exploitation

Immunefi Security Chief Gonçalo Magalhães stated that an unnamed Base treasury suffered a vulnerability exploit of approximately 6 million dollars, while there were still about 31.7 million dollars in assets within the treasury at the time of the incident.According to the briefing, the attacker added a malicious contract to the treasury's lending whitelist through a Safe multi-signature wallet, subsequently withdrawing 1,783 aBaswstETH, which were then exchanged for approximately 1,783 wstETH via AaveV3. Gonçalo Magalhães pointed out that the whitelist's restricted addresses appeared secure, but approved addresses could withdraw assets without collateral, constituting a vulnerability; this whitelist weakness had been discovered the previous week, but researchers lacked a clear disclosure channel. More than 24 hours after the incident, no team has publicly claimed responsibility or disclosed remedial measures.

According to CoinDesk, Chainalysis organized a multi-day operation called "Operation Lighthouse," utilizing blockchain intelligence to investigate networks disseminating child sexual abuse materials. The operation is headquartered at the National Cyber Crime Forensics and Training Alliance in New York and collaborates with global law enforcement agencies such as Europol, the Australian Federal Police, the Royal Canadian Mounted Police, and the UK's National Crime Agency.The operation investigated over 29,000 cryptocurrency addresses and digital identifiers, identified more than 100 related forums and hubs, and generated over 14,000 investigative leads, with suspects located in 125 countries, some of whom are registered sex offenders. Several cryptocurrency companies participated, including payment company Block and nonprofit organizations like the Internet Observation Foundation.Gavin Sather, Senior Project Manager for Anti-Child Exploitation at Binance, stated that the transparency of blockchain makes it difficult for criminals to hide their crimes for long periods.

According to on-chain detective Specter monitoring, Wemix Network may have experienced a vulnerability exploitation event exceeding $700,000, with the related address being 0xC921...7EA2.

Summer.fi released an analysis report on the Lazy Summer Protocol USDC treasury attack incident. The attacker manipulated the prices of two USDC treasury shares in a single atomic transaction, extracting approximately $6.04 million of depositor funds. The core of the attack lies in the calculation method of the treasury's net asset value (NAV).The attacker donated tokens that still retained the old valuation to a Silo Ark that had been suspended after the incident in November 2025 but had not yet been completely removed, resulting in an inflated total asset value of approximately 9.5%, raising the share price, which was then redeemed at an inflated price and withdrawn from the treasury's actual liquidity. The report emphasizes that this attack was not due to a contract code vulnerability, but rather a missing link in the treasury's offline process—the deposit limit for that Ark had been set to zero, yet it was still counted in the NAV of active assets.The attacker premeditatedly accumulated the required tokens three months in advance through multiple wallets and transferred part of the profits via Tornado Cash. After the incident, Guardian Multisig has suspended all on-chain treasuries and set the deposit limit to zero. The Lazy Summer DAO will discuss compensation plans for affected users and the treasury restart plan in the coming days.

The Cybersecurity Threat and Vulnerability Information Sharing Platform (NVDB) of the Ministry of Industry and Information Technology of China has monitored and found that attackers are using exploit tools targeting Apple Inc.'s terminal products to carry out cyber attack activities, which can lead to serious harms such as information theft and system control. The affected range includes Apple terminal products such as iPhone and iPad running iOS 13 to 17.2.1.Attackers induce users to use the Safari browser to visit web pages containing malicious code through methods such as SMS, email, or web poisoning, comprehensively utilizing security vulnerabilities present in the terminal devices to implant remote control Trojans into the victim's terminal products, stealing sensitive user information, gaining maximum privileges, and taking control.It is recommended that users of Apple terminal products conduct risk assessments, and promptly fix vulnerabilities through version upgrades and patch installations (refer to the Apple Security Updates). Pay attention to system update notifications and the latest security update announcements released by Apple, upgrade to the latest secure version in a timely manner, strengthen security awareness, avoid clicking on unknown links, and prevent the risk of cyber attacks.

According to Cointelegraph, Google's Threat Analysis Group recently disclosed a new iOS exploit kit named "Coruna," which is being used for cryptocurrency theft targeting iPhone users. This kit primarily targets devices running iOS versions 13 to 17.2.1 and includes 23 exploit scripts and 5 complete attack chains, some of which are previously unknown vulnerabilities.It can carry out attacks through counterfeit cryptocurrency-related websites. Reportedly, when users access these malicious sites using vulnerable iOS devices, the attack code automatically runs, scanning for sensitive information on the device, particularly text containing keywords such as mnemonic phrases, backup phrases, and bank account details, and attempts to steal assets from cryptocurrency applications like Uniswap and MetaMask.Google researchers strongly recommend that iPhone users immediately update their devices to the latest iOS version. If updating is not possible, they should enable Apple's "Lockdown Mode" to enhance protection.

ChainCatcher message, the official Sui ecosystem yield protocol Typus Finance stated on social media that about 2 hours ago, its TLP contract was exploited due to a lack of permission verification in the oracle. To protect all users, the official has immediately suspended the operation of all Typus smart contracts.Currently, a comprehensive investigation is underway with the emergency technical support provided by the Sui Foundation, and any progress will be promptly updated.

ChainCatcher news, according to decrypt, U.S. President Trump has signed the bipartisan "Take It Down Act" into law. This legislation classifies the non-consensual online publication of intimate images (including real images or AI-generated images) and deepfake pornographic content as a criminal offense, and requires major tech platforms to remove such content within 48 hours of receiving a notice.First Lady Melania Trump called the legislation a "national victory" for protecting children from online exploitation. Victims of deepfakes and revenge porn will now be protected under U.S. federal law.

ChainCatcher news, according to Cointelegraph, Fideum co-founder and CEO Anastasija Plotnikova stated that meme coins are violating the fundamental spirit of cryptocurrency decentralization, increasingly being used to exploit retail investors amid a growing number of rug pulls. She added, "Meme coins have evolved from community-driven social experiments into a chaotic situation dominated by retail investors extracting value, where internal circles, stock price manipulation, and targeted groups have replaced the organic and collectible nature of the original meme coin community, creating an unhealthy competitive environment."Anastasija Plotnikova believes that some behaviors are clearly illegal and fall under the jurisdiction of law enforcement agencies, and she supports the enforcement of certain projects.

ChainCatcher message, Slow Mist's Chief Information Security Officer 23pds posted on social media, "The notorious cryptocurrency theft software Rhadamanthys Crypto Stealer officially announced today that it has started supporting BTC popular wallet UniSat Wallet for extension wallet theft and exploitation. Users need to be aware of security risks and beware of Google AD phishing and private message poisoning phishing." (source link)

ChainCatcher news, security company CertiK tweeted: "We are actively investigating the Merlin (zkSync ecosystem DEX) incident. Current investigation results point to potential private key management issues rather than exploitation of vulnerabilities. If any wrongdoing is found, we will cooperate with the relevant authorities and share the information."Previously reported, Merlin was hacked and $1.82 million in funds was stolen. It is reported that Merlin announced an audit by CertiK on April 24 and launched the MAGE public sale yesterday at 23:00. (Source link)

ChainCatcher news, according to PeckShield statistics, in February 2023, over 200 exploitation incidents were monitored, with a total stolen amount of 35.3 million USD, of which about 141 exploitations occurred on February 11. The largest security incident was the exploitation of BonqDAO, resulting in a loss of 120 million USD, while the attacker profited approximately 2 million USD. As of February 28, 2023, 935,000 ETH and 6,000 BNB have been transferred to Tornado Cash. (source link)