{ "meta": { "version": "2026.09.25.257", "updatedAt": "2026-09-25T06:02:36.537Z", "currency": "USD", "methodology": "Aggregate statistics count only verified independent attacks or executed attack attempts. Follow-up fund movement, freezes, returns, enforcement, ruled-out anomalies, unconfirmed rug risk, duplicate updates, and unexploited advisories are retained locally but excluded from public totals.", "aliases": { "DCI-2026-250": "DCI-2026-245" } }, "incidents": [ { "id": "DCI-2026-339", "status": "verified", "incidentDate": "2026-09-25", "datePrecision": "day", "title": { "zh": "Bitget 钱包后台系统入侵与多链资产转出", "tw": "Bitget 錢包後臺系統入侵與多鏈資產轉出", "en": "Bitget wallet-backend compromise and multi-chain asset transfers" }, "summary": { "zh": "Bitget 官方初报称约 3.516 亿美元资产受影响；攻击者进入钱包后台、伪造转账数据并触发授权签名流程，官方初步排除私钥泄露。XRP Ledger 约 1.0298 亿 XRP 转入归集地址，EVM 换 ETH 估值属于同一影响金额。", "tw": "Bitget 官方初報稱約 3.516 億美元資產受影響；攻擊者進入錢包後臺、偽造轉賬數據並觸發授權簽名流程，官方初步排除私鑰洩露。XRP Ledger 約 1.0298 億 XRP 轉入歸集地址，EVM 換 ETH 估值屬於同一影響金額。", "en": "Bitget’s initial official estimate said about $351.6 million in assets were affected. Attackers accessed a wallet backend, spoofed transfer data, and triggered its signing process; the initial review ruled out a private-key leak. About 102.98 million XRP moved to an XRP Ledger aggregator; the EVM ETH conversion estimate is part of the same affected amount." }, "details": { "zh": "## 事件背景\nBitget 于 2026 年 9 月 25 日报告钱包后台安全事件。CEO 称攻击者进入关键钱包服务后台、伪造转账数据并触发授权签名流程；初步排除直接私钥泄露，入侵入口仍未知。\n\n## 事件经过\n官方称 02:31 检出异常；CEO 初报约 3.516 亿美元受影响并暂停提现。XRP Ledger 三笔大额转入同一归集地址，合计约 102,976,680 XRP。研究者报告 EVM 资产换成 ETH，约 1.83 亿美元，为总影响金额的组成部分。\n\n## 资金流向\nBitget 标注的 XRP 源地址 → 归集地址 → 多笔分拆；EVM 侧报告换成约 67,982 ETH。跨链归属、全部下游地址及最终回收仍待独立对账。\n\n## 金额口径\n官方初步称受影响约 3.516 亿美元。4.64 亿美元保护基金是承诺，不代表损失已返还。XRP 与 EVM 估值为总额子集，不相加。\n\n## 证据边界\n官方公告支持后台系统受侵和初步金额；XRPL 原生交易支持转入和分拆；EVM 估值主要来自研究者。冷热钱包层级与最终净损待完整调查。\n\n## 处置状态\nBitget 暂停提现并审查、加固系统；未公布明确恢复时间或用户赔付到账。\n\n## 地址与交易\n保留 XRPSCAN 标注的 Bitget 源地址与事件归集地址，不自动推定归集地址控制人。", "tw": "## 事件背景\nBitget 於 2026 年 9 月 25 日報告錢包後臺安全事件。CEO 稱攻擊者進入關鍵錢包服務後臺、偽造轉賬數據並觸發授權簽名流程；初步排除直接私鑰洩露，入侵入口仍未知。\n\n## 事件經過\n官方稱 02:31 檢出異常；CEO 初報約 3.516 億美元受影響並暫停提現。XRP Ledger 三筆大額轉入同一歸集地址，合計約 102,976,680 XRP。研究者報告 EVM 資產換成 ETH，約 1.83 億美元，為總影響金額的組成部分。\n\n## 資金流向\nBitget 標註的 XRP 源地址 → 歸集地址 → 多筆分拆；EVM 側報告換成約 67,982 ETH。跨鏈歸屬、全部下游地址及最終回收仍待獨立對賬。\n\n## 金額口徑\n官方初步稱受影響約 3.516 億美元。4.64 億美元保護基金是承諾，不代表損失已返還。XRP 與 EVM 估值為總額子集，不相加。\n\n## 證據邊界\n官方公告支持後臺系統受侵和初步金額；XRPL 原生交易支持轉入和分拆；EVM 估值主要來自研究者。冷熱錢包層級與最終淨損待完整調查。\n\n## 處置狀態\nBitget 暫停提現並審查、加固系統；未公佈明確恢復時間或用戶賠付到賬。\n\n## 地址與交易\n保留 XRPSCAN 標註的 Bitget 源地址與事件歸集地址，不自動推定歸集地址控制人。", "en": "## Incident overview\nBitget reported a wallet-backend incident on September 25, 2026. Its CEO said attackers accessed a critical backend, spoofed transfer data, and triggered the signing process. The initial review ruled out a direct private-key leak; the entry vector remained unknown.\n\n## Incident sequence\nBitget said it detected anomalies at 02:31 and initially estimated $351.6 million in affected assets while pausing withdrawals. Three large XRP Ledger transfers moved about 102,976,680 XRP to one aggregator. Researchers reported EVM assets swapped to ETH near $183 million, part of the total.\n\n## Fund flow\nBitget-labeled XRP sources → aggregator → splits; EVM reports described about 67,982 ETH after swaps. Cross-chain attribution, downstream destinations, and recovery await reconciliation.\n\n## Amount basis\nThe official preliminary affected amount was about $351.6 million. The $464 million protection fund is a commitment, not a return. XRP and EVM valuations are components and are not added.\n\n## Evidence boundary\nOfficial notices support the backend compromise and initial amount; XRP Ledger transactions support deposits and splits; EVM valuation relies mainly on researchers. Wallet tier and final net loss await a full investigation.\n\n## Current status\nBitget paused withdrawals while reviewing and hardening systems; no firm restoration time or completed compensation was published.\n\n## Addresses and transactions\nThe record keeps XRPSCAN-labeled sources and the incident aggregator; aggregator control is not inferred." }, "category": "access-control", "severity": "critical", "ecosystems": [ "XRP Ledger", "Ethereum" ], "chains": [ "XRP Ledger", "Ethereum" ], "lossUsd": 351600000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "官方初步受影响金额约 3.516 亿美元，最终净损待调查。4.64 亿美元用户保护基金是承诺，不是已返还金额；XRP 与 EVM 资产是总额组成，不重复相加。", "tw": "官方初步受影響金額約 3.516 億美元，最終淨損待調查。4.64 億美元用戶保護基金是承諾，不是已返還金額；XRP 與 EVM 資產是總額組成，不重複相加。", "en": "The official preliminary affected-asset amount was about $351.6 million; final net loss awaits investigation. The $464 million User Protection Fund is a commitment, not a return. XRP and EVM assets are components of the total and are not added again." }, "addressDisclosure": "published", "addresses": [ { "chain": "XRP Ledger", "address": "rwNhefsz1UQEusxhCvHip3RANinWi4CTck", "entity": { "zh": "Bitget 事件相关 XRP 归集地址；资金流可核，控制人归因待确认。", "tw": "Bitget 事件相關 XRP 歸集地址；資金流可核，控制人歸因待確認。", "en": "XRP aggregator associated with the Bitget incident; transfers are observable, controller attribution awaits confirmation." }, "role": "aggregation-address", "category": "unknown", "confidence": 0.68, "sourceUrl": "https://api.xrpscan.com/api/v1/account/rwNhefsz1UQEusxhCvHip3RANinWi4CTck/transactions?limit=100", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "XRPL 交易显示大额汇入和分拆，不独立确认控制人。", "tw": "XRPL 交易顯示大額匯入和分拆，不獨立確認控制人。", "en": "XRPL transactions show large deposits and splits but do not independently identify the controller." }, "reviewRequired": true }, { "chain": "XRP Ledger", "address": "rGDreBvnHrX1get7na3J4oowN19ny4GzFn", "entity": { "zh": "XRPSCAN 标注为 Bitget 的源地址，冷热钱包层级待核。", "tw": "XRPSCAN 標註為 Bitget 的源地址，冷熱錢包層級待核。", "en": "Source address labeled Bitget by XRPSCAN; wallet tier is unverified." }, "role": "affected-custody-source", "category": "custodian", "confidence": 0.75, "sourceUrl": "https://xrpscan.com/account/rGDreBvnHrX1get7na3J4oowN19ny4GzFn", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "账本显示向归集地址转账；标签不单独证明冷热层级。", "tw": "賬本顯示向歸集地址轉賬；標籤不單獨證明冷熱層級。", "en": "The ledger shows transfers to the aggregator; the label alone does not prove wallet tier." }, "reviewRequired": true }, { "chain": "XRP Ledger", "address": "rwTTsHVUDF8Ub2nzV2oAeWxfJzUvobXLEf", "entity": { "zh": "XRPSCAN 标注为 Bitget 的源地址，冷热钱包层级待核。", "tw": "XRPSCAN 標註為 Bitget 的源地址，冷熱錢包層級待核。", "en": "Source address labeled Bitget by XRPSCAN; wallet tier is unverified." }, "role": "affected-custody-source", "category": "custodian", "confidence": 0.75, "sourceUrl": "https://xrpscan.com/account/rwTTsHVUDF8Ub2nzV2oAeWxfJzUvobXLEf", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "账本显示向归集地址转账；标签不单独证明冷热层级。", "tw": "賬本顯示向歸集地址轉賬；標籤不單獨證明冷熱層級。", "en": "The ledger shows transfers to the aggregator; the label alone does not prove wallet tier." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "Bitget CEO 初步公告", "tw": "Bitget CEO 初步公告", "en": "Bitget CEO initial notice" }, "url": "https://x.com/GracyBitget/status/2103235655879074084", "type": "official" }, { "label": { "zh": "Bitget 后台路径初查", "tw": "Bitget 後臺路徑初查", "en": "Bitget backend-path update" }, "url": "https://x.com/GracyBitget/status/2103284083363398137", "type": "official" }, { "label": { "zh": "XRPL 归集地址交易", "tw": "XRPL 歸集地址交易", "en": "XRPL aggregation-address transactions" }, "url": "https://api.xrpscan.com/api/v1/account/rwNhefsz1UQEusxhCvHip3RANinWi4CTck/transactions?limit=100", "type": "research" }, { "label": { "zh": "XRPSCAN Bitget 源地址", "tw": "XRPSCAN Bitget 源地址", "en": "XRPSCAN Bitget source account" }, "url": "https://xrpscan.com/account/rGDreBvnHrX1get7na3J4oowN19ny4GzFn", "type": "research" }, { "label": { "zh": "EVM 资金研究", "tw": "EVM 資金研究", "en": "EVM fund-flow research" }, "url": "https://x.com/lookonchain/status/2103268114603639155", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-339", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-340", "status": "verified", "incidentDate": "2026-09-24", "datePrecision": "day", "title": { "zh": "Meter Passport BNB Chain 无背书代币铸造攻击", "tw": "Meter Passport BNB Chain 無背書代幣鑄造攻擊", "en": "Meter Passport unbacked-token minting exploit on BNB Chain" }, "summary": { "zh": "Blockaid 报告 Meter Passport 桥在 BNB Chain 出现进行中的无背书 wMTRG 铸造，约两笔铸造的名义估值约 230 万美元，部分代币已在 PancakeSwap 出售。SlowMist 将其列为攻击事件；实际套现额和最终净损未核。", "tw": "Blockaid 報告 Meter Passport 橋在 BNB Chain 出現進行中的無背書 wMTRG 鑄造，約兩筆鑄造的名義估值約 230 萬美元，部分代幣已在 PancakeSwap 出售。SlowMist 將其列為攻擊事件；實際套現額和最終淨損未核。", "en": "Blockaid reported an ongoing unbacked wMTRG mint through Meter Passport on BNB Chain. Roughly two mints had a nominal estimate near $2.3 million, and some tokens were sold on PancakeSwap. SlowMist listed it as an attack; realized proceeds and final net loss remain unverified." }, "details": { "zh": "## 事件背景\nMeter Passport 桥在 BNB Chain 出现异常无背书 wMTRG 铸造，监测告警称攻击仍在进行。\n\n## 事件经过\nBlockaid 于 9 月 24 日报告约两笔异常铸造，并称部分代币已在 PancakeSwap 出售；SlowMist 将其列为安全事件。\n\n## 资金流向\nMeter Passport 铸造路径 → wMTRG → PancakeSwap 部分出售；攻击地址、完整交易和出售所得未完整公开。\n\n## 金额口径\n约 230 万美元是无背书代币名义估值，不记为已实现损失；净损与卖出数量未核。\n\n## 证据边界\nBlockaid 与 SlowMist 支持事件发生；完整交易、项目方复盘及确切动作时间待后续确认。\n\n## 处置状态\n公开资料未确认完整暂停、修复、冻结或追回结果。\n\n## 地址与交易\n没有核实的完整攻击地址或交易标识符。", "tw": "## 事件背景\nMeter Passport 橋在 BNB Chain 出現異常無背書 wMTRG 鑄造，監測告警稱攻擊仍在進行。\n\n## 事件經過\nBlockaid 於 9 月 24 日報告約兩筆異常鑄造，並稱部分代幣已在 PancakeSwap 出售；SlowMist 將其列為安全事件。\n\n## 資金流向\nMeter Passport 鑄造路徑 → wMTRG → PancakeSwap 部分出售；攻擊地址、完整交易和出售所得未完整公開。\n\n## 金額口徑\n約 230 萬美元是無背書代幣名義估值，不記為已實現損失；淨損與賣出數量未核。\n\n## 證據邊界\nBlockaid 與 SlowMist 支持事件發生；完整交易、項目方復盤及確切動作時間待後續確認。\n\n## 處置狀態\n公開資料未確認完整暫停、修復、凍結或追回結果。\n\n## 地址與交易\n沒有核實的完整攻擊地址或交易標識符。", "en": "## Incident overview\nMeter Passport on BNB Chain showed anomalous minting of unbacked wMTRG; the monitoring alert described an ongoing exploit.\n\n## Incident sequence\nBlockaid reported about two anomalous mints on September 24 and said some tokens had been sold on PancakeSwap; SlowMist listed the event.\n\n## Fund flow\nMeter Passport mint path → wMTRG → partial PancakeSwap sales; attacker addresses, full transactions, and proceeds were not fully public.\n\n## Amount basis\nAbout $2.3 million is a nominal estimate, not realized loss; net loss and amount sold remain unknown.\n\n## Evidence boundary\nBlockaid and SlowMist support the event; full transactions, a project postmortem, and exact action time remain pending.\n\n## Current status\nPublic sources did not establish the full pause, repair, freeze, or recovery outcome.\n\n## Addresses and transactions\nNo complete attacker address or transaction identifier was verified." }, "category": "bridge-exploit", "severity": "high", "ecosystems": [ "BNB Chain" ], "chains": [ "BNB Chain" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 230 万美元是无背书 wMTRG 名义估值，不是核实的套现额或净损。", "tw": "約 230 萬美元是無背書 wMTRG 名義估值，不是核實的套現額或淨損。", "en": "About $2.3 million is a nominal unbacked-wMTRG estimate, not verified proceeds or net loss." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "Blockaid 告警", "tw": "Blockaid 告警", "en": "Blockaid alert" }, "url": "https://x.com/blockaid_/status/2103121249706877178", "type": "research" }, { "label": { "zh": "SlowMist Hacked Zone 记录", "tw": "SlowMist Hacked Zone 記錄", "en": "SlowMist Hacked Zone record" }, "url": "https://hacked.slowmist.io/zh/", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-340", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-338", "status": "verified", "incidentDate": "2026-09-24", "datePrecision": "day", "title": { "zh": "Duelbits 多链热钱包异常转出", "tw": "Duelbits 多鏈熱錢包異常轉出", "en": "Duelbits multi-chain hot-wallet unauthorized transfers" }, "summary": { "zh": "Duelbits 确认安全事件后关闭网站调查；ScamSniffer 追踪 Ethereum、BNB Chain 与 TRON 多链转出，SlowMist 记录约 490 万美元。早期约 420 万和其他约 700 万估值范围不同，不相加；私钥泄露尚未确认。", "tw": "Duelbits 確認安全事件後關閉網站調查；ScamSniffer 追蹤 Ethereum、BNB Chain 與 TRON 多鏈轉出，SlowMist 記錄約 490 萬美元。早期約 420 萬和其他約 700 萬估值範圍不同，不相加；私鑰洩露尚未確認。", "en": "Duelbits took its site offline after confirming a security incident. ScamSniffer tracked transfers on Ethereum, BNB Chain, and TRON; SlowMist recorded about $4.9 million. Estimates near $4.2 million and $7 million use different scopes and are not added; a private-key leak remains unconfirmed." }, "details": { "zh": "## 事件背景\nDuelbits 于 2026 年 9 月 24 日发生多链钱包安全事件并关闭网站调查。平台确认事件，但没有公布根因。\n\n## 事件经过\nScamSniffer 报告 Ethereum、BNB Chain 和 TRON 热钱包异常转出并估算约 420 万美元；Duelbits 随后确认并下线检查。SlowMist 记录约 490 万美元，其他报道约 700 万美元的时间和资产范围不同。\n\n## 资金流向\n研究者标记的 Ethereum/TRON 源地址 → 新地址 → 部分换成 ETH。Ethereum 归集地址读取时约有 2,234.599 ETH，不代表全案损失或攻击者最终收益。\n\n## 金额口径\n主记录采用 SlowMist 约 490 万美元转出估值。约 420 万和约 700 万美元估值不相加。研究者怀疑私钥泄露，平台未确认。\n\n## 证据边界\n平台确认安全事件；研究者提供多链地址和估值，且一笔 Ethereum 入账可核。BNB、TRON 完整账本及最终净损仍未公布。\n\n## 处置状态\n网站关闭调查；未见官方最终净损、复站时间或赔付到账说明。\n\n## 地址与交易\n研究者关联地址按待复核证据标注；不能据余额快照或上游转账推定账户归属。", "tw": "## 事件背景\nDuelbits 於 2026 年 9 月 24 日發生多鏈錢包安全事件並關閉網站調查。平臺確認事件，但沒有公佈根因。\n\n## 事件經過\nScamSniffer 報告 Ethereum、BNB Chain 和 TRON 熱錢包異常轉出並估算約 420 萬美元；Duelbits 隨後確認並下線檢查。SlowMist 記錄約 490 萬美元，其他報道約 700 萬美元的時間和資產範圍不同。\n\n## 資金流向\n研究者標記的 Ethereum/TRON 源地址 → 新地址 → 部分換成 ETH。Ethereum 歸集地址讀取時約有 2,234.599 ETH，不代表全案損失或攻擊者最終收益。\n\n## 金額口徑\n主記錄採用 SlowMist 約 490 萬美元轉出估值。約 420 萬和約 700 萬美元估值不相加。研究者懷疑私鑰洩露，平臺未確認。\n\n## 證據邊界\n平臺確認安全事件；研究者提供多鏈地址和估值，且一筆 Ethereum 入賬可核。BNB、TRON 完整賬本及最終淨損仍未公佈。\n\n## 處置狀態\n網站關閉調查；未見官方最終淨損、復站時間或賠付到賬說明。\n\n## 地址與交易\n研究者關聯地址按待複核證據標註；不能據餘額快照或上游轉賬推定賬戶歸屬。", "en": "## Incident overview\nDuelbits experienced a multi-chain wallet security incident on September 24, 2026 and took its site offline. The platform confirmed an incident but did not publish a root cause.\n\n## Incident sequence\nScamSniffer reported hot-wallet outflows on Ethereum, BNB Chain, and TRON near $4.2 million; Duelbits confirmed and took its site offline. SlowMist recorded about $4.9 million; other coverage near $7 million used different scopes.\n\n## Fund flow\nResearcher-labeled Ethereum/TRON sources → new addresses → some funds swapped to ETH. An Ethereum aggregator held about 2,234.599 ETH at read time; this is not total case loss or final attacker proceeds.\n\n## Amount basis\nThe main record uses SlowMist’s estimate near $4.9 million. Estimates near $4.2 million and $7 million are not added. A private-key leak was suspected by a researcher but not confirmed by the platform.\n\n## Evidence boundary\nThe platform confirmed an incident; researchers supplied addresses and estimates, and one Ethereum deposit is observable. Complete BNB/TRON ledgers and final net loss remain unpublished.\n\n## Current status\nThe site was offline for investigation; no final net loss, restoration time, or completed compensation was published.\n\n## Addresses and transactions\nResearcher-associated addresses remain evidence-qualified; balance snapshots and upstream transfers do not prove ownership." }, "category": "access-control", "severity": "critical", "ecosystems": [ "Ethereum", "BNB Chain", "TRON" ], "chains": [ "Ethereum", "BNB Chain", "TRON" ], "lossUsd": 4900000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "SlowMist 记录约 490 万美元转出估值；ScamSniffer 首报约 420 万，其他报道约 700 万，时间与范围不同。归集地址余额快照不等于全案损失。", "tw": "SlowMist 記錄約 490 萬美元轉出估值；ScamSniffer 首報約 420 萬，其他報道約 700 萬，時間與範圍不同。歸集地址餘額快照不等於全案損失。", "en": "SlowMist recorded an estimated $4.9 million transferred; ScamSniffer first reported about $4.2 million and other coverage cited about $7 million with different scopes. An aggregator balance snapshot is not total case loss." }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0x014435b1e39945cf4f5f0c3cbb5833195a95cc9b", "entity": { "zh": "ScamSniffer 标记的 Duelbits 相关源地址，控制关系属研究者归因。", "tw": "ScamSniffer 標記的 Duelbits 相關源地址，控制關係屬研究者歸因。", "en": "Duelbits-associated source address labeled by ScamSniffer; control attribution is from the researcher." }, "role": "reported-source-wallet", "category": "unknown", "confidence": 0.68, "sourceUrl": "https://x.com/realScamSniffer/status/2103059906303869042", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "研究者称该地址涉及多链异常转出。", "tw": "研究者稱該地址涉及多鏈異常轉出。", "en": "The researcher said this address was involved in multi-chain outflows." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xa77e24fe29d16e051e487ef4ea7b056cb05aef76", "entity": { "zh": "ScamSniffer 归因的可疑接收地址。", "tw": "ScamSniffer 歸因的可疑接收地址。", "en": "Suspicious recipient attributed by ScamSniffer." }, "role": "suspected-recipient", "category": "unknown", "confidence": 0.68, "sourceUrl": "https://x.com/realScamSniffer/status/2103059906303869042", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "研究者列为相关多链转出接收方。", "tw": "研究者列為相關多鏈轉出接收方。", "en": "A researcher listed it as a recipient in related multi-chain transfers." }, "reviewRequired": true }, { "chain": "TRON", "address": "THqFmhAPcdHECH3wmrpZv4MWAB2v9TY1oN", "entity": { "zh": "ScamSniffer 标记的 Duelbits 相关源地址，控制关系属研究者归因。", "tw": "ScamSniffer 標記的 Duelbits 相關源地址，控制關係屬研究者歸因。", "en": "Duelbits-associated source address labeled by ScamSniffer; control attribution is from the researcher." }, "role": "reported-source-wallet", "category": "unknown", "confidence": 0.68, "sourceUrl": "https://x.com/realScamSniffer/status/2103059906303869042", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "研究者称该地址涉及多链异常转出。", "tw": "研究者稱該地址涉及多鏈異常轉出。", "en": "The researcher said this address was involved in multi-chain outflows." }, "reviewRequired": true }, { "chain": "TRON", "address": "TAvraZZFCZbDSZoyqWWRRsBkFgZqKaCGbK", "entity": { "zh": "ScamSniffer 归因的可疑接收地址。", "tw": "ScamSniffer 歸因的可疑接收地址。", "en": "Suspicious recipient attributed by ScamSniffer." }, "role": "suspected-recipient", "category": "unknown", "confidence": 0.68, "sourceUrl": "https://x.com/realScamSniffer/status/2103059906303869042", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "研究者列为相关多链转出接收方。", "tw": "研究者列為相關多鏈轉出接收方。", "en": "A researcher listed it as a recipient in related multi-chain transfers." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x8db9d7f0a03d212c566ca80c66e294cecc20c306", "entity": { "zh": "研究者归因的 Ethereum 归集地址；读取时约 2,234.599 ETH 是余额快照。", "tw": "研究者歸因的 Ethereum 歸集地址；讀取時約 2,234.599 ETH 是餘額快照。", "en": "Ethereum aggregation address attributed by a researcher; about 2,234.599 ETH was a read-time snapshot." }, "role": "aggregation-address", "category": "unknown", "confidence": 0.68, "sourceUrl": "https://eth.blockscout.com/address/0x8db9d7f0a03d212c566ca80c66e294cecc20c306", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "地址余额可查，控制关系依赖研究者归因。", "tw": "地址餘額可查，控制關係依賴研究者歸因。", "en": "The balance is observable; control attribution relies on the researcher." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x181A638038A4bD75c207d080DE83e217f8e8a1d7", "entity": { "zh": "向归集地址转入 ETH 的上游地址；身份与控制关系未核。", "tw": "向歸集地址轉入 ETH 的上游地址；身份與控制關係未核。", "en": "Upstream address that sent ETH to the aggregator; identity and control are unverified." }, "role": "upstream-transfer-source", "category": "unknown", "confidence": 0.45, "sourceUrl": "https://eth.blockscout.com/tx/0x1ed02f15aa99313f414151c110ba1a0d4da600f01e6a586a1610ddf27baca3ba", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "成功交易证明转账，不证明该地址为攻击者。", "tw": "成功交易證明轉賬，不證明該地址為攻擊者。", "en": "The successful transaction proves the transfer, not that this address is the attacker." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "Duelbits 官方安全说明", "tw": "Duelbits 官方安全說明", "en": "Duelbits official security notice" }, "url": "https://x.com/Duelbits/status/2103087620104323369", "type": "official" }, { "label": { "zh": "ScamSniffer 多链监测", "tw": "ScamSniffer 多鏈監測", "en": "ScamSniffer multi-chain monitoring" }, "url": "https://x.com/realScamSniffer/status/2103059906303869042", "type": "research" }, { "label": { "zh": "Ethereum 归集入账交易", "tw": "Ethereum 歸集入賬交易", "en": "Ethereum aggregation deposit" }, "url": "https://eth.blockscout.com/tx/0x1ed02f15aa99313f414151c110ba1a0d4da600f01e6a586a1610ddf27baca3ba", "type": "research" }, { "label": { "zh": "SlowMist Hacked Zone 记录", "tw": "SlowMist Hacked Zone 記錄", "en": "SlowMist Hacked Zone record" }, "url": "https://hacked.slowmist.io/zh/", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-338", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-337", "status": "verified", "incidentDate": "2026-09-24", "datePrecision": "day", "title": { "zh": "Payy Ethereum RollupV1 桥批次伪造提现", "tw": "Payy Ethereum RollupV1 橋批次偽造提現", "en": "Payy Ethereum RollupV1 bridge batch forged-withdrawal exploit" }, "summary": { "zh": "Payy RollupV1 桥遭伪造批次提现攻击，成功交易显示 1,828,589.378132 USDC 转至可疑地址；SlowMist 记录约 1,832,149 美元总额估值。官方暂停 Payy Network 交易并调查，根因尚待复盘。", "tw": "Payy RollupV1 橋遭偽造批次提現攻擊，成功交易顯示 1,828,589.378132 USDC 轉至可疑地址；SlowMist 記錄約 1,832,149 美元總額估值。官方暫停 Payy Network 交易並調查，根因尚待復盤。", "en": "Payy’s RollupV1 bridge suffered a forged-batch withdrawal. A successful transaction sent 1,828,589.378132 USDC to a suspicious address; SlowMist recorded an estimated total near $1,832,149. Payy paused Network transactions while investigating; root cause awaits a postmortem." }, "details": { "zh": "## 事件背景\nPayy Ethereum RollupV1 桥批次验证流程遭到利用。ExVul 提出零 burn hash 的提现可能通过验证；prover 密钥失陷或内层证明电路缺陷仍是技术假设。\n\n## 事件经过\n9 月 24 日 12:21:23 北京时间，verifyRollup 交易成功；批次中一笔向可疑地址转出 1,828,589.378132 USDC。其他正常用户提现不计入攻击收益。Payy 随后暂停 Network 和 Wallet 功能。\n\n## 资金流向\nEthereum RollupV1 桥 → 批次内可疑接收地址；下游兑换、跨链或返还没有完整公开核验。\n\n## 金额口径\nSlowMist 总额估值约 1,832,149 美元；单笔可核转出为 1,828,589.378132 USDC。同批正常提现不并入攻击收益。\n\n## 证据边界\nPayy 官方确认桥被利用，ExVul 提供技术分析，成功交易支持具体金额。密钥是否泄露、证明电路根因及最终控制关系仍待确认。\n\n## 处置状态\nPayy 暂停网络和钱包功能并调查；未确认追回或赔付金额。\n\n## 地址与交易\n桥合约、可疑接收地址与 prover 发起地址分层记录，不把 prover 自动标为黑客。", "tw": "## 事件背景\nPayy Ethereum RollupV1 橋批次驗證流程遭到利用。ExVul 提出零 burn hash 的提現可能通過驗證；prover 密鑰失陷或內層證明電路缺陷仍是技術假設。\n\n## 事件經過\n9 月 24 日 12:21:23 北京時間，verifyRollup 交易成功；批次中一筆向可疑地址轉出 1,828,589.378132 USDC。其他正常用戶提現不計入攻擊收益。Payy 隨後暫停 Network 和 Wallet 功能。\n\n## 資金流向\nEthereum RollupV1 橋 → 批次內可疑接收地址；下游兌換、跨鏈或返還沒有完整公開核驗。\n\n## 金額口徑\nSlowMist 總額估值約 1,832,149 美元；單筆可核轉出為 1,828,589.378132 USDC。同批正常提現不併入攻擊收益。\n\n## 證據邊界\nPayy 官方確認橋被利用，ExVul 提供技術分析，成功交易支持具體金額。密鑰是否洩露、證明電路根因及最終控制關係仍待確認。\n\n## 處置狀態\nPayy 暫停網絡和錢包功能並調查；未確認追回或賠付金額。\n\n## 地址與交易\n橋合約、可疑接收地址與 prover 發起地址分層記錄，不把 prover 自動標為黑客。", "en": "## Incident overview\nPayy’s Ethereum RollupV1 batch-validation path was exploited. ExVul proposed that a zero-burn-hash withdrawal passed verification; a compromised prover key or inner-proof flaw remains a hypothesis.\n\n## Incident sequence\nA verifyRollup transaction succeeded at 12:21:23 Beijing time on September 24. One withdrawal sent 1,828,589.378132 USDC to a suspicious address. Ordinary withdrawals in the batch are excluded. Payy then paused Network and Wallet functions.\n\n## Fund flow\nEthereum RollupV1 bridge → suspicious batch recipient; no complete verified downstream swap, bridge, or return route was public.\n\n## Amount basis\nSlowMist estimated about $1,832,149 in total; the verified suspicious transfer was 1,828,589.378132 USDC. Ordinary batch withdrawals are not attacker proceeds.\n\n## Evidence boundary\nPayy confirmed exploitation, ExVul supplied technical analysis, and the successful transaction supports the amount. Key compromise, proof-circuit root cause, and final control remain unconfirmed.\n\n## Current status\nPayy paused Network and Wallet functions while investigating. No recovery or compensation amount was confirmed.\n\n## Addresses and transactions\nThe bridge, suspected recipient, and prover address are separated by evidence; the prover is not automatically labeled as the attacker." }, "category": "bridge-exploit", "severity": "critical", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 1832149, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "SlowMist 总额估值约 1,832,149 美元；单笔可核异常转账为 1,828,589.378132 USDC。