vulnerability

According to Slow Fog monitoring, the decentralized finance protocol Lien Finance was attacked. The attacker exploited a smart contract vulnerability to mint uncollateralized bond tokens and stole approximately $542,000 USDC.Using this vulnerability, the attacker successfully minted new non-anomalous BondTokens without destroying the corresponding input bonds and exchanged USDC through a pre-authorized address, ultimately transferring about 542,144.63 USDC from the victim's address. Analysis indicates that this incident was essentially due to a validation flaw in the bond token exchange logic, allowing the attacker to bypass asset collateral constraints and mint unsupported assets.

Zilliqa stated that there is a serious random number generation vulnerability in the Zilliqa Ledger application, affecting the Schnorr signatures of native non-EVM Zilliqa transactions. Attackers can recover the signer's private key from the biased temporary random numbers using only publicly available on-chain data.Any account that has signed and broadcasted about 5 or more native transactions through the Zilliqa Ledger application should be considered compromised. Since the related signatures are permanently recorded on the chain, subsequent updates to the application cannot eliminate the risk, and the affected private keys must be deactivated. EVM transactions and development tools such as zilliqa-js, gozilliqa-sdk, and pyzil are not affected.The vulnerability arises from the application selecting the wrong 32 bytes when copying the random number, retaining 8 bytes of zero padding and losing 8 bytes of entropy, resulting in each random number having a maximum of 64 bits fixed to zero. Attackers can use 5 or more affected signatures to recover the private key within seconds using ordinary hardware. Zilliqa observed suspected active exploitation on July 19 and confirmed the root cause on July 21.Zilliqa has suspended native transactions to prevent further loss of funds and is preparing a revised application with Ledger. However, the revised version cannot protect the exposed keys, and affected users should not transfer assets on their own but wait for the official announcement of a coordinated disposal plan.

According to on-chain analyst Onchain Lens (@OnchainLens), the Summer Fi vulnerability attacker has transferred most of the stolen funds. The attacker obtained 6.017 million DAI from the vulnerability on July 6 and has since continued to mix and transfer funds through Tornado Cash.Currently, two related addresses still have a small amount of funds remaining: the original wallet (0x7bf7...bdca) has 11.3 ETH (approximately $21,600) left, and the second wallet (0x46e0...eba7) has 282.9 ETH (approximately $543,500) left.

On-chain detective ZachXBT stated that the cross-chain protocol TeleSwap suffered a vulnerability attack of approximately $735,000 on July 15, and after the incident, its Bitcoin hot wallet immediately stopped processing transactions.As of now, five days have passed since the incident, and the project team has not made any public disclosures regarding this event. ZachXBT noted that about two hours ago, the attacker transferred the stolen funds to Tornado Cash.

Project Eleven has launched a new zero-knowledge proof system, providing a recovery method for the quantum-vulnerable Bitcoin proposed to be frozen under BIP-361, including the Bitcoin held by Satoshi Nakamoto.The solution leverages the property that quantum computers can break elliptic curve signatures but cannot break the one-way hash used in modern wallet key derivation, allowing the true owner holding the seed material to prove control. Benchmark tests show that the Project Eleven prototype is significantly faster than previous solutions, but the prototype has not yet been audited and is incomplete. It requires controversial modifications to blockchain rules before it can protect existing Bitcoin on the chain.

Bitcoin News posted on the X platform that Dathon Pwn claims to have discovered a BIP 110 late upgrade consensus vulnerability, which may allow nodes upgrading from old software to retain chain history, while newly deployed BIP 110 nodes would reject this history, potentially leading to a hidden chain split.

Robinhood Chain's Pons launchpad officially responded to previous reports regarding a token authorization vulnerability in its frontend, stating that the Pons launchpad trading page does not have any Multicall3 functionality. The Multicall3 functionality mentioned in the tweet comes from the previous version of the Debank Chain cross-chain bridge, which was launched before the Pons launchpad and does not affect launchpad users.Currently, the only confirmed affected asset is 0.6 NOXA tokens, valued at approximately $0.66. As a security precaution, Pons recommends that users who have used the old cross-chain bridge revoke token authorization through revoke.cash. The team is currently working with auditing firms to investigate potential risks and stated that they will restore Pons frontend services once it is confirmed that there are no actual vulnerabilities.

Elon Musk stated that after completing the security vulnerability review, X will open source all code repositories without exception. In addition, X will invite third-party auditors to verify the actual operating system to confirm its consistency with the publicly available source code.

According to official news, PinGo announced that its reward contract was recently attacked by hackers. The hackers exploited a vulnerability in permission verification to illegally claim 840,000 PINGO tokens.PinGo officials pointed out that this security incident has been effectively controlled, the remaining assets have been successfully migrated, and the upgrade of the related contract has also been completed. The officials emphasized that the PINGO tokens and related private keys are still in a secure state, and the reward claiming function has now been reopened.

Ledger researchers found that all Tangem hardware wallet cards' passwords can be reset through a laser attack.This attack requires physical contact with the device and approximately $250,000 worth of laboratory equipment, and the cards that are already in circulation cannot be patched to fix this issue.

Summer.fi released an analysis report on the Lazy Summer Protocol USDC treasury attack incident. The attacker manipulated the prices of two USDC treasury shares in a single atomic transaction, extracting approximately $6.04 million of depositor funds. The core of the attack lies in the calculation method of the treasury's net asset value (NAV).The attacker donated tokens that still retained the old valuation to a Silo Ark that had been suspended after the incident in November 2025 but had not yet been completely removed, resulting in an inflated total asset value of approximately 9.5%, raising the share price, which was then redeemed at an inflated price and withdrawn from the treasury's actual liquidity. The report emphasizes that this attack was not due to a contract code vulnerability, but rather a missing link in the treasury's offline process—the deposit limit for that Ark had been set to zero, yet it was still counted in the NAV of active assets.The attacker premeditatedly accumulated the required tokens three months in advance through multiple wallets and transferred part of the profits via Tornado Cash. After the incident, Guardian Multisig has suspended all on-chain treasuries and set the deposit limit to zero. The Lazy Summer DAO will discuss compensation plans for affected users and the treasury restart plan in the coming days.

