A certain Web3 project contract may have been implanted with malicious code by an employee, resulting in losses of hundreds of thousands of dollars
ChainCatcher news, according to a disclosure by crypto community member Cat (@0xCat_Crypto), a Web3 startup project lost hundreds of thousands of USDT due to hardcoded authorized wallet addresses in its smart contract code.In the incident, the contract code submitted by an employee was suspicious, but the employee denied writing the relevant code, claiming that the malicious code was automatically generated by an AI programming assistant and not adequately reviewed. Currently, the ownership of the involved wallet cannot be confirmed, and the identity of the code author is also difficult to ascertain.Slow Mist's Yu Xian stated that, after preliminary investigation, in an environment using the Cursor and Claude 3.7 models, the AI auto-completed address did not match the involved malicious address, ruling out the possibility of AI code generation being the cause of the wrongdoing. The malicious address had owner permissions of the smart contract, resulting in the complete transfer of funds from the project party.