统计范围不同，不相加。", "tw": "SlowMist 總額估值約 1,832,149 美元；單筆可核異常轉賬為 1,828,589.378132 USDC。統計範圍不同，不相加。", "en": "SlowMist estimated about $1,832,149 in total; the verified suspicious transfer was 1,828,589.378132 USDC. The scopes differ and are not added." }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0x367C1eAF14AA06b78ce76bd0243297de79d85270", "entity": { "zh": "Payy RollupV1 受影响桥合约，不是攻击者地址。", "tw": "Payy RollupV1 受影響橋合約，不是攻擊者地址。", "en": "Affected Payy RollupV1 bridge contract, not an attacker address." }, "role": "affected-bridge", "category": "bridge", "confidence": 0.98, "sourceUrl": "https://eth.blockscout.com/tx/0xf43abdac5422087f645d77923eb1c825178bff3eb86d17d40fa18d89701e1814", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "成功 verifyRollup 交易涉及此桥合约。", "tw": "成功 verifyRollup 交易涉及此橋合約。", "en": "The successful verifyRollup transaction involved this bridge contract." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xAa4985dBDaBfACa344237D40F7E06C4a0BB57E70", "entity": { "zh": "ExVul 归因的伪造提现接收地址，最终控制关系待确认。", "tw": "ExVul 歸因的偽造提現接收地址，最終控制關係待確認。", "en": "Forged-withdrawal recipient attributed by ExVul; final control remains unconfirmed." }, "role": "suspected-recipient", "category": "hack", "confidence": 0.76, "sourceUrl": "https://x.com/exvulsec/status/2103065252011397214", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "研究者将其与成功桥提现交易关联。", "tw": "研究者將其與成功橋提現交易關聯。", "en": "A researcher linked it to the successful bridge withdrawal." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x5343b904bf837befb2f5a256b0cd5fbf30503d38", "entity": { "zh": "Payy prover 交易发起地址；凭据失陷未确认。", "tw": "Payy prover 交易發起地址；憑據失陷未確認。", "en": "Payy prover transaction-submission address; credential compromise is unconfirmed." }, "role": "prover-submitter", "category": "unknown", "confidence": 0.55, "sourceUrl": "https://eth.blockscout.com/tx/0xf43abdac5422087f645d77923eb1c825178bff3eb86d17d40fa18d89701e1814", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "交易相关地址，来源未认定为攻击者。", "tw": "交易相關地址，來源未認定為攻擊者。", "en": "A transaction-related address not identified as the attacker by the source." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "Payy 官方事件说明", "tw": "Payy 官方事件說明", "en": "Payy official incident notice" }, "url": "https://x.com/payy_link/status/2103123293687419136", "type": "official" }, { "label": { "zh": "Payy 暂停服务更新", "tw": "Payy 暫停服務更新", "en": "Payy service-pause update" }, "url": "https://x.com/payy_link/status/2103153530424918509", "type": "official" }, { "label": { "zh": "ExVul 技术分析", "tw": "ExVul 技術分析", "en": "ExVul technical analysis" }, "url": "https://x.com/exvulsec/status/2103065252011397214", "type": "research" }, { "label": { "zh": "Ethereum 成功交易", "tw": "Ethereum 成功交易", "en": "Successful Ethereum transaction" }, "url": "https://eth.blockscout.com/tx/0xf43abdac5422087f645d77923eb1c825178bff3eb86d17d40fa18d89701e1814", "type": "research" }, { "label": { "zh": "SlowMist Hacked Zone 记录", "tw": "SlowMist Hacked Zone 記錄", "en": "SlowMist Hacked Zone record" }, "url": "https://hacked.slowmist.io/zh/", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-337", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-336", "status": "verified", "incidentDate": "2026-09-24", "datePrecision": "day", "title": { "zh": "MetaMask 用户恶意浏览器扩展致双链盗币", "tw": "MetaMask 用戶惡意瀏覽器擴展致雙鏈盜幣", "en": "Malicious browser extension led to theft from a MetaMask user on two chains" }, "summary": { "zh": "一名 MetaMask 用户在 Ethereum 与 Polygon 的同一受害钱包遭四笔稳定币转出，面值合计 1,063.980000 美元。窗口内盗转由成功交易支持；恶意扩展植入路径来自受害者陈述。", "tw": "一名 MetaMask 用戶在 Ethereum 與 Polygon 的同一受害錢包遭四筆穩定幣轉出，面值合計 1,063.980000 美元。窗口內盜轉由成功交易支持；惡意擴展植入路徑來自受害者陳述。", "en": "Four stablecoin transfers totaling $1,063.980000 in face value left the same victim wallet on Ethereum and Polygon. Successful transactions support the in-window theft; the malicious-extension path comes from the victim’s account." }, "details": { "zh": "## 事件背景\n受害者称 Mac Chrome 上的 MetaMask 扩展曾被恶意副本替换并可能外传凭据；据称植入发生于 6 月，早于本窗口。\n\n## 事件经过\n9 月 24 日 09:01 至 09:08 北京时间，Ethereum 转出 697.27 USDT、220.135882 USDC、1.064118 USDC，Polygon 转出 145.51 USDT0；四笔均成功。\n\n## 资金流向\n受害者钱包 → 报告指认的接收地址；一笔 1.064118 USDC 的接收方角色未核。Mayan 调用不单独证明终点归属。\n\n## 金额口径\n四笔稳定币面值合计 1,063.980000 美元，不含 Gas 和后续价格变化。交易支持转出事实；扩展感染路径来自受害者陈述。\n\n## 证据边界\n链上交易确认金额；扩展替换和凭据外传没有独立设备取证。不能仅凭签名交易断定攻击者或具体恶意代码。\n\n## 处置状态\n未见公开追回或冻结确认；应从干净设备创建新钱包并迁移剩余资产。\n\n## 地址与交易\n受害钱包及指认收款地址按链标注；Mayan 方法调用不作终点归因。", "tw": "## 事件背景\n受害者稱 Mac Chrome 上的 MetaMask 擴展曾被惡意副本替換並可能外傳憑據；據稱植入發生於 6 月，早於本窗口。\n\n## 事件經過\n9 月 24 日 09:01 至 09:08 北京時間，Ethereum 轉出 697.27 USDT、220.135882 USDC、1.064118 USDC，Polygon 轉出 145.51 USDT0；四筆均成功。\n\n## 資金流向\n受害者錢包 → 報告指認的接收地址；一筆 1.064118 USDC 的接收方角色未核。Mayan 調用不單獨證明終點歸屬。\n\n## 金額口徑\n四筆穩定幣面值合計 1,063.980000 美元，不含 Gas 和後續價格變化。交易支持轉出事實；擴展感染路徑來自受害者陳述。\n\n## 證據邊界\n鏈上交易確認金額；擴展替換和憑據外傳沒有獨立設備取證。不能僅憑簽名交易斷定攻擊者或具體惡意代碼。\n\n## 處置狀態\n未見公開追回或凍結確認；應從乾淨設備創建新錢包並遷移剩餘資產。\n\n## 地址與交易\n受害錢包及指認收款地址按鏈標註；Mayan 方法調用不作終點歸因。", "en": "## Incident overview\nThe victim said a malicious copy of the Chrome MetaMask extension on a Mac may have exposed wallet credentials; the alleged installation occurred in June, before this window.\n\n## Incident sequence\nBetween 09:01 and 09:08 Beijing time on September 24, Ethereum transferred 697.27 USDT, 220.135882 USDC, and 1.064118 USDC; Polygon transferred 145.51 USDT0. All four transactions succeeded.\n\n## Fund flow\nVictim wallet → reported recipients; the recipient of a 1.064118 USDC transfer is unverified. A Mayan call alone does not establish a destination.\n\n## Amount basis\nFour stablecoin transfers total $1,063.980000 in face value, excluding gas and later price changes. Transactions support the transfers; the extension path comes from the victim’s account.\n\n## Evidence boundary\nTransactions confirm amounts; extension replacement and credential theft were not established by independent device forensics. Signed transactions alone do not identify malware or its operator.\n\n## Current status\nNo public recovery or freeze was confirmed; remaining assets should be moved using a clean device.\n\n## Addresses and transactions\nVictim and reported recipient addresses are listed by chain; the Mayan call is not used to infer an endpoint." }, "category": "supply-chain", "severity": "medium", "ecosystems": [ "Ethereum", "Polygon" ], "chains": [ "Ethereum", "Polygon" ], "lossUsd": 1063.98, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "四笔稳定币转出面值合计 1,063.980000 美元，不含 Gas；扩展植入路径来自受害者陈述。", "tw": "四筆穩定幣轉出面值合計 1,063.980000 美元，不含 Gas；擴展植入路徑來自受害者陳述。", "en": "Four stablecoin transfers totaled $1,063.980000 in face value, excluding gas; the extension-infection path is based on the victim’s account." }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0xbf4535952e891D8c9d84518882BD7f65D91B8e11", "entity": { "zh": "受害者 MetaMask 钱包，同一地址也出现在 Polygon 交易中。", "tw": "受害者 MetaMask 錢包，同一地址也出現在 Polygon 交易中。", "en": "Victim’s MetaMask wallet; the same address also appears in Polygon transactions." }, "role": "victim-wallet", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/JohnyPastrami/status/2103225402215051573", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "受害者报告与成功转账支持其为资金来源。", "tw": "受害者報告與成功轉賬支持其為資金來源。", "en": "The victim report and successful transfers support this as the source wallet." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xa2931Fb743fF3889BEcCee4BF45aEb2CC066B9a8", "entity": { "zh": "受害者指认的稳定币接收地址，后续控制关系待核。", "tw": "受害者指認的穩定幣接收地址，後續控制關係待核。", "en": "Stablecoin recipient identified by the victim; downstream control remains unverified." }, "role": "suspected-recipient", "category": "unknown", "confidence": 0.65, "sourceUrl": "https://x.com/JohnyPastrami/status/2103225402215051573", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "交易路径与受害者陈述关联，未独立确认控制人。", "tw": "交易路徑與受害者陳述關聯，未獨立確認控制人。", "en": "Linked by the victim’s report and transaction path; controller not independently verified." }, "reviewRequired": true }, { "chain": "Polygon", "address": "0xbf4535952e891D8c9d84518882BD7f65D91B8e11", "entity": { "zh": "受害者 MetaMask 钱包，同一地址也出现在 Ethereum 交易中。", "tw": "受害者 MetaMask 錢包，同一地址也出現在 Ethereum 交易中。", "en": "Victim’s MetaMask wallet; the same address also appears in Ethereum transactions." }, "role": "victim-wallet", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://polygon.blockscout.com/tx/0xc63703e8a14452e037a5f6371ac141034d7c60b1aa9e8b276f9562e41f330955", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Polygon 成功交易和受害者报告支持其为资金来源。", "tw": "Polygon 成功交易和受害者報告支持其為資金來源。", "en": "The successful Polygon transaction and victim report support this as the source wallet." }, "reviewRequired": true }, { "chain": "Polygon", "address": "0xa2931Fb743fF3889BEcCee4BF45aEb2CC066B9a8", "entity": { "zh": "受害者指认的稳定币接收地址，后续控制关系待核。", "tw": "受害者指認的穩定幣接收地址，後續控制關係待核。", "en": "Stablecoin recipient identified by the victim; downstream control remains unverified." }, "role": "suspected-recipient", "category": "unknown", "confidence": 0.65, "sourceUrl": "https://polygon.blockscout.com/tx/0xc63703e8a14452e037a5f6371ac141034d7c60b1aa9e8b276f9562e41f330955", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "交易路径与受害者陈述关联，未独立确认控制人。", "tw": "交易路徑與受害者陳述關聯，未獨立確認控制人。", "en": "Linked by the victim’s report and transaction path; controller not independently verified." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "受害者事件说明", "tw": "受害者事件說明", "en": "Victim incident report" }, "url": "https://x.com/JohnyPastrami/status/2103225402215051573", "type": "research" }, { "label": { "zh": "Ethereum USDT 转出", "tw": "Ethereum USDT 轉出", "en": "Ethereum USDT transfer" }, "url": "https://eth.blockscout.com/tx/0xe85250090f5cbbedd522572a3cafaf61f7f2c1076c95f63c6615700f61684ce5", "type": "research" }, { "label": { "zh": "Ethereum USDC 转出一", "tw": "Ethereum USDC 轉出一", "en": "Ethereum USDC transfer one" }, "url": "https://eth.blockscout.com/tx/0x0cbb0c92f8449ab4a500fc795609c0e4e1617e1d5406a7a832e934fa2576af1e", "type": "research" }, { "label": { "zh": "Ethereum USDC 转出二", "tw": "Ethereum USDC 轉出二", "en": "Ethereum USDC transfer two" }, "url": "https://eth.blockscout.com/tx/0x12362bf472e117a305ae81d1daeafba3936eaae166c82a8ee71cbddb3b80a9ba", "type": "research" }, { "label": { "zh": "Polygon USDT0 转出", "tw": "Polygon USDT0 轉出", "en": "Polygon USDT0 transfer" }, "url": "https://polygon.blockscout.com/tx/0xc63703e8a14452e037a5f6371ac141034d7c60b1aa9e8b276f9562e41f330955", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-336", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-335", "status": "verified", "incidentDate": "2026-09-23", "datePrecision": "day", "title": { "zh": "Nano Labs 创办人 X 账号遭接管并推广假代币", "tw": "Nano Labs 創辦人 X 賬號遭接管並推廣假代幣", "en": "Nano Labs founder’s X account compromised to promote a fake token" }, "summary": { "zh": "Nano Labs 官方确认创办人个人 X 账号被未授权控制并发布假 AI 交易代币 $BWA 宣传。公司否认发行或背书该代币；未核实到受害转账和损失金额。", "tw": "Nano Labs 官方確認創辦人個人 X 賬號被未授權控制併發布假 AI 交易代幣 $BWA 宣傳。公司否認發行或背書該代幣；未核實到受害轉賬和損失金額。", "en": "Nano Labs confirmed unauthorized control of its founder’s personal X account to promote a fake AI-trading token, $BWA. The company denied issuing or endorsing it; no victim transfer or loss amount was verified." }, "details": { "zh": "## 事件背景\nNano Labs 创办人个人 X 账号被未授权控制，用于宣传假 AI 交易代币 Binance World Assets（$BWA）。\n\n## 事件经过\n恶意帖子约于 9 月 23 日前后发布。公司于 9 月 24 日声明内容未经授权，并提醒用户勿点击链接或向合约转账。\n\n## 资金流向\n确认社交账号被接管，但没有核实受害地址、成功转账或下游资金路径。\n\n## 金额口径\n受害者数量和直接损失未核实。\n\n## 证据边界\n官方声明确认账号失陷与帖子未授权；提到 BNB Chain 不等于确认链上损失。\n\n## 处置状态\n公司发布纠正与防骗提醒；账号恢复状态和影响范围未完整说明。\n\n## 地址与交易\n没有可核验的受害地址或交易。", "tw": "## 事件背景\nNano Labs 創辦人個人 X 賬號被未授權控制，用於宣傳假 AI 交易代幣 Binance World Assets（$BWA）。\n\n## 事件經過\n惡意帖子約於 9 月 23 日前後發佈。公司於 9 月 24 日聲明內容未經授權，並提醒用戶勿點擊鏈接或向合約轉賬。\n\n## 資金流向\n確認社交賬號被接管，但沒有核實受害地址、成功轉賬或下游資金路徑。\n\n## 金額口徑\n受害者數量和直接損失未核實。\n\n## 證據邊界\n官方聲明確認賬號失陷與帖子未授權；提到 BNB Chain 不等於確認鏈上損失。\n\n## 處置狀態\n公司發佈糾正與防騙提醒；賬號恢復狀態和影響範圍未完整說明。\n\n## 地址與交易\n沒有可核驗的受害地址或交易。", "en": "## Incident overview\nNano Labs’ founder’s personal X account was accessed without authorization and used to promote a fake AI-trading token, Binance World Assets ($BWA).\n\n## Incident sequence\nThe malicious posts appeared around September 23. On September 24, the company said they were unauthorized and warned users not to click links or send funds to contracts.\n\n## Fund flow\nThe account takeover was confirmed, but no victim address, successful transfer, or downstream route was verified.\n\n## Amount basis\nVictim count and direct loss were not verified.\n\n## Evidence boundary\nThe official statement confirms compromise and unauthorized posts; a BNB Chain mention does not establish on-chain loss.\n\n## Current status\nThe company issued a correction and fraud warning; restoration status and full reach were not detailed.\n\n## Addresses and transactions\nNo verifiable victim address or transaction was published." }, "category": "account-takeover", "severity": "medium", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "账号接管已获官方确认；链上受害转账和损失金额未核实。", "tw": "賬號接管已獲官方確認；鏈上受害轉賬和損失金額未核實。", "en": "The account compromise was confirmed; no victim on-chain transfer or loss amount was verified." }, "addressDisclosure": "not-applicable", "addresses": [], "references": [ { "label": { "zh": "Nano Labs 官方纠正", "tw": "Nano Labs 官方糾正", "en": "Nano Labs official correction" }, "url": "https://x.com/NanoLabsLtd/status/2102935346057273829", "type": "official" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-335", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-334", "status": "verified", "incidentDate": "2026-09-22", "datePrecision": "day", "title": { "zh": "Neutron 治理夺权波及 Astroport 与 Drop", "tw": "Neutron 治理奪權波及 Astroport 與 Drop", "en": "Neutron governance takeover affected Astroport and Drop" }, "summary": { "zh": "Neutron 提案 #9 的管理员变更把 Astroport 与 Drop 合约控制权交给攻击者，之后约 10 份合约被迁移并抽取资产。SlowMist 分别估算约 490 万与 440 万美元，合并约 930 万美元；约 196 万美元跨链离开和转入恢复多签的 ATOM 均是处置子集。", "tw": "Neutron 提案 #9 的管理員變更把 Astroport 與 Drop 合約控制權交給攻擊者，之後約 10 份合約被遷移並抽取資產。SlowMist 分別估算約 490 萬與 440 萬美元，合併約 930 萬美元；約 196 萬美元跨鏈離開和轉入恢復多籤的 ATOM 均是處置子集。", "en": "Neutron proposal #9 transferred control of Astroport and Drop contracts to an attacker, who migrated about ten contracts and drained assets. SlowMist estimated roughly $4.9 million and $4.4 million for the two protocols, about $9.3 million combined; the roughly $1.96 million bridged out and ATOM moved to a recovery multisig are response subsets." }, "details": { "zh": "## 事件背景\nNeutron 治理提案 #9 含多条管理员变更消息，获批后攻击者取得 Astroport 与 Drop 的 Neutron 合约管理员权限。该事件由同一提案和攻击链造成，按一个事件簇记录。\n\n## 事件经过\n1. 提案 #9 于 2026 年 9 月 22 日通过，含 11 条 MsgUpdateAdmin。\n2. 攻击者把约 10 个 Astroport/Drop 合约迁移至恶意代码并调用提取逻辑。\n3. Astroport 警示用户从各链池子撤资；Neutron 暂停出块调查。\n4. Cosmos Hub 为限制涉案 ATOM 流转暂停出块，重启时将攻击地址内 1,227,121 ATOM 转入社区验证者恢复多签。\n\n## 资金流向\nAstroport/Drop 合约资产 → Neutron 攻击关联地址 → 部分经 IBC 转出。研究者称约 196 万美元已跨链离开，为总受影响估值的子集。恢复多签资产未确认已退还用户。\n\n## 金额口径\nSlowMist 分别估算 Astroport 约 490 万美元、Drop 约 440 万美元；来源/GoPlus 另估约 940 万美元。估值不同不相加。约 20,199 USDC 是投票权购买成本，不是损失。\n\n## 证据边界\nAstroport、Cosmos Hub 和链上治理记录支持事件与处置；GoPlus 提供攻击关联地址及机制分析。最终净损、全部跨链落点和用户赔付仍未确认。\n\n## 处置状态\nNeutron 曾暂停运行；Cosmos Hub 已恢复出块。1,227,121 ATOM 转入恢复多签属于资产保全，不等于返还或赔付。\n\n## 地址与交易\n保留 GoPlus 关联地址、Hub 官方确认的涉案接收地址及恢复多签。单源 Ethereum 关联地址仍待核。", "tw": "## 事件背景\nNeutron 治理提案 #9 含多條管理員變更消息，獲批後攻擊者取得 Astroport 與 Drop 的 Neutron 合約管理員權限。該事件由同一提案和攻擊鏈造成，按一個事件簇記錄。\n\n## 事件經過\n1. 提案 #9 於 2026 年 9 月 22 日通過，含 11 條 MsgUpdateAdmin。\n2. 攻擊者把約 10 個 Astroport/Drop 合約遷移至惡意代碼並調用提取邏輯。\n3. Astroport 警示用戶從各鏈池子撤資；Neutron 暫停出塊調查。\n4. Cosmos Hub 為限制涉案 ATOM 流轉暫停出塊，重啟時將攻擊地址內 1,227,121 ATOM 轉入社區驗證者恢復多籤。\n\n## 資金流向\nAstroport/Drop 合約資產 → Neutron 攻擊關聯地址 → 部分經 IBC 轉出。研究者稱約 196 萬美元已跨鏈離開，為總受影響估值的子集。恢復多籤資產未確認已退還用戶。\n\n## 金額口徑\nSlowMist 分別估算 Astroport 約 490 萬美元、Drop 約 440 萬美元；來源/GoPlus 另估約 940 萬美元。估值不同不相加。約 20,199 USDC 是投票權購買成本，不是損失。\n\n## 證據邊界\nAstroport、Cosmos Hub 和鏈上治理記錄支持事件與處置；GoPlus 提供攻擊關聯地址及機制分析。最終淨損、全部跨鏈落點和用戶賠付仍未確認。\n\n## 處置狀態\nNeutron 曾暫停運行；Cosmos Hub 已恢復出塊。1,227,121 ATOM 轉入恢復多籤屬於資產保全，不等於返還或賠付。\n\n## 地址與交易\n保留 GoPlus 關聯地址、Hub 官方確認的涉案接收地址及恢復多籤。單源 Ethereum 關聯地址仍待核。", "en": "## Incident overview\nNeutron governance proposal #9 contained administrator changes that gave an attacker control of Astroport and Drop contracts on Neutron. The projects were affected through the same proposal and attack chain, so they are one incident cluster.\n\n## Incident sequence\n1. Proposal #9 passed on September 22, 2026 with eleven MsgUpdateAdmin messages.\n2. The attacker migrated about ten Astroport/Drop contracts to malicious code and invoked withdrawal logic.\n3. Astroport warned users to withdraw liquidity across chains, while Neutron halted block production.\n4. Cosmos Hub halted to limit movement of incident-related ATOM and moved 1,227,121 ATOM remaining in the attacker address at restart to a community-validator recovery multisig.\n\n## Fund flow\nAstroport/Drop contracts → Neutron-associated attacker addresses → some funds bridged through IBC. Researchers said about $1.96 million had left the chain; this is a subset of total exposure. Recovery-multisig funds are not confirmed returned to users.\n\n## Amount basis\nSlowMist estimated about $4.9 million for Astroport and $4.4 million for Drop; the source report/GoPlus cited a different estimate near $9.4 million. Estimates are not added. About $20,199 USDC spent to obtain voting power is not a loss.\n\n## Evidence boundary\nAstroport, Cosmos Hub, and on-chain governance records support the incident and response; GoPlus supplied the attack-linked addresses and mechanism analysis. Final net loss, cross-chain destinations, and user compensation remain unconfirmed.\n\n## Current status\nNeutron halted temporarily and Cosmos Hub resumed block production. Moving 1,227,121 ATOM to a recovery multisig is preservation, not confirmed return or compensation.\n\n## Addresses and transactions\nThe record keeps the GoPlus-associated address, the Hub-identified recipient, and the recovery multisig. Single-source Ethereum associations remain unverified." }, "category": "governance-attack", "severity": "critical", "ecosystems": [ "Neutron", "Cosmos Hub", "Ethereum" ], "chains": [ "Neutron", "Cosmos Hub", "Ethereum" ], "lossUsd": 9300000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "SlowMist 分别估算 Astroport 约 490 万、Drop 约 440 万美元，合计约 930 万美元；原报告/GoPlus 约 940 万为不同估值。跨链离开额及恢复多签资产不重复计入。", "tw": "SlowMist 分別估算 Astroport 約 490 萬、Drop 約 440 萬美元，合計約 930 萬美元；原報告/GoPlus 約 940 萬為不同估值。跨鏈離開額及恢復多籤資產不重複計入。", "en": "SlowMist estimated about $4.9 million for Astroport and $4.4 million for Drop, about $9.3 million combined; the source report and GoPlus cited a different estimate near $9.4 million. Bridged-out assets and recovery-multisig funds are not added again." }, "addressDisclosure": "published", "addresses": [ { "chain": "Neutron", "address": "neutron1dd25c4sshelrpfs0433apg24c5phrhk8l6n605", "entity": { "zh": "Neutron 治理攻击关联地址，GoPlus 归因；完整角色待官方追踪。", "tw": "Neutron 治理攻擊關聯地址，GoPlus 歸因；完整角色待官方追蹤。", "en": "Neutron governance-attack-associated address attributed by GoPlus; full role awaits an official trace." }, "role": "suspected-attacker", "category": "hack", "confidence": 0.78, "sourceUrl": "https://x.com/GoPlusSecurity/status/2102737243760685263", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "GoPlus 将其与提案和跨链转移关联，不证明控制全部相关资产。", "tw": "GoPlus 將其與提案和跨鏈轉移關聯，不證明控制全部相關資產。", "en": "GoPlus linked it to the proposal and cross-chain transfers; this does not prove control of all related assets." }, "reviewRequired": true }, { "chain": "Cosmos Hub", "address": "cosmos1dd25c4sshelrpfs0433apg24c5phrhk8m96c4n", "entity": { "zh": "涉案 ATOM 接收地址，Cosmos Hub 官方更新确认其涉案状态。", "tw": "涉案 ATOM 接收地址，Cosmos Hub 官方更新確認其涉案狀態。", "en": "Incident-related ATOM recipient identified in a Cosmos Hub official update." }, "role": "attacker-receiving", "category": "hack", "confidence": 0.88, "sourceUrl": "https://forum.cosmos.network/t/hub-weekly-update-17-september-24-2026/17364", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Hub 官方更新将其与进入 Hub 的涉案资产关联。", "tw": "Hub 官方更新將其與進入 Hub 的涉案資產關聯。", "en": "The Hub update linked it to incident-related assets transferred to the Hub." }, "reviewRequired": true }, { "chain": "Cosmos Hub", "address": "cosmos1z8pq5cn7tdrwwzlwm0e44fgq07e43ner6vph64", "entity": { "zh": "社区验证者 4/6 恢复多签；持有资产尚未确认已赔付给用户。", "tw": "社區驗證者 4/6 恢復多籤；持有資產尚未確認已賠付給用戶。", "en": "Community-validator 4-of-6 recovery multisig; funds held there are not confirmed paid to users." }, "role": "recovery-multisig", "category": "unknown", "confidence": 0.96, "sourceUrl": "https://forum.cosmos.network/t/hub-weekly-update-17-september-24-2026/17364", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Cosmos Hub 官方更新称该多签接收 1,227,121 ATOM。", "tw": "Cosmos Hub 官方更新稱該多籤接收 1,227,121 ATOM。", "en": "A Cosmos Hub official update said the multisig received 1,227,121 ATOM." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xe149310eB8b1b3D9C471CcD81819D393621fBA5c", "entity": { "zh": "GoPlus 单源关联的 Ethereum 地址，路径未核。", "tw": "GoPlus 單源關聯的 Ethereum 地址，路徑未核。", "en": "Ethereum address associated by GoPlus alone; path unresolved." }, "role": "associated-address", "category": "unknown", "confidence": 0.55, "sourceUrl": "https://x.com/GoPlusSecurity/status/2102737243760685263", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "未定性为独立盗款接收地址。", "tw": "未定性為獨立盜款接收地址。", "en": "Not established as a distinct stolen-funds recipient." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xEF6c5A31df984c8569236a0AbC1f27580E2a5D54", "entity": { "zh": "GoPlus 单源关联的 Ethereum 地址，路径未核。", "tw": "GoPlus 單源關聯的 Ethereum 地址，路徑未核。", "en": "Ethereum address associated by GoPlus alone; path unresolved." }, "role": "associated-address", "category": "unknown", "confidence": 0.55, "sourceUrl": "https://x.com/GoPlusSecurity/status/2102737243760685263", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "未定性为独立盗款接收地址。", "tw": "未定性為獨立盜款接收地址。", "en": "Not established as a distinct stolen-funds recipient." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "Astroport 首次安全公告", "tw": "Astroport 首次安全公告", "en": "Astroport initial notice" }, "url": "https://x.com/astroport_fi/status/2102348511400403381", "type": "official" }, { "label": { "zh": "Astroport 后续说明", "tw": "Astroport 後續說明", "en": "Astroport follow-up" }, "url": "https://x.com/astroport_fi/status/2102389563259818099", "type": "official" }, { "label": { "zh": "GoPlus 技术分析", "tw": "GoPlus 技術分析", "en": "GoPlus technical analysis" }, "url": "https://x.com/GoPlusSecurity/status/2102737243760685263", "type": "research" }, { "label": { "zh": "Cosmos Hub 官方更新", "tw": "Cosmos Hub 官方更新", "en": "Cosmos Hub official update" }, "url": "https://forum.cosmos.network/t/hub-weekly-update-17-september-24-2026/17364", "type": "official" }, { "label": { "zh": "Neutron 提案 #9", "tw": "Neutron 提案 #9", "en": "Neutron proposal #9" }, "url": "https://www.mintscan.io/neutron/proposals/9", "type": "research" }, { "label": { "zh": "SlowMist Hacked Zone 记录", "tw": "SlowMist Hacked Zone 記錄", "en": "SlowMist Hacked Zone record" }, "url": "https://hacked.slowmist.io/zh/", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-334", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-344", "status": "verified", "incidentDate": "2026-09-21", "datePrecision": "day", "title": { "zh": "DoinGud Diamond 竞价记录重复利用", "tw": "DoinGud Diamond 競價記錄重複利用", "en": "DoinGud Diamond bid record reuse exploit" }, "summary": { "zh": "Polygon 上 DoinGud Diamond 竞价合约付款后没有清除出价记录，攻击者重复接受同一出价，从合约抽取约 35,486 USDC.e。", "tw": "Polygon 上 DoinGud Diamond 競價合約付款後沒有清除出價記錄，攻擊者重複接受同一出價，從合約抽取約 35,486 USDC.e。", "en": "DoinGud’s Diamond bidding contract on Polygon failed to clear a bid after payout. The attacker reused the same bid and drained about $35,486 USDC.e." }, "details": { "zh": "## 事件背景\nPolygon 上 DoinGud Diamond 竞价合约付款后没有清除出价记录，攻击者重复接受同一出价，从合约抽取约 35,486 USDC.e。