vulnerabilities

Polygon Labs disclosed that it has fixed a batch of security vulnerabilities in its proof-of-stake network through two hard forks, with the related fixes privately deployed before public disclosure. According to a forum post released on Wednesday, the team packaged the fixes into the Austin hard fork of the Bor client and the Kyoto hard fork of the Heimdall client, both of which followed the standard process for fixing issues that affect consensus: first validated on the Amoy testnet, and then publicly disclosed once the mainnet was activated and the network was secure.The Austin fork fixed two denial-of-service paths in block processing, including a vulnerability where malicious block producers could crash peer nodes by filling them with oversized field data. The Kyoto fork addressed a broader range of consensus hardening issues, with the most severe vulnerability allowing an attacker to force the entire validator set to perform costly and coordinated work with just one crafted transaction—the cost of constructing the transaction is low, but the network processing cost is high. Polygon emphasized that none of the vulnerabilities were observed to be exploited on the mainnet and have been proactively addressed. The two upgrades are now mandatory for node operators and have taken effect without the need for state migration or resynchronization.This disclosure comes at a critical transformation period for Polygon, which has completed the migration of the traditional MATIC token to POL as part of a comprehensive overhaul of its network architecture. The news did not boost the price of POL; according to CoinGecko data, POL traded at approximately $0.09983 on Sunday, down 2.3% in 24 hours, down about 6.8% over the past week, and down about 60.8% over the past year, with a market capitalization of approximately $1.07 billion.

Polygon disclosed multiple previously undisclosed security vulnerabilities recently fixed through two hard forks, Austin and Kyoto, which could affect its proof-of-stake network. The vulnerabilities involve Polygon's Bor and Heimdall clients, including denial-of-service risks, validator resource exhaustion, and defects affecting checkpoint and milestone processing.Polygon stated that the fixes were privately tested before being deployed to the mainnet and publicly disclosed. The most severe issue involved Heimdall, where carefully crafted transactions could force validators to perform excessive processing work, disrupting the network. The Austin hard fork also fixed two denial-of-service risks in Bor that could slow down block processing or cause node crashes. Polygon indicated that these vulnerabilities were not exploited on the mainnet, and the fixes were proactively completed before the details of the vulnerabilities were made public.

The cryptocurrency payment platform Rain stated that its monitoring system detected a vulnerability affecting a small number of programs using outdated versions of Solana contracts, while other programs were not affected. Rain immediately launched an investigation to determine the scope of the incident.The Rain team has successfully upgraded all programs using outdated versions of Solana contracts, and the related issues have been resolved. Rain will continue to monitor the situation and has hired a third-party forensic expert to conduct an investigation, while also cooperating with law enforcement and relevant regulatory agencies. All affected users will receive full compensation, and Rain has begun the remediation process and is committed to completing the handling swiftly and responsibly.

The security team of the open-source wallet provider OneKey successfully replicated the exploitation of a vulnerability in the old version of the Ledger Ethereum application in a laboratory environment. OneKey's founder and CEO Wang Yishi stated that they executed a "transaction replacement attack" on Ledger Ethereum application version 1.22.1 by exploiting a previously patched vulnerability, allowing attackers to overwrite pending transactions while users review legitimate transactions.Ledger responded that exploiting this vulnerability requires controlling the communication between the device and the host, such as through malware, compromised wallet software, or malicious web pages. Ledger has added application layer protections in the Ethereum application version 1.22.2 released on August 13 and fixed the underlying issue in Secure SDK 26.6.1 on August 21. Ledger emphasized that no users were hacked as a result; this was merely a replication of the vulnerability in a laboratory environment.This security test occurred after the Coldcard vulnerability incident. Previously, the Coldcard wallet had a firmware vulnerability that posed security risks to some mnemonic phrase generation, but Ledger stated that its devices were not affected by this vulnerability because recovery phrases are generated by a certified random source built into the device's secure chip. The vulnerability replicated by OneKey is unrelated to mnemonic phrase generation but affects the way transactions are processed during the signing process.

