originate

The cross-chain exchange protocol NEAR Intents released a post-mortem report attributing a $3.8 million vulnerability to a flaw in the deposit notification feature. The protocol deploys a public settlement contract on NEAR that maintains an internal ledger of deposited tokens, while withdrawals transfer tokens out via a cross-chain bridge. The report was published by NEAR Intents General Manager Alex Shevchenko on October 16, stating that the attacker withdrew $3.8 million before the protocol was shut down on October 1 and returned all funds within 36 hours of detection, with all affected users fully compensated.The report indicates that the feature notifies third-party contracts when tokens are deposited. The attacker created a contract that intentionally caused the notification to fail, allowing the token contract to refund the deposit while NEAR Intents retained the corresponding ledger credit. Through 23 failed deposit transactions, the attacker accumulated $3.8 million in unsupported balance, referred to in the report as ghost funds, and subsequently withdrew real tokens based on this and transferred them to other chains via the Omni infrastructure. Shevchenko stated that this was a vulnerability in the NEAR Intents contract, not in the Omni infrastructure.Withdrawals occurred between September 29 and October 1. The settlement contract was paused and reopened on October 1, with affected routes gradually restored, and contract-side deposits resumed on October 2. The report noted that the vulnerability went undetected because monitoring only compared the original chain assets with the total balance of NEAR side tokens, without comparing the total internal user balances with the actual tokens held by the contract; the team has since added this check and will automatically pause the contract when there is a balance inconsistency. The fix for the October vulnerability was deployed on October 2, but another serious vulnerability report regarding the same feature prompted its complete removal on October 7, with the relevant researcher receiving a $300,000 reward.

Bitget's Greater China Regional Head, Xie Jiayin, recently addressed community concerns during a live broadcast. He reflected that since Bitget's establishment 8 years ago, user asset security has always been the top priority, successfully resisting multiple attempts of cyber attacks and maintaining a long-term record of secure operations. This incident marks the first security crisis in the platform's 8-year development history.Upon complete tracing, this incident is classified as a special attack targeting a third-party security software supply chain. The attacker exploited vulnerabilities in third-party products to obtain internal network credentials; however, private keys were not leaked, and cold wallet assets were unaffected. Currently, Bitget has partnered with security agencies Mandiant and SlowMist to conduct an independent review and will comprehensively upgrade the monitoring and management standards for third-party components. We are not only committed to promoting a full recovery following this incident but will also contribute to a safer, more robust, and healthier development of the industry through continuous technological iteration and system upgrades.

In today's community live broadcast, Bitget CEO Gracy responded to recent security incidents and the platform's financial status. She candidly stated that this is the first security incident encountered since Bitget was established 8 years ago. After a complete trace, it was found that hackers exploited vulnerabilities in third-party security products to steal internal network access credentials, forged withdrawal commands to the wallet system, and deceived the wallet into executing abnormal transfers that bypassed risk checks. Gracy emphasized that no private keys were leaked, and cold wallets were unaffected; specific technical details will be disclosed in the formally released security report.Gracy pointed out that the verified losses from this incident are within the coverage of the protection fund, and user funds are not affected. The platform's own funds exceed $1.4 billion, which includes approximately $464 million in the user protection fund. The platform will continue to uphold the security commitments made when the protection fund was established in 2022, planning to replenish the fund to the baseline of $300 million within a week."The protection fund is not just a slogan, but an important mechanism that provides tangible security for users in the event of extreme security incidents," Gracy stated. In the face of sudden security challenges, the platform's comprehensive strength and its ability to take responsibility are important criteria for measuring its risk response capability and long-term credibility. Bitget will continue to uphold its long-term commitment to prioritize user interests.

The cross-chain protocol Axelar Network released a statement regarding the recent security incident related to Secret Network, stating that there is a misunderstanding within the community about the event. Both Axelar and the Inter-Blockchain Communication Protocol (IBC) were not attacked or compromised. The affected token smart contracts were neither developed, deployed, nor maintained by Axelar, and Axelar's firewall mechanism also prevented the impact from spreading to other chains.It is reported that the exploited contract is a forked version based on CW20-ICS20, but the developers removed two core security checks, resulting in an "infinite minting" vulnerability. By deleting the verification mechanisms originally used to prevent such issues, this fork altered the original trust model of the contract and did not undergo a new security audit.Axelar Network explained that anyone can deploy contracts for cross-chain asset wrapping through IBC, and similar contracts have also been used to wrap tokens from other chains into Secret Network. However, the Secret side fork version in this incident has vulnerabilities due to the removal of key security checks. This incident is not a unique logical flaw, nor is it an issue with the IBC protocol itself, but rather a security risk introduced by modifications to third-party contracts.