\n\n## 事件经过\n攻击者借入接近合约余额的 USDC，向自己出价并触发两次 acceptBid；旧出价记录未清除，第二次仍被结算。\n\n## 资金流向\nDoinGud Diamond 合约 → 攻击者，约 35,486 USDC.e；后续路径未公开。\n\n## 金额口径\n约 35,486 USDC.e，SlowMist 估值约 35,486 美元。\n\n## 证据边界\nSlowMist 记录约 35,486 美元损失；完整官方复盘、修复与追回账目未公开。\n\n## 处置状态\n公开来源未说明合约修复或用户赔付完成情况。\n\n## 地址与交易\n公开记录未提供可在本条完整复核的地址与交易集合，不补写缺失标识符。", "tw": "## 事件背景\nPolygon 上 DoinGud Diamond 競價合約付款後沒有清除出價記錄，攻擊者重複接受同一出價，從合約抽取約 35,486 USDC.e。\n\n## 事件經過\n攻擊者借入接近合約餘額的 USDC，向自己出價並觸發兩次 acceptBid；舊出價記錄未清除，第二次仍被結算。\n\n## 資金流向\nDoinGud Diamond 合約 → 攻擊者，約 35,486 USDC.e；後續路徑未公開。\n\n## 金額口徑\n約 35,486 USDC.e，SlowMist 估值約 35,486 美元。\n\n## 證據邊界\nSlowMist 記錄約 35,486 美元損失；完整官方復盤、修復與追回賬目未公開。\n\n## 處置狀態\n公開來源未說明合約修復或用戶賠付完成情況。\n\n## 地址與交易\n公開記錄未提供可在本條完整複核的地址與交易集合，不補寫缺失標識符。", "en": "## Incident overview\nDoinGud’s Diamond bidding contract on Polygon failed to clear a bid after payout. The attacker reused the same bid and drained about $35,486 USDC.e.\n\n## Incident sequence\nThe attacker flash-loaned USDC close to the contract balance, bid against themselves, and triggered two acceptBid payouts; the uncleared bid record enabled the second settlement.\n\n## Fund flow\nDoinGud Diamond contract → attacker, about 35,486 USDC.e; downstream route was not published.\n\n## Amount basis\nAbout 35,486 USDC.e, valued near $35,486 by SlowMist.\n\n## Evidence boundary\nSlowMist recorded a loss near $35,486; a full official postmortem, repair, and recovery ledger were not public.\n\n## Current status\nPublic sources did not establish contract repair or completed user compensation.\n\n## Addresses and transactions\nThe public entry did not provide a complete verifiable address and transaction set for this record." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "Polygon" ], "chains": [ "Polygon" ], "lossUsd": 35486, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 35,486 USDC.e，SlowMist 估值约 35,486 美元。", "tw": "約 35,486 USDC.e，SlowMist 估值約 35,486 美元。", "en": "About 35,486 USDC.e, valued near $35,486 by SlowMist." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "SlowMist Hacked Zone 事件记录", "tw": "SlowMist Hacked Zone 事件記錄", "en": "SlowMist Hacked Zone incident record" }, "url": "https://hacked.slowmist.io/zh/", "type": "research" }, { "label": { "zh": "DoinGud 攻击研究", "tw": "DoinGud 攻擊研究", "en": "DoinGud exploit research" }, "url": "https://x.com/teddyctf/status/2102235278970933264", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-344", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-343", "status": "verified", "incidentDate": "2026-09-21", "datePrecision": "day", "title": { "zh": "GaslessReservoirEnabler 授权校验缺陷盗取代币", "tw": "GaslessReservoirEnabler 授權校驗缺陷盜取代幣", "en": "GaslessReservoirEnabler authorization flaw drained tokens" }, "summary": { "zh": "Polygon 上 GaslessReservoirEnabler 的 transferFrom 路径没有把转账绑定到已授权资产所有者。攻击者消费用户既有 WETH 与 ZED 授权，约 997 个地址被转走资产，SlowMist 估算约 23,000 美元。", "tw": "Polygon 上 GaslessReservoirEnabler 的 transferFrom 路徑沒有把轉賬綁定到已授權資產所有者。攻擊者消費用戶既有 WETH 與 ZED 授權，約 997 個地址被轉走資產，SlowMist 估算約 23,000 美元。", "en": "GaslessReservoirEnabler on Polygon failed to bind transferFrom calls to the authorized owner. The attacker spent existing WETH and ZED allowances; about 997 addresses were drained, with SlowMist estimating a loss near $23,000." }, "details": { "zh": "## 事件背景\nPolygon 上 GaslessReservoirEnabler 的 transferFrom 路径没有把转账绑定到已授权资产所有者。攻击者消费用户既有 WETH 与 ZED 授权，约 997 个地址被转走资产，SlowMist 估算约 23,000 美元。\n\n## 事件经过\nerc20WithTransfersAndExecute 进入 _executeInternal 时只检查模块地址，没有把转账绑定资产所有者，因此可消费用户既有授权；资金归集后进入 Polygon 桥。\n\n## 资金流向\n用户既有 WETH/ZED 授权 → 攻击者转出 → Polygon 归集 → 跨链桥。\n\n## 金额口径\nSlowMist 估算约 23,000 美元，涉及约 997 个地址。\n\n## 证据边界\n约 23,000 美元为 SlowMist 估值；单个用户损失和完整地址清单未公开。\n\n## 处置状态\n公开记录称资金已归集并进入 Polygon 桥，最终落点和追回情况待核。\n\n## 地址与交易\n公开记录未提供可在本条完整复核的地址与交易集合，不补写缺失标识符。", "tw": "## 事件背景\nPolygon 上 GaslessReservoirEnabler 的 transferFrom 路徑沒有把轉賬綁定到已授權資產所有者。攻擊者消費用戶既有 WETH 與 ZED 授權，約 997 個地址被轉走資產，SlowMist 估算約 23,000 美元。\n\n## 事件經過\nerc20WithTransfersAndExecute 進入 _executeInternal 時只檢查模塊地址，沒有把轉賬綁定資產所有者，因此可消費用戶既有授權；資金歸集後進入 Polygon 橋。\n\n## 資金流向\n用戶既有 WETH/ZED 授權 → 攻擊者轉出 → Polygon 歸集 → 跨鏈橋。\n\n## 金額口徑\nSlowMist 估算約 23,000 美元，涉及約 997 個地址。\n\n## 證據邊界\n約 23,000 美元為 SlowMist 估值；單個用戶損失和完整地址清單未公開。\n\n## 處置狀態\n公開記錄稱資金已歸集並進入 Polygon 橋，最終落點和追回情況待核。\n\n## 地址與交易\n公開記錄未提供可在本條完整複核的地址與交易集合，不補寫缺失標識符。", "en": "## Incident overview\nGaslessReservoirEnabler on Polygon failed to bind transferFrom calls to the authorized owner. The attacker spent existing WETH and ZED allowances; about 997 addresses were drained, with SlowMist estimating a loss near $23,000.\n\n## Incident sequence\nThe path through erc20WithTransfersAndExecute checked module addresses but did not bind transfers to the asset owner, allowing existing allowances to be spent; proceeds were consolidated and sent to a Polygon bridge.\n\n## Fund flow\nExisting user WETH/ZED allowances → attacker transfers → Polygon aggregation → bridge.\n\n## Amount basis\nSlowMist estimated about $23,000 across roughly 997 addresses.\n\n## Evidence boundary\nAbout $23,000 is SlowMist’s estimate; individual losses and a complete victim list were not published.\n\n## Current status\nThe public entry said proceeds were consolidated and sent to a Polygon bridge; destination and recovery remain unresolved.\n\n## Addresses and transactions\nThe public entry did not provide a complete verifiable address and transaction set for this record." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "Polygon" ], "chains": [ "Polygon" ], "lossUsd": 23000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "SlowMist 估算约 23,000 美元，涉及约 997 个地址。", "tw": "SlowMist 估算約 23,000 美元，涉及約 997 個地址。", "en": "SlowMist estimated about $23,000 across roughly 997 addresses." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "SlowMist Hacked Zone 事件记录", "tw": "SlowMist Hacked Zone 事件記錄", "en": "SlowMist Hacked Zone incident record" }, "url": "https://hacked.slowmist.io/zh/", "type": "research" }, { "label": { "zh": "SlowMist 授权缺陷分析", "tw": "SlowMist 授權缺陷分析", "en": "SlowMist authorization-flaw analysis" }, "url": "https://x.com/SlowMist_Team/status/2102227043979313539", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-343", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-342", "status": "verified", "incidentDate": "2026-09-21", "datePrecision": "day", "title": { "zh": "RWC Token 无权限销毁与储备操纵攻击", "tw": "RWC Token 無權限銷燬與儲備操縱攻擊", "en": "RWC Token permissionless-burn and reserve-manipulation exploit" }, "summary": { "zh": "BNB Chain 上 RWC 的无权限销毁函数被利用，攻击者销毁 PancakeSwap 池内代币并调用 sync() 改写储备、抬高价格后卖出。SlowMist 记录池流出约 109,460.85 USDT，攻击者净得约 39,964.07 USDT，其余流入项目钱包。", "tw": "BNB Chain 上 RWC 的無權限銷燬函數被利用，攻擊者銷燬 PancakeSwap 池內代幣並調用 sync() 改寫儲備、抬高價格後賣出。SlowMist 記錄池流出約 109,460.85 USDT，攻擊者淨得約 39,964.07 USDT，其餘流入項目錢包。", "en": "An unrestricted burn function in RWC on BNB Chain was exploited to burn PancakeSwap pool tokens, use sync() to rewrite reserves, inflate price, and sell. SlowMist recorded about 109,460.85 USDT leaving the pool; the attacker netted about $39,964.07 and the remainder went to project wallets." }, "details": { "zh": "## 事件背景\nBNB Chain 上 RWC 的无权限销毁函数被利用，攻击者销毁 PancakeSwap 池内代币并调用 sync() 改写储备、抬高价格后卖出。SlowMist 记录池流出约 109,460.85 USDT，攻击者净得约 39,964.07 USDT，其余流入项目钱包。\n\n## 事件经过\n攻击者用闪电贷调用无权限 burn 销毁池内 RWC，sync() 改写储备后推高价格，再卖出获利。\n\n## 资金流向\n同一交易的池总流出和攻击者净得是不同口径；代币费用把部分资产路由至项目钱包。\n\n## 金额口径\n池流出约 109,460.85 USDT；攻击者净得约 39,964.07 USDT，其余约 69,496.78 USDT 进入项目钱包。\n\n## 证据边界\n总池流出与攻击者净得不相加；项目钱包收到部分费用也不算攻击者收益。\n\n## 处置状态\nSlowMist 记录交易和金额拆分；项目修复及用户影响完整说明待公开。\n\n## 地址与交易\n公开记录未提供可在本条完整复核的地址与交易集合，不补写缺失标识符。", "tw": "## 事件背景\nBNB Chain 上 RWC 的無權限銷燬函數被利用，攻擊者銷燬 PancakeSwap 池內代幣並調用 sync() 改寫儲備、抬高價格後賣出。SlowMist 記錄池流出約 109,460.85 USDT，攻擊者淨得約 39,964.07 USDT，其餘流入項目錢包。\n\n## 事件經過\n攻擊者用閃電貸調用無權限 burn 銷燬池內 RWC，sync() 改寫儲備後推高價格，再賣出獲利。\n\n## 資金流向\n同一交易的池總流出和攻擊者淨得是不同口徑；代幣費用把部分資產路由至項目錢包。\n\n## 金額口徑\n池流出約 109,460.85 USDT；攻擊者淨得約 39,964.07 USDT，其餘約 69,496.78 USDT 進入項目錢包。\n\n## 證據邊界\n總池流出與攻擊者淨得不相加；項目錢包收到部分費用也不算攻擊者收益。\n\n## 處置狀態\nSlowMist 記錄交易和金額拆分；項目修復及用戶影響完整說明待公開。\n\n## 地址與交易\n公開記錄未提供可在本條完整複核的地址與交易集合，不補寫缺失標識符。", "en": "## Incident overview\nAn unrestricted burn function in RWC on BNB Chain was exploited to burn PancakeSwap pool tokens, use sync() to rewrite reserves, inflate price, and sell. SlowMist recorded about 109,460.85 USDT leaving the pool; the attacker netted about $39,964.07 and the remainder went to project wallets.\n\n## Incident sequence\nUsing a flash loan, the attacker called an unrestricted burn against pool-held RWC, used sync() to rewrite reserves and inflate price, then sold.\n\n## Fund flow\nPool outflow and attacker net proceeds are different measures of the same transaction; token fees routed some assets to project wallets.\n\n## Amount basis\nAbout 109,460.85 USDT left the pool; attacker net proceeds were about $39,964.07 and about $69,496.78 went to project wallets.\n\n## Evidence boundary\nTotal pool outflow and attacker net proceeds are not added; fees routed to project wallets are not attacker proceeds.\n\n## Current status\nSlowMist documented the transaction and split; full repair and user-impact details remain pending.\n\n## Addresses and transactions\nThe public entry did not provide a complete verifiable address and transaction set for this record." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "BNB Chain" ], "chains": [ "BNB Chain" ], "lossUsd": 109460.85, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "池流出约 109,460.85 USDT；攻击者净得约 39,964.07 USDT，其余约 69,496.78 USDT 进入项目钱包。", "tw": "池流出約 109,460.85 USDT；攻擊者淨得約 39,964.07 USDT，其餘約 69,496.78 USDT 進入項目錢包。", "en": "About 109,460.85 USDT left the pool; attacker net proceeds were about $39,964.07 and about $69,496.78 went to project wallets." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "SlowMist Hacked Zone 事件记录", "tw": "SlowMist Hacked Zone 事件記錄", "en": "SlowMist Hacked Zone incident record" }, "url": "https://hacked.slowmist.io/zh/", "type": "research" }, { "label": { "zh": "TenArmor RWC Token 告警", "tw": "TenArmor RWC Token 告警", "en": "TenArmor RWC Token alert" }, "url": "https://x.com/TenArmorAlert/status/2101925758214316524", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-342", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-341", "status": "verified", "incidentDate": "2026-09-21", "datePrecision": "day", "title": { "zh": "Internet Token DAO LiquidityUnifier 伪造池回调铸币", "tw": "Internet Token DAO LiquidityUnifier 偽造池回調鑄幣", "en": "Internet Token DAO LiquidityUnifier fake-pool callback exploit" }, "summary": { "zh": "Base 上 Internet Token DAO 信任调用者提供的 Uniswap V3 池地址，伪造池回调可铸造约 9.25 亿 INT。SlowMist 描述中可核的官方池流出为 5.847 WETH（约 16,033.55 美元）；条目 265,000 美元金额字段属于更宽估值，不视作实际提现。", "tw": "Base 上 Internet Token DAO 信任調用者提供的 Uniswap V3 池地址，偽造池回調可鑄造約 9.25 億 INT。SlowMist 描述中可核的官方池流出為 5.847 WETH（約 16,033.55 美元）；條目 265,000 美元金額字段屬於更寬估值，不視作實際提現。", "en": "Internet Token DAO on Base trusted a caller-supplied Uniswap V3 pool address, allowing a fake-pool callback to mint about 925 million INT. The transaction-specific drain described by SlowMist was 5.847 WETH (about $16,033.55); its $265,000 amount field uses a broader scope and is not treated as realized withdrawal." }, "details": { "zh": "## 事件背景\nBase 上 Internet Token DAO 信任调用者提供的 Uniswap V3 池地址，伪造池回调可铸造约 9.25 亿 INT。SlowMist 描述中可核的官方池流出为 5.847 WETH（约 16,033.55 美元）；条目 265,000 美元金额字段属于更宽估值，不视作实际提现。\n\n## 事件经过\n伪造 Uniswap V3 池回调铸造约 9.25 亿 INT，从官方 INT/WETH 池取走 5.847 WETH。未及时撤销的铸币权限随后导致复制利用和供应膨胀。\n\n## 资金流向\n官方 INT/WETH 池 → 攻击者取得的 WETH；大量新增 INT 的名义数量不按面值累计为美元损失。\n\n## 金额口径\n5.847 WETH，约 16,033.55 美元的池资产转出；INT 名义铸造量不另计。\n\n## 证据边界\nSlowMist 描述中的具体池流出为 5.847 WETH；其金额栏另列 265,000 美元宽估值。后续复制利用没有独立损失账，不并入此条。\n\n## 处置状态\n公开档案指出铸币权限未及时撤销并出现复制利用；完整修复与损失对账待披露。\n\n## 地址与交易\n公开记录未提供可在本条完整复核的地址与交易集合，不补写缺失标识符。", "tw": "## 事件背景\nBase 上 Internet Token DAO 信任調用者提供的 Uniswap V3 池地址，偽造池回調可鑄造約 9.25 億 INT。SlowMist 描述中可核的官方池流出為 5.847 WETH（約 16,033.55 美元）；條目 265,000 美元金額字段屬於更寬估值，不視作實際提現。\n\n## 事件經過\n偽造 Uniswap V3 池回調鑄造約 9.25 億 INT，從官方 INT/WETH 池取走 5.847 WETH。未及時撤銷的鑄幣權限隨後導致複製利用和供應膨脹。\n\n## 資金流向\n官方 INT/WETH 池 → 攻擊者取得的 WETH；大量新增 INT 的名義數量不按面值累計為美元損失。\n\n## 金額口徑\n5.847 WETH，約 16,033.55 美元的池資產轉出；INT 名義鑄造量不另計。\n\n## 證據邊界\nSlowMist 描述中的具體池流出為 5.847 WETH；其金額欄另列 265,000 美元寬估值。後續複製利用沒有獨立損失賬，不併入此條。\n\n## 處置狀態\n公開檔案指出鑄幣權限未及時撤銷並出現複製利用；完整修復與損失對賬待披露。\n\n## 地址與交易\n公開記錄未提供可在本條完整複核的地址與交易集合，不補寫缺失標識符。", "en": "## Incident overview\nInternet Token DAO on Base trusted a caller-supplied Uniswap V3 pool address, allowing a fake-pool callback to mint about 925 million INT. The transaction-specific drain described by SlowMist was 5.847 WETH (about $16,033.55); its $265,000 amount field uses a broader scope and is not treated as realized withdrawal.\n\n## Incident sequence\nA fake Uniswap V3 pool callback minted about 925 million INT and drained 5.847 WETH from the official INT/WETH pool. A mint role left active later enabled copycat activity and supply inflation.\n\n## Fund flow\nOfficial INT/WETH pool → WETH obtained by the attacker; nominal newly minted INT is not valued at face value as USD loss.\n\n## Amount basis\n5.847 WETH, about $16,033.55, left the pool; nominal INT minting is not added.\n\n## Evidence boundary\nThe specific pool outflow in SlowMist’s description was 5.847 WETH; its amount field separately listed a broader $265,000 estimate. Copycat activity has no separate loss ledger and is not included.\n\n## Current status\nThe entry said the mint role was not revoked promptly and copycats followed; full repair and loss reconciliation await disclosure.\n\n## Addresses and transactions\nThe public entry did not provide a complete verifiable address and transaction set for this record." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "Base" ], "chains": [ "Base" ], "lossUsd": 16033.55, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "5.847 WETH，约 16,033.55 美元的池资产转出；INT 名义铸造量不另计。", "tw": "5.847 WETH，約 16,033.55 美元的池資產轉出；INT 名義鑄造量不另計。", "en": "5.847 WETH, about $16,033.55, left the pool; nominal INT minting is not added." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "SlowMist Hacked Zone 事件记录", "tw": "SlowMist Hacked Zone 事件記錄", "en": "SlowMist Hacked Zone incident record" }, "url": "https://hacked.slowmist.io/zh/", "type": "research" }, { "label": { "zh": "Internet Token 事件告警", "tw": "Internet Token 事件告警", "en": "Internet Token incident alert" }, "url": "https://x.com/DefimonAlerts/status/2101969009461567690", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-341", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-333", "status": "verified", "incidentDate": "2026-09-19", "datePrecision": "day", "title": { "zh": "MultiversX VM 原子性漏洞与网络暂停", "tw": "MultiversX VM 原子性漏洞與網絡暫停", "en": "MultiversX VM atomicity flaw and network pause" }, "summary": { "zh": "MultiversX 遭遇 VM 层原子性漏洞导致无效状态变更，项目暂停网络并准备有限回滚，尚未确认用户资产损失。", "tw": "MultiversX 遭遇 VM 層原子性漏洞導致無效狀態變更，項目暫停網絡並準備有限回滾，尚未確認用戶資產損失。", "en": "MultiversX suffered invalid state changes from a VM-layer atomicity flaw. The network paused and prepared a limited rollback; no user-asset loss was confirmed." }, "details": { "zh": "## 事件背景\nMultiversX 遭遇 VM 层原子性漏洞导致无效状态变更，项目暂停网络并准备有限回滚，尚未确认用户资产损失。\n\n## 事件经过\nVM 原子性漏洞、无效状态变更、暂停网络、影子分叉修复验证和有限回滚。\n\n## 资金流向\nSlowMist 记录支持相应攻击或异常处置路径；完整地址和交易集合未全部公开。\n\n## 金额口径\n已确认安全事件但未确认用户资产损失，公开损失为 0 USD。\n\n## 证据边界\n该条目来自 SlowMist Hacked Zone 的窗口内记录，后续项目复盘、地址和追回状态可能继续更新。\n\n## 处置状态\n截至核验点没有完整公开追回或赔付账本。\n\n## 地址与交易\n公开来源未提供完整标识符，不进行补写。", "tw": "## 事件背景\nMultiversX 遭遇 VM 層原子性漏洞導致無效狀態變更，項目暫停網絡並準備有限回滾，尚未確認用戶資產損失。\n\n## 事件經過\nVM 原子性漏洞、無效狀態變更、暫停網絡、影子分叉修復驗證和有限回滾。\n\n## 資金流向\nSlowMist 記錄支持相應攻擊或異常處置路徑；完整地址和交易集合未全部公開。\n\n## 金額口徑\n已確認安全事件但未確認用戶資產損失，公開損失為 0 USD。\n\n## 證據邊界\n該條目來自 SlowMist Hacked Zone 的窗口內記錄，後續項目復盤、地址和追回狀態可能繼續更新。\n\n## 處置狀態\n截至核驗點沒有完整公開追回或賠付賬本。\n\n## 地址與交易\n公開來源未提供完整標識符，不進行補寫。", "en": "## Incident overview\nMultiversX suffered invalid state changes from a VM-layer atomicity flaw. The network paused and prepared a limited rollback; no user-asset loss was confirmed.\n\n## Incident sequence\nA VM atomicity flaw caused invalid state changes, followed by a network pause, shadow-fork fix validation, and limited rollback.\n\n## Fund flow\nThe SlowMist record supports the attack or disposition path, but complete addresses and transactions were not fully public.\n\n## Amount basis\nA security event was confirmed but no user-asset loss was confirmed; reported loss is $0.\n\n## Evidence boundary\nThis item comes from the SlowMist Hacked Zone during the window; project postmortems, addresses, and recovery status may change.\n\n## Current status\nNo complete public recovery or compensation ledger was available at verification.\n\n## Addresses and transactions\nPublic sources did not provide complete identifiers, so none are filled in." }, "category": "protocol-exploit", "severity": "medium", "ecosystems": [ "MultiversX" ], "chains": [ "MultiversX" ], "lossUsd": 0, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "已确认安全事件但未确认用户资产损失，公开损失为 0 USD。", "tw": "已確認安全事件但未確認用戶資產損失，公開損失為 0 USD。", "en": "A security event was confirmed but no user-asset loss was confirmed; reported loss is $0." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "SlowMist Hacked 记录", "tw": "SlowMist Hacked 記錄", "en": "SlowMist Hacked record" }, "url": "https://hacked.slowmist.io/zh/?page=1", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-333", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-332", "status": "verified", "incidentDate": "2026-09-19", "datePrecision": "day", "title": { "zh": "Blink Wallet 少数托管账户异常访问", "tw": "Blink Wallet 少數託管賬戶異常訪問", "en": "Blink Wallet limited custodial-account compromise" }, "summary": { "zh": "Blink Wallet 暂停服务并称极少数托管账户被非法访问、部分资金转出；大部分资金和非托管钱包未受影响。", "tw": "Blink Wallet 暫停服務並稱極少數託管賬戶被非法訪問、部分資金轉出；大部分資金和非託管錢包未受影響。", "en": "Blink Wallet paused service after saying a very small number of custodial accounts were accessed and some funds moved; most funds and non-custodial wallets were unaffected." }, "details": { "zh": "## 事件背景\nBlink Wallet 暂停服务并称极少数托管账户被非法访问、部分资金转出；大部分资金和非托管钱包未受影响。\n\n## 事件经过\n托管账户被访问、部分资金转出、平台暂停并调查；非托管钱包未受影响。\n\n## 资金流向\nSlowMist 记录支持相应攻击或异常处置路径；完整地址和交易集合未全部公开。\n\n## 金额口径\n未公开可靠美元损失总额。\n\n## 证据边界\n该条目来自 SlowMist Hacked Zone 的窗口内记录，后续项目复盘、地址和追回状态可能继续更新。\n\n## 处置状态\n截至核验点没有完整公开追回或赔付账本。\n\n## 地址与交易\n公开来源未提供完整标识符，不进行补写。", "tw": "## 事件背景\nBlink Wallet 暫停服務並稱極少數託管賬戶被非法訪問、部分資金轉出；大部分資金和非託管錢包未受影響。\n\n## 事件經過\n託管賬戶被訪問、部分資金轉出、平臺暫停並調查；非託管錢包未受影響。\n\n## 資金流向\nSlowMist 記錄支持相應攻擊或異常處置路徑；完整地址和交易集合未全部公開。\n\n## 金額口徑\n未公開可靠美元損失總額。\n\n## 證據邊界\n該條目來自 SlowMist Hacked Zone 的窗口內記錄，後續項目復盤、地址和追回狀態可能繼續更新。\n\n## 處置狀態\n截至核驗點沒有完整公開追回或賠付賬本。\n\n## 地址與交易\n公開來源未提供完整標識符，不進行補寫。", "en": "## Incident overview\nBlink Wallet paused service after saying a very small number of custodial accounts were accessed and some funds moved; most funds and non-custodial wallets were unaffected.\n\n## Incident sequence\nCustodial accounts were accessed, some funds moved, and the platform paused and investigated; non-custodial wallets were unaffected.\n\n## Fund flow\nThe SlowMist record supports the attack or disposition path, but complete addresses and transactions were not fully public.\n\n## Amount basis\nNo reliable total USD loss was published.\n\n## Evidence boundary\nThis item comes from the SlowMist Hacked Zone during the window; project postmortems, addresses, and recovery status may change.\n\n## Current status\nNo complete public recovery or compensation ledger was available at verification.\n\n## Addresses and transactions\nPublic sources did not provide complete identifiers, so none are filled in." }, "category": "account-takeover", "severity": "high", "ecosystems": [ "Bitcoin" ], "chains": [ "Bitcoin" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "未公开可靠美元损失总额。", "tw": "未公開可靠美元損失總額。", "en": "No reliable total USD loss was published." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "SlowMist Hacked 记录", "tw": "SlowMist Hacked 記錄", "en": "SlowMist Hacked record" }, "url": "https://hacked.slowmist.io/zh/?page=1", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-332", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-321", "status": "verified", "incidentDate": "2026-09-19", "datePrecision": "day", "title": { "zh": "ASI 转换基础设施攻击簇", "tw": "ASI 轉換基礎設施攻擊簇", "en": "ASI token-conversion infrastructure attack cluster" }, "summary": { "zh": "同一攻击簇利用 Fetch 转换器签名授权抽取约 1.56M USD FET，并从 NuNet 铸造约 45 万美元级 NTX；随后继续触及 SingularityNET / WMTx 转换器。已确认损失主口径约 2.01M USD，代币名义铸造量不重复计入。", "tw": "同一攻擊簇利用 Fetch 轉換器簽名授權抽取約 1.56M USD FET，並從 NuNet 鑄造約 45 萬美元級 NTX；隨後繼續觸及 SingularityNET / WMTx 轉換器。已確認損失主口徑約 2.01M USD，代幣名義鑄造量不重複計入。", "en": "The same cluster used conversion-authorization signatures to extract about $1.56 million in FET and mint roughly $450,000 worth of NTX from NuNet, then touched SingularityNET / WMTx converters. The confirmed primary loss basis is about $2.01 million; nominal token mints are not added." }, "details": { "zh": "## 事件背景\nASI 转换器基础设施包含 Fetch、NuNet 和后续 SingularityNET / WMTx 相关转换路径。公开信息指向转换授权签名与操作层问题，而非单一用户钱包。\n\n## 事件经过\n1. 攻击者使用有效转换授权签名调用 Fetch TokenConversionManagerV3.conversionIn()。\n2. 抽取约 1.56M USD FET，并从 NuNet 部署者账户接收大量 NTX 铸造。\n3. 同一攻击钱包随后触及 SingularityNET / WMTx 转换器，出现大额异常铸造。\n4. Fetch 停用受影响钱包和合约，并与安全机构调查。\n\n## 资金流向\n转换器库存与部署者铸造路径 → 攻击者 EOA；部分 FET / NTX 形成已确认经济损失，AGIX / WMTx 名义铸造量的可兑现价值未核实。\n\n## 金额口径\nFetch 约 1.56M USD 加 NuNet 约 450,000 USD 级 NTX，主口径约 2.01M USD。约 2.6 亿 AGIX 与约 5,383.8 万 WMTx 是名义铸造量，不另计。\n\n## 证据边界\nFetch 官方确认、Blockaid、PeckShield、GoPlus 和 SlowMist 支持转换器利用与集群关系；完整 SingularityNET / WMTx 受害合约、冻结量和最终兑现量仍待核对。\n\n## 处置状态\nFetch 已停用相关钱包和合约并调查；其他转换器的处置继续进行，未确认追回。\n\n## 地址与交易\n攻击者 EOA、Fetch 转换器和 FET 合约保留为正式标签；交易哈希只作为来源引用。\n\n## 2026 年 9 月 20 日后续调查\n补充报告将 FET 实际转出量列为 8,721,530.40 FET，事发估值约 153 万美元；NuNet 铸造约 408.5M NTX，PeckShield 对该次铸造估值约 462,730 美元。约 260M AGIX 与 53.838M WMTx 是名义铸造量，地址余额估值及后续可实现价值不是新增损失。World Mobile 运行攻击前快照并暂停 WMTx 交易；Fetch.ai 表示其自身合约未受影响。这些进展属于同一攻击簇，不另计事件或叠加名义币值。", "tw": "## 事件背景\nASI 轉換器基礎設施包含 Fetch、NuNet 和後續 SingularityNET / WMTx 相關轉換路徑。公開信息指向轉換授權簽名與操作層問題，而非單一用戶錢包。\n\n## 事件經過\n1. 攻擊者使用有效轉換授權簽名調用 Fetch TokenConversionManagerV3.conversionIn()。\n2. 抽取約 1.56M USD FET，並從 NuNet 部署者賬戶接收大量 NTX 鑄造。\n3. 同一攻擊錢包隨後觸及 SingularityNET / WMTx 轉換器，出現大額異常鑄造。\n4. Fetch 停用受影響錢包和合約，並與安全機構調查。\n\n## 資金流向\n轉換器庫存與部署者鑄造路徑 → 攻擊者 EOA；部分 FET / NTX 形成已確認經濟損失，AGIX / WMTx 名義鑄造量的可兌現價值未核實。\n\n## 金額口徑\nFetch 約 1.56M USD 加 NuNet 約 450,000 USD 級 NTX，主口徑約 2.01M USD。約 2.6 億 AGIX 與約 5,383.8 萬 WMTx 是名義鑄造量，不另計。\n\n## 證據邊界\nFetch 官方確認、Blockaid、PeckShield、GoPlus 和 SlowMist 支持轉換器利用與集群關係；完整 SingularityNET / WMTx 受害合約、凍結量和最終兌現量仍待核對。\n\n## 處置狀態\nFetch 已停用相關錢包和合約並調查；其他轉換器的處置繼續進行，未確認追回。\n\n## 地址與交易\n攻擊者 EOA、Fetch 轉換器和 FET 合約保留為正式標籤；交易哈希只作為來源引用。\n\n## 2026 年 9 月 20 日後續調查\n補充報告將 FET 實際轉出量列為 8,721,530.40 FET，事發估值約 153 萬美元；NuNet 鑄造約 408.5M NTX，PeckShield 對該次鑄造估值約 462,730 美元。約 260M AGIX 與 53.838M WMTx 是名義鑄造量，地址餘額估值及後續可實現價值不是新增損失。World Mobile 運行攻擊前快照並暫停 WMTx 交易；Fetch.ai 表示其自身合約未受影響。這些進展屬於同一攻擊簇，不另計事件或疊加名義幣值。", "en": "## Incident overview\nThe ASI conversion infrastructure spans Fetch, NuNet, and later SingularityNET / WMTx conversion paths. Public evidence points to conversion-authorization and operations-layer issues rather than one user wallet.