The decentralized lending protocol Moonwell is investigating issues affecting the MAMO Core Market on Base. Security firms CertiK and PeckShield have flagged a multi-million dollar exploit incident, estimating losses of approximately $8.7 million.Moonwell stated on X that as a precaution, the borrowing limit for all Core Markets on Base has been set to 1 wei, and the supply limits for MAMO and WELL have also been set to 1 wei. PeckShield noted that the attacker aggregated stolen funds to an address for the DAI stablecoin; CertiK indicated that the attacker manipulated the collateral price of the low liquidity MAMO token and then borrowed real cbBTC from the mCBTC market to carry out the attack, with Blockaid also identifying the same attack mechanism.As a result, the WELL token dropped about 13% in 24 hours, while MAMO fell about 9%. This exploit incident is part of a period of frequent DeFi vulnerabilities since April, during which multiple protocols have been hacked for over $600 million, with the largest being a $292 million exploit of Kelp DAO.

According to CoinDesk, the developers of the Bitcoin Lightning Network payment software Core Lightning (CLN) issued an urgent warning to node operators after the team received a large number of AI-generated security reports, revealing several real vulnerabilities. The development team advised operators not to directly shut down the machine power but to restart the software in "--offline" mode, which stops communication with other Lightning Network nodes while still keeping it operational to continuously monitor the Bitcoin blockchain and protect the funds in the payment channels.The Core Lightning team began receiving a large number of AI-generated vulnerability reports since early August, some of which have been confirmed to be valid. Developers will keep the details confidential for two weeks to complete the patch development and plan to release a signed patch version for operators to verify the source. The source code and vulnerability details will be made public after the confidentiality period ends.This is the second AI-related security incident in the Lightning Network this month. Earlier in early August, BTCPay Server experienced a vulnerability that led to the leakage of credentials for some Lightning Network nodes and theft of funds. Additionally, the "Bitcoin Red Team," composed of 16 developers, used AI models to scan 390 Bitcoin code repositories at the end of July, discovering nearly 5,000 issues, 85 of which were rated as critical.

The Ethereum client Besu has fixed five security vulnerabilities discovered by the blockchain security company CertiK in version 26.7.1 released on July 27, and published four detailed security announcements on August 14. The details of the vulnerabilities were disclosed later to allow node operators to complete the upgrade deployment.Jialiang Chang, CertiK's Director of Security Engineering and Senior Audit Partner, stated that the arrangement of releasing patches first and details later provides an 18-day buffer period, allowing node operators to identify affected deployments, test the new version, and coordinate with validators or consortium participants to complete the upgrade. The relevant vulnerabilities involve block broadcasting processing, future height consensus proposal caching, WebSocket subscription limits, and JSON-RPC filter creation. If not fixed, attackers could exhaust node memory or thread resources, affecting node availability and consensus processing.CertiK conducted adversarial testing on peer-to-peer, HTTP RPC, WebSocket RPC, and consensus interfaces in a private multi-node test network using the Chain Scan method, and provided reproducible testing tools to the Besu team. CertiK is updating Chain Scan to expand around-the-clock multi-node testing for public chain networks.

The cryptocurrency wallet Rabby Wallet posted on platform X that the team has fixed a vulnerability after discovering it and released an update on August 11. The mobile application is not affected.The conditions that triggered the vulnerability are extremely limited: the wallet must be connected to a malicious website, and the user must manually set the auto-lock timer to 10 minutes (other settings are not affected). No exploitation in the wild has been found so far.