Syndicate has released an update regarding the recent security incident, stating that the leakage of private keys led to the malicious upgrade of bridging contracts on two chains, resulting in the theft of approximately 18.5 million SYND (about $330,000) and around $50,000 in customer tokens. Affected users will receive full compensation, and SYND holders will receive additional compensation.The attack involved multi-stage reconnaissance, infrastructure mapping, vulnerability exploitation development, and precise timing, ruling out the possibility of insider involvement. The root cause of the vulnerability was the storage of private keys in a password manager, and the upgrade process did not utilize multi-signature or hardware signing. Syndicate is strengthening security measures, including adding an encryption layer outside the password manager and implementing multi-signature or hardware signing for the upgrade path.

The blockchain interoperability protocol Hyperbridge disclosed details of the previous DOT attack incident, resulting in a loss of approximately $237,000. The root of the vulnerability lies in the HandlerV1 contract's VerifyProof() function, which lacks input validation and does not verify the leaf_index leafCount, allowing attackers to forge Merkle proofs.Using this, the attacker gained administrator privileges for the DOT token bridging contract on Ethereum, subsequently minting 1 billion bridged DOT (which is about 2800 times the legitimate circulation of approximately 356,000) and cashing out on decentralized exchanges. Hyperbridge stated that it is currently working with security partners to trace the funds, and cross-chain functionality will remain suspended until the investigation is completed.

Venus Protocol released a statement regarding the THE market event, stating that this incident was not a flash loan attack, but rather a result of the attacker exploiting a supply cap vulnerability in the old code of the protocol. The team indicated that the attacker had been accumulating THE tokens for about 9 months, gradually establishing a dominant supply position on Venus.The announcement pointed out that the attacker bypassed the normal deposit process by directly transferring THE tokens into the protocol contract, thereby breaking through the supply cap limit of 14.5 million THE. They manipulated DEX prices by taking advantage of the low on-chain liquidity. As the external price was gradually reflected by the TWAP oracle, the attacker borrowed assets (such as CAKE, BNB, etc.) against the inflated collateral value, then bought more THE to drive up the price, and continuously transferred THE into the vTHE market to increase the collateral value. This cycle once pushed the price from about $0.27 to about $0.53, ultimately leaving bad debt in the protocol after the positions were liquidated.Venus stated that it has currently suspended the THE market, reduced its collateral factor to 0, and suspended withdrawals. Additionally, as a precautionary measure, the collateral factors for 8 markets including BCH, LTC, AAVE, POL, FIL, TWT, UNI, and lisUSD have also been reduced to 0. The team and security partners are continuing to investigate and will release a complete post-analysis report in the future.

According to BlockSec monitoring, Inverse Finance is suspected of suffering a loss of approximately $240,000 due to an attack. YAM Finance responded in a post on platform X, stating that this incident is not a vulnerability in the Inverse contract, but rather related to the LlamaLend mechanism.According to their explanation, the attacker initiated a "donation attack" on sDOLA on LlamaLend, driving the price from about 1.188 sDOLA = 1 DOLA up to about 1.358 sDOLA = 1 DOLA, and subsequently liquidated almost all user positions that had crvUSD borrowed against sDOLA as collateral. It is still unclear why the increase in collateral value triggered liquidations, as it should logically keep users away from the liquidation line rather than bring them closer.It is worth noting that the "secondary effects" of this price anomaly are still ongoing. As a result, users who did not engage in leveraged operations on LlamaLend and only held sDOLA have seen their paper profits increase by about 14%. Additionally, DOLA is currently trading at about a 1% discount in the secondary market compared to its pegged value, and some community members suggest that borrowing users consider repaying their DOLA debts during this discount phase.

BNB Chain's Chief Growth Officer Nina Rong posted that the theft of the BNB Chain Coinmarketcap account was due to a vulnerability that previously existed on the Coinmarketcap community platform. Immediate measures have been taken to ensure account security, and additional security measures have been implemented to prevent similar incidents from occurring again.