\n\n## Incident sequence\n1. The attacker used a valid conversion-authorization signature to call Fetch TokenConversionManagerV3.conversionIn().\n2. About $1.56 million in FET was extracted, and large NTX minting was received from a NuNet deployer account.\n3. The same wallet then touched SingularityNET / WMTx converters, producing large anomalous mints.\n4. Fetch disabled affected wallets and contracts while investigating with security teams.\n\n## Fund flow\nConverter inventory and deployer-mint paths → attacker EOA; FET / NTX form the confirmed economic-loss basis, while realizable value of AGIX / WMTx nominal mints remains unverified.\n\n## Amount basis\nAbout $1.56 million in FET plus roughly $450,000 in NTX gives a primary basis near $2.01 million. About 260 million AGIX and 53.838 million WMTx are nominal mints and are excluded.\n\n## Evidence boundary\nFetch confirmation, Blockaid, PeckShield, GoPlus, and SlowMist support the converter exploit and cluster relationship. Complete SingularityNET / WMTx victim contracts, freeze amounts, and final realization remain under review.\n\n## Current status\nFetch disabled affected wallets and contracts and is investigating; other converter response continues and no recovery was confirmed.\n\n## Addresses and transactions\nThe attacker EOA, Fetch converter, and FET contract are retained as formal labels; transaction hashes remain references.\n\n## Follow-up investigation on September 20, 2026\nThe overlapping report specified an actual transfer of 8,721,530.40 FET, valued near $1.53 million at the time. NuNet minted about 408.5 million NTX, valued by PeckShield near $462,730. About 260 million AGIX and 53.838 million WMTx were nominal mints; address-balance estimates and later realizable value are not additional losses. World Mobile took a pre-attack snapshot and paused WMTx trading; Fetch.ai said its own contracts were unaffected. These updates belong to the same cluster and do not create another incident or add nominal token values." }, "category": "access-control", "severity": "critical", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 2010000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "Fetch 约 1.56M USD FET 加 NuNet 约 450,000 USD 级 NTX，合计约 2.01M USD；AGIX / WMTx 名义铸造量不计。", "tw": "Fetch 約 1.56M USD FET 加 NuNet 約 450,000 USD 級 NTX，合計約 2.01M USD；AGIX / WMTx 名義鑄造量不計。", "en": "About $1.56 million in FET plus roughly $450,000 in NTX, about $2.01 million total; nominal AGIX / WMTx minting is excluded." }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0x1572F2af7696b39c85E3221CDE8EFb640F86c362", "entity": { "zh": "ASI 转换攻击者 EOA", "tw": "ASI 轉換攻擊者 EOA", "en": "ASI conversion attacker EOA" }, "role": "attacker", "category": "hack", "confidence": 0.88, "sourceUrl": "https://x.com/Blockaid_/status/2101426529376854257", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "安全机构将该 EOA 与 Fetch / NuNet 转换器攻击簇关联。", "tw": "安全機構將該 EOA 與 Fetch / NuNet 轉換器攻擊簇關聯。", "en": "Security researchers link this EOA to the Fetch / NuNet converter attack cluster." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xab424A430CC09864fA1277A38193111705ADF3A3", "entity": { "zh": "Fetch TokenConversionManagerV3", "tw": "Fetch TokenConversionManagerV3", "en": "Fetch TokenConversionManagerV3" }, "role": "affected-contract", "category": "unknown", "confidence": 0.94, "sourceUrl": "https://x.com/Fetch_ai/status/2101564803533926694", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Fetch 官方和安全机构将该转换器列为受影响合约，不是攻击者。", "tw": "Fetch 官方和安全機構將該轉換器列為受影響合約，不是攻擊者。", "en": "Fetch and security researchers identify this converter as affected infrastructure, not an attacker." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xaea46A60368A7bD060eec7DF8CBa43b7EF41Ad85", "entity": { "zh": "FET 代币合约", "tw": "FET 代幣合約", "en": "FET token contract" }, "role": "contract", "category": "unknown", "confidence": 0.96, "sourceUrl": "https://x.com/Fetch_ai/status/2101564803533926694", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址是受影响资产合约，不是攻击者地址。", "tw": "該地址是受影響資產合約，不是攻擊者地址。", "en": "This is the affected asset contract, not an attacker address." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "Fetch 官方确认", "tw": "Fetch 官方確認", "en": "Fetch official confirmation" }, "url": "https://x.com/Fetch_ai/status/2101564803533926694", "type": "official" }, { "label": { "zh": "Fetch 官方处置更新", "tw": "Fetch 官方處置更新", "en": "Fetch official response update" }, "url": "https://x.com/Fetch_ai/status/2101595159054131393", "type": "official" }, { "label": { "zh": "PeckShield Fetch / NuNet 告警", "tw": "PeckShield Fetch / NuNet 告警", "en": "PeckShield Fetch / NuNet alert" }, "url": "https://x.com/PeckShieldAlert/status/2101457227379044822", "type": "research" }, { "label": { "zh": "Blockaid 地址线索", "tw": "Blockaid 地址線索", "en": "Blockaid addresses and transactions" }, "url": "https://x.com/blockaid_/status/2101426529376854257", "type": "research" }, { "label": { "zh": "SlowMist 根因说明", "tw": "SlowMist 根因說明", "en": "SlowMist root-cause explanation" }, "url": "https://x.com/SlowMist_Team/status/2101503515877396639", "type": "research" }, { "label": { "zh": "PeckShield SingularityNET / WMTx 更新", "tw": "PeckShield SingularityNET / WMTx 更新", "en": "PeckShield SingularityNET / WMTx update" }, "url": "https://x.com/PeckShieldAlert/status/2101602701251334368", "type": "research" }, { "label": { "zh": "World Mobile 安全通知", "tw": "World Mobile 安全通知", "en": "World Mobile security notice" }, "url": "https://x.com/wmchain/status/2101538765332431188", "type": "official" }, { "label": { "zh": "FET 交易与地址资料", "tw": "FET 交易與地址資料", "en": "FET transaction and address report" }, "url": "https://www.aicoin.com/en/news-flash/3090825", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-321", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-320", "status": "verified", "incidentDate": "2026-09-19", "datePrecision": "day", "title": { "zh": "FomoPeek iOS 恶意应用导致钱包资产被盗", "tw": "FomoPeek iOS 惡意應用導致錢包資產被盜", "en": "FomoPeek iOS malware app stole wallet assets" }, "summary": { "zh": "SlowMist 与 OKX 安全团队确认 FomoPeek iOS 1.1—1.2 包含恶意代码，部分用户发生私钥泄露和资产转移。公开帖没有给出可核总金额。", "tw": "SlowMist 與 OKX 安全團隊確認 FomoPeek iOS 1.1—1.2 包含惡意代碼，部分用戶發生私鑰洩露和資產轉移。公開帖沒有給出可核總金額。", "en": "SlowMist and OKX security teams confirmed malicious code in FomoPeek iOS versions 1.1–1.2. Some users suffered private-key exposure and asset transfers, but no verified total loss was published." }, "details": { "zh": "## 事件背景\nFomoPeek iOS 1.1—1.2 被确认包含恶意代码，影响钱包用户的私钥或种子短语安全。\n\n## 事件经过\n1. 2026 年 9 月 19 日，SlowMist 发布告警。\n2. SlowMist 与 OKX 安全团队确认受影响版本。\n3. 部分用户在安装或使用后发生私钥泄露和资产转移。\n\n## 资金流向\n恶意 App → 私钥或种子短语泄露 → 用户多链钱包资产转移；完整地址、交易和总损失未公开。\n\n## 金额口径\n公开告警只称收到多起盗币报告，没有可靠总金额。\n\n## 证据边界\n软件供应链风险和部分受害事实已被确认，但应用包来源、所有受影响用户和后续资金路径仍待完整报告。\n\n## 处置状态\n用户应卸载受影响版本、迁移钱包并通过官方渠道核对版本。未确认追回。\n\n## 地址与交易\n没有公开适合标签的完整区块链地址或交易哈希。", "tw": "## 事件背景\nFomoPeek iOS 1.1—1.2 被確認包含惡意代碼，影響錢包用戶的私鑰或種子短語安全。\n\n## 事件經過\n1. 2026 年 9 月 19 日，SlowMist 發佈告警。\n2. SlowMist 與 OKX 安全團隊確認受影響版本。\n3. 部分用戶在安裝或使用後發生私鑰洩露和資產轉移。\n\n## 資金流向\n惡意 App → 私鑰或種子短語洩露 → 用戶多鏈錢包資產轉移；完整地址、交易和總損失未公開。\n\n## 金額口徑\n公開告警只稱收到多起盜幣報告，沒有可靠總金額。\n\n## 證據邊界\n軟件供應鏈風險和部分受害事實已被確認，但應用包來源、所有受影響用戶和後續資金路徑仍待完整報告。\n\n## 處置狀態\n用戶應卸載受影響版本、遷移錢包並通過官方渠道核對版本。未確認追回。\n\n## 地址與交易\n沒有公開適合標籤的完整區塊鏈地址或交易哈希。", "en": "## Incident overview\nFomoPeek iOS versions 1.1–1.2 were confirmed to contain malicious code affecting private-key and seed-phrase security.\n\n## Incident sequence\n1. SlowMist published an alert on September 19, 2026.\n2. SlowMist and OKX security teams confirmed the affected versions.\n3. Some users experienced private-key exposure and asset transfers after installation or use.\n\n## Fund flow\nMalicious app → private key or seed phrase exposure → multi-chain wallet transfers; complete addresses, transactions, and total loss were not published.\n\n## Amount basis\nThe public alert described multiple theft reports without a reliable total amount.\n\n## Evidence boundary\nThe supply-chain risk and some victims are confirmed, while package origin, full user scope, and later fund routes await a complete report.\n\n## Current status\nUsers should remove affected versions, migrate wallets, and verify versions through official channels. No recovery was confirmed.\n\n## Addresses and transactions\nNo complete blockchain address or transaction hash suitable for labeling was published." }, "category": "supply-chain", "severity": "critical", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开确认部分用户资产被盗，但没有核验总美元损失。", "tw": "公開確認部分用戶資產被盜，但沒有核驗總美元損失。", "en": "Some users were publicly reported to have lost assets, but no verified total USD loss was published." }, "addressDisclosure": "not-applicable", "addresses": [], "references": [ { "label": { "zh": "SlowMist FomoPeek 告警", "tw": "SlowMist FomoPeek 告警", "en": "SlowMist FomoPeek alert" }, "url": "https://x.com/SlowMist_Team/status/2101211432541192615", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-320", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-319", "status": "verified", "incidentDate": "2026-09-18", "datePrecision": "day", "title": { "zh": "Likwid Finance 保证金借贷逻辑缺陷", "tw": "Likwid Finance 保證金借貸邏輯缺陷", "en": "Likwid Finance margin-lending logic exploit" }, "summary": { "zh": "Likwid 的 _executeAddCollateralAndBorrow 在 leverage = 0 分支没有正确更新 pairDelta，借贷路径不触及储备，攻击者重复利用相同报价抽取 74.31 BNB。", "tw": "Likwid 的 _executeAddCollateralAndBorrow 在 leverage = 0 分支沒有正確更新 pairDelta，借貸路徑不觸及儲備，攻擊者重複利用相同報價抽取 74.31 BNB。", "en": "Likwid's leverage = 0 branch failed to update pairDelta in _executeAddCollateralAndBorrow, leaving the lending path detached from reserves and allowing repeated extraction of 74.31 BNB." }, "details": { "zh": "## 事件背景\nLikwid 保证金借贷路径在 leverage = 0 分支没有正确更新 pairDelta，且 getAmountOut 持续返回相同报价。\n\n## 事件经过\n1. 2026 年 9 月 18 日，SlowMist 发布告警。\n2. 攻击者重复调用借贷路径。\n3. 储备没有按预期更新，重复报价被用于抽取资产。\n\n## 资金流向\nLikwid 借贷池 → 重复报价和保证金路径 → 约 74.31 BNB；完整地址和交易未恢复。\n\n## 金额口径\n报告采用 74.31 BNB，不把其换算成静态美元损失。\n\n## 证据边界\nSlowMist 告警支持代码逻辑和资产数量；项目方根因复盘、攻击地址和交易仍未公开。\n\n## 处置状态\n未确认追回。\n\n## 地址与交易\n公开来源没有提供完整地址或交易哈希。", "tw": "## 事件背景\nLikwid 保證金借貸路徑在 leverage = 0 分支沒有正確更新 pairDelta，且 getAmountOut 持續返回相同報價。\n\n## 事件經過\n1. 2026 年 9 月 18 日，SlowMist 發佈告警。\n2. 攻擊者重複調用借貸路徑。\n3. 儲備沒有按預期更新，重複報價被用於抽取資產。\n\n## 資金流向\nLikwid 借貸池 → 重複報價和保證金路徑 → 約 74.31 BNB；完整地址和交易未恢復。\n\n## 金額口徑\n報告採用 74.31 BNB，不把其換算成靜態美元損失。\n\n## 證據邊界\nSlowMist 告警支持代碼邏輯和資產數量；項目方根因復盤、攻擊地址和交易仍未公開。\n\n## 處置狀態\n未確認追回。\n\n## 地址與交易\n公開來源沒有提供完整地址或交易哈希。", "en": "## Incident overview\nLikwid's leverage = 0 branch failed to update pairDelta, while getAmountOut kept returning the same quote.\n\n## Incident sequence\n1. SlowMist published the alert on September 18, 2026.\n2. The attacker repeatedly called the lending path.\n3. Reserves did not update as expected, allowing the repeated quote to extract assets.\n\n## Fund flow\nLikwid lending pool → repeated quote and collateral path → about 74.31 BNB; complete addresses and transactions were not recovered.\n\n## Amount basis\nThe report uses 74.31 BNB and does not convert it using a static USD value.\n\n## Evidence boundary\nThe SlowMist alert supports the code path and asset quantity; a project postmortem, attacker address, and transaction remain unpublished.\n\n## Current status\nNo recovery was confirmed.\n\n## Addresses and transactions\nPublic sources did not provide a complete address or transaction hash." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "BNB Chain" ], "chains": [ "BNB Chain" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 74.31 BNB；报告没有采用静态美元折算。", "tw": "約 74.31 BNB；報告沒有采用靜態美元折算。", "en": "About 74.31 BNB; no static USD conversion is used." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "SlowMist Likwid 告警", "tw": "SlowMist Likwid 告警", "en": "SlowMist Likwid alert" }, "url": "https://x.com/SlowMist_Team/status/2100785330849009937", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-319", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-318", "status": "verified", "incidentDate": "2026-09-18", "datePrecision": "day", "title": { "zh": "Nimiq ERC20PermitHTLCHandler 授权验证缺陷", "tw": "Nimiq ERC20PermitHTLCHandler 授權驗證缺陷", "en": "Nimiq ERC20PermitHTLCHandler authorization-validation exploit" }, "summary": { "zh": "Nimiq 的 ERC20PermitHTLCHandler 在 RelayHub 路径中没有正确验证签名、nonce 和业务参数，攻击者利用遗留授权锁定并赎回约 50,463 USD 资产。", "tw": "Nimiq 的 ERC20PermitHTLCHandler 在 RelayHub 路徑中沒有正確驗證簽名、nonce 和業務參數，攻擊者利用遺留授權鎖定並贖回約 50,463 USD 資產。", "en": "Nimiq ERC20PermitHTLCHandler failed to validate signature, nonce, and business parameters correctly through RelayHub, allowing an attacker to use legacy allowances and lock and redeem assets worth about $50,463." }, "details": { "zh": "## 事件背景\nERC20PermitHTLCHandler 的 execute() 丢弃多个 calldata 参数，关键签名和 nonce 检查只在 preRelayedCall() 执行，RelayHub 场景可能绕过。\n\n## 事件经过\n1. 2026 年 9 月 18 日，SlowMist 发布技术告警。\n2. 攻击者自建 Relay，冒充流动性钱包发起 open。\n3. 利用遗留 ERC20 授权把 USDC、USDT0 和 USDC.e 锁入指定托管路径。\n4. 通过 CREATE2 一次性合约以 secret = 1 赎回。\n\n## 资金流向\n受害授权钱包 → ERC20PermitHTLCHandler → 攻击者指定托管 → 一次性 CREATE2 合约赎回。\n\n## 金额口径\n三类稳定币合计约 50,463 USD；资产数量和美元估值是同一事件口径。\n\n## 证据边界\nSlowMist 支持验证路径和金额，但完整地址、交易和最终归集未从公开告警恢复。\n\n## 处置状态\n未见追回或退款证明。\n\n## 地址与交易\n公开来源没有提供完整攻击地址或交易哈希。", "tw": "## 事件背景\nERC20PermitHTLCHandler 的 execute() 丟棄多個 calldata 參數，關鍵簽名和 nonce 檢查只在 preRelayedCall() 執行，RelayHub 場景可能繞過。\n\n## 事件經過\n1. 2026 年 9 月 18 日，SlowMist 發佈技術告警。\n2. 攻擊者自建 Relay，冒充流動性錢包發起 open。\n3. 利用遺留 ERC20 授權把 USDC、USDT0 和 USDC.e 鎖入指定託管路徑。\n4. 通過 CREATE2 一次性合約以 secret = 1 贖回。\n\n## 資金流向\n受害授權錢包 → ERC20PermitHTLCHandler → 攻擊者指定託管 → 一次性 CREATE2 合約贖回。\n\n## 金額口徑\n三類穩定幣合計約 50,463 USD；資產數量和美元估值是同一事件口徑。\n\n## 證據邊界\nSlowMist 支持驗證路徑和金額，但完整地址、交易和最終歸集未從公開告警恢復。\n\n## 處置狀態\n未見追回或退款證明。\n\n## 地址與交易\n公開來源沒有提供完整攻擊地址或交易哈希。", "en": "## Incident overview\nERC20PermitHTLCHandler discarded multiple calldata parameters, leaving key signature and nonce checks only in preRelayedCall(), which could be bypassed through RelayHub.\n\n## Incident sequence\n1. SlowMist published the technical alert on September 18, 2026.\n2. The attacker built a relay and opened positions as a liquidity wallet.\n3. Existing ERC-20 allowances locked USDC, USDT0, and USDC.e into the selected custody path.\n4. A one-time CREATE2 contract redeemed them with secret = 1.\n\n## Fund flow\nVictim allowance wallets → ERC20PermitHTLCHandler → attacker-selected custody → one-time CREATE2 redemption.\n\n## Amount basis\nThe three stablecoins totaled about $50,463; token quantities and USD valuation describe the same event.\n\n## Evidence boundary\nSlowMist supports the validation path and amount, but complete addresses, transactions, and final aggregation were not recovered from the public alert.\n\n## Current status\nNo return or refund evidence was found.\n\n## Addresses and transactions\nPublic sources did not provide a complete attacker address or transaction hash." }, "category": "phishing-approval", "severity": "high", "ecosystems": [ "Ethereum", "Polygon" ], "chains": [ "Ethereum", "Polygon" ], "lossUsd": 50463, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 26,130.64171 USDC、24,332.489269 USDT0 和 0.661117 USDC.e，估值约 50,463 USD。", "tw": "約 26,130.64171 USDC、24,332.489269 USDT0 和 0.661117 USDC.e，估值約 50,463 USD。", "en": "About 26,130.64171 USDC, 24,332.489269 USDT0, and 0.661117 USDC.e, valued near $50,463." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "SlowMist Nimiq 告警", "tw": "SlowMist Nimiq 告警", "en": "SlowMist Nimiq alert" }, "url": "https://x.com/SlowMist_Team/status/2100896541859054006", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-318", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-317", "status": "verified", "incidentDate": "2026-09-17", "datePrecision": "day", "title": { "zh": "Nostra Starknet NSTR 预言机价格操纵", "tw": "Nostra Starknet NSTR 預言機價格操縱", "en": "Nostra Starknet NSTR oracle-price manipulation" }, "summary": { "zh": "攻击者操纵低流动性 NSTR 价格，以虚高抵押品从 Nostra 借出约 3.5M USD 资产；约 1.92M USD 已桥至 Ethereum，最终损失和追回仍待确认。", "tw": "攻擊者操縱低流動性 NSTR 價格，以虛高抵押品從 Nostra 借出約 3.5M USD 資產；約 1.92M USD 已橋至 Ethereum，最終損失和追回仍待確認。", "en": "An attacker manipulated the thin NSTR market and used inflated collateral to borrow about $3.5 million from Nostra. About $1.92 million reached Ethereum; final loss and recoveries remain unresolved." }, "details": { "zh": "## 事件背景\nNostra 的 NSTR 价格聚合选中了被操纵的低流动性池，攻击者可以把虚高 NSTR 当作抵押品。\n\n## 事件经过\n1. 2026 年 9 月 17 日，攻击者把 NSTR 价格从约 0.006 USD 推至约 49.5 USD。\n2. 以虚高 NSTR 抵押借出 ETH、STRK、USDC、USDT、WBTC 和 DAI。\n3. 资产通过 AVNU、Ekubo、JediSwap 拆分，约 1.92M USD 经桥到 Ethereum。\n4. Nostra 暂停供应、借贷、取款和清算。\n\n## 资金流向\nStarknet NSTR 市场 → Nostra Money Market → 借出资产 → Starknet DEX 拆分 → 部分经 NEAR Intents 到 Ethereum。\n\n## 金额口径\n约 3.5M USD 是借出 / 涉资口径；约 1.92M USD 是已到 Ethereum 的监控口径，不重复相加。\n\n## 证据边界\nNostra 官方、多家安全机构和技术报道支持价格操纵与暂停；最终净损失、追回金额和借款地址仍待核查。\n\n## 处置状态\nNostra 相关市场暂停，团队追踪资金并核对影响；未确认追回。\n\n## 地址与交易\n公开完整地址仅包括受影响路径合约；Ethereum 归集线索为截断值，不写入正式标签。", "tw": "## 事件背景\nNostra 的 NSTR 價格聚合選中了被操縱的低流動性池，攻擊者可以把虛高 NSTR 當作抵押品。\n\n## 事件經過\n1. 2026 年 9 月 17 日，攻擊者把 NSTR 價格從約 0.006 USD 推至約 49.5 USD。\n2. 以虛高 NSTR 抵押借出 ETH、STRK、USDC、USDT、WBTC 和 DAI。\n3. 資產通過 AVNU、Ekubo、JediSwap 拆分，約 1.92M USD 經橋到 Ethereum。\n4. Nostra 暫停供應、借貸、取款和清算。\n\n## 資金流向\nStarknet NSTR 市場 → Nostra Money Market → 借出資產 → Starknet DEX 拆分 → 部分經 NEAR Intents 到 Ethereum。\n\n## 金額口徑\n約 3.5M USD 是借出 / 涉資口徑；約 1.92M USD 是已到 Ethereum 的監控口徑，不重複相加。\n\n## 證據邊界\nNostra 官方、多家安全機構和技術報道支持價格操縱與暫停；最終淨損失、追回金額和借款地址仍待核查。\n\n## 處置狀態\nNostra 相關市場暫停，團隊追蹤資金並核對影響；未確認追回。\n\n## 地址與交易\n公開完整地址僅包括受影響路徑合約；Ethereum 歸集線索為截斷值，不寫入正式標籤。", "en": "## Incident overview\nNostra's price aggregation selected a manipulated thin-liquidity NSTR pool, allowing inflated NSTR to be used as collateral.\n\n## Incident sequence\n1. On September 17, 2026, NSTR was pushed from about $0.006 to about $49.5.\n2. The attacker borrowed ETH, STRK, USDC, USDT, WBTC, and DAI against inflated NSTR.\n3. Assets were split through AVNU, Ekubo, and JediSwap, with about $1.92 million bridged to Ethereum.\n4. Nostra paused supply, borrowing, withdrawal, and liquidation functions.\n\n## Fund flow\nStarknet NSTR market → Nostra Money Market → borrowed assets → Starknet DEX splits → part bridged to Ethereum through NEAR Intents.\n\n## Amount basis\nAbout $3.5 million is the borrowed or exposed basis; about $1.92 million reached Ethereum and is not added again.\n\n## Evidence boundary\nNostra, multiple security firms, and technical reports support the manipulation and pause; final net loss, recovery, and borrowing addresses remain under review.\n\n## Current status\nNostra markets are paused while funds and impact are reviewed; no recovery was confirmed.\n\n## Addresses and transactions\nOnly the affected-path contract was complete; the Ethereum aggregation clue was truncated and is excluded from formal labels." }, "category": "oracle-manipulation", "severity": "critical", "ecosystems": [ "Starknet", "Ethereum" ], "chains": [ "Starknet", "Ethereum" ], "lossUsd": 3500000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 3.5M USD 借出 / 涉资；约 1.92M USD 已桥至 Ethereum，其余路径待核。", "tw": "約 3.5M USD 借出 / 涉資；約 1.92M USD 已橋至 Ethereum，其餘路徑待核。", "en": "About $3.5 million was borrowed or exposed; about $1.92 million reached Ethereum and the remainder is unresolved." }, "addressDisclosure": "published", "addresses": [ { "chain": "Starknet", "address": "0x06d48ef7ab62c26e3ef1987c322096cd508e9034c82048783a6b438fc1344bc3", "entity": { "zh": "Nostra 受影响 / 借款路径合约", "tw": "Nostra 受影響 / 借款路徑合約", "en": "Nostra affected / borrowing-path contract" }, "role": "affected-contract", "category": "unknown", "confidence": 0.86, "sourceUrl": "https://x.com/nostrafinance/status/2100577538053493076", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址被报告列为受影响或借款路径合约，不是攻击者地址。", "tw": "該地址被報告列為受影響或借款路徑合約，不是攻擊者地址。", "en": "The report identifies this as an affected or borrowing-path contract, not an attacker address." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "Nostra 官方披露", "tw": "Nostra 官方披露", "en": "Nostra official disclosure" }, "url": "https://x.com/nostrafinance/status/2100577538053493076", "type": "official" }, { "label": { "zh": "PeckShield Nostra 告警", "tw": "PeckShield Nostra 告警", "en": "PeckShield Nostra alert" }, "url": "https://x.com/PeckShieldAlert/status/2100747001516454390", "type": "research" }, { "label": { "zh": "CertiK 链上分布", "tw": "CertiK 鏈上分佈", "en": "CertiK on-chain distribution" }, "url": "https://x.com/CertiKAlert/status/2100774528494526812", "type": "research" }, { "label": { "zh": "SlowMist Hacked Nostra 记录", "tw": "SlowMist Hacked Nostra 記錄", "en": "SlowMist Hacked Nostra record" }, "url": "https://hacked.slowmist.io/zh/?c=&page=1", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-317", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-327", "status": "verified", "incidentDate": "2026-09-16", "datePrecision": "day", "title": { "zh": "BonfireSwap Router 授权盗币", "tw": "BonfireSwap Router 授權盜幣", "en": "BonfireSwap Router allowance theft" }, "summary": { "zh": "路由 transfer 缺少 from 与调用者授权检查，约 41 名授权持有人被利用，损失约 50,000 USD。", "tw": "路由 transfer 缺少 from 與調用者授權檢查，約 41 名授權持有人被利用，損失約 50,000 USD。", "en": "The router transfer lacked from and caller-authorization checks; about 41 approved holders were drained for roughly $50,000." }, "details": { "zh": "## 事件背景\n路由 transfer 缺少 from 与调用者授权检查，约 41 名授权持有人被利用，损失约 50,000 USD。\n\n## 事件经过\n把已授权用户设为 from、攻击者设为 to，调用 transfer 后经同币种池兑换。\n\n## 资金流向\nSlowMist 记录支持相应攻击或异常处置路径；完整地址和交易集合未全部公开。\n\n## 金额口径\n约 50,000 USD。\n\n## 证据边界\n该条目来自 SlowMist Hacked Zone 的窗口内记录，后续项目复盘、地址和追回状态可能继续更新。\n\n## 处置状态\n截至核验点没有完整公开追回或赔付账本。\n\n## 地址与交易\n公开来源未提供完整标识符，不进行补写。", "tw": "## 事件背景\n路由 transfer 缺少 from 與調用者授權檢查，約 41 名授權持有人被利用，損失約 50,000 USD。\n\n## 事件經過\n把已授權用戶設為 from、攻擊者設為 to，調用 transfer 後經同幣種池兌換。\n\n## 資金流向\nSlowMist 記錄支持相應攻擊或異常處置路徑；完整地址和交易集合未全部公開。\n\n## 金額口徑\n約 50,000 USD。\n\n## 證據邊界\n該條目來自 SlowMist Hacked Zone 的窗口內記錄，後續項目復盤、地址和追回狀態可能繼續更新。\n\n## 處置狀態\n截至核驗點沒有完整公開追回或賠付賬本。\n\n## 地址與交易\n公開來源未提供完整標識符，不進行補寫。", "en": "## Incident overview\nThe router transfer lacked from and caller-authorization checks; about 41 approved holders were drained for roughly $50,000.\n\n## Incident sequence\nApproved holders were set as from and the attacker as to, then transfer drained TOKEN before a same-token swap.\n\n## Fund flow\nThe SlowMist record supports the attack or disposition path, but complete addresses and transactions were not fully public.\n\n## Amount basis\nAbout $50,000.\n\n## Evidence boundary\nThis item comes from the SlowMist Hacked Zone during the window; project postmortems, addresses, and recovery status may change.\n\n## Current status\nNo complete public recovery or compensation ledger was available at verification.\n\n## Addresses and transactions\nPublic sources did not provide complete identifiers, so none are filled in." }, "category": "phishing-approval", "severity": "high", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": 50000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 50,000 USD。", "tw": "約 50,000 USD。", "en": "About $50,000." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "SlowMist Hacked 记录", "tw": "SlowMist Hacked 記錄", "en": "SlowMist Hacked record" }, "url": "https://hacked.slowmist.io/zh/?page=1", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-327", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-326", "status": "verified", "incidentDate": "2026-09-16", "datePrecision": "day", "title": { "zh": "Startale ERC-7579 智能账户初始化漏洞", "tw": "Startale ERC-7579 智能賬戶初始化漏洞", "en": "Startale ERC-7579 smart-account initialization exploit" }, "summary": { "zh": "transient storage 生命周期错误允许同一交易内重新初始化约 330 个预存资金账户，损失约 2,876 USD。", "tw": "transient storage 生命週期錯誤允許同一交易內重新初始化約 330 個預存資金賬戶，損失約 2,876 USD。", "en": "A transient-storage lifecycle flaw allowed reinitialization of about 330 funded counterfactual accounts in one transaction, causing about $2,876 loss." }, "details": { "zh": "## 事件背景\ntransient storage 生命周期错误允许同一交易内重新初始化约 330 个预存资金账户，损失约 2,876 USD。