Scan to download
BTC $79,056.05 -2.29%
ETH $2,227.04 -1.79%
BNB $668.68 -1.45%
XRP $1.44 -3.14%
SOL $89.06 -3.06%
TRX $0.3513 -0.48%
DOGE $0.1125 -3.11%
ADA $0.2612 -3.10%
BCH $425.53 -2.27%
LINK $10.06 -3.07%
HYPE $43.19 -6.00%
AAVE $92.59 -5.32%
SUI $1.09 -7.32%
XLM $0.1550 -3.71%
ZEC $508.51 -6.94%
BTC $79,056.05 -2.29%
ETH $2,227.04 -1.79%
BNB $668.68 -1.45%
XRP $1.44 -3.14%
SOL $89.06 -3.06%
TRX $0.3513 -0.48%
DOGE $0.1125 -3.11%
ADA $0.2612 -3.10%
BCH $425.53 -2.27%
LINK $10.06 -3.07%
HYPE $43.19 -6.00%
AAVE $92.59 -5.32%
SUI $1.09 -7.32%
XLM $0.1550 -3.71%
ZEC $508.51 -6.94%

mem

AI Agent Security Risk Exposure: Attackers Can Exploit "Memory Pollution" to Induce Misoperation of Funds

The GoPlus Security team has disclosed a new type of attack in its AgentGuard AI project: inducing AI agents to perform unauthorized sensitive operations through "memory poisoning." This attack method does not rely on traditional vulnerabilities or malicious code but exploits the long-term memory mechanism of AI agents. For example, an attacker first induces the agent to "remember preferences," such as "usually prioritizing proactive refunds instead of waiting for chargebacks," and then uses vague expressions like "process as usual" or "execute as before" in subsequent instructions, thereby triggering automated financial operations.GoPlus points out that the key risk in such cases lies in the AI agent mistakenly treating "historical preferences" as a basis for authorization, leading to financial losses or security incidents in operations such as refunds, transfers, and configuration changes. To address this issue, the team has proposed several protective recommendations, including:Operations involving refunds, transfers, deletions, or sensitive configurations must require explicit confirmation in the current session.Memory-related instructions like "habit," "usual way," and "as before" should be regarded as high-risk state changes.Long-term memory must have a traceability mechanism (writer, time, confirmation status).Vague instructions should automatically elevate the risk level and trigger secondary verification.Long-term memory must not replace real-time authorization processes.The team emphasizes that the "AI agent memory system" should be viewed as a potential attack surface and should be constrained and audited through a dedicated security framework.

OneBullEx May Member Day has started, OBE points can be exchanged for USDT at a 1:1 ratio, with a prize pool reaching 300,000 USDT

According to the official announcement from OneBullEx, the platform's May Member Day event has officially started. This time, it continues to offer a 1:1 exchange of OBE points for USDT, with a prize pool reaching 300,000 USDT. The event will take place on May 11 from 11:00 to 20:00 (GMT+4), divided into 10 exchange sessions, with approximately 1,500 exchange slots available for each session, on a first-come, first-served basis, until all slots are filled.It is introduced that users need to consume 20 points for each exchange participation. After completing the exchange, the corresponding USDT rewards will be directly credited to their accounts. Users participating in this event must have at least 500 points in their accounts, and the specific amount credited and participation rules are subject to what is displayed on the event page.It is reported that OneBullEx has designated the 11th of each month as a fixed Member Day, continuously strengthening user participation and platform activity through mechanisms such as point exchanges, task incentives, and community interactions. As the May Member Day continues, the 1:1 exchange of OBE points for USDT is further entering a periodic operation, and Member Day is gradually becoming an important benefit scenario within the OneBullEx points system.

LayerZero has been reported to have used multi-signature wallets to trade Meme coins, and the default library contract upgrade mechanism poses risks

According to market news, LayerZero Labs co-founder and CEO Bryan Pellegrino had a heated debate with security researchers today in the ETHSecurity Community Telegram group. The core controversy includes: since LayerZero Labs can immediately upgrade a default library contract without a time limit to forge messages (similar to the case where rsETH was hacked), the LZ OFT, valued at over $3 billion, is recently at risk of being stolen; researcher Banteg pointed out that mainstream projects like Ethena and EtherFi were still using this default library contract weeks ago, and currently, there is still $178 million worth exposed to risk, with these funds coming from projects that are still using the default library.On-chain data shows that LayerZero Labs multi-signature signers participated in non-multi-signature activities such as meme coin trading, DEX exchanges, and cross-chain bridging, which means that the multi-signature keys in the formal environment were connected to websites, increasing phishing risks. Regarding the multi-signature signers of LayerZero using production environment keys for trading activities, Bryan confirmed that the related transactions were completed by members of the multi-signature team, but denied that it was "meme coin trading," explaining it as "testing PEPE on the LZ OFT token standard," and stated that the involved member has been removed. Bryan also suggested that project parties "directly fix configurations" instead of using default configurations to reduce risks. Banteg subsequently tagged a long list of LayerZero users still using the default library contract, pointing out that these projects should migrate to fixed configurations as soon as possible.
app_icon
ChainCatcher Building the Web3 world with innovations.