BTC $81,335.60 -3.37%
ETH $2,390.69 -3.33%
BNB $731.13 -2.27%
XRP $1.31 -3.70%
SOL $103.92 -2.96%
TRX $0.3283 -0.61%
DOGE $0.0789 -3.55%
ADA $0.2123 -5.95%
BCH $275.95 -3.87%
LINK $11.99 -4.54%
HYPE $77.72 -3.56%
AAVE $147.74 -4.89%
SUI $0.9757 -5.60%
XLM $0.1756 -4.42%
ZEC $1,223.85 -7.59%
AAPL $348.26 +1.29%
AMZN $251.53 -3.81%
GOOGL $324.87 -2.61%
MSFT $521.88 -1.68%
META $648.21 -9.32%
NVDA $213.52 -3.02%
TSLA $376.76 +0.54%
SNDK $1,266.33 -6.87%
INTC $86.18 -5.55%
SPCX $147.63 -6.49%
MU $862.58 -4.53%
AMD $513.72 -5.54%
BTC $81,335.60 -3.37%
ETH $2,390.69 -3.33%
BNB $731.13 -2.27%
XRP $1.31 -3.70%
SOL $103.92 -2.96%
TRX $0.3283 -0.61%
DOGE $0.0789 -3.55%
ADA $0.2123 -5.95%
BCH $275.95 -3.87%
LINK $11.99 -4.54%
HYPE $77.72 -3.56%
AAVE $147.74 -4.89%
SUI $0.9757 -5.60%
XLM $0.1756 -4.42%
ZEC $1,223.85 -7.59%
AAPL $348.26 +1.29%
AMZN $251.53 -3.81%
GOOGL $324.87 -2.61%
MSFT $521.88 -1.68%
META $648.21 -9.32%
NVDA $213.52 -3.02%
TSLA $376.76 +0.54%
SNDK $1,266.33 -6.87%
INTC $86.18 -5.55%
SPCX $147.63 -6.49%
MU $862.58 -4.53%
AMD $513.72 -5.54%

origin

All
Article
Flash

first_img NEAR Intents released a post-mortem report, revealing that the $3.8 million vulnerability originated from a deposit notification flaw

The cross-chain exchange protocol NEAR Intents released a post-mortem report attributing a $3.8 million vulnerability to a flaw in the deposit notification feature. The protocol deploys a public settlement contract on NEAR that maintains an internal ledger of deposited tokens, while withdrawals transfer tokens out via a cross-chain bridge. The report was published by NEAR Intents General Manager Alex Shevchenko on October 16, stating that the attacker withdrew $3.8 million before the protocol was shut down on October 1 and returned all funds within 36 hours of detection, with all affected users fully compensated.The report indicates that the feature notifies third-party contracts when tokens are deposited. The attacker created a contract that intentionally caused the notification to fail, allowing the token contract to refund the deposit while NEAR Intents retained the corresponding ledger credit. Through 23 failed deposit transactions, the attacker accumulated $3.8 million in unsupported balance, referred to in the report as ghost funds, and subsequently withdrew real tokens based on this and transferred them to other chains via the Omni infrastructure. Shevchenko stated that this was a vulnerability in the NEAR Intents contract, not in the Omni infrastructure.Withdrawals occurred between September 29 and October 1. The settlement contract was paused and reopened on October 1, with affected routes gradually restored, and contract-side deposits resumed on October 2. The report noted that the vulnerability went undetected because monitoring only compared the original chain assets with the total balance of NEAR side tokens, without comparing the total internal user balances with the actual tokens held by the contract; the team has since added this check and will automatically pause the contract when there is a balance inconsistency. The fix for the October vulnerability was deployed on October 2, but another serious vulnerability report regarding the same feature prompted its complete removal on October 7, with the relevant researcher receiving a $300,000 reward.

Bitget CEO live-streamed a response to the platform's first security incident in eight years: the attack originated from a vulnerability in a third-party security product, and the losses will be covered by the user protection fund

In today's community live broadcast, Bitget CEO Gracy responded to recent security incidents and the platform's financial status. She candidly stated that this is the first security incident encountered since Bitget was established 8 years ago. After a complete trace, it was found that hackers exploited vulnerabilities in third-party security products to steal internal network access credentials, forged withdrawal commands to the wallet system, and deceived the wallet into executing abnormal transfers that bypassed risk checks. Gracy emphasized that no private keys were leaked, and cold wallets were unaffected; specific technical details will be disclosed in the formally released security report.Gracy pointed out that the verified losses from this incident are within the coverage of the protection fund, and user funds are not affected. The platform's own funds exceed $1.4 billion, which includes approximately $464 million in the user protection fund. The platform will continue to uphold the security commitments made when the protection fund was established in 2022, planning to replenish the fund to the baseline of $300 million within a week."The protection fund is not just a slogan, but an important mechanism that provides tangible security for users in the event of extreme security incidents," Gracy stated. In the face of sudden security challenges, the platform's comprehensive strength and its ability to take responsibility are important criteria for measuring its risk response capability and long-term credibility. Bitget will continue to uphold its long-term commitment to prioritize user interests.

X launches an original content reward program, the old revenue sharing plan will end on September 7

The X platform has announced the launch of the Original Content Rewards Program, aimed at rewarding creators who bring original perspectives, expertise, reporting, creativity, and commentary to the platform.X stated that, effective immediately, new users will no longer be able to join the original revenue sharing program. Existing revenue sharing program users can continue to earn revenue until September 7, during which three final payments will be made on August 14, August 28, and approximately September 11.Starting September 8, eligible existing creators can apply to join the new Original Content Rewards Program. The new program will distribute earnings based on the qualified exposure generated by the creator's original content, with rewards issued every two weeks, and the first payment expected to be issued on August 28.To apply for the Original Content Rewards Program, the following conditions must be met:Must be at least 18 years old;Reside in a country or region supported by the program;Account must be in good standing, with no multiple violations of revenue standards or service terms;Must have a personal or business account;Must subscribe to X Premium, Premium+, or Premium Business;Must have at least 500 verified followers;Must have achieved at least 500,000 impressions from verified users on the home timeline in the past 90 days (excluding reply impressions);Must continuously publish original content.
app_icon
ChainCatcher Building the Web3 world with innovations.