\n\n## 事件经过\n重新初始化账户并注入恶意 bootstrap，逐个清空尚未正式部署但已有余额的账户。\n\n## 资金流向\nSlowMist 记录支持相应攻击或异常处置路径；完整地址和交易集合未全部公开。\n\n## 金额口径\n约 2,876 USD。\n\n## 证据边界\n该条目来自 SlowMist Hacked Zone 的窗口内记录，后续项目复盘、地址和追回状态可能继续更新。\n\n## 处置状态\n截至核验点没有完整公开追回或赔付账本。\n\n## 地址与交易\n公开来源未提供完整标识符，不进行补写。", "tw": "## 事件背景\ntransient storage 生命週期錯誤允許同一交易內重新初始化約 330 個預存資金賬戶，損失約 2,876 USD。\n\n## 事件經過\n重新初始化賬戶並注入惡意 bootstrap，逐個清空尚未正式部署但已有餘額的賬戶。\n\n## 資金流向\nSlowMist 記錄支持相應攻擊或異常處置路徑；完整地址和交易集合未全部公開。\n\n## 金額口徑\n約 2,876 USD。\n\n## 證據邊界\n該條目來自 SlowMist Hacked Zone 的窗口內記錄，後續項目復盤、地址和追回狀態可能繼續更新。\n\n## 處置狀態\n截至核驗點沒有完整公開追回或賠付賬本。\n\n## 地址與交易\n公開來源未提供完整標識符，不進行補寫。", "en": "## Incident overview\nA transient-storage lifecycle flaw allowed reinitialization of about 330 funded counterfactual accounts in one transaction, causing about $2,876 loss.\n\n## Incident sequence\nAccounts were reinitialized with a malicious bootstrap, draining funded counterfactual accounts.\n\n## Fund flow\nThe SlowMist record supports the attack or disposition path, but complete addresses and transactions were not fully public.\n\n## Amount basis\nAbout $2,876.\n\n## Evidence boundary\nThis item comes from the SlowMist Hacked Zone during the window; project postmortems, addresses, and recovery status may change.\n\n## Current status\nNo complete public recovery or compensation ledger was available at verification.\n\n## Addresses and transactions\nPublic sources did not provide complete identifiers, so none are filled in." }, "category": "access-control", "severity": "high", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 2876, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 2,876 USD。", "tw": "約 2,876 USD。", "en": "About $2,876." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "SlowMist Hacked 记录", "tw": "SlowMist Hacked 記錄", "en": "SlowMist Hacked record" }, "url": "https://hacked.slowmist.io/zh/?page=1", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-326", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-316", "status": "verified", "incidentDate": "2026-09-16", "datePrecision": "day", "title": { "zh": "Flamincome 旧 Vault 估值操纵", "tw": "Flamincome 舊 Vault 估值操縱", "en": "Flamincome legacy Vault valuation manipulation" }, "summary": { "zh": "Flamincome 旧版 Vault 将可无许可注入的 Curve / Convex 资产纳入份额估值，攻击者用 Morpho 闪电贷抬高 NAV 并赎回 aUSDT，净获利约 345,902.67 USDT。", "tw": "Flamincome 舊版 Vault 將可無許可注入的 Curve / Convex 資產納入份額估值，攻擊者用 Morpho 閃電貸抬高 NAV 並贖回 aUSDT，淨獲利約 345,902.67 USDT。", "en": "Flamincome's legacy Vault counted permissionlessly injected Curve / Convex assets in share valuation. The attacker used a Morpho flash loan to inflate NAV and redeem aUSDT, realizing about 345,902.67 USDT." }, "details": { "zh": "## 事件背景\n旧版 Flamincome Vault 允许把可无许可注入的 Curve / Convex 资产计入份额估值，并依赖脱锚池的 virtual price。\n\n## 事件经过\n1. 攻击者借入约 18.09M USD 的 Morpho 闪电贷。\n2. 向 Strategy 注入 USDP / 3CRV LP，使 VaultYUSDT 份额价格被抬高。\n3. 攻击者从 Aave 侧赎回真实 aUSDT 流动性。\n4. 偿还闪电贷后留下约 345,902.67 USDT 净收益。\n\n## 资金流向\nMorpho 闪电贷 → Curve / Convex 资产注入 → 份额估值抬高 → Aave aUSDT 赎回 → 攻击者净收益。\n\n## 金额口径\n345,902.67 USDT 是净收益口径；闪电贷名义额不是损失。\n\n## 证据边界\nSlowMist、Blockaid 和技术记录支持根因、地址和交易；旧 Vault 具体弃用范围与最终资金状态仍待核对。\n\n## 处置状态\n未确认追回或冻结。\n\n## 地址与交易\n攻击者地址、两个攻击合约和受影响 Vault 保留为地址标签；交易哈希仅在来源引用中记录。", "tw": "## 事件背景\n舊版 Flamincome Vault 允許把可無許可注入的 Curve / Convex 資產計入份額估值，並依賴脫錨池的 virtual price。\n\n## 事件經過\n1. 攻擊者借入約 18.09M USD 的 Morpho 閃電貸。\n2. 向 Strategy 注入 USDP / 3CRV LP，使 VaultYUSDT 份額價格被抬高。\n3. 攻擊者從 Aave 側贖回真實 aUSDT 流動性。\n4. 償還閃電貸後留下約 345,902.67 USDT 淨收益。\n\n## 資金流向\nMorpho 閃電貸 → Curve / Convex 資產注入 → 份額估值抬高 → Aave aUSDT 贖回 → 攻擊者淨收益。\n\n## 金額口徑\n345,902.67 USDT 是淨收益口徑；閃電貸名義額不是損失。\n\n## 證據邊界\nSlowMist、Blockaid 和技術記錄支持根因、地址和交易；舊 Vault 具體棄用範圍與最終資金狀態仍待核對。\n\n## 處置狀態\n未確認追回或凍結。\n\n## 地址與交易\n攻擊者地址、兩個攻擊合約和受影響 Vault 保留為地址標籤；交易哈希僅在來源引用中記錄。", "en": "## Incident overview\nThe legacy Flamincome Vault counted permissionlessly injected Curve / Convex assets in share valuation and relied on a depegged pool virtual price.\n\n## Incident sequence\n1. The attacker borrowed about $18.09 million through a Morpho flash loan.\n2. USDP / 3CRV LP was injected into the Strategy, inflating VaultYUSDT shares.\n3. Real Aave aUSDT liquidity was redeemed.\n4. After repaying the loan, about 345,902.67 USDT remained as net proceeds.\n\n## Fund flow\nMorpho flash liquidity → Curve / Convex injection → inflated share valuation → Aave aUSDT redemption → attacker proceeds.\n\n## Amount basis\n345,902.67 USDT is net proceeds; the flash-loan notional is not loss.\n\n## Evidence boundary\nSlowMist, Blockaid, and the technical record support root cause, addresses, and transactions; the legacy scope and final asset status require further review.\n\n## Current status\nNo recovery or freeze was confirmed.\n\n## Addresses and transactions\nThe attacker, two attack contracts, and affected Vault are retained as labels; transaction hashes remain in the references." }, "category": "oracle-manipulation", "severity": "high", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 345902.67, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "攻击者净获利约 345,902.67 USDT；约 18.09M USD 闪电贷名义额不计入损失。", "tw": "攻擊者淨獲利約 345,902.67 USDT；約 18.09M USD 閃電貸名義額不計入損失。", "en": "Attacker net proceeds were about 345,902.67 USDT; the roughly $18.09 million flash-loan notional is excluded." }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0x83381e7F7232775735169d72D237B858fFc36871", "entity": { "zh": "Flamincome 攻击者归集地址", "tw": "Flamincome 攻擊者歸集地址", "en": "Flamincome attacker aggregation address" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/SlowMist_Team/status/2100256590716907706", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "SlowMist 将该地址与攻击者资金归集关联。", "tw": "SlowMist 將該地址與攻擊者資金歸集關聯。", "en": "SlowMist links this address to attacker fund aggregation." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x875da4Bd7b4a52a806A533b1cf6D6fF92365d2E6", "entity": { "zh": "Flamincome 攻击合约", "tw": "Flamincome 攻擊合約", "en": "Flamincome attack contract" }, "role": "attacker-contract", "category": "hack", "confidence": 0.88, "sourceUrl": "https://x.com/SlowMist_Team/status/2100256590716907706", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该合约位于旧 Vault 估值操纵路径。", "tw": "該合約位於舊 Vault 估值操縱路徑。", "en": "This contract is in the legacy Vault valuation-manipulation path." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x1C7EAceF3630E764519e6EA2E8caA2bDB7D8b486", "entity": { "zh": "Flamincome 攻击合约", "tw": "Flamincome 攻擊合約", "en": "Flamincome attack contract" }, "role": "attacker-contract", "category": "hack", "confidence": 0.88, "sourceUrl": "https://x.com/SlowMist_Team/status/2100256590716907706", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该合约位于旧 Vault 估值操纵路径。", "tw": "該合約位於舊 Vault 估值操縱路徑。", "en": "This contract is in the legacy Vault valuation-manipulation path." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xb8d6471cA573C92c7096Ab8600347F6a9Fe268a5", "entity": { "zh": "Flamincome 受影响 Vault / 策略", "tw": "Flamincome 受影響 Vault / 策略", "en": "Affected Flamincome Vault / strategy" }, "role": "affected-contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/SlowMist_Team/status/2100256590716907706", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址是受影响策略或 Vault，不是攻击者。", "tw": "該地址是受影響策略或 Vault，不是攻擊者。", "en": "This is the affected strategy or Vault, not an attacker." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "SlowMist Flamincome 告警", "tw": "SlowMist Flamincome 告警", "en": "SlowMist Flamincome alert" }, "url": "https://x.com/SlowMist_Team/status/2100256590716907706", "type": "research" }, { "label": { "zh": "Blockaid 地址与交易", "tw": "Blockaid 地址與交易", "en": "Blockaid addresses and transaction" }, "url": "https://x.com/blockaid_/status/2100226319711719532", "type": "research" }, { "label": { "zh": "Flamincome 技术记录", "tw": "Flamincome 技術記錄", "en": "Flamincome technical record" }, "url": "https://smartcontractshacking.com/hacks/flamincome-hack-2026", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-316", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-315", "status": "verified", "incidentDate": "2026-09-15", "datePrecision": "day", "title": { "zh": "Ethereum Safe 自定义模块 rsETH 授权盗币与 MEV 抢跑", "tw": "Ethereum Safe 自定義模塊 rsETH 授權盜幣與 MEV 搶跑", "en": "Ethereum Safe custom-module rsETH theft and MEV front-run" }, "summary": { "zh": "Safe 自定义 LP 模块和 Uniswap V4 hook 路径被利用，攻击者抽取约 2,900 rsETH，安全机构估计约 7.73M 至 7.81M USD。Yoink 机器人抢先获得主要 rsETH，Kelp 对接收地址临时暂停。", "tw": "Safe 自定義 LP 模塊和 Uniswap V4 hook 路徑被利用，攻擊者抽取約 2,900 rsETH，安全機構估計約 7.73M 至 7.81M USD。Yoink 機器人搶先獲得主要 rsETH，Kelp 對接收地址臨時暫停。", "en": "An Ethereum Safe custom LP module and Uniswap V4 hook path were exploited to extract about 2,900 rsETH, estimated at $7.73 million to $7.81 million. A Yoink bot front-ran the main transaction, and Kelp temporarily paused the receiver." }, "details": { "zh": "## 事件背景\nSafe 自定义 LP 模块和 keeper helper 的授权边界被错误使用，攻击者可把模块路由到恶意 Uniswap V4 hook 池。\n\n## 事件经过\n1. 2026 年 9 月 15 日 12:38:47，攻击路径从受害 Safe 触发。\n2. 攻击者借助 helper / LP 模块和 unwrap 流程抽取 aEthrsETH 并转换为 rsETH。\n3. Yoink 机器人观察公共 mempool 后支付约 18.95 ETH 级别优先费用抢跑，获得主要 rsETH。\n4. Kelp 对资金接收地址实施 24 小时钱包级暂停。\n\n## 资金流向\n受害 Safe → 自定义模块 / Uniswap V4 hook → rsETH 接收地址；MEV 抢跑机器人取得主要收益，最终冻结和返还未确认。\n\n## 金额口径\nBlockaid 约 7.73M USD，PeckShield 约 7.81M USD；两者是估值差异，不重复相加。\n\n## 证据边界\nSafe 核心、Kelp rsETH 合约不是根因；授权模块和 helper 路径为主要风险。截断地址和未完成交易不写入完整账本。\n\n## 处置状态\nKelp 临时暂停接收地址，未确认追回或协议级冻结。\n\n## 地址与交易\n受害 Safe、keeper helper、Yoink 账户和合约、rsETH 接收地址与 Token 合约均保留角色标签。", "tw": "## 事件背景\nSafe 自定義 LP 模塊和 keeper helper 的授權邊界被錯誤使用，攻擊者可把模塊路由到惡意 Uniswap V4 hook 池。\n\n## 事件經過\n1. 2026 年 9 月 15 日 12:38:47，攻擊路徑從受害 Safe 觸發。\n2. 攻擊者藉助 helper / LP 模塊和 unwrap 流程抽取 aEthrsETH 並轉換為 rsETH。\n3. Yoink 機器人觀察公共 mempool 後支付約 18.95 ETH 級別優先費用搶跑，獲得主要 rsETH。\n4. Kelp 對資金接收地址實施 24 小時錢包級暫停。\n\n## 資金流向\n受害 Safe → 自定義模塊 / Uniswap V4 hook → rsETH 接收地址；MEV 搶跑機器人取得主要收益，最終凍結和返還未確認。\n\n## 金額口徑\nBlockaid 約 7.73M USD，PeckShield 約 7.81M USD；兩者是估值差異，不重複相加。\n\n## 證據邊界\nSafe 核心、Kelp rsETH 合約不是根因；授權模塊和 helper 路徑為主要風險。截斷地址和未完成交易不寫入完整賬本。\n\n## 處置狀態\nKelp 臨時暫停接收地址，未確認追回或協議級凍結。\n\n## 地址與交易\n受害 Safe、keeper helper、Yoink 賬戶和合約、rsETH 接收地址與 Token 合約均保留角色標籤。", "en": "## Incident overview\nA Safe custom LP module and keeper-helper authorization boundary were misused to route the module through a malicious Uniswap V4 hook pool.\n\n## Incident sequence\n1. The path was triggered at 12:38:47 Beijing time on September 15, 2026.\n2. The attacker used the helper / LP module and unwrap flow to extract aEthrsETH and convert it to rsETH.\n3. A Yoink bot observed the public mempool and paid a priority fee near 18.95 ETH to front-run the transaction, receiving most rsETH.\n4. Kelp paused the receiver wallet for 24 hours.\n\n## Fund flow\nVictim Safe → custom module / Uniswap V4 hook → rsETH receiver; the MEV bot took most proceeds and final freeze or return is unconfirmed.\n\n## Amount basis\nBlockaid estimated about $7.73 million and PeckShield about $7.81 million. They are valuation differences and are not additive.\n\n## Evidence boundary\nSafe core and Kelp rsETH contracts were not identified as the root cause; the module and helper path were. Truncated addresses and incomplete transactions are excluded from formal labels.\n\n## Current status\nKelp temporarily paused the receiving address; no recovery or protocol-level freeze was confirmed.\n\n## Addresses and transactions\nThe victim Safe, keeper helper, Yoink account and contract, rsETH receiver, and token contract are retained with roles." }, "category": "access-control", "severity": "critical", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 7730000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 2,900 rsETH，安全机构估计约 7.73M 至 7.81M USD；MEV 抢跑改变收益归属，不改变受害 Safe 资产被抽取事实。", "tw": "約 2,900 rsETH，安全機構估計約 7.73M 至 7.81M USD；MEV 搶跑改變收益歸屬，不改變受害 Safe 資產被抽取事實。", "en": "About 2,900 rsETH, estimated at $7.73 million to $7.81 million; the MEV front-run changed proceeds ownership but not the Safe asset extraction." }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0x40E93a52F6Af9fCD3b476aeDADD7FeABD9f7AbA8", "entity": { "zh": "受害 Safe 钱包", "tw": "受害 Safe 錢包", "en": "Victim Safe wallet" }, "role": "victim", "category": "stolen_funds", "confidence": 0.95, "sourceUrl": "https://x.com/PeckShieldAlert/status/2099740493165068581", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "安全机构将该地址列为受害 Safe 钱包。", "tw": "安全機構將該地址列為受害 Safe 錢包。", "en": "Security researchers identify this address as the victim Safe wallet." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x4f0055926c839d1d960a82cbf84e2ee933958ebc", "entity": { "zh": "Safe keeper multicall / helper", "tw": "Safe keeper multicall / helper", "en": "Safe keeper multicall / helper" }, "role": "affected-contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/PeckShieldAlert/status/2099740493165068581", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该合约位于受影响授权路径，不是攻击者地址。", "tw": "該合約位於受影響授權路徑，不是攻擊者地址。", "en": "This contract is in the affected authorization path, not an attacker address." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xFDe0d1575Ed8E06FBf36256bcdfA1F359281455A", "entity": { "zh": "Yoink 外部账户", "tw": "Yoink 外部賬戶", "en": "Yoink external account" }, "role": "mev-actor", "category": "unknown", "confidence": 0.7, "sourceUrl": "https://x.com/blockaid_/status/2100226319711719532", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址与 MEV 抢跑收益路径关联，最终归因未完全确认。", "tw": "該地址與 MEV 搶跑收益路徑關聯，最終歸因未完全確認。", "en": "This address is linked to the MEV front-run proceeds route; final attribution is unconfirmed." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x80BF7Db69556D9521c03461978B8fC731DBBD4e4", "entity": { "zh": "Yoink 机器人合约", "tw": "Yoink 機器人合約", "en": "Yoink bot contract" }, "role": "mev-contract", "category": "service", "confidence": 0.76, "sourceUrl": "https://x.com/blockaid_/status/2100226319711719532", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址参与抢跑执行路径，不直接等于原始攻击者。", "tw": "該地址參與搶跑執行路徑，不直接等於原始攻擊者。", "en": "This address participated in the front-run execution path and is not necessarily the original attacker." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xC70f00CD7E461686b04B0E912E309becA8b80ea0", "entity": { "zh": "rsETH 接收地址", "tw": "rsETH 接收地址", "en": "rsETH receiving address" }, "role": "stolen-funds-destination", "category": "stolen_funds", "confidence": 0.84, "sourceUrl": "https://x.com/PeckShieldAlert/status/2099740493165068581", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址接收受害 Safe 资产，并被 Kelp 临时暂停。", "tw": "該地址接收受害 Safe 資產，並被 Kelp 臨時暫停。", "en": "This address received assets from the victim Safe and was temporarily paused by Kelp." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xa1290d69c65a6fe4df752f95823fae25cb99e5a7", "entity": { "zh": "rsETH Token 合约", "tw": "rsETH Token 合約", "en": "rsETH token contract" }, "role": "contract", "category": "unknown", "confidence": 0.94, "sourceUrl": "https://x.com/PeckShieldAlert/status/2099740493165068581", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址是受影响资产 Token 合约，不是攻击者地址。", "tw": "該地址是受影響資產 Token 合約，不是攻擊者地址。", "en": "This is the affected asset token contract, not an attacker address." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "PeckShield Safe / rsETH 告警", "tw": "PeckShield Safe / rsETH 告警", "en": "PeckShield Safe / rsETH alert" }, "url": "https://x.com/PeckShieldAlert/status/2099740493165068581", "type": "research" }, { "label": { "zh": "PeckShield 资金位置更新", "tw": "PeckShield 資金位置更新", "en": "PeckShield fund-location update" }, "url": "https://x.com/PeckShieldAlert/status/2099744390143217951", "type": "research" }, { "label": { "zh": "CoinDesk 事件说明", "tw": "CoinDesk 事件說明", "en": "CoinDesk incident report" }, "url": "https://www.coindesk.com/business/2026/09/15/how-a-simple-coding-mistake-let-a-hacker-drain-usd7-8-million-from-a-crypto-wallet", "type": "research" }, { "label": { "zh": "Blockaid 地址线索", "tw": "Blockaid 地址線索", "en": "Blockaid address lead" }, "url": "https://x.com/blockaid_/status/2100226319711719532", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-315", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-331", "status": "verified", "incidentDate": "2026-09-14", "datePrecision": "day", "title": { "zh": "Long Bridge 第三方 RPC 伪造提现事件", "tw": "Long Bridge 第三方 RPC 偽造提現事件", "en": "Long Bridge forged-withdrawal event through third-party RPC" }, "summary": { "zh": "第三方 RPC 向 keeper 推送伪造 Arc 提现事件，金库多付 46.7928 WETH；项目暂停 keeper 并补满金库，用户未亏损。", "tw": "第三方 RPC 向 keeper 推送偽造 Arc 提現事件，金庫多付 46.7928 WETH；項目暫停 keeper 並補滿金庫，用戶未虧損。", "en": "A third-party RPC pushed a forged Arc withdrawal event to a keeper, causing a 46.7928 WETH overpayment. The project paused the keeper and refilled the vault, with no user loss." }, "details": { "zh": "## 事件背景\n第三方 RPC 向 keeper 推送伪造 Arc 提现事件，金库多付 46.7928 WETH；项目暂停 keeper 并补满金库，用户未亏损。\n\n## 事件经过\n伪造提现事件、keeper 多付 WETH、暂停 keeper、重建校验并补满金库。\n\n## 资金流向\nSlowMist 记录支持相应攻击或异常处置路径；完整地址和交易集合未全部公开。\n\n## 金额口径\n金库多付约 118,000 USD 等值 WETH；用户未亏损。\n\n## 证据边界\n该条目来自 SlowMist Hacked Zone 的窗口内记录，后续项目复盘、地址和追回状态可能继续更新。\n\n## 处置状态\n截至核验点没有完整公开追回或赔付账本。\n\n## 地址与交易\n公开来源未提供完整标识符，不进行补写。", "tw": "## 事件背景\n第三方 RPC 向 keeper 推送偽造 Arc 提現事件，金庫多付 46.7928 WETH；項目暫停 keeper 並補滿金庫，用戶未虧損。\n\n## 事件經過\n偽造提現事件、keeper 多付 WETH、暫停 keeper、重建校驗並補滿金庫。\n\n## 資金流向\nSlowMist 記錄支持相應攻擊或異常處置路徑；完整地址和交易集合未全部公開。\n\n## 金額口徑\n金庫多付約 118,000 USD 等值 WETH；用戶未虧損。\n\n## 證據邊界\n該條目來自 SlowMist Hacked Zone 的窗口內記錄，後續項目復盤、地址和追回狀態可能繼續更新。\n\n## 處置狀態\n截至核驗點沒有完整公開追回或賠付賬本。\n\n## 地址與交易\n公開來源未提供完整標識符，不進行補寫。", "en": "## Incident overview\nA third-party RPC pushed a forged Arc withdrawal event to a keeper, causing a 46.7928 WETH overpayment. The project paused the keeper and refilled the vault, with no user loss.\n\n## Incident sequence\nForge the withdrawal event, trigger keeper overpayment, pause the keeper, rebuild validation, and refill the vault.\n\n## Fund flow\nThe SlowMist record supports the attack or disposition path, but complete addresses and transactions were not fully public.\n\n## Amount basis\nThe vault overpaid about $118,000 equivalent in WETH; users did not lose funds.\n\n## Evidence boundary\nThis item comes from the SlowMist Hacked Zone during the window; project postmortems, addresses, and recovery status may change.\n\n## Current status\nNo complete public recovery or compensation ledger was available at verification.\n\n## Addresses and transactions\nPublic sources did not provide complete identifiers, so none are filled in." }, "category": "supply-chain", "severity": "high", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": 118000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "金库多付约 118,000 USD 等值 WETH；用户未亏损。", "tw": "金庫多付約 118,000 USD 等值 WETH；用戶未虧損。", "en": "The vault overpaid about $118,000 equivalent in WETH; users did not lose funds." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "SlowMist Hacked 记录", "tw": "SlowMist Hacked 記錄", "en": "SlowMist Hacked record" }, "url": "https://hacked.slowmist.io/zh/?c=Bridge", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-331", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-330", "status": "verified", "incidentDate": "2026-09-14", "datePrecision": "day", "title": { "zh": "SpiralHookV2 现货价格操纵借贷", "tw": "SpiralHookV2 現貨價格操縱借貸", "en": "SpiralHookV2 spot-price manipulation borrowing exploit" }, "summary": { "zh": "SpiralHookV2 使用 slot0 估值且缺少 TWAP 和价格限制，攻击者用多个 EOA 绕过同块防护并借出约 10.7 ETH。", "tw": "SpiralHookV2 使用 slot0 估值且缺少 TWAP 和價格限制，攻擊者用多個 EOA 繞過同塊防護並借出約 10.7 ETH。", "en": "SpiralHookV2 used slot0 without TWAP or price limits; multiple EOAs bypassed the same-block guard and borrowed about 10.7 ETH." }, "details": { "zh": "## 事件背景\nSpiralHookV2 使用 slot0 估值且缺少 TWAP 和价格限制，攻击者用多个 EOA 绕过同块防护并借出约 10.7 ETH。\n\n## 事件经过\n操纵现货价格、绕过 tx.origin 同块限制、使用虚高抵押品借款。\n\n## 资金流向\nSlowMist 记录支持相应攻击或异常处置路径；完整地址和交易集合未全部公开。\n\n## 金额口径\n约 10.7 ETH，估值约 26,800 USD。\n\n## 证据边界\n该条目来自 SlowMist Hacked Zone 的窗口内记录，后续项目复盘、地址和追回状态可能继续更新。\n\n## 处置状态\n截至核验点没有完整公开追回或赔付账本。\n\n## 地址与交易\n公开来源未提供完整标识符，不进行补写。", "tw": "## 事件背景\nSpiralHookV2 使用 slot0 估值且缺少 TWAP 和價格限制，攻擊者用多個 EOA 繞過同塊防護並借出約 10.7 ETH。\n\n## 事件經過\n操縱現貨價格、繞過 tx.origin 同塊限制、使用虛高抵押品借款。\n\n## 資金流向\nSlowMist 記錄支持相應攻擊或異常處置路徑；完整地址和交易集合未全部公開。\n\n## 金額口徑\n約 10.7 ETH，估值約 26,800 USD。\n\n## 證據邊界\n該條目來自 SlowMist Hacked Zone 的窗口內記錄，後續項目復盤、地址和追回狀態可能繼續更新。\n\n## 處置狀態\n截至核驗點沒有完整公開追回或賠付賬本。\n\n## 地址與交易\n公開來源未提供完整標識符，不進行補寫。", "en": "## Incident overview\nSpiralHookV2 used slot0 without TWAP or price limits; multiple EOAs bypassed the same-block guard and borrowed about 10.7 ETH.\n\n## Incident sequence\nManipulate the spot price, bypass the tx.origin same-block guard, and borrow against inflated collateral.\n\n## Fund flow\nThe SlowMist record supports the attack or disposition path, but complete addresses and transactions were not fully public.\n\n## Amount basis\nAbout 10.7 ETH, valued near $26,800.\n\n## Evidence boundary\nThis item comes from the SlowMist Hacked Zone during the window; project postmortems, addresses, and recovery status may change.\n\n## Current status\nNo complete public recovery or compensation ledger was available at verification.\n\n## Addresses and transactions\nPublic sources did not provide complete identifiers, so none are filled in." }, "category": "oracle-manipulation", "severity": "high", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 26800, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 10.7 ETH，估值约 26,800 USD。", "tw": "約 10.7 ETH，估值約 26,800 USD。", "en": "About 10.7 ETH, valued near $26,800." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "SlowMist Hacked 记录", "tw": "SlowMist Hacked 記錄", "en": "SlowMist Hacked record" }, "url": "https://hacked.slowmist.io/zh/?c=ETH&page=1", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-330", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-314", "status": "verified", "incidentDate": "2026-09-13", "datePrecision": "day", "title": { "zh": "Optim Finance / Splash OADA 池流动性抽空", "tw": "Optim Finance / Splash OADA 池流動性抽空", "en": "Optim Finance / Splash OADA pool liquidity drain" }, "summary": { "zh": "Cardano 上 Optim / Splash 的 OADA 相关池被利用并暂停操作，攻击者随后清空其他 OADA 配对池。最终 ADA / OADA 数量未公开，不能把 TVL 当作损失。", "tw": "Cardano 上 Optim / Splash 的 OADA 相關池被利用並暫停操作，攻擊者隨後清空其他 OADA 配對池。最終 ADA / OADA 數量未公開，不能把 TVL 當作損失。", "en": "Optim / Splash OADA-related pools on Cardano were exploited and operations paused, after which other OADA pools were emptied. Final ADA / OADA quantities were not disclosed and TVL is not treated as loss." }, "details": { "zh": "## 事件背景\nOptim / Splash 的 OADA 相关交易池承担锚定和退出流动性，事件后多个配对池被暂停。\n\n## 事件经过\n1. 2026 年 9 月 13 日，项目确认 OADA 相关池被利用。\n2. 同一行为人随后移除其他 OADA 配对池流动性。\n3. 项目暂停相关操作并等待根因与地址复盘。\n\n## 资金流向\nOADA / ADA 相关池 → 攻击者控制路径；完整地址、交易和最终余额未公开。\n\n## 金额口径\n公开报道没有核验的最终 ADA / OADA 数量，Splash TVL 不能直接作为损失。\n\n## 证据边界\n项目公开暂停和事件报道支持池被利用，但根因、攻击地址和赔偿状态仍不完整。\n\n## 处置状态\n相关池和操作暂停，未确认追回。\n\n## 地址与交易\n没有可核验的完整地址或交易哈希。", "tw": "## 事件背景\nOptim / Splash 的 OADA 相關交易池承擔錨定和退出流動性，事件後多個配對池被暫停。\n\n## 事件經過\n1. 2026 年 9 月 13 日，項目確認 OADA 相關池被利用。\n2. 同一行為人隨後移除其他 OADA 配對池流動性。\n3. 項目暫停相關操作並等待根因與地址復盤。\n\n## 資金流向\nOADA / ADA 相關池 → 攻擊者控制路徑；完整地址、交易和最終餘額未公開。