The cross-chain liquidity protocol Maya Protocol was attacked on August 18, with the attacker exploiting six interconnected software vulnerabilities to create false account balances, stealing approximately 20.83 BTC (about $1.34 million) and other assets, resulting in a total direct loss of about $1.65 million. The incident led to the suspension of trading on the MAYAChain network, with its token CACAO plummeting nearly 89% from $0.115 to $0.013, before recovering to around $0.03.Technical reviews show that the attack began when MAYAChain mistakenly judged a transaction to be lost and triggered a compensation mechanism, but the mechanism miscalculated, adding about 49 million CACAO to a small liquidity pool, while the protocol's reserves only held about 168,000 CACAO. After the transfer failed, the system incorrectly saved the new balance, and the attacker subsequently deposited a very small amount into the liquidity pool, acquiring over 99% of the pool's share and immediately withdrawing 48.87 million CACAO, which was then exchanged for Bitcoin, Ethereum, and other assets.The incident caused the total value of the Maya Protocol liquidity pool to decrease by about $10.9 million, of which approximately $6.4 million was due to the depreciation of CACAO, and about $2.9 million came from arbitrage trading. The team expressed hope that the attacker would return the funds in the form of a bug bounty; otherwise, they would seek to recover losses through investments in channels like Aztec Chain. Maya Protocol has not yet announced a specific time for resuming trading. This incident once again exposed the security risks within the complex logic of DeFi protocols.

Decred official X account (@decredproject) released a security notice, stating that a security vulnerability has been discovered in the Decred (DCR) network, and a patch will be released on August 18 at 10 AM Eastern Time.For security reasons, the official recommends that users suspend voting and mining operations until the upgrade is completed. An announcement will be synchronized on the official X account as soon as the patch is released.

Payward (the parent company of Kraken) stated that in the coming weeks, it will use Claude Mythos 5 to scan for vulnerabilities in all Payward environments, and the findings will be directly incorporated into its existing security program.

Bitcoin News posted on the X platform that after two weeks of using cutting-edge AI to scan almost the entire Bitcoin open-source ecosystem for vulnerabilities, Bitcoin Red Team member @callebtc stated, "The easily discoverable vulnerabilities have been addressed," and maintainers are verifying "a large number" of serious and high-risk vulnerabilities.@callebtc indicated that the main findings include: decades of accumulated open-source technical debt are being exposed alongside AI capabilities that can discover vulnerabilities at speeds and scales unattainable by human researchers; Lightning seems particularly vulnerable, with its complexity meaning its security status is "worse than average"; unmaintained Bitcoin projects should be considered vulnerable until their security is confirmed.Projects that began building AI security and auditing processes months ago are now in a completely different position compared to those that have been waiting until now. The Bitcoin Red Team has now completed a foundational scan of almost the entire Bitcoin open-source ecosystem. Easily discoverable vulnerabilities have mostly been addressed, but as AI capabilities improve, external red team testing may need to continue indefinitely. Despite discovering and reporting "a large number" of real serious and high-risk vulnerabilities, @callebtc believes this process will ultimately make Bitcoin stronger. The same AI security review will soon expand to areas far beyond Bitcoin.

The Bitcoin wallet Electrum has released version 4.8.1, with the official statement claiming that this update includes "important security fixes" and urging users to upgrade as soon as possible.Developers involved in reproducible builds have provided independent signatures for the binary packages on the download page to verify the consistency between the release package and the source code.

According to Forbes, the scale of the theft in the Coldcard hardware wallet vulnerability incident has risen to approximately $130 million, involving about 2,000 BTC and over 5,200 addresses, reigniting the industry's debate over who should hold private keys. Data from Bitcoin Magazine shows that in the days following the incident, the net inflow into U.S. spot Bitcoin ETFs was $626 million, with some opinions suggesting that the vulnerability may drive more funds towards ETFs.Reports indicate that supporters of self-custody remain undeterred. Casa co-founder Jameson Lopp stated that confidence in self-custody should not be lost due to recent events, as custodial institutions also rely on random number generators. Bitcoin core early developer Peter Todd noted that the historical record of self-custody is far better than that of third parties. Another viewpoint argues that both reflexive choices have flaws. Onramp co-founder Michael Tanguma stated that if the only answer is Coinbase or ETFs, it poses a serious problem, as centralizing what should be decentralized assets undermines their foundation, advocating for a multi-institutional custody solution where keys are held by multiple regulated entities.