The security company Coinspect Security posted on platform X that by analyzing cryptocurrency wallet seeds generated with insecure code since 2018, they discovered that thousands of seeds had been actually used. Just last month, it was found that the amount stolen from these wallets reached up to 3.14 million dollars, most of which went unreported.Some funds were concentrated into a single address and exhibited money laundering patterns. One affected address transferred out 2 million dollars just hours after the alert was issued, and it is uncertain whether this was theft. Coinspect warns that users who believe many assets are still at risk may be located in China.

According to CoinDesk, researchers from the blockchain security company Hexens have discovered a "stale cache" type obfuscation vulnerability in the Aptos blockchain Move virtual machine. Attackers only need about $3,000 in server costs to launch an attack in a simulated environment with nearly a 90% success rate, without requiring validator permissions or insider knowledge.In simulated tests, researchers ran about 20 attacks, successfully executing 17-18 times, and verified the potential control over cross-chain protocol management permissions such as LayerZero, Wormhole, and USDC CCTP.Hexens assesses that this vulnerability directly threatens DeFi, stablecoins, and liquid staking protocols on the Aptos chain, involving low single-digit billion-dollar assets; if spread through cross-chain bridges, stablecoin minting, and centralized exchanges, the systemic risk exposure could reach up to $70 billion. The Aptos team completed the fix and deployed it to the mainnet within hours of receiving the vulnerability report on February 25, and currently, no user funds have been compromised.

The Chief Information Security Officer of Slow Fog, 23pds, stated that researchers have exposed a high-risk vulnerability in CI/CD called Cordyceps, affecting the open-source repositories of major companies such as Microsoft, Google, Apache, and Cloudflare. Attackers do not need corporate accounts or any system permissions; they can simply register a free GitHub account, submit a malicious PR, and leave a comment to forge approvals, steal server keys, and push malicious code, completely taking control of the corporate code repository.

According to the Associated Press, Anthropic's Mythos model has discovered vulnerabilities in the U.S. government's classified systems.

The blockchain research organization Common Prefix disclosed that on June 10, hackers exploited a vulnerability in the Secret Network and Axelar cross-chain bridge contract to forge deposits and mint uncollateralized tokens, subsequently cashing out approximately $4.67 million.The attack went undetected for seven days until a normal cross-chain transfer failed due to insufficient funds in the escrow account on June 17, revealing the anomaly. The root of the vulnerability lies in the fact that when the contract changed from an escrow model to a minting model, it deleted two key functions responsible for verifying the source of transfers, and it had never undergone an external audit since its deployment in early 2023. Secret Network pointed out that the Axelar bridging infrastructure failed to trigger any effective anomaly monitoring or emergency pause mechanism before the assets were stolen on a large scale.The stolen funds were routed through Osmosis to Ethereum and exchanged for ETH on CoW Protocol, then dispersed into exchanges such as KuCoin, ChangeNow, and HitBTC. Currently, approximately $672,000 remains in the attackers' Axelar wallet. Secret Network has requested Axelar to freeze that address, but the request was denied. Axelar emphasized that its core protocol was never affected, and the exploited contract was not developed or maintained by Axelar. Currently, Axelar has disabled the related cross-chain connections and stated that it is coordinating follow-up actions with exchanges and law enforcement agencies.

The cross-chain protocol Axelar Network released a statement regarding the recent security incident related to Secret Network, stating that there is a misunderstanding within the community about the event. Both Axelar and the Inter-Blockchain Communication Protocol (IBC) were not attacked or compromised. The affected token smart contracts were neither developed, deployed, nor maintained by Axelar, and Axelar's firewall mechanism also prevented the impact from spreading to other chains.It is reported that the exploited contract is a forked version based on CW20-ICS20, but the developers removed two core security checks, resulting in an "infinite minting" vulnerability. By deleting the verification mechanisms originally used to prevent such issues, this fork altered the original trust model of the contract and did not undergo a new security audit.Axelar Network explained that anyone can deploy contracts for cross-chain asset wrapping through IBC, and similar contracts have also been used to wrap tokens from other chains into Secret Network. However, the Secret side fork version in this incident has vulnerabilities due to the removal of key security checks. This incident is not a unique logical flaw, nor is it an issue with the IBC protocol itself, but rather a security risk introduced by modifications to third-party contracts.

RetoSwap disclosed on platform X that the team received a report at 2:02 AM (Beijing time) today that the Haveno trading protocol was under attack. They immediately set the minimum client version to 2.0 through the filter function and suspended trading, as well as banned the attacker's onion address. RetoSwap stated that the team was not attacked, and the vulnerability lies at the Haveno protocol level. The losses seem to be limited to large cryptocurrency asset orders, and fiat currency traders were not affected. The team is evaluating plans to assist affected traders in recovery. Trading will resume after the protocol is fixed.Previously, on May 21, it was reported that RetoSwap lost approximately $2.7 million due to vulnerabilities in the Haveno protocol.

Regarding the suspected attack on the Aztec Router contract on the Ethereum chain, Aztec Labs has officially launched an investigation and clarified that Aztec Connect was deprecated three years ago. Aztec Labs does not hold any administrator keys or control over the system, and currently cannot pause or upgrade it. Therefore, the community is reminded to be vigilant against false "support" accounts and private messages.