\n\n## 金額口徑\n公開報道沒有核驗的最終 ADA / OADA 數量，Splash TVL 不能直接作為損失。\n\n## 證據邊界\n項目公開暫停和事件報道支持池被利用，但根因、攻擊地址和賠償狀態仍不完整。\n\n## 處置狀態\n相關池和操作暫停，未確認追回。\n\n## 地址與交易\n沒有可核驗的完整地址或交易哈希。", "en": "## Incident overview\nOptim / Splash OADA pools provided peg and exit liquidity and were paused after the incident.\n\n## Incident sequence\n1. Optim confirmed an OADA-related pool exploit on September 13, 2026.\n2. The same actor then removed liquidity from other OADA pairs.\n3. The project paused related operations pending root-cause and address review.\n\n## Fund flow\nOADA / ADA pools → attacker route; complete addresses, transactions, and final balances were not disclosed.\n\n## Amount basis\nNo verified final ADA / OADA amount was public; Splash TVL is not loss.\n\n## Evidence boundary\nPublic pause notices and reporting support the pool event, but root cause, attacker address, and compensation remain incomplete.\n\n## Current status\nRelated pools and operations are paused; no recovery was confirmed.\n\n## Addresses and transactions\nNo complete verifiable address or transaction hash was published." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "Cardano" ], "chains": [ "Cardano" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开资料未给出可核的最终 ADA / OADA 损失金额。", "tw": "公開資料未給出可核的最終 ADA / OADA 損失金額。", "en": "Public sources did not provide a verifiable final ADA / OADA loss amount." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "Optim / Splash 事件报道", "tw": "Optim / Splash 事件報道", "en": "Optim / Splash incident report" }, "url": "https://cryptotimes.io/2026/09/13/optim-finance-pauses-oada-after-splash-pool-exploit-drains-cardano-liquidity", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-314", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-313", "status": "verified", "incidentDate": "2026-09-12", "datePrecision": "day", "title": { "zh": "Chainflip TRON USDT 双重支付攻击", "tw": "Chainflip TRON USDT 雙重支付攻擊", "en": "Chainflip TRON USDT duplicate-payout exploit" }, "summary": { "zh": "Chainflip 的 TRON USDT 存款识别把已处理存款和改变 memo 的请求重复识别，攻击者约 90 分钟内获得 6 笔未授权付款，合计 736,442.17 USDT。", "tw": "Chainflip 的 TRON USDT 存款識別把已處理存款和改變 memo 的請求重複識別，攻擊者約 90 分鐘內獲得 6 筆未授權付款，合計 736,442.17 USDT。", "en": "Chainflip's TRON USDT deposit handling treated memo-modified requests as new swaps, producing six unauthorized payouts totaling 736,442.17 USDT over about 90 minutes." }, "details": { "zh": "## 事件背景\nChainflip 的 TRON USDT 集成把已处理的存款与改变 memo 的请求重复识别为新的失败兑换。\n\n## 事件经过\n1. 2026 年 9 月 12 日，攻击持续约 90 分钟。\n2. 攻击者重复触发同一存款的 payout 路径，8 次尝试中 6 次成功。\n3. 网络随后暂停并部署修复，9 月 18 日恢复全部功能。\n\n## 资金流向\nTRON USDT 存款 → Chainflip vault payout → 跨链兑换结算；完整接收地址和交易未公开。\n\n## 金额口径\n736,442.17 USDT 是未授权付款总额；115,654.41 USDT 留在金库，不计入损失。\n\n## 证据边界\nChainflip 官方更新、补偿提案和技术报道支持重复支付机制；没有私钥被盗证据。\n\n## 处置状态\n网络曾暂停，随后修复并恢复；节点运营商通过提案补偿受影响 LP。\n\n## 地址与交易\n公开更新没有提供完整攻击地址或交易哈希。", "tw": "## 事件背景\nChainflip 的 TRON USDT 集成把已處理的存款與改變 memo 的請求重複識別為新的失敗兌換。\n\n## 事件經過\n1. 2026 年 9 月 12 日，攻擊持續約 90 分鐘。\n2. 攻擊者重複觸發同一存款的 payout 路徑，8 次嘗試中 6 次成功。\n3. 網絡隨後暫停並部署修復，9 月 18 日恢復全部功能。\n\n## 資金流向\nTRON USDT 存款 → Chainflip vault payout → 跨鏈兌換結算；完整接收地址和交易未公開。\n\n## 金額口徑\n736,442.17 USDT 是未授權付款總額；115,654.41 USDT 留在金庫，不計入損失。\n\n## 證據邊界\nChainflip 官方更新、補償提案和技術報道支持重複支付機制；沒有私鑰被盜證據。\n\n## 處置狀態\n網絡曾暫停，隨後修復並恢復；節點運營商通過提案補償受影響 LP。\n\n## 地址與交易\n公開更新沒有提供完整攻擊地址或交易哈希。", "en": "## Incident overview\nChainflip's TRON USDT integration treated an already processed deposit with a modified memo as a new failed swap.\n\n## Incident sequence\n1. The attack lasted about 90 minutes on September 12, 2026.\n2. The attacker repeatedly triggered the same deposit payout path; six of eight attempts succeeded.\n3. The network paused and deployed a fix, restoring all functions on September 18.\n\n## Fund flow\nTRON USDT deposit → Chainflip vault payout → cross-chain settlement; complete receivers and transactions were not published.\n\n## Amount basis\nThe unauthorized payouts totaled 736,442.17 USDT; 115,654.41 USDT remained safely in the vault and is excluded.\n\n## Evidence boundary\nChainflip updates, the compensation proposal, and technical reporting support the duplicate-payout mechanism; no private-key compromise was evidenced.\n\n## Current status\nThe network paused and later recovered after a fix; node operators approved compensation for affected LPs.\n\n## Addresses and transactions\nPublic updates did not provide a complete attacker address or transaction hash." }, "category": "bridge-exploit", "severity": "critical", "ecosystems": [ "TRON", "Other" ], "chains": [ "TRON", "Other" ], "lossUsd": 736442.17, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 736,442.17 USDT 被取出；另有 115,654.41 USDT 用户兑换留在金库，未计入损失。", "tw": "約 736,442.17 USDT 被取出；另有 115,654.41 USDT 用戶兌換留在金庫，未計入損失。", "en": "About 736,442.17 USDT was paid out; another 115,654.41 USDT user swap remained in the vault and is not counted as loss." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "Chainflip 恢复更新", "tw": "Chainflip 恢復更新", "en": "Chainflip recovery update" }, "url": "https://x.com/Chainflip/status/2100971274998800564", "type": "official" }, { "label": { "zh": "Chainflip LP 补偿提案", "tw": "Chainflip LP 補償提案", "en": "Chainflip LP compensation proposal" }, "url": "https://x.com/Chainflip/status/2100871539746881799", "type": "official" }, { "label": { "zh": "Chainflip 技术报道", "tw": "Chainflip 技術報道", "en": "Chainflip technical report" }, "url": "https://mainstreamcryptonews.com/chainflip-loses-736k-in-usdt-after-tron-exploit-triggers-double-payouts", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-313", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-325", "status": "verified", "incidentDate": "2026-09-11", "datePrecision": "day", "title": { "zh": "ORBToken 免税抛售与 LP 销毁漏洞", "tw": "ORBToken 免稅拋售與 LP 銷燬漏洞", "en": "ORBToken tax-free sell and LP-burn exploit" }, "summary": { "zh": "ORBToken 的自动授权、免税白名单和缺少重入保护被组合利用，攻击者销毁 LP、同步储备并抽取约 32,610.72 USD。", "tw": "ORBToken 的自動授權、免稅白名單和缺少重入保護被組合利用，攻擊者銷燬 LP、同步儲備並抽取約 32,610.72 USD。", "en": "ORBToken automatic allowance, tax-exempt whitelist, and missing reentrancy protection were combined to burn LP, sync reserves, and extract about $32,610.72." }, "details": { "zh": "## 事件背景\nORBToken 的自动授权、免税白名单和缺少重入保护被组合利用，攻击者销毁 LP、同步储备并抽取约 32,610.72 USD。\n\n## 事件经过\n自动授权 → 免税卖出 → burnLP 销毁 LP → sync 操纵储备并获利。\n\n## 资金流向\nSlowMist 记录支持相应攻击或异常处置路径；完整地址和交易集合未全部公开。\n\n## 金额口径\n约 32,610.72 USD。\n\n## 证据边界\n该条目来自 SlowMist Hacked Zone 的窗口内记录，后续项目复盘、地址和追回状态可能继续更新。\n\n## 处置状态\n截至核验点没有完整公开追回或赔付账本。\n\n## 地址与交易\n公开来源未提供完整标识符，不进行补写。", "tw": "## 事件背景\nORBToken 的自動授權、免稅白名單和缺少重入保護被組合利用，攻擊者銷燬 LP、同步儲備並抽取約 32,610.72 USD。\n\n## 事件經過\n自動授權 → 免稅賣出 → burnLP 銷燬 LP → sync 操縱儲備並獲利。\n\n## 資金流向\nSlowMist 記錄支持相應攻擊或異常處置路徑；完整地址和交易集合未全部公開。\n\n## 金額口徑\n約 32,610.72 USD。\n\n## 證據邊界\n該條目來自 SlowMist Hacked Zone 的窗口內記錄，後續項目復盤、地址和追回狀態可能繼續更新。\n\n## 處置狀態\n截至核驗點沒有完整公開追回或賠付賬本。\n\n## 地址與交易\n公開來源未提供完整標識符，不進行補寫。", "en": "## Incident overview\nORBToken automatic allowance, tax-exempt whitelist, and missing reentrancy protection were combined to burn LP, sync reserves, and extract about $32,610.72.\n\n## Incident sequence\nAutomatic allowance → tax-free selling → burnLP removes LP → sync manipulates reserves for profit.\n\n## Fund flow\nThe SlowMist record supports the attack or disposition path, but complete addresses and transactions were not fully public.\n\n## Amount basis\nAbout $32,610.72.\n\n## Evidence boundary\nThis item comes from the SlowMist Hacked Zone during the window; project postmortems, addresses, and recovery status may change.\n\n## Current status\nNo complete public recovery or compensation ledger was available at verification.\n\n## Addresses and transactions\nPublic sources did not provide complete identifiers, so none are filled in." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 32610.72, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 32,610.72 USD。", "tw": "約 32,610.72 USD。", "en": "About $32,610.72." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "SlowMist Hacked 记录", "tw": "SlowMist Hacked 記錄", "en": "SlowMist Hacked record" }, "url": "https://hacked.slowmist.io/zh/?page=1", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-325", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-324", "status": "verified", "incidentDate": "2026-09-11", "datePrecision": "day", "title": { "zh": "Dominion Market SILV 金库多签失陷", "tw": "Dominion Market SILV 金庫多籤失陷", "en": "Dominion Market SILV treasury multisig compromise" }, "summary": { "zh": "攻击者掌握 3/5 多签后清空 SILV 金库并抛售约 46,909 枚 SILV，实际套现约 238,000 USD。", "tw": "攻擊者掌握 3/5 多籤後清空 SILV 金庫並拋售約 46,909 枚 SILV，實際套現約 238,000 USD。", "en": "The attacker obtained 3 of 5 SILV treasury signatures, emptied the treasury, and sold about 46,909 SILV, realizing about $238,000." }, "details": { "zh": "## 事件背景\n攻击者掌握 3/5 多签后清空 SILV 金库并抛售约 46,909 枚 SILV，实际套现约 238,000 USD。\n\n## 事件经过\n控制多签、提取金库和抵押 SILV，向浅薄池抛售并造成脱锚；项目撤流动性并计划退款。\n\n## 资金流向\nSlowMist 记录支持相应攻击或异常处置路径；完整地址和交易集合未全部公开。\n\n## 金额口径\n实际套现约 238,000 USD；代币面值约 3M USD 不作为额外损失。\n\n## 证据边界\n该条目来自 SlowMist Hacked Zone 的窗口内记录，后续项目复盘、地址和追回状态可能继续更新。\n\n## 处置状态\n截至核验点没有完整公开追回或赔付账本。\n\n## 地址与交易\n公开来源未提供完整标识符，不进行补写。", "tw": "## 事件背景\n攻擊者掌握 3/5 多籤後清空 SILV 金庫並拋售約 46,909 枚 SILV，實際套現約 238,000 USD。\n\n## 事件經過\n控制多籤、提取金庫和抵押 SILV，向淺薄池拋售並造成脫錨；項目撤流動性並計劃退款。\n\n## 資金流向\nSlowMist 記錄支持相應攻擊或異常處置路徑；完整地址和交易集合未全部公開。\n\n## 金額口徑\n實際套現約 238,000 USD；代幣面值約 3M USD 不作為額外損失。\n\n## 證據邊界\n該條目來自 SlowMist Hacked Zone 的窗口內記錄，後續項目復盤、地址和追回狀態可能繼續更新。\n\n## 處置狀態\n截至核驗點沒有完整公開追回或賠付賬本。\n\n## 地址與交易\n公開來源未提供完整標識符，不進行補寫。", "en": "## Incident overview\nThe attacker obtained 3 of 5 SILV treasury signatures, emptied the treasury, and sold about 46,909 SILV, realizing about $238,000.\n\n## Incident sequence\nThe multisig and collateral SILV were drained, dumped into thin pools, and depegged; the team removed liquidity and planned refunds.\n\n## Fund flow\nThe SlowMist record supports the attack or disposition path, but complete addresses and transactions were not fully public.\n\n## Amount basis\nAbout $238,000 realized; the roughly $3 million token face value is not additional loss.\n\n## Evidence boundary\nThis item comes from the SlowMist Hacked Zone during the window; project postmortems, addresses, and recovery status may change.\n\n## Current status\nNo complete public recovery or compensation ledger was available at verification.\n\n## Addresses and transactions\nPublic sources did not provide complete identifiers, so none are filled in." }, "category": "key-compromise", "severity": "high", "ecosystems": [ "Solana" ], "chains": [ "Solana" ], "lossUsd": 238000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "实际套现约 238,000 USD；代币面值约 3M USD 不作为额外损失。", "tw": "實際套現約 238,000 USD；代幣面值約 3M USD 不作為額外損失。", "en": "About $238,000 realized; the roughly $3 million token face value is not additional loss." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "SlowMist Hacked 记录", "tw": "SlowMist Hacked 記錄", "en": "SlowMist Hacked record" }, "url": "https://hacked.slowmist.io/zh/?c=Solana", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-324", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-323", "status": "verified", "incidentDate": "2026-09-11", "datePrecision": "day", "title": { "zh": "ether.fi Liquid AtomicQueue 授权盗币", "tw": "ether.fi Liquid AtomicQueue 授權盜幣", "en": "ether.fi Liquid AtomicQueue authorization theft" }, "summary": { "zh": "AtomicQueue.solve() 对调用方传入 solver 参数缺少访问控制，约 11 名用户的既有 ERC-20 授权被利用，损失约 15.45 ETH。", "tw": "AtomicQueue.solve() 對調用方傳入 solver 參數缺少訪問控制，約 11 名用戶的既有 ERC-20 授權被利用，損失約 15.45 ETH。", "en": "Missing access control on the caller-supplied solver parameter in AtomicQueue.solve() let an attacker use existing ERC-20 allowances from about 11 users, losing about 15.45 ETH." }, "details": { "zh": "## 事件背景\nAtomicQueue.solve() 对调用方传入 solver 参数缺少访问控制，约 11 名用户的既有 ERC-20 授权被利用，损失约 15.45 ETH。\n\n## 事件经过\n构造恶意 AtomicRequest，将已授权用户指定为 solver，再通过 transferFrom 转走资金。\n\n## 资金流向\nSlowMist 记录支持相应攻击或异常处置路径；完整地址和交易集合未全部公开。\n\n## 金额口径\n约 15.45 ETH，SlowMist 估值约 38,130 USD。\n\n## 证据边界\n该条目来自 SlowMist Hacked Zone 的窗口内记录，后续项目复盘、地址和追回状态可能继续更新。\n\n## 处置状态\n截至核验点没有完整公开追回或赔付账本。\n\n## 地址与交易\n公开来源未提供完整标识符，不进行补写。", "tw": "## 事件背景\nAtomicQueue.solve() 對調用方傳入 solver 參數缺少訪問控制，約 11 名用戶的既有 ERC-20 授權被利用，損失約 15.45 ETH。\n\n## 事件經過\n構造惡意 AtomicRequest，將已授權用戶指定為 solver，再通過 transferFrom 轉走資金。\n\n## 資金流向\nSlowMist 記錄支持相應攻擊或異常處置路徑；完整地址和交易集合未全部公開。\n\n## 金額口徑\n約 15.45 ETH，SlowMist 估值約 38,130 USD。\n\n## 證據邊界\n該條目來自 SlowMist Hacked Zone 的窗口內記錄，後續項目復盤、地址和追回狀態可能繼續更新。\n\n## 處置狀態\n截至核驗點沒有完整公開追回或賠付賬本。\n\n## 地址與交易\n公開來源未提供完整標識符，不進行補寫。", "en": "## Incident overview\nMissing access control on the caller-supplied solver parameter in AtomicQueue.solve() let an attacker use existing ERC-20 allowances from about 11 users, losing about 15.45 ETH.\n\n## Incident sequence\nA malicious AtomicRequest forced approved users into the solver role, then transferFrom drained their funds.\n\n## Fund flow\nThe SlowMist record supports the attack or disposition path, but complete addresses and transactions were not fully public.\n\n## Amount basis\nAbout 15.45 ETH, valued near $38,130 by SlowMist.\n\n## Evidence boundary\nThis item comes from the SlowMist Hacked Zone during the window; project postmortems, addresses, and recovery status may change.\n\n## Current status\nNo complete public recovery or compensation ledger was available at verification.\n\n## Addresses and transactions\nPublic sources did not provide complete identifiers, so none are filled in." }, "category": "phishing-approval", "severity": "high", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 38130, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 15.45 ETH，SlowMist 估值约 38,130 USD。", "tw": "約 15.45 ETH，SlowMist 估值約 38,130 USD。", "en": "About 15.45 ETH, valued near $38,130 by SlowMist." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "SlowMist Hacked 记录", "tw": "SlowMist Hacked 記錄", "en": "SlowMist Hacked record" }, "url": "https://hacked.slowmist.io/zh/?page=1", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-323", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-304", "status": "verified", "incidentDate": "2026-09-11", "datePrecision": "day", "title": { "zh": "Symbiosis Finance syBTC BridgeV2 异常铸币", "tw": "Symbiosis Finance syBTC BridgeV2 異常鑄幣", "en": "Symbiosis Finance syBTC BridgeV2 unauthorized mint exploit" }, "summary": { "zh": "Symbiosis BridgeV2 接收路径接受异常消息并铸造约 2^62 raw syBTC，攻击者随后在 Ethereum 出售约 4.39 WBTC，实现收益约 336,000 USD。", "tw": "Symbiosis BridgeV2 接收路徑接受異常消息並鑄造約 2^62 raw syBTC，攻擊者隨後在 Ethereum 出售約 4.39 WBTC，實現收益約 336,000 USD。", "en": "Symbiosis BridgeV2 accepted an abnormal message and minted about 2^62 raw syBTC. The beneficiary then sold about 4.39 WBTC on Ethereum, realizing roughly $336,000." }, "details": { "zh": "## 事件背景\nSymbiosis BridgeV2 的签名接收路径接受了异常消息。公开资料尚未确认是签名验证失效、重放还是边界检查缺失。\n\n## 事件经过\n1. 2026 年 9 月 11 日 12:28:48，攻击路径调用 BNB Chain BridgeV2 接收流程。\n2. 新地址获得约 2^62 raw syBTC 的异常铸造。\n3. 同一受益人在 Ethereum Uniswap V4 出售约 4.39 WBTC。\n4. Symbiosis 暂停 Bitcoin 相关 swap 并部署更新。\n\n## 资金流向\nBNB Chain 异常 syBTC → 跨链受益路径 → Ethereum WBTC 出售；示例攻击交易已成功上链。\n\n## 金额口径\n约 4.39 WBTC、约 336,000 USD 是已实现收益口径；约 2^62 raw syBTC 是 8 位小数下的名义数量，不能当作现金损失。\n\n## 证据边界\nBlockaid 两条告警和 BNB Chain 示例交易支持异常铸币与受益地址；完整 Ethereum 出售交易和签名验证根因仍待技术复盘。\n\n## 处置状态\nBitcoin 相关 swap 已暂停或维护，团队部署更新；未确认追回。\n\n## 地址与交易\n攻击者 / 受益地址、syBTC Token、BridgeV2 交互合约均保留为相关地址，交易哈希放入来源引用。\n\n## 2026 年 9 月 11 日后续复盘\n后续 SlowMist / Hacked Zone 复盘把总损失口径更新为用户与 LP 合计约 9.97 BTC，约 15.2 BTC 被转入储备地址，项目提出 20% 白帽赏金。原记录采用约 4.39 WBTC、约 336,000 USD 的已实现口径，保留两种语义，不重复相加。\n", "tw": "## 事件背景\nSymbiosis BridgeV2 的簽名接收路徑接受了異常消息。公開資料尚未確認是簽名驗證失效、重放還是邊界檢查缺失。\n\n## 事件經過\n1. 2026 年 9 月 11 日 12:28:48，攻擊路徑調用 BNB Chain BridgeV2 接收流程。\n2. 新地址獲得約 2^62 raw syBTC 的異常鑄造。\n3. 同一受益人在 Ethereum Uniswap V4 出售約 4.39 WBTC。\n4. Symbiosis 暫停 Bitcoin 相關 swap 並部署更新。\n\n## 資金流向\nBNB Chain 異常 syBTC → 跨鏈受益路徑 → Ethereum WBTC 出售；示例攻擊交易已成功上鍊。\n\n## 金額口徑\n約 4.39 WBTC、約 336,000 USD 是已實現收益口徑；約 2^62 raw syBTC 是 8 位小數下的名義數量，不能當作現金損失。\n\n## 證據邊界\nBlockaid 兩條告警和 BNB Chain 示例交易支持異常鑄幣與受益地址；完整 Ethereum 出售交易和簽名驗證根因仍待技術復盤。\n\n## 處置狀態\nBitcoin 相關 swap 已暫停或維護，團隊部署更新；未確認追回。\n\n## 地址與交易\n攻擊者 / 受益地址、syBTC Token、BridgeV2 交互合約均保留為相關地址，交易哈希放入來源引用。\n\n## 2026 年 9 月 11 日後續復盤\n後續 SlowMist / Hacked Zone 復盤把總損失口徑更新為用戶與 LP 合計約 9.97 BTC，約 15.2 BTC 被轉入儲備地址，項目提出 20% 白帽賞金。原記錄採用約 4.39 WBTC、約 336,000 USD 的已實現口徑，保留兩種語義，不重複相加。\n", "en": "## Incident overview\nThe Symbiosis BridgeV2 signed-receive path accepted an abnormal message. Public material has not established whether signature validation failed, a replay occurred, or a boundary check was missing.\n\n## Incident sequence\n1. At 12:28:48 Beijing time on September 11, 2026, the path called the BNB Chain BridgeV2 receive flow.\n2. A new address received an abnormal mint of about 2^62 raw syBTC.\n3. The same beneficiary sold about 4.39 WBTC on Ethereum Uniswap V4.\n4. Symbiosis paused Bitcoin-related swaps and deployed an update.\n\n## Fund flow\nAbnormal BNB Chain syBTC → cross-chain beneficiary path → WBTC sale on Ethereum; the example attack transaction succeeded on-chain.\n\n## Amount basis\nAbout 4.39 WBTC, valued near $336,000, is the realized basis. The roughly 2^62 raw syBTC is an 8-decimal nominal quantity and is not cash loss.\n\n## Evidence boundary\nTwo Blockaid alerts and the BNB Chain example transaction support the mint and beneficiary address. The complete Ethereum sale and signature-validation root cause await technical review.\n\n## Current status\nBitcoin-related swaps are paused or under maintenance while the team deploys an update; no recovery was confirmed.\n\n## Addresses and transactions\nThe attacker / beneficiary, syBTC token, and BridgeV2 interaction contract are retained as related addresses; transaction hashes remain in the references.\n\n## Follow-up review on September 11, 2026\nThe later SlowMist / Hacked Zone review updated total user and LP loss to about 9.97 BTC, noted about 15.2 BTC evacuated to reserve addresses, and described a 20% white-hat bounty. The record keeps the realized basis of about 4.39 WBTC and $336,000; the figures are not added together.\n" }, "category": "bridge-exploit", "severity": "critical", "ecosystems": [ "BNB Chain", "Ethereum" ], "chains": [ "BNB Chain", "Ethereum" ], "lossUsd": 336000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 4.39 WBTC，已实现口径约 336,000 USD；2^62 raw syBTC 是异常名义铸币量，不重复计入。", "tw": "約 4.39 WBTC，已實現口徑約 336,000 USD；2^62 raw syBTC 是異常名義鑄幣量，不重複計入。", "en": "About 4.39 WBTC was realized, valued near $336,000; the 2^62 raw syBTC is a nominal mint amount and is not added again." }, "addressDisclosure": "published", "addresses": [ { "chain": "BNB Chain", "address": "0x025122b60470EEe9e7947fbD922FE0d35F5d3Ba2", "entity": { "zh": "Symbiosis syBTC BridgeV2 攻击者 / 受益地址", "tw": "Symbiosis syBTC BridgeV2 攻擊者 / 受益地址", "en": "Symbiosis syBTC BridgeV2 attacker / beneficiary" }, "role": "attacker", "category": "hack", "confidence": 0.84, "sourceUrl": "https://x.com/blockaid_/status/2098275381417513149", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Blockaid 将该地址与异常铸币和跨链受益路径关联。", "tw": "Blockaid 將該地址與異常鑄幣和跨鏈受益路徑關聯。", "en": "Blockaid links this address to the abnormal mint and beneficiary route." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xA67c48F86Fc6d0176Dca38883CA8153C76a532c7", "entity": { "zh": "Symbiosis syBTC Token 合约", "tw": "Symbiosis syBTC Token 合約", "en": "Symbiosis syBTC token contract" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/blockaid_/status/2098275381417513149", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址是异常铸造涉及的 syBTC Token 合约，不是攻击者地址。", "tw": "該地址是異常鑄造涉及的 syBTC Token 合約，不是攻擊者地址。", "en": "This is the syBTC token contract involved in the abnormal mint, not an attacker address." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xb8f275fbf7a959f4bce59999a2ef122a099e81a8", "entity": { "zh": "Symbiosis BridgeV2 交互合约", "tw": "Symbiosis BridgeV2 交互合約", "en": "Symbiosis BridgeV2 interaction contract" }, "role": "contract", "category": "unknown", "confidence": 0.72, "sourceUrl": "https://bscscan.com/tx/0x9a2bc0ac8112131d664096a66e50e44c3580a2c20b629c963421abf821b9b959", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址是示例攻击交易的交互合约，具体角色待项目确认。", "tw": "該地址是示例攻擊交易的交互合約，具體角色待項目確認。", "en": "This address is the interaction contract in the example attack transaction; its exact role awaits project confirmation." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "Blockaid Symbiosis 首次告警", "tw": "Blockaid Symbiosis 首次告警", "en": "Blockaid initial Symbiosis alert" }, "url": "https://x.com/blockaid_/status/2098275381417513149", "type": "research" }, { "label": { "zh": "Blockaid Symbiosis 后续告警", "tw": "Blockaid Symbiosis 後續告警", "en": "Blockaid follow-up Symbiosis alert" }, "url": "https://x.com/blockaid_/status/2098275453035315642", "type": "research" }, { "label": { "zh": "Symbiosis BNB Chain 示例交易", "tw": "Symbiosis BNB Chain 示例交易", "en": "Symbiosis BNB Chain example transaction" }, "url": "https://bscscan.com/tx/0x9a2bc0ac8112131d664096a66e50e44c3580a2c20b629c963421abf821b9b959", "type": "explorer" }, { "label": { "zh": "SlowMist Symbiosis 后续复盘", "tw": "SlowMist Symbiosis 後續復盤", "en": "SlowMist Symbiosis follow-up" }, "url": "https://hacked.slowmist.io/zh/?c=Bridge", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-304", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-303", "status": "verified", "incidentDate": "2026-09-11", "datePrecision": "day", "title": { "zh": "OMNI404 / O404 ERC-404 混合代币记账漏洞", "tw": "OMNI404 / O404 ERC-404 混合代幣記賬漏洞", "en": "OMNI404 / O404 ERC-404 accounting exploit" }, "summary": { "zh": "OMNI404 的 ERC-20 / ERC-721 混合转账记账没有一致处理小额 tokenId 与固定单位转移，攻击者循环制造余额错位并抽取 WETH。SlowMist 主口径为 2.4 WETH。", "tw": "OMNI404 的 ERC-20 / ERC-721 混合轉賬記賬沒有一致處理小額 tokenId 與固定單位轉移，攻擊者循環制造餘額錯位並抽取 WETH。SlowMist 主口徑為 2.4 WETH。", "en": "OMNI404 accounting handled small tokenId values and fixed-unit transfers inconsistently across its ERC-20 / ERC-721 hybrid logic. The attacker looped the mismatch to extract WETH; SlowMist's primary basis was 2.4 WETH." }, "details": { "zh": "## 事件背景\nOMNI404 同时实现 ERC-20 和 ERC-721 语义。`_transfer()` 通过整数余额差推导 NFT 铸销，`transfer(address,uint256)` 又把小数值解释为 tokenId，形成记账边界。\n\n## 事件经过\n1. 2026 年 9 月 11 日，攻击者利用混合接口的参数语义差异。\n2. 固定单位的 ERC-20 转移与 NFT 铸销计数不同步。\n3. 攻击者循环制造 ERC-20 / NFT 余额错位，并把差额转换为 WETH。\n\n## 资金流向\nOMNI404 / WETH 流动性池 → 攻击者路径；完整攻击交易和地址未从公开告警中恢复。\n\n## 金额口径\nSlowMist 估计约 2.4 WETH，另一独立告警约 3.02 ETH；两种资产口径不相加，且没有可靠美元估值。\n\n## 证据边界\nSlowMist 技术告警支持记账缺陷和主要资产口径；项目方复盘、攻击者地址、池地址和完整交易仍未公开。\n\n## 处置状态\n截至截止时没有项目方修复、冻结、追回或赔付公告。\n\n## 地址与交易\n公开来源没有提供可核验的完整地址或交易哈希。\n\n## 2026 年 9 月 11 日 SlowMist 更新\nSlowMist Hacked Zone 进一步给出约 5,923 USD 的估值，并补充 exact-output 小额兑换和池内 wei 级记账差异。另一告警的约 3.02 ETH 仍作为不同估值保留。\n", "tw": "## 事件背景\nOMNI404 同時實現 ERC-20 和 ERC-721 語義。`_transfer()` 通過整數餘額差推導 NFT 鑄銷，`transfer(address,uint256)` 又把小數值解釋為 tokenId，形成記賬邊界。\n\n## 事件經過\n1. 2026 年 9 月 11 日，攻擊者利用混合接口的參數語義差異。\n2. 固定單位的 ERC-20 轉移與 NFT 鑄銷計數不同步。\n3. 攻擊者循環制造 ERC-20 / NFT 餘額錯位，並把差額轉換為 WETH。\n\n## 資金流向\nOMNI404 / WETH 流動性池 → 攻擊者路徑；完整攻擊交易和地址未從公開告警中恢復。\n\n## 金額口徑\nSlowMist 估計約 2.4 WETH，另一獨立告警約 3.02 ETH；兩種資產口徑不相加，且沒有可靠美元估值。\n\n## 證據邊界\nSlowMist 技術告警支持記賬缺陷和主要資產口徑；項目方復盤、攻擊者地址、池地址和完整交易仍未公開。\n\n## 處置狀態\n截至截止時沒有項目方修復、凍結、追回或賠付公告。\n\n## 地址與交易\n公開來源沒有提供可核驗的完整地址或交易哈希。\n\n## 2026 年 9 月 11 日 SlowMist 更新\nSlowMist Hacked Zone 進一步給出約 5,923 USD 的估值，並補充 exact-output 小額兌換和池內 wei 級記賬差異。另一告警的約 3.02 ETH 仍作為不同估值保留。\n", "en": "## Incident overview\nOMNI404 combined ERC-20 and ERC-721 semantics. `_transfer()` derived NFT mint or burn counts from integer balance differences, while `transfer(address,uint256)` treated small values as token IDs, creating an accounting boundary.