ChainCatcher news, according to SlowMist's cosine analysis, the attack on the cross-chain bridge project 402Bridge originated from a private key leak, and the possibility of insider involvement cannot be ruled out.The domain 402 bridge.fun was registered only two days before ceasing operations, and there has been no further movement of the stolen funds. This is the first public security incident related to the 402 protocol services, and SlowMist's cosine stated that this incident is not a typical case of collective wrongdoing by the project team.

ChainCatcher news, on the X platform, on-chain detective ZachXBT pointed out that the wallet addresses corresponding to the approximately 127,000 bitcoins (worth about $14 billion) announced for seizure by the U.S. government had been identified two years ago in a security research report (Milky Sad Report) as having private key vulnerability risks.ZachXBT stated that these addresses are now claimed by the U.S. government to be "under their control and custody," raising concerns about how they were obtained. When a user asked, "Is it transferred to a more secure wallet?" ZachXBT responded, "Not likely, it’s more like someone helped the U.S. government 'hack' it back." This statement implies that the related BTC may not have been obtained through conventional judicial means.

ChainCatcher message, the DeFi protocol Nemo on Sui has released an incident report stating that due to a security vulnerability in the flash_loan and get_sy_amount_in_for_exact_py_out functions in the contract, it was exploited by attackers, resulting in an asset loss of approximately 2.59 million USD.The attack originated from the developers launching new features without sufficient auditing and failing to promptly address known risks. The main funds were transferred to Ethereum via a cross-chain bridge, and the core functions of the protocol have currently been frozen. A vulnerability patch has been submitted for emergency auditing, and the team is formulating user compensation and asset tracking plans.

ChainCatcher news, according to official sources, the Cardano Foundation has officially launched the open-source traceability infrastructure Originate, aimed at verifying product authenticity and supporting industry certification. This solution will reshape product processes and enhance consumer trust.It is reported that Originate is suitable for multiple industries and application scenarios, with advantages such as scalability, low cost, and high customizability, providing a solid foundation for authenticity verification, trust building, and market expansion.

ChainCatcher news, according to Cointelegraph, the WAP token promoted by the famous American rapper Cardi B on the social platform X has sparked controversy. Blockchain analyst Wazz's preliminary investigation shows that the wallet address disclosed by Cardi B is associated with multiple rug pull projects. Blockchain security company PeckShield suspects that Cardi B's X account may have been hacked.However, Wazz refuted PeckShield's speculation, stating that her account has not been compromised, "This is a planned action, with multiple promotions, cartoons, and previous tweets as evidence. Additionally, you misread the liquidity pool; the actual liquidity is $700,000."Blockchain data visualization platform BubbleMaps found that 60% of the WAP token supply was bundled at the time of issuance. Furthermore, within 10 hours of the project's launch, approximately $500,000 worth of tokens had been sold off. BubbleMaps also pointed out, "To evade tracking, all wallets involved in the bundling transferred their tokens one-to-one to brand new addresses 4 hours ago."

ChainCatcher news, on-chain data analyst @ai_9684xtpa posted that smart money arthurgayes.eth deposited 20 trillion MOG into Bybit and Gate 10 hours ago, worth 4.34 million USD. If sold entirely, it would yield a profit of 4.28 million USD. This address previously purchased 82.5 trillion MOG in September 2023 at an average price of 0.0000000301 USD, spending 248,000 USD; currently, it still holds 62.5 trillion tokens, with an unrealized profit of up to 13.4 million USD.According to analysis, the miner fees for the address starting with 0x5041 used by arthurgayes.eth for offloading come from the "PORTAL market maker address," which is suspected to belong to DWF Labs. (Although there is currently no public cooperation information between DWF and the meme token MOG)

ChainCatcher message, regarding the wallet attack incident on the Bittensor chain, on-chain detective ZachXBT monitored and discovered that an address starting with 5FbWTr had 32,000 TAO (worth 8 million USD) stolen.ZachXBT stated that the attack incident faced by Bittensor originated from a stolen private key.

ChainCatcher message, cross-chain bridge Meson Finance tweeted that it has deleted the phishing tweet, confirming that the issue originated from a third-party API and not a direct attack on its account. Its account has now been restored to normal.