According to Cointelegraph, BTCPay Server has temporarily restricted public remote connections to Lightning Network nodes running the Lightning Network Daemon (LND) software after attackers exploited a serious vulnerability to obtain credentials and transfer funds.BTCPay stated that this restriction prevents external wallets like Zeus from connecting through the BTCPay Server domain. BTCPay mentioned that Lightning payments can continue, and they plan to restore remote access options when they deem it safe.

According to Decrypt, a volunteer security team stated that it scanned 150 Bitcoin code repositories using cutting-edge artificial intelligence models and discovered a dozen vulnerabilities. The team has built multiple AI-based review systems, targeting wallets, cryptographic libraries, infrastructure, and other Bitcoin projects. Team members claim that, on average, each person can find about one serious vulnerability per hour, and in the past 12 hours, they have submitted security reports to multiple projects, but specific affected projects have not yet been made public.

The Bitcoin Red Team's volunteer security initiative has scanned approximately 150 Bitcoin code repositories and disclosed more than a dozen vulnerabilities. The team is developing an open-source AI platform for auditing Bitcoin software, covering wallets, cryptographic libraries, infrastructure, and other projects.AnchorWatch CEO Rob Hamilton stated that the team has currently spent about $20,000 on various AI services and is using Kimi K3, OpenAI's GPT Sol, Anthropic's Claude Fable and Opus, as well as Z.ai's GLM 5.2 to identify vulnerabilities and generate related documentation. A pseudonymous Bitcoin developer, Calle, mentioned that the team has reported critical vulnerabilities to multiple projects in the past 12 hours, averaging about one critical vulnerability discovered per person per hour, with daily expenditures of approximately $10,000. The team did not disclose the affected projects or details of the vulnerabilities.

According to TechCrunch, OpenAI is fighting back against Apple's lawsuit regarding the leak of trade secrets, stating that Apple itself has vulnerabilities in its information security management and employee departure processes, and cannot prove that the relevant information is protected trade secrets.Apple previously accused OpenAI of obtaining hardware-related secrets through former employees who left Apple and requested the court to expedite the evidence investigation. In the latest legal documents submitted, OpenAI stated that Apple allows employees to use personal iCloud accounts to handle work materials and did not promptly revoke access after employees left. OpenAI claimed that Apple did not specify the exact trade secrets that were allegedly stolen, but only referred generally to information such as product development processes, supply chains, and testing.OpenAI believes that Apple's lawsuit is more about restricting its development in the AI hardware field and denies that the company needs or uses Apple's trade secrets. The focus of the dispute between the two parties centers on employee mobility, intellectual property protection, and competition in the AI hardware sector.

Bitcoin News posted on the X platform that the volunteer organization Bitcoin Red Team has scanned 150 code repositories, privately disclosed more than a dozen vulnerabilities, and identified key issues during the process of strengthening wallets, cryptographic libraries, and infrastructure following the COLDCARD vulnerability incident. This work has consumed approximately $20,000 in AI computing costs, covered by OpenSats.Researchers are using multiple AI tools, with many stating that open-source models like Kimi K3 have become primary tools for security research, while cutting-edge closed-source models like OpenAI and Anthropic are considered to impose more limitations in such analyses. The team plans to open-source its AI security tools to enable projects to continuously audit their own codebases. Researchers warn that Bitcoin may just be the first industry facing a wave of AI-assisted vulnerability discovery, with similar efforts likely to expand to all open-source software.

Bitcoin News posted on the X platform stating that Coinkite claims the vulnerability exists at the boundaries of two unrelated firmware submodules, rather than in its Bitcoin or crypto code, allowing it to evade manual and AI-assisted code reviews for years.Coinkite stated that after the incident, the company tested cutting-edge AI models including Kimi K3, Claude Fable, and Codex 5.6, none of which identified the flaw. Coinkite is currently urging security-critical projects to specifically audit build systems and submodule boundaries, warning that AI-assisted development may leave similar blind spots in the Bitcoin ecosystem.