and transferring approximately 141.18 million H tokens, and on the BSC side, by taking over the ProxyAdmin contract and minting new tokens. The stolen assets were then continuously sold on Uniswap and PancakeSwap for about 8 hours, causing significant impact on liquidity and market prices.Currently, the H token contract on the Ethereum side has been frozen, the mainnet bridge remains unaffected, but the BSC deployment has been controlled by the attacker and still has minting permissions. The team is working with exchanges and security parties to advance subsequent disposal and recovery plans, while reminding users to be wary of false "compensation/claim" links, and stated that further progress will be announced through official channels.Previously, the Humanity Protocol was attacked, resulting in the leak of a private key from a member of the Humanity Foundation, leading to over 31 million dollars in funds being stolen.

Raydium core contributor InfraRAY posted on platform X, stating that the team has confirmed that the old version of the AMM V3 program, which was previously discontinued in 2021, has been attacked. The attacker unauthorizedly removed part of the liquidity, but this incident does not affect current Raydium users, and the related liquidity pools have been unable to interact through the official Raydium UI since being disabled. The Raydium SDK and DApp also do not support operations on the mainnet old version AMM V3 liquidity pools.The five affected liquidity pools include: Sollet USDT-RAY, Sollet ETH-RAY, SRM-RAY, USDC-RAY, and RAY-SOL. Preliminary statistics show that the stolen assets include approximately 150,177 RAY, 5,603 SOL, and 893,700 USDC, with a total value of about $1.34 million. The related losses will be fully compensated by the treasury.Investigations reveal that the vulnerability originated from insufficient verification of the LP token minting address. The attacker created new LP tokens and impersonated legitimate LP tokens, bypassing the protocol's ratio verification mechanism to extract funds. However, this incident is classified as an independent logical vulnerability and is not due to private key leakage or permission intrusion, and there is no risk of spread. Currently, all existing Raydium mainnet programs have not been affected.

PiggyBank released a detailed report on the LAB incident on June 6, stating that the protocol experienced a net withdrawal of approximately $579,000 on June 6, primarily due to a LAB token basis trade being manipulated by the market.In early May, PiggyBank purchased 142,800 locked LAB tokens (approximately $102,500) through an OTC intermediary while simultaneously opening a perpetual contract short hedge. However, market participants continuously maintained the spot price above the perpetual contract price, resulting in a deeply negative funding rate (annualized -17,000%), and the high hedging costs forced the shorts to close, resulting in a loss of approximately $476,000. The currently locked LAB tokens have a spot value of about $1 million, but due to poor liquidity and lack of hedging, they have been excluded from the NAV calculation.PiggyBank will undergo structural reforms: increasing transparency of on-chain mechanisms, strategy logic, and fund allocation will be publicly verifiable, while basis trading and funding rate arbitrage will be gradually phased out. In terms of compensation, affected users will receive USDC compensation based on actual losses, with funding sources including NAV discrepancies, future LAB sales (expected to unlock from August 14 to October 14, currently valued at approximately $1 million), and 50% of future platform revenue. All users recorded in the snapshot on June 6 are eligible for compensation.

Driven by the Bitget US stock 2.0 upgrade, according to DefiLlama data, Bitget has seen a net inflow of approximately $177 million in the past 7 days, ranking second among global centralized exchanges. During the same period, OKX ranked first with $409 million, and Bybit ranked third with $161 million.

Dragonfly Managing Partner Haseeb published a statement regarding the recently patched Zcash vulnerability, indicating that there are many misunderstandings in the market about this event. He pointed out that even if the vulnerability had been exploited before it was fixed, attackers could only profit by faking ZEC in the privacy pool, and these tokens must first be converted from a privacy address to a transparent address to enter mainstream trading platforms.Since the supply of ZEC in transparent addresses can be publicly verified, any abnormal transfers exceeding the maximum supply will be detected and blocked, so the vast majority of investors holding transparent ZEC and exchange users will not be affected.Haseeb stated that the Zcash team plans to introduce a new "Turnstile" mechanism and a brand new privacy pool in future upgrades to verify that there is no inflation issue in the current privacy pool. He also mentioned that formally verified cryptographic systems can reduce implementation errors from a design perspective. Haseeb finally disclosed that Dragonfly still holds ZEC, and he is also a ZODL investor.

According to Jinshi reports, Russian President Putin stated that the "theft" of Russian assets has affected the US dollar and the euro.

Affected by profit-taking from AI concept assets and a decline in market risk appetite, Bitcoin has fallen to around $62,000, a cumulative drop of nearly 16% from last week's high of over $74,000. Market analysis suggests that if it falls below the key level of $60,000, the next key technical support for Bitcoin may be around $55,000. In addition, the U.S. spot Bitcoin ETF has recorded net outflows for 15 consecutive trading days, totaling over $4.7 billion, while Strategy disclosed this week that it sold Bitcoin for the first time since 2022, further weakening market expectations for institutional buying.

According to a report by 21st Century Business Herald, Futu Holdings' US stock pre-market once fell over 40%. In terms of news, the China Securities Regulatory Commission plans to decide to confiscate all illegal gains of Tiger, Futu, and Changqiao's domestic and foreign related entities, and impose severe penalties according to the law.In response, the company's customer service staff stated that the company has been paying attention to relevant regulatory developments and is carefully studying the related content. Once the information is complete, the company will respond uniformly. Currently, the company's business operations are normal, and customers' account assets and various services are not affected.

The DAO infrastructure service provider Syndicate announced that it will gradually cease operations. It stated that after five years of continuous development of on-chain developer infrastructure, the Rollup market has undergone fundamental changes. Currently, the Rollup market size has significantly shrunk, with some Rollup projects gradually shutting down, and the market has shifted from EVM Rollups to custom chain models built from scratch by consulting teams, resulting in a significant decline in reusable technology and network value.Syndicate stated that its system consists of two parts: Syndicate Labs, responsible for development, will shut down, while the independent entity Syndicate Network Collective (Wyoming DUNA), which holds SYND tokens and has governance rights, will continue to exist, and SYND governance will not be affected in the short term.In addition, Syndicate emphasized that this decision to cease operations is unrelated to recent cross-chain security incidents, and affected users and SYND holders have received full compensation through treasury reserves, while team and investor tokens are still locked.