\n\n## Incident sequence\n1. On September 11, 2026, the attacker exploited the parameter semantics of the hybrid interface.\n2. Fixed-unit ERC-20 transfers and NFT mint or burn counts diverged.\n3. The attacker looped the ERC-20 / NFT mismatch and converted the difference into WETH.\n\n## Fund flow\nOMNI404 / WETH liquidity pool → attacker route; the complete attack transaction and addresses were not recovered from public alerts.\n\n## Amount basis\nSlowMist estimated about 2.4 WETH, while another alert cited about 3.02 ETH. The asset figures are not added and no reliable USD valuation is used.\n\n## Evidence boundary\nThe SlowMist technical alert supports the accounting flaw and primary asset basis; a project review, attacker address, pool address, and complete transactions remain unpublished.\n\n## Current status\nNo project repair, freeze, recovery, or compensation notice was found by the cutoff.\n\n## Addresses and transactions\nPublic sources did not provide a complete verifiable address or transaction hash.\n\n## SlowMist update on September 11, 2026\nThe SlowMist Hacked Zone added a valuation near $5,923 and clarified the exact-output small-swap and wei-level pool-accounting difference. Another alert's roughly 3.02 ETH remains a separate estimate.\n" }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 5923, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "SlowMist 主口径约 2.4 WETH，约 5,923 USD；另一告警约 3.02 ETH，不合并。", "tw": "SlowMist 主口徑約 2.4 WETH，約 5,923 USD；另一告警約 3.02 ETH，不合並。", "en": "SlowMist's primary basis was about 2.4 WETH, near $5,923; another alert cited about 3.02 ETH and is not combined." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "SlowMist OMNI404 告警", "tw": "SlowMist OMNI404 告警", "en": "SlowMist OMNI404 alert" }, "url": "https://x.com/SlowMist_Team/status/2098300936720695573", "type": "research" }, { "label": { "zh": "SlowMist OMNI404 Hacked 记录", "tw": "SlowMist OMNI404 Hacked 記錄", "en": "SlowMist OMNI404 Hacked record" }, "url": "https://hacked.slowmist.io/zh/?page=1", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-303", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-305", "status": "verified", "incidentDate": "2026-09-10", "datePrecision": "day", "title": { "zh": "Brevo 登录授权缺陷引发加密邮件供应链钓鱼", "tw": "Brevo 登錄授權缺陷引發加密郵件供應鏈釣魚", "en": "Brevo login-authorization flaw enabled crypto-email supply-chain phishing" }, "summary": { "zh": "攻击者利用 Brevo 登录授权边界访问合法客户组织，并冒充 Trezor、BitBox 和 CoinTracking 发送安全告警钓鱼邮件。Trezor 约 347,000 个 newsletter 地址处于风险范围，暂无确认链上损失。", "tw": "攻擊者利用 Brevo 登錄授權邊界訪問合法客戶組織，並冒充 Trezor、BitBox 和 CoinTracking 發送安全告警釣魚郵件。Trezor 約 347,000 個 newsletter 地址處於風險範圍，暫無確認鏈上損失。", "en": "Attackers exploited a Brevo login-authorization boundary to access legitimate customer organizations and send security-themed phishing emails impersonating Trezor, BitBox, and CoinTracking. About 347,000 Trezor newsletter addresses were at risk, with no confirmed on-chain loss." }, "details": { "zh": "## 事件背景\nBrevo 的登录和组织授权边界出现缺陷，攻击者可以访问合法客户可达的邮件组织，并利用真实邮件基础设施发送高可信钓鱼内容。\n\n## 事件经过\n1. 2026 年 9 月 10 日，攻击者访问多个 Brevo 客户组织。\n2. Trezor 账号发送 Critical Security Alert: STM32 Entropy Vulnerability，诱导用户下载应用并输入 wallet backup。\n3. BitBox 用户收到冒充 RNG 安全告警，CoinTracking 用户收到刷新 API Keys 的数据泄露邮件。\n4. Trezor 在约 20 分钟内下线恶意域名并禁用邮件发送，BitBox 和 CoinTracking 继续发出警告。\n\n## 资金流向\nBrevo 合法邮件组织 → 仿冒安全邮件 → 恶意页面索取 wallet backup、助记词或 API 凭据 → 潜在多链盗转；窗口内没有确认的链上损失。\n\n## 金额口径\nTrezor 报告约 347,000 个 newsletter 地址处于风险范围，约 2,500 人点击恶意链接；Brevo 事后披露 138 个客户账号被访问，但未确认资产损失。\n\n## 证据边界\nTrezor 官方博客、Trezor / BitBox 官方警报与多家媒体互证攻击机制和影响范围。CoinTracking 官方站内公告、受害地址和交易哈希尚未公开。\n\n## 处置状态\n恶意域名和邮件发送已被部分下线或报告，受影响服务继续调查；用户不应输入助记词、钱包备份或 API 密钥。\n\n## 地址与交易\n这是链下邮件供应链事件，公开来源没有提供适合核验的完整区块链地址或交易哈希。", "tw": "## 事件背景\nBrevo 的登錄和組織授權邊界出現缺陷，攻擊者可以訪問合法客戶可達的郵件組織，並利用真實郵件基礎設施發送高可信釣魚內容。\n\n## 事件經過\n1. 2026 年 9 月 10 日，攻擊者訪問多個 Brevo 客戶組織。\n2. Trezor 賬號發送 Critical Security Alert: STM32 Entropy Vulnerability，誘導用戶下載應用並輸入 wallet backup。\n3. BitBox 用戶收到冒充 RNG 安全告警，CoinTracking 用戶收到刷新 API Keys 的數據洩露郵件。\n4. Trezor 在約 20 分鐘內下線惡意域名並禁用郵件發送，BitBox 和 CoinTracking 繼續發出警告。\n\n## 資金流向\nBrevo 合法郵件組織 → 仿冒安全郵件 → 惡意頁面索取 wallet backup、助記詞或 API 憑據 → 潛在多鏈盜轉；窗口內沒有確認的鏈上損失。\n\n## 金額口徑\nTrezor 報告約 347,000 個 newsletter 地址處於風險範圍，約 2,500 人點擊惡意鏈接；Brevo 事後披露 138 個客戶賬號被訪問，但未確認資產損失。\n\n## 證據邊界\nTrezor 官方博客、Trezor / BitBox 官方警報與多家媒體互證攻擊機制和影響範圍。CoinTracking 官方站內公告、受害地址和交易哈希尚未公開。\n\n## 處置狀態\n惡意域名和郵件發送已被部分下線或報告，受影響服務繼續調查；用戶不應輸入助記詞、錢包備份或 API 密鑰。\n\n## 地址與交易\n這是鏈下郵件供應鏈事件，公開來源沒有提供適合核驗的完整區塊鏈地址或交易哈希。", "en": "## Incident overview\nA flaw in Brevo login and organization authorization allowed attackers to reach legitimate customer mailing organizations and send convincing phishing content through real email infrastructure.\n\n## Incident sequence\n1. On September 10, 2026, attackers accessed multiple Brevo customer organizations.\n2. A Trezor account sent a “Critical Security Alert: STM32 Entropy Vulnerability” message that asked users to download an app and enter a wallet backup.\n3. BitBox users received fake RNG security alerts, and CoinTracking users received a data-breach message asking them to refresh API keys.\n4. Trezor took down the malicious domain and disabled sending within about 20 minutes while BitBox and CoinTracking issued warnings.\n\n## Fund flow\nLegitimate Brevo mailing organizations → fake security email → malicious page requesting wallet backup, seed phrase, or API credentials → potential multi-chain theft; no on-chain loss was confirmed in the window.\n\n## Amount basis\nTrezor reported about 347,000 newsletter addresses at risk and roughly 2,500 clicks. Brevo later said 138 customer accounts were accessed, without confirming asset loss.\n\n## Evidence boundary\nTrezor's official blog, Trezor / BitBox alerts, and multiple reports corroborate the mechanism and reach. A CoinTracking first-party notice, victim addresses, and transaction hashes remain unpublished.\n\n## Current status\nThe malicious domain and sending paths were partly disabled or reported while affected services investigated. Users should never enter a seed phrase, wallet backup, or API key.\n\n## Addresses and transactions\nThis is an off-chain email supply-chain incident; no complete blockchain address or transaction hash was published." }, "category": "supply-chain", "severity": "high", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": 0, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开未确认直接链上损失；约 347,000 个 newsletter 地址处于风险范围，约 2,500 人点击恶意链接。", "tw": "公開未確認直接鏈上損失；約 347,000 個 newsletter 地址處於風險範圍，約 2,500 人點擊惡意鏈接。", "en": "No direct on-chain loss was publicly confirmed; about 347,000 newsletter addresses were at risk and roughly 2,500 people clicked malicious links." }, "addressDisclosure": "not-applicable", "addresses": [], "references": [ { "label": { "zh": "Trezor Brevo 官方说明", "tw": "Trezor Brevo 官方說明", "en": "Trezor Brevo incident notice" }, "url": "https://trezor.io/blog/news/security-incident-at-brevo-our-third-party-email-provider", "type": "official" }, { "label": { "zh": "Trezor 官方 X 警报", "tw": "Trezor 官方 X 警報", "en": "Trezor official X alert" }, "url": "https://x.com/Trezor/status/2097786518110609620", "type": "official" }, { "label": { "zh": "BitBox 官方警报", "tw": "BitBox 官方警報", "en": "BitBox official alert" }, "url": "https://x.com/BitBoxSwiss/status/2097777460305657932", "type": "official" }, { "label": { "zh": "The Record 交叉报道", "tw": "The Record 交叉報道", "en": "The Record cross-report" }, "url": "https://therecord.media/trezor-bitbox-cointracking-phishing-crypto-holders", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-305", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-329", "status": "verified", "incidentDate": "2026-09-09", "datePrecision": "day", "title": { "zh": "BeatXswap LiquidityVestingConvert 现货价格操纵", "tw": "BeatXswap LiquidityVestingConvert 現貨價格操縱", "en": "BeatXswap LiquidityVestingConvert spot-price manipulation" }, "summary": { "zh": "仅使用 V3 slot0 现货价格，攻击者闪电贷砸盘后铸造 LP 并抽走约 2,984,557 BTX，损失约 77,512 USD。", "tw": "僅使用 V3 slot0 現貨價格，攻擊者閃電貸砸盤後鑄造 LP 並抽走約 2,984,557 BTX，損失約 77,512 USD。", "en": "Using only a V3 slot0 spot price, the attacker flash-dumped BTX, minted LP at the manipulated quote, and drained about 2,984,557 BTX worth $77,512." }, "details": { "zh": "## 事件背景\n仅使用 V3 slot0 现货价格，攻击者闪电贷砸盘后铸造 LP 并抽走约 2,984,557 BTX，损失约 77,512 USD。\n\n## 事件经过\n闪电贷借入 BTX、砸盘压价、存入 USDT 铸造 LP，再按异常报价抽走 BTX。\n\n## 资金流向\nSlowMist 记录支持相应攻击或异常处置路径；完整地址和交易集合未全部公开。\n\n## 金额口径\n约 77,512 USD。\n\n## 证据边界\n该条目来自 SlowMist Hacked Zone 的窗口内记录，后续项目复盘、地址和追回状态可能继续更新。\n\n## 处置状态\n截至核验点没有完整公开追回或赔付账本。\n\n## 地址与交易\n公开来源未提供完整标识符，不进行补写。", "tw": "## 事件背景\n僅使用 V3 slot0 現貨價格，攻擊者閃電貸砸盤後鑄造 LP 並抽走約 2,984,557 BTX，損失約 77,512 USD。\n\n## 事件經過\n閃電貸借入 BTX、砸盤壓價、存入 USDT 鑄造 LP，再按異常報價抽走 BTX。\n\n## 資金流向\nSlowMist 記錄支持相應攻擊或異常處置路徑；完整地址和交易集合未全部公開。\n\n## 金額口徑\n約 77,512 USD。\n\n## 證據邊界\n該條目來自 SlowMist Hacked Zone 的窗口內記錄，後續項目復盤、地址和追回狀態可能繼續更新。\n\n## 處置狀態\n截至核驗點沒有完整公開追回或賠付賬本。\n\n## 地址與交易\n公開來源未提供完整標識符，不進行補寫。", "en": "## Incident overview\nUsing only a V3 slot0 spot price, the attacker flash-dumped BTX, minted LP at the manipulated quote, and drained about 2,984,557 BTX worth $77,512.\n\n## Incident sequence\nFlash-loan BTX, crash the price, deposit USDT to mint LP, and drain BTX at the manipulated quote.\n\n## Fund flow\nThe SlowMist record supports the attack or disposition path, but complete addresses and transactions were not fully public.\n\n## Amount basis\nAbout $77,512.\n\n## Evidence boundary\nThis item comes from the SlowMist Hacked Zone during the window; project postmortems, addresses, and recovery status may change.\n\n## Current status\nNo complete public recovery or compensation ledger was available at verification.\n\n## Addresses and transactions\nPublic sources did not provide complete identifiers, so none are filled in." }, "category": "oracle-manipulation", "severity": "high", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": 77512, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 77,512 USD。", "tw": "約 77,512 USD。", "en": "About $77,512." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "SlowMist Hacked 记录", "tw": "SlowMist Hacked 記錄", "en": "SlowMist Hacked record" }, "url": "https://hacked.slowmist.io/zh/?c=&page=2", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-329", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-328", "status": "verified", "incidentDate": "2026-09-09", "datePrecision": "day", "title": { "zh": "Zentra Finance repayWithATokens 会计边界漏洞", "tw": "Zentra Finance repayWithATokens 會計邊界漏洞", "en": "Zentra Finance repayWithATokens accounting-edge exploit" }, "summary": { "zh": "repayWithATokens 路径可结清债务但把 aToken 销毁减为 0，攻击者抽出约 140,030 USD，市场约 17 分钟后暂停。", "tw": "repayWithATokens 路徑可結清債務但把 aToken 銷燬減為 0，攻擊者抽出約 140,030 USD，市場約 17 分鐘後暫停。", "en": "The repayWithATokens path could clear debt while reducing the matching aToken burn to zero. About $140,030 was drained before markets paused." }, "details": { "zh": "## 事件背景\nrepayWithATokens 路径可结清债务但把 aToken 销毁减为 0，攻击者抽出约 140,030 USD，市场约 17 分钟后暂停。\n\n## 事件经过\n用约 200,000 USDC.e 闪电流动性作为临时抵押，从 Citrea 借贷池抽出 ctUSD 和 USDC.e；多签暂停市场。\n\n## 资金流向\nSlowMist 记录支持相应攻击或异常处置路径；完整地址和交易集合未全部公开。\n\n## 金额口径\n约 140,030 USD。\n\n## 证据边界\n该条目来自 SlowMist Hacked Zone 的窗口内记录，后续项目复盘、地址和追回状态可能继续更新。\n\n## 处置状态\n截至核验点没有完整公开追回或赔付账本。\n\n## 地址与交易\n公开来源未提供完整标识符，不进行补写。", "tw": "## 事件背景\nrepayWithATokens 路徑可結清債務但把 aToken 銷燬減為 0，攻擊者抽出約 140,030 USD，市場約 17 分鐘後暫停。\n\n## 事件經過\n用約 200,000 USDC.e 閃電流動性作為臨時抵押，從 Citrea 借貸池抽出 ctUSD 和 USDC.e；多籤暫停市場。\n\n## 資金流向\nSlowMist 記錄支持相應攻擊或異常處置路徑；完整地址和交易集合未全部公開。\n\n## 金額口徑\n約 140,030 USD。\n\n## 證據邊界\n該條目來自 SlowMist Hacked Zone 的窗口內記錄，後續項目復盤、地址和追回狀態可能繼續更新。\n\n## 處置狀態\n截至核驗點沒有完整公開追回或賠付賬本。\n\n## 地址與交易\n公開來源未提供完整標識符，不進行補寫。", "en": "## Incident overview\nThe repayWithATokens path could clear debt while reducing the matching aToken burn to zero. About $140,030 was drained before markets paused.\n\n## Incident sequence\nAbout 200,000 USDC.e of flash liquidity was used as collateral to drain ctUSD and USDC.e on Citrea before the multisig paused markets.\n\n## Fund flow\nThe SlowMist record supports the attack or disposition path, but complete addresses and transactions were not fully public.\n\n## Amount basis\nAbout $140,030.\n\n## Evidence boundary\nThis item comes from the SlowMist Hacked Zone during the window; project postmortems, addresses, and recovery status may change.\n\n## Current status\nNo complete public recovery or compensation ledger was available at verification.\n\n## Addresses and transactions\nPublic sources did not provide complete identifiers, so none are filled in." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": 140030, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 140,030 USD。", "tw": "約 140,030 USD。", "en": "About $140,030." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "SlowMist Hacked 记录", "tw": "SlowMist Hacked 記錄", "en": "SlowMist Hacked record" }, "url": "https://hacked.slowmist.io/zh/?c=&page=2", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-328", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-302", "status": "verified", "incidentDate": "2026-09-09", "datePrecision": "day", "title": { "zh": "Enso Finance DPI Strategy Vault 预言机估值错误", "tw": "Enso Finance DPI Strategy Vault 預言機估值錯誤", "en": "Enso Finance DPI Strategy Vault oracle valuation exploit" }, "summary": { "zh": "Enso Finance 的 DPI Strategy Vault 使用失衡 Uniswap V3 现货路径估值，攻击者以 0.683 WETH 换入 FARM 后铸造过量份额并赎回约 5.6 ETH。", "tw": "Enso Finance 的 DPI Strategy Vault 使用失衡 Uniswap V3 現貨路徑估值，攻擊者以 0.683 WETH 換入 FARM 後鑄造過量份額並贖回約 5.6 ETH。", "en": "Enso Finance DPI Strategy Vault used an imbalanced Uniswap V3 spot path for valuation. The attacker swapped 0.683 WETH for FARM, minted excess shares, and redeemed about 5.6 ETH." }, "details": { "zh": "## 事件背景\nEnso Controller 在存入策略代币前后调用估值函数，预言机注册表把 fee 字段复用为 secondsAgo，形成接近现货的短窗口价格。\n\n## 事件经过\n1. 2026 年 9 月 9 日，攻击者在 Uniswap V2 用 0.683 WETH 换入 268.42 FARM。\n2. 失衡的 V3 池把同一批 FARM 估值抬高约 9.2 倍。\n3. Controller 按错误估值铸造过多策略份额。\n4. 攻击者赎回并取得约 5.6 ETH。\n\n## 资金流向\n0.683 WETH → FARM → DPI Strategy Vault 错误份额 → 赎回约 5.6 ETH；攻击者地址和交易未公开恢复。\n\n## 金额口径\n约 5.6 ETH 是公开主要资产口径；0.683 WETH 输入和估值差不重复计算，美元金额留空。\n\n## 证据边界\nSlowMist 技术告警和 KuCoin 简报支持根因与金额；策略合约地址、攻击者地址和完整交易集合尚未公开。\n\n## 处置状态\nEnso 表示受影响合约已弃用约四年，并要求用户通过官方渠道退出；未见追回确认。\n\n## 地址与交易\n没有适合进入正式地址标签的完整攻击地址或交易哈希。", "tw": "## 事件背景\nEnso Controller 在存入策略代幣前後調用估值函數，預言機註冊表把 fee 字段複用為 secondsAgo，形成接近現貨的短窗口價格。\n\n## 事件經過\n1. 2026 年 9 月 9 日，攻擊者在 Uniswap V2 用 0.683 WETH 換入 268.42 FARM。\n2. 失衡的 V3 池把同一批 FARM 估值抬高約 9.2 倍。\n3. Controller 按錯誤估值鑄造過多策略份額。\n4. 攻擊者贖回並取得約 5.6 ETH。\n\n## 資金流向\n0.683 WETH → FARM → DPI Strategy Vault 錯誤份額 → 贖回約 5.6 ETH；攻擊者地址和交易未公開恢復。\n\n## 金額口徑\n約 5.6 ETH 是公開主要資產口徑；0.683 WETH 輸入和估值差不重複計算，美元金額留空。\n\n## 證據邊界\nSlowMist 技術告警和 KuCoin 簡報支持根因與金額；策略合約地址、攻擊者地址和完整交易集合尚未公開。\n\n## 處置狀態\nEnso 表示受影響合約已棄用約四年，並要求用戶通過官方渠道退出；未見追回確認。\n\n## 地址與交易\n沒有適合進入正式地址標籤的完整攻擊地址或交易哈希。", "en": "## Incident overview\nEnso Controller valued strategy deposits before and after token transfer. Its oracle registry reused a fee field as secondsAgo, creating a near-spot short-window price.\n\n## Incident sequence\n1. On September 9, 2026, the attacker swapped 0.683 WETH for 268.42 FARM on Uniswap V2.\n2. An imbalanced V3 pool valued that FARM about 9.2 times higher.\n3. The Controller minted excess strategy shares from the incorrect valuation.\n4. The attacker redeemed about 5.6 ETH.\n\n## Fund flow\n0.683 WETH → FARM → incorrectly valued DPI Strategy Vault shares → about 5.6 ETH redemption; attacker address and transactions were not recovered.\n\n## Amount basis\nAbout 5.6 ETH is the primary public asset basis. The WETH input and valuation difference are not added, and no reliable USD amount is used.\n\n## Evidence boundary\nThe SlowMist alert and KuCoin brief support the root cause and amount; strategy-contract, attacker-address, and complete transaction data remain unpublished.\n\n## Current status\nEnso said the affected contract had been deprecated for about four years and asked users to exit through official channels; no recovery was confirmed.\n\n## Addresses and transactions\nNo complete attacker address or transaction hash suitable for formal labeling was published." }, "category": "oracle-manipulation", "severity": "high", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 5.6 ETH 被提取；公开资料没有可靠的美元损失口径。", "tw": "約 5.6 ETH 被提取；公開資料沒有可靠的美元損失口徑。", "en": "About 5.6 ETH was extracted; public sources provide no reliable USD loss basis." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "SlowMist Enso 告警", "tw": "SlowMist Enso 告警", "en": "SlowMist Enso alert" }, "url": "https://x.com/SlowMist_Team/status/2097602957311455640", "type": "research" }, { "label": { "zh": "KuCoin Enso 简报", "tw": "KuCoin Enso 簡報", "en": "KuCoin Enso brief" }, "url": "https://kucoin.com/news/flash/enso-finance-vault-loses-5-6-eth-due-to-oracle-price-error", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-302", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-301", "status": "verified", "incidentDate": "2026-09-09", "datePrecision": "day", "title": { "zh": "Amnext / AMC 异常 Ticket 铸造抽取约 154.02 WBNB", "tw": "Amnext / AMC 異常 Ticket 鑄造抽取約 154.02 WBNB", "en": "Amnext / AMC anomalous Ticket mint extracted about 154.02 WBNB" }, "summary": { "zh": "BNB Chain 上 Amnext 的无损抽奖 / 奖池合约允许批量铸造异常 Ticket AMC，攻击者经 PancakeSwap 抽取约 154.02 WBNB，估值约 116,100 USD。", "tw": "BNB Chain 上 Amnext 的無損抽獎 / 獎池合約允許批量鑄造異常 Ticket AMC，攻擊者經 PancakeSwap 抽取約 154.02 WBNB，估值約 116,100 USD。", "en": "Amnext's no-loss lottery / pool contract on BNB Chain allowed anomalous Ticket AMC minting. The attacker extracted about 154.02 WBNB through PancakeSwap, valued near $116,100." }, "details": { "zh": "## 事件背景\nAmnext AMC 无损抽奖 / 奖池逻辑存在可批量铸造 Ticket AMC 的缺陷，允许攻击者绕过正常票券约束。\n\n## 事件经过\n1. 2026 年 9 月 9 日，攻击者批量铸造 Ticket AMC。\n2. 异常票券被用于抽取协议奖池和流动性。\n3. 资产经 PancakeSwap 换出约 154.02 WBNB。\n\n## 资金流向\nAmnext 奖池 → 异常 Ticket AMC → PancakeSwap → WBNB 收益；完整地址和交易未公开。\n\n## 金额口径\nSlowMist 口径约 154.02 WBNB、约 116,100 USD；不把票券名义数量重复计入。\n\n## 证据边界\nTenArmor、SlowMist 和 Hacked Zone 记录支持攻击存在与金额；项目官方澄清和完整链上账本仍待补充。\n\n## 处置状态\n未发现官方追回、回滚或赔付公告。\n\n## 地址与交易\n公开来源没有提供完整攻击者地址或交易哈希。", "tw": "## 事件背景\nAmnext AMC 無損抽獎 / 獎池邏輯存在可批量鑄造 Ticket AMC 的缺陷，允許攻擊者繞過正常票券約束。\n\n## 事件經過\n1. 2026 年 9 月 9 日，攻擊者批量鑄造 Ticket AMC。\n2. 異常票券被用於抽取協議獎池和流動性。\n3. 資產經 PancakeSwap 換出約 154.02 WBNB。\n\n## 資金流向\nAmnext 獎池 → 異常 Ticket AMC → PancakeSwap → WBNB 收益；完整地址和交易未公開。\n\n## 金額口徑\nSlowMist 口徑約 154.02 WBNB、約 116,100 USD；不把票券名義數量重複計入。\n\n## 證據邊界\nTenArmor、SlowMist 和 Hacked Zone 記錄支持攻擊存在與金額；項目官方澄清和完整鏈上賬本仍待補充。\n\n## 處置狀態\n未發現官方追回、回滾或賠付公告。\n\n## 地址與交易\n公開來源沒有提供完整攻擊者地址或交易哈希。", "en": "## Incident overview\nAmnext's AMC no-loss lottery / pool logic allowed batch minting of Ticket AMC outside normal constraints.\n\n## Incident sequence\n1. On September 9, 2026, the attacker minted Ticket AMC in bulk.\n2. The anomalous tickets were used to extract pool value and liquidity.\n3. The assets were exchanged through PancakeSwap for about 154.02 WBNB.\n\n## Fund flow\nAmnext pool → anomalous Ticket AMC → PancakeSwap → WBNB proceeds; complete addresses and transaction were not published.\n\n## Amount basis\nSlowMist reported about 154.02 WBNB, valued near $116,100; nominal ticket quantity is not added again.\n\n## Evidence boundary\nTenArmor, SlowMist, and the Hacked Zone record support the incident and amount; an official clarification and complete on-chain ledger remain pending.\n\n## Current status\nNo official recovery, rollback, or compensation notice was found.\n\n## Addresses and transactions\nPublic sources did not provide a complete attacker address or transaction hash." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "BNB Chain" ], "chains": [ "BNB Chain" ], "lossUsd": 116100, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 154.02 WBNB，公开估值约 116,100 USD。", "tw": "約 154.02 WBNB，公開估值約 116,100 USD。", "en": "About 154.02 WBNB, publicly valued near $116,100." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "TenArmor AMC 告警", "tw": "TenArmor AMC 告警", "en": "TenArmor AMC alert" }, "url": "https://x.com/tenarmoralert/status/2097506987554808212", "type": "research" }, { "label": { "zh": "SlowMist Hacked 记录", "tw": "SlowMist Hacked 記錄", "en": "SlowMist Hacked record" }, "url": "https://hacked.slowmist.io/?c=bridge&page=1", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-301", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-300", "status": "verified", "incidentDate": "2026-09-08", "datePrecision": "day", "title": { "zh": "WealthManagementV2 Owner 权限滥用导致 26,414 USDT 被提取", "tw": "WealthManagementV2 Owner 權限濫用導致 26,414 USDT 被提取", "en": "WealthManagementV2 owner-privilege abuse extracted 26,414 USDT" }, "summary": { "zh": "WealthManagementV2 的 Owner 权限被非法转移后，攻击者把计划参数改成零周期和极高乘数，利用同一交易投资、赎回并提取 26,414 USDT。", "tw": "WealthManagementV2 的 Owner 權限被非法轉移後，攻擊者把計劃參數改成零週期和極高乘數，利用同一交易投資、贖回並提取 26,414 USDT。", "en": "After WealthManagementV2 owner authority was unlawfully transferred, the attacker set a zero period and extreme multipliers, then invested, redeemed, and withdrew 26,414 USDT." }, "details": { "zh": "## 事件背景\nWealthManagementV2 的计划配置由 Owner 控制，缺少时间锁和参数边界。公开告警怀疑 Owner 私钥或权限路径被攻破。\n\n## 事件经过\n1. Owner 控制权转到攻击者或攻击者控制主体。\n2. `updatePlanConfig` 将周期设为 0，将利率和解锁乘数设为 528,300,000。\n3. 攻击者投资并赎回，铸造虚高利息。\n4. 第二次投资触发解锁并提取约 26,414 USDT。\n\n## 资金流向\nWealthManagementV2 合约 → 攻击者控制的 USDT 提款；完整交易和地址没有恢复。\n\n## 金额口径\n26,414 USDT 是公开事件损失口径，不把异常利息或合约余额另行相加。\n\n## 证据边界\nSlowMist 告警支持权限滥用和金额；私钥泄露仍是可能性，不作为已确认根因。\n\n## 处置状态\n未确认追回、冻结或退款。\n\n## 地址与交易\n公开来源没有提供完整攻击地址或交易哈希。", "tw": "## 事件背景\nWealthManagementV2 的計劃配置由 Owner 控制，缺少時間鎖和參數邊界。公開告警懷疑 Owner 私鑰或權限路徑被攻破。\n\n## 事件經過\n1. Owner 控制權轉到攻擊者或攻擊者控制主體。\n2. `updatePlanConfig` 將週期設為 0，將利率和解鎖乘數設為 528,300,000。\n3. 攻擊者投資並贖回，鑄造虛高利息。\n4. 第二次投資觸發解鎖並提取約 26,414 USDT。\n\n## 資金流向\nWealthManagementV2 合約 → 攻擊者控制的 USDT 提款；完整交易和地址沒有恢復。\n\n## 金額口徑\n26,414 USDT 是公開事件損失口徑，不把異常利息或合約餘額另行相加。\n\n## 證據邊界\nSlowMist 告警支持權限濫用和金額；私鑰洩露仍是可能性，不作為已確認根因。\n\n## 處置狀態\n未確認追回、凍結或退款。\n\n## 地址與交易\n公開來源沒有提供完整攻擊地址或交易哈希。", "en": "## Incident overview\nWealthManagementV2 owner control was reportedly transferred without authorization, with no timelock or parameter bounds. The alert suspects a private-key or privilege-path compromise.\n\n## Incident sequence\n1. Owner control moved to the attacker or an attacker-controlled subject.\n2. `updatePlanConfig` set the period to zero and interest and unlock multipliers to 528,300,000.\n3. The attacker invested and redeemed to mint inflated interest.\n4. A second investment unlocked and withdrew about 26,414 USDT.\n\n## Fund flow\nWealthManagementV2 contract → attacker-controlled USDT withdrawal; complete transaction and address data were not recovered.\n\n## Amount basis\nThe $26,414 USDT is the public loss basis; abnormal interest and contract balances are not added separately.\n\n## Evidence boundary\nThe SlowMist alert supports privilege abuse and amount. Private-key compromise remains a possibility rather than a confirmed root cause.\n\n## Current status\nNo recovery, freeze, or refund was confirmed.\n\n## Addresses and transactions\nPublic sources did not provide a complete attacker address or transaction hash." }, "category": "access-control", "severity": "high", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": 26414, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开记录确认提取约 26,414 USDT；具体 EVM 网络、攻击地址和交易仍未公开。", "tw": "公開記錄確認提取約 26,414 USDT；具體 EVM 網絡、攻擊地址和交易仍未公開。", "en": "Public records confirm about 26,414 USDT withdrawn; the exact EVM network, attacker address, and transaction remain unpublished." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "SlowMist WealthManagementV2 告警", "tw": "SlowMist WealthManagementV2 告警", "en": "SlowMist WealthManagementV2 alert" }, "url": "https://x.com/SlowMist_Team/status/2097222515009724817", "type": "research" }, { "label": { "zh": "SlowMist Hacked 记录", "tw": "SlowMist Hacked 記錄", "en": "SlowMist Hacked record" }, "url": "https://hacked.slowmist.io/?c=bridge&page=1", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-300", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-299", "status": "verified", "incidentDate": "2026-09-07", "datePrecision": "day", "title": { "zh": "Hemi Genesis Drop MerkleBox 重入提取约 124.5M HEMI", "tw": "Hemi Genesis Drop MerkleBox 重入提取約 124.5M HEMI", "en": "Hemi Genesis Drop MerkleBox reentrancy drained about 124.5 million HEMI" }, "summary": { "zh": "Hemi Genesis Drop MerkleBox 在更新可领取余额前创建锁仓，攻击者控制的 lockup 合约重入 claim 63 次，提取约 124.5M HEMI，并将约 255,000 USD 稳定币收益跨链。", "tw": "Hemi Genesis Drop MerkleBox 在更新可領取餘額前創建鎖倉，攻擊者控制的 lockup 合約重入 claim 63 次，提取約 124.5M HEMI，並將約 255,000 USD 穩定幣收益跨鏈。", "en": "Hemi Genesis Drop MerkleBox created lockups before updating claimable balances. A malicious lockup reentered claim 63 times, extracting about 124.5 million HEMI and bridging roughly $255,000 in stablecoin proceeds." }, "details": { "zh": "## 事件背景\n修改版 Genesis Drop MerkleBox 在更新可领取余额前先创建锁仓，并允许 claim group 指定自定义 lockup，形成可重入的领取路径。\n\n## 事件经过\n1. 2026 年 9 月 7 日 03:35:23 UTC，攻击者部署编排、claim-group creator 和伪 lockup。\n2. 03:36:47 UTC 从 SushiSwap HEMI / USDT 池取得约 2M HEMI。\n3. 创建并注资恶意 claim group，伪 lockup 在记账更新前递归重入 claim 63 次。\n4. HEMI 在 Hemi DEX 出售，稳定币经 LayerZero 转到 Ethereum、Arbitrum、BNB Chain、Optimism、Avalanche 和 Polygon。\n\n## 资金流向\nGenesis Drop MerkleBox → Hemi 攻击者 EOA → Hemi DEX → LayerZero 多链出口；主要稳定币随后在 Ethereum 转换为 ETH。\n\n## 金额口径\n约 124.5M HEMI 是未领取分配额数量，已实现稳定币包括 151,524.70 USDT 和 103,422.62 USDC，约 255,000 USD。代币名义面值不等于实际损失。\n\n## 证据边界\nHemi 官方复盘和链上标识支持重入机制、次数、合约和跨链交易；用户已领取余额、最终控制关系和追回金额仍在调查。\n\n## 处置状态\n受影响合约已空且不可变，Hemi / veHEMI、hVM、原生隧道和第三方桥未受影响；交易所已发出风险提示，追回未确认。\n\n## 地址与交易\nMerkeBox、攻击编排合约、claim group / lockup、攻击者 EOA 和 Ethereum 出口地址均保留；交易哈希放入来源引用。", "tw": "## 事件背景\n修改版 Genesis Drop MerkleBox 在更新可領取餘額前先創建鎖倉，並允許 claim group 指定自定義 lockup，形成可重入的領取路徑。\n\n## 事件經過\n1. 2026 年 9 月 7 日 03:35:23 UTC，攻擊者部署編排、claim-group creator 和偽 lockup。\n2. 03:36:47 UTC 從 SushiSwap HEMI / USDT 池取得約 2M HEMI。\n3. 創建並注資惡意 claim group，偽 lockup 在記賬更新前遞歸重入 claim 63 次。\n4. HEMI 在 Hemi DEX 出售，穩定幣經 LayerZero 轉到 Ethereum、Arbitrum、BNB Chain、Optimism、Avalanche 和 Polygon。\n\n## 資金流向\nGenesis Drop MerkleBox → Hemi 攻擊者 EOA → Hemi DEX → LayerZero 多鏈出口；主要穩定幣隨後在 Ethereum 轉換為 ETH。\n\n## 金額口徑\n約 124.5M HEMI 是未領取分配額數量，已實現穩定幣包括 151,524.70 USDT 和 103,422.62 USDC，約 255,000 USD。代幣名義面值不等於實際損失。\n\n## 證據邊界\nHemi 官方復盤和鏈上標識支持重入機制、次數、合約和跨鏈交易；用戶已領取餘額、最終控制關係和追回金額仍在調查。\n\n## 處置狀態\n受影響合約已空且不可變，Hemi / veHEMI、hVM、原生隧道和第三方橋未受影響；交易所已發出風險提示，追回未確認。\n\n## 地址與交易\nMerkeBox、攻擊編排合約、claim group / lockup、攻擊者 EOA 和 Ethereum 出口地址均保留；交易哈希放入來源引用。", "en": "## Incident overview\nThe modified Genesis Drop MerkleBox created a lockup before updating claimable balances and allowed each claim group to choose a custom lockup, creating a reentrancy path.\n\n## Incident sequence\n1. At 03:35:23 UTC on September 7, 2026, the attacker deployed the orchestrator, claim-group creator, and fake lockup.\n2. At 03:36:47 UTC, about 2 million HEMI was sourced from the SushiSwap HEMI / USDT pool.\n3. Malicious claim groups were funded and the fake lockup reentered claim 63 times before the accounting update.\n4. HEMI was sold on Hemi DEX and stablecoins were bridged to Ethereum, Arbitrum, BNB Chain, Optimism, Avalanche, and Polygon.\n\n## Fund flow\nGenesis Drop MerkleBox → Hemi attacker EOA → Hemi DEX → LayerZero multi-chain exits; most stablecoins were later converted to ETH on Ethereum.\n\n## Amount basis\nAbout 124.5 million HEMI represents unclaimed allocation units. Realized stablecoins included 151,524.70 USDT and 103,422.62 USDC, about $255,000. Nominal token value is not realized loss.\n\n## Evidence boundary\nThe Hemi postmortem and on-chain identifiers support the reentrancy mechanism, count, contracts, and bridge transactions. The claimed-balance set, final control, and recovery remain under investigation.\n\n## Current status\nThe affected contract was emptied and is immutable. HEMI / veHEMI, hVM, the native tunnel, and third-party bridges were not affected; exchanges issued warnings and recovery was unconfirmed.\n\n## Addresses and transactions\nThe MerkleBox, attack orchestrator, claim-group / lockup contracts, attacker EOA, and Ethereum exit are retained; transaction hashes remain in the references." }, "category": "protocol-exploit", "severity": "critical", "ecosystems": [ "Hemi", "Ethereum", "Arbitrum", "BNB Chain", "Optimism", "Avalanche", "Polygon" ], "chains": [ "Hemi", "Ethereum", "Arbitrum", "BNB Chain", "Optimism", "Avalanche", "Polygon" ], "lossUsd": 255000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 124.5M HEMI 未领取分配额被提取；已实现稳定币口径约 255,000 USD，不把代币名义面值相加。", "tw": "約 124.5M HEMI 未領取分配額被提取；已實現穩定幣口徑約 255,000 USD，不把代幣名義面值相加。", "en": "About 124.5 million HEMI in unclaimed allocations was extracted; realized stablecoin proceeds were about $255,000, without adding nominal token value." }, "addressDisclosure": "published", "addresses": [ { "chain": "Hemi", "address": "0x9Ab3660ceE733332785cEa09D1a4Ff222F31aE54", "entity": { "zh": "Hemi Genesis Drop MerkleBox", "tw": "Hemi Genesis Drop MerkleBox", "en": "Hemi Genesis Drop MerkleBox" }, "role": "contract", "category": "unknown", "confidence": 0.95, "sourceUrl": "https://hemi.xyz/blog/genesis-drop-exploit-september-7-2026-post-mortem", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Hemi 官方复盘将该合约列为受影响领取合约，不是攻击者地址。", "tw": "Hemi 官方復盤將該合約列為受影響領取合約，不是攻擊者地址。", "en": "The Hemi postmortem identifies this as the affected claim contract, not an attacker address." }, "reviewRequired": true }, { "chain": "Hemi", "address": "0x86b1EbFEbb0502D3d5915c920f90a61892501B69", "entity": { "zh": "Hemi 攻击编排合约", "tw": "Hemi 攻擊編排合約", "en": "Hemi attack orchestrator" }, "role": "attacker_contract", "category": "hack", "confidence": 0.84, "sourceUrl": "https://hemi.xyz/blog/genesis-drop-exploit-september-7-2026-post-mortem", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "公开链上账本将该合约列入 claim 重入执行路径。", "tw": "公開鏈上賬本將該合約列入 claim 重入執行路徑。", "en": "The public on-chain ledger places this contract in the reentrant claim execution path." }, "reviewRequired": true }, { "chain": "Hemi", "address": "0xB67A9E46BCB99D4f65dC6825500Ef5cc8d6Eb364", "entity": { "zh": "Hemi claim group / lockup 合约", "tw": "Hemi claim group / lockup 合約", "en": "Hemi claim-group / lockup contract" }, "role": "attacker_contract", "category": "hack", "confidence": 0.8, "sourceUrl": "https://hemi.xyz/blog/genesis-drop-exploit-september-7-2026-post-mortem", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址与恶意 claim group 和伪 lockup 路径关联。", "tw": "該地址與惡意 claim group 和偽 lockup 路徑關聯。", "en": "This address is linked to the malicious claim-group and fake-lockup path." }, "reviewRequired": true }, { "chain": "Hemi", "address": "0xa6CB36fA743342dC4890c1fCC36d6D86E234eD80", "entity": { "zh": "Hemi 攻击者收益接收 EOA", "tw": "Hemi 攻擊者收益接收 EOA", "en": "Hemi attacker proceeds EOA" }, "role": "attacker", "category": "stolen_funds", "confidence": 0.84, "sourceUrl": "https://hemi.xyz/blog/genesis-drop-exploit-september-7-2026-post-mortem", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "公开账本将该 EOA 列为 HEMI 收益接收方。", "tw": "公開賬本將該 EOA 列為 HEMI 收益接收方。", "en": "The public ledger identifies this EOA as a HEMI proceeds recipient." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xAD5cd7F2AFd4b5e9e758E8658A9Dc43925B9822E", "entity": { "zh": "Hemi 跨链后 ETH 转换地址", "tw": "Hemi 跨鏈後 ETH 轉換地址", "en": "Hemi post-bridge ETH conversion address" }, "role": "stolen_funds", "category": "stolen_funds", "confidence": 0.76, "sourceUrl": "https://hemi.xyz/blog/genesis-drop-exploit-september-7-2026-post-mortem", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "公开账本将该地址列为跨链后 ETH 转换持有方，实体控制关系待核。", "tw": "公開賬本將該地址列為跨鏈後 ETH 轉換持有方，實體控制關係待核。", "en": "The public ledger lists this as the post-bridge ETH conversion holder; entity control remains unresolved." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "Hemi 官方复盘", "tw": "Hemi 官方復盤", "en": "Hemi official postmortem" }, "url": "https://hemi.xyz/blog/genesis-drop-exploit-september-7-2026-post-mortem", "type": "official" }, { "label": { "zh": "Hemi 事件报道", "tw": "Hemi 事件報道", "en": "Hemi incident report" }, "url": "https://crypto-economy.com/hemi-releases-post-mortem-on-genesis-drop-exploit-that-drained-124-5-million-tokens", "type": "research" }, { "label": { "zh": "Upbit 与 Hemi 风险报道", "tw": "Upbit 與 Hemi 風險報道", "en": "Upbit and Hemi risk report" }, "url": "https://crypto.news/upbit-drops-hemi-after-exploit-lists-cp-and-useless", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-299", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-298", "status": "verified", "incidentDate": "2026-09-07", "datePrecision": "day", "title": { "zh": "未具名 BSC DEX Router 回调鉴权缺失导致授权盗取", "tw": "未具名 BSC DEX Router 回調鑑權缺失導致授權盜取", "en": "Unnamed BSC DEX Router callback-authentication exploit" }, "summary": { "zh": "BNB Chain 上未具名 DEX Router 未验证 uniswapV3SwapCallback 是否来自真实 V3 Pool，攻击者利用受害者既有授权转走约 62.28 WBNB，约 46,070 USD。", "tw": "BNB Chain 上未具名 DEX Router 未驗證 uniswapV3SwapCallback 是否來自真實 V3 Pool，攻擊者利用受害者既有授權轉走約 62.28 WBNB，約 46,070 USD。", "en": "An unnamed BNB Chain DEX Router did not verify that uniswapV3SwapCallback came from a real V3 pool. The attacker used victims' existing allowances to transfer about 62.28 WBNB, valued near $46,070." }, "details": { "zh": "## 事件背景\nRouter 的回调函数没有确认调用者是已注册的 Uniswap V3 池，导致攻击者可以把受害地址设为 payer 并复用历史 allowance。\n\n## 事件经过\n1. 攻击者部署或使用伪造 V3 Pool。\n2. 以受害者地址作为 payer 调用 Router 回调。\n3. Router 通过既有授权执行 `transferFrom`。\n4. 被盗资产归集为约 62.28 WBNB。\n\n## 资金流向\n受害者既有授权 → 伪造池 / Router 回调 → WBNB 收益；完整攻击交易和地址未恢复。\n\n## 金额口径\nSlowMist 记录约 62.28 WBNB，估值约 46,070 USD；受害钱包数量不等于损失数量。\n\n## 证据边界\nSlowMist 告警支持回调鉴权缺失、资产类型和金额；项目身份、攻击者地址和交易集合没有公开。\n\n## 处置状态\n未确认追回或退款。\n\n## 地址与交易\n公开来源没有提供完整地址或交易哈希。", "tw": "## 事件背景\nRouter 的回調函數沒有確認調用者是已註冊的 Uniswap V3 池，導致攻擊者可以把受害地址設為 payer 並複用歷史 allowance。\n\n## 事件經過\n1. 攻擊者部署或使用偽造 V3 Pool。\n2. 以受害者地址作為 payer 調用 Router 回調。\n3. Router 通過既有授權執行 `transferFrom`。\n4. 被盜資產歸集為約 62.28 WBNB。\n\n## 資金流向\n受害者既有授權 → 偽造池 / Router 回調 → WBNB 收益；完整攻擊交易和地址未恢復。\n\n## 金額口徑\nSlowMist 記錄約 62.28 WBNB，估值約 46,070 USD；受害錢包數量不等於損失數量。\n\n## 證據邊界\nSlowMist 告警支持回調鑑權缺失、資產類型和金額；項目身份、攻擊者地址和交易集合沒有公開。\n\n## 處置狀態\n未確認追回或退款。\n\n## 地址與交易\n公開來源沒有提供完整地址或交易哈希。", "en": "## Incident overview\nThe Router did not verify that a callback caller was a registered Uniswap V3 pool, allowing the attacker to set victims as payers and reuse historical allowances.\n\n## Incident sequence\n1. The attacker deployed or used a fake V3 pool.\n2. A victim address was supplied as payer in a Router callback.\n3. The Router used the existing allowance to execute `transferFrom`.\n4. The stolen asset was aggregated as about 62.28 WBNB.\n\n## Fund flow\nExisting victim allowance → fake pool / Router callback → WBNB proceeds; complete transaction and addresses were not recovered.\n\n## Amount basis\nThe SlowMist record cites about 62.28 WBNB, valued near $46,070; victim-wallet count is not loss amount.\n\n## Evidence boundary\nThe SlowMist alert supports the callback-authentication flaw, asset, and amount. Project identity, attacker address, and transaction set were not published.\n\n## Current status\nNo recovery or refund was confirmed.\n\n## Addresses and transactions\nPublic sources did not provide complete addresses or transaction hashes." }, "category": "phishing-approval", "severity": "high", "ecosystems": [ "BNB Chain" ], "chains": [ "BNB Chain" ], "lossUsd": 46070, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 62.28 WBNB，公开估值约 46,070 USD；涉及约 29 个受害钱包。", "tw": "約 62.28 WBNB，公開估值約 46,070 USD；涉及約 29 個受害錢包。", "en": "About 62.28 WBNB, valued near $46,070, with roughly 29 victim wallets reported." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "SlowMist BSC Router 告警", "tw": "SlowMist BSC Router 告警", "en": "SlowMist BSC Router alert" }, "url": "https://x.com/SlowMist_Team/status/2097153762746159228", "type": "research" }, { "label": { "zh": "SlowMist Hacked 记录", "tw": "SlowMist Hacked 記錄", "en": "SlowMist Hacked record" }, "url": "https://hacked.slowmist.io/?c=bridge&page=1", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-298", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-297", "status": "verified", "incidentDate": "2026-09-07", "datePrecision": "day", "title": { "zh": "Cozy Finance 保护市场预言机触发滥用", "tw": "Cozy Finance 保護市場預言機觸發濫用", "en": "Cozy Finance protection-market oracle-trigger abuse" }, "summary": { "zh": "Cozy Finance 的保护市场接受 UMA Optimistic Oracle 中无人争议的 YES 结果，却没有独立验证真实攻击，攻击者销毁 PToken 领取 USDC.e 并跨桥转出。SlowMist 主口径约 160,000 USD。", "tw": "Cozy Finance 的保護市場接受 UMA Optimistic Oracle 中無人爭議的 YES 結果，卻沒有獨立驗證真實攻擊，攻擊者銷燬 PToken 領取 USDC.e 並跨橋轉出。SlowMist 主口徑約 160,000 USD。", "en": "Cozy Finance protection markets accepted an uncontested YES result from UMA Optimistic Oracle without independently verifying a real underlying attack. The attacker burned PTokens, claimed USDC.e, and bridged it out; SlowMist's primary estimate was about $160,000." }, "details": { "zh": "## 事件背景\nCozy 保护市场的触发条件依赖 UMA 乐观预言机答案，赔付资格又没有绑定提案前持仓快照。\n\n## 事件经过\n1. 攻击者买入 Aave v2 和 Curve 保护市场 PToken。\n2. 向 UMA 提交 YES 答案且无人争议。\n3. 市场进入 TRIGGERED 后，攻击者销毁 PToken 领取 USDC.e。\n4. 领取后约 13 分钟，部分资金跨桥转出。\n\n## 资金流向\nCozy Optimism 保护市场 → USDC.e 赔付 → 跨桥路径；完整桥接交易和地址未公开。\n\n## 金额口径\nSlowMist 约 160,000 USD，Blockaid / 媒体约 170,000 USD 或 163,326 USDC.e；保留为同一事件的不同估值。\n\n## 证据边界\nCozy 事件报道、SlowMist 记录与 Blockaid 跟踪支持触发滥用；UMA 结果是否由协同行为造成、完整桥接路径和最终净损失仍待核验。\n\n## 处置状态\nBlockaid 继续跟踪，未确认追回。\n\n## 地址与交易\n公开来源没有提供完整攻击者地址或交易哈希。", "tw": "## 事件背景\nCozy 保護市場的觸發條件依賴 UMA 樂觀預言機答案，賠付資格又沒有綁定提案前持倉快照。\n\n## 事件經過\n1. 攻擊者買入 Aave v2 和 Curve 保護市場 PToken。\n2. 向 UMA 提交 YES 答案且無人爭議。\n3. 市場進入 TRIGGERED 後，攻擊者銷燬 PToken 領取 USDC.e。\n4. 領取後約 13 分鐘，部分資金跨橋轉出。\n\n## 資金流向\nCozy Optimism 保護市場 → USDC.e 賠付 → 跨橋路徑；完整橋接交易和地址未公開。\n\n## 金額口徑\nSlowMist 約 160,000 USD，Blockaid / 媒體約 170,000 USD 或 163,326 USDC.e；保留為同一事件的不同估值。\n\n## 證據邊界\nCozy 事件報道、SlowMist 記錄與 Blockaid 跟蹤支持觸發濫用；UMA 結果是否由協同行為造成、完整橋接路徑和最終淨損失仍待核驗。\n\n## 處置狀態\nBlockaid 繼續跟蹤，未確認追回。\n\n## 地址與交易\n公開來源沒有提供完整攻擊者地址或交易哈希。", "en": "## Incident overview\nCozy protection markets relied on an UMA optimistic-oracle answer, while eligibility was not bound to a pre-proposal holdings snapshot.\n\n## Incident sequence\n1. The attacker bought Aave v2 and Curve protection PTokens.\n2. A YES answer was submitted to UMA without a dispute.\n3. After the market entered TRIGGERED, PTokens were burned for USDC.e.\n4. Part of the funds was bridged out about 13 minutes later.\n\n## Fund flow\nCozy Optimism protection market → USDC.e payout → bridge route; complete bridge transaction and addresses were not published.\n\n## Amount basis\nSlowMist estimated about $160,000, while Blockaid and media cited about $170,000 or 163,326 USDC.e. These are alternative estimates for the same event.\n\n## Evidence boundary\nIncident reporting, the SlowMist record, and Blockaid tracking support the trigger abuse. Whether the UMA result was coordinated, the full bridge route, and final net loss remain open.\n\n## Current status\nBlockaid continued tracking; no recovery was confirmed.\n\n## Addresses and transactions\nPublic sources did not provide a complete attacker address or transaction hash." }, "category": "oracle-manipulation", "severity": "high", "ecosystems": [ "Optimism" ], "chains": [ "Optimism" ], "lossUsd": 160000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 160,000 USD USDC.e；其他来源给出约 170,000 USD 或 163,326 USDC.e。", "tw": "約 160,000 USD USDC.e；其他來源給出約 170,000 USD 或 163,326 USDC.e。", "en": "About $160,000 in USDC.e; other sources cite about $170,000 or 163,326 USDC.e." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "Cozy Finance 事件报道", "tw": "Cozy Finance 事件報道", "en": "Cozy Finance incident report" }, "url": "https://crypto-economy.com/cozy-finance-suffers-second-exploit", "type": "research" }, { "label": { "zh": "SlowMist Cozy 告警", "tw": "SlowMist Cozy 告警", "en": "SlowMist Cozy alert" }, "url": "https://x.com/SlowMist_Team/status/2096881310237426062", "type": "research" }, { "label": { "zh": "SlowMist Hacked 记录", "tw": "SlowMist Hacked 記錄", "en": "SlowMist Hacked record" }, "url": "https://hacked.slowmist.io/?c=bridge&page=1", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-297", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-293", "status": "verified", "incidentDate": "2026-09-07", "datePrecision": "day", "title": { "zh": "Rocket / RCKT Foundation 永续市场价格操纵与桥提款", "tw": "Rocket / RCKT Foundation 永續市場價格操縱與橋提款", "en": "Rocket / RCKT Foundation perpetual-market manipulation and bridge withdrawal" }, "summary": { "zh": "Rocket 低流动性休眠永续市场被自成交操纵，攻击者制造虚假正 PnL 后通过 Bridge 提出约 287,000 USD。平台已暂停充值、提现和交易。", "tw": "Rocket 低流動性休眠永續市場被自成交操縱，攻擊者製造虛假正 PnL 後通過 Bridge 提出約 287,000 USD。平臺已暫停充值、提現和交易。", "en": "A low-liquidity dormant Rocket perpetual market was manipulated through self-trading, creating false positive PnL before about $287,000 was withdrawn through the Bridge. Deposits, withdrawals, and trading were paused." }, "details": { "zh": "## 事件背景\nRocket 的休眠永续市场流动性很低，关联账户可用虚高价格自成交制造账面盈利。\n\n## 事件经过\n1. 2026 年 9 月 6 日，燃烧账户在不活跃市场挂出异常订单。\n2. 攻击者与自身成交，使一侧显示盈利、另一侧形成资不抵债状态。\n3. 盈利账户通过 Rocket Bridge 提出约 287,000 USD。\n4. 项目暂停充值、提现和交易，并联系外部服务追踪。\n\n## 资金流向\n人工制造的 PnL → Rocket Bridge 提款 → 交易所、桥和稳定币服务的追踪 / 限制路径；完整地址未公开。\n\n## 金额口径\n287,000 USD 是公开报道的已提出正 PnL，不等于所有受影响账户余额或最终平台净损失。\n\n## 证据边界\nRocket 官方更新、SlowMist 记录和媒体报道支持市场操纵与暂停状态；目标链、完整交易和提款地址尚未公开。\n\n## 处置状态\n充值、提现和交易暂停，恢复与退款方案未定；没有公开追回确认。\n\n## 地址与交易\n公开来源没有提供适合复核的完整钱包地址或交易哈希。", "tw": "## 事件背景\nRocket 的休眠永續市場流動性很低，關聯賬戶可用虛高價格自成交製造賬面盈利。\n\n## 事件經過\n1. 2026 年 9 月 6 日，燃燒賬戶在不活躍市場掛出異常訂單。\n2. 攻擊者與自身成交，使一側顯示盈利、另一側形成資不抵債狀態。\n3. 盈利賬戶通過 Rocket Bridge 提出約 287,000 USD。\n4. 項目暫停充值、提現和交易，並聯系外部服務追蹤。\n\n## 資金流向\n人工製造的 PnL → Rocket Bridge 提款 → 交易所、橋和穩定幣服務的追蹤 / 限制路徑；完整地址未公開。\n\n## 金額口徑\n287,000 USD 是公開報道的已提出正 PnL，不等於所有受影響賬戶餘額或最終平臺淨損失。\n\n## 證據邊界\nRocket 官方更新、SlowMist 記錄和媒體報道支持市場操縱與暫停狀態；目標鏈、完整交易和提款地址尚未公開。\n\n## 處置狀態\n充值、提現和交易暫停，恢復與退款方案未定；沒有公開追回確認。\n\n## 地址與交易\n公開來源沒有提供適合複核的完整錢包地址或交易哈希。", "en": "## Incident overview\nRocket's dormant perpetual market had very little liquidity, allowing related accounts to create artificial profit through self-trading at inflated prices.\n\n## Incident sequence\n1. On September 6, 2026, a burner account posted abnormal orders in the inactive market.\n2. The attacker traded against itself, showing profit on one side and insolvency on the other.\n3. The profitable account withdrew about $287,000 through the Rocket Bridge.\n4. The project paused deposits, withdrawals, and trading and contacted external services for tracing.\n\n## Fund flow\nArtificial PnL → Rocket Bridge withdrawal → tracing or restriction paths at exchanges, bridges, and stablecoin services; complete addresses were not published.\n\n## Amount basis\nThe $287,000 figure is the reported positive PnL withdrawn, not every affected account balance or final platform net loss.\n\n## Evidence boundary\nRocket updates, the SlowMist record, and media reporting support the manipulation and pause; the target chain, full transactions, and withdrawal address remain unpublished.\n\n## Current status\nDeposits, withdrawals, and trading are paused. Recovery and refund terms are pending, with no public recovery confirmation.\n\n## Addresses and transactions\nPublic sources did not provide a complete wallet address or transaction hash suitable for verification." }, "category": "oracle-manipulation", "severity": "high", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": 287000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 287,000 USD 正 PnL 通过 Rocket Bridge 提出；平台最终净损失和退款仍待确认。", "tw": "約 287,000 USD 正 PnL 通過 Rocket Bridge 提出；平臺最終淨損失和退款仍待確認。", "en": "About $287,000 in positive PnL was withdrawn through the Rocket Bridge; final platform loss and refunds remain unconfirmed." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "Rocket 官方更新", "tw": "Rocket 官方更新", "en": "Rocket official update" }, "url": "https://x.com/rcktfoundation/status/2096594778863669498", "type": "official" }, { "label": { "zh": "Rocket 事件报道", "tw": "Rocket 事件報道", "en": "Rocket incident report" }, "url": "https://crypto.news/rocket-suffers-287k-loss-after-attacker-manipulates-dormant-perp-market", "type": "research" }, { "label": { "zh": "SlowMist Hacked 记录", "tw": "SlowMist Hacked 記錄", "en": "SlowMist Hacked record" }, "url": "https://hacked.slowmist.io/?c=bridge&page=1", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-293", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-292", "status": "verified", "incidentDate": "2026-09-07", "datePrecision": "day", "title": { "zh": "Liquid Network / Blockstream Elements rangeproof 缓存漏洞", "tw": "Liquid Network / Blockstream Elements rangeproof 緩存漏洞", "en": "Liquid Network / Blockstream Elements rangeproof-cache exploit" }, "summary": { "zh": "Elements 的机密交易 rangeproof 验证缓存存在歧义，攻击者据此无抵押铸造约 4,000 L-BTC，再通过正常 peg-out 从联盟储备提出约 4,000 BTC。约 3,400 BTC 已公开报道返还，余款状态仍未完全解决。", "tw": "Elements 的機密交易 rangeproof 驗證緩存存在歧義，攻擊者據此無抵押鑄造約 4,000 L-BTC，再通過正常 peg-out 從聯盟儲備提出約 4,000 BTC。約 3,400 BTC 已公開報道返還，餘款狀態仍未完全解決。", "en": "An ambiguity in Elements confidential-transaction rangeproof caching enabled roughly 4,000 unbacked L-BTC to be minted and pegged out through the normal federation reserve. About 3,400 BTC was publicly reported returned, while the remaining balance is unresolved." }, "details": { "zh": "## 事件背景\nBlockstream Elements 的 rangeproof 验证缓存把无分隔字段作为键，可能让一个有效证明被错误复用于不同输入。该缺陷影响 Liquid 侧铸币和 peg-out 逻辑，不代表 Bitcoin 主网或私钥被攻破。\n\n## 事件经过\n1. 2026 年 9 月 6 日晚，行为人先提交准备交易预热缓存。\n2. 随后提交异常增发交易，铸造约 4,000 L-BTC。\n3. 事件派生 UTXO 被拆分，并通过 SideSwap / 标准 peg-out 路径提取主网 BTC。\n4. 行为人自称白帽，补丁沟通后报道返还约 3,400 BTC，仍有约 598.5 至 600 BTC 未返还。\n\n## 资金流向\n无抵押 L-BTC → Liquid 事件派生 UTXO → peg-out 交易 → Bitcoin 主网联盟储备 BTC；公开资料没有完整披露余款最终控制方。\n\n## 金额口径\n异常铸币约 3,998.5 至 4,000 L-BTC，实际 peg-out 约 3,996 至 4,000 BTC，媒体估值约 318.7M 至 320M USD。返还数量是同一批资产的后续状态，不重复相加。\n\n## 证据边界\nCertiK、Chainalysis、Liquid 官方说明和公开交易支持漏洞、peg-out 路径与返还进度。没有证据显示 Bitcoin 基础层或 federation 私钥被攻破，行为人身份和余款处置仍待确认。\n\n## 处置状态\nElements 已修补，Liquid 曾暂停 peg-in / peg-out 并恢复受控出块；公开信息只确认部分返还，不能把返还报道写成全部追回。\n\n## 地址与交易\n报告提供的完整标识符主要是 Liquid 和 Bitcoin 交易哈希；唯一完整 Bitcoin 地址按资金路径保留，交易哈希只在来源中引用。", "tw": "## 事件背景\nBlockstream Elements 的 rangeproof 驗證緩存把無分隔字段作為鍵，可能讓一個有效證明被錯誤複用於不同輸入。該缺陷影響 Liquid 側鑄幣和 peg-out 邏輯，不代表 Bitcoin 主網或私鑰被攻破。\n\n## 事件經過\n1. 2026 年 9 月 6 日晚，行為人先提交準備交易預熱緩存。\n2. 隨後提交異常增發交易，鑄造約 4,000 L-BTC。\n3. 事件派生 UTXO 被拆分，並通過 SideSwap / 標準 peg-out 路徑提取主網 BTC。\n4. 行為人自稱白帽，補丁溝通後報道返還約 3,400 BTC，仍有約 598.5 至 600 BTC 未返還。\n\n## 資金流向\n無抵押 L-BTC → Liquid 事件派生 UTXO → peg-out 交易 → Bitcoin 主網聯盟儲備 BTC；公開資料沒有完整披露餘款最終控制方。\n\n## 金額口徑\n異常鑄幣約 3,998.5 至 4,000 L-BTC，實際 peg-out 約 3,996 至 4,000 BTC，媒體估值約 318.7M 至 320M USD。返還數量是同一批資產的後續狀態，不重複相加。\n\n## 證據邊界\nCertiK、Chainalysis、Liquid 官方說明和公開交易支持漏洞、peg-out 路徑與返還進度。沒有證據顯示 Bitcoin 基礎層或 federation 私鑰被攻破，行為人身份和餘款處置仍待確認。\n\n## 處置狀態\nElements 已修補，Liquid 曾暫停 peg-in / peg-out 並恢復受控出塊；公開信息只確認部分返還，不能把返還報道寫成全部追回。\n\n## 地址與交易\n報告提供的完整標識符主要是 Liquid 和 Bitcoin 交易哈希；唯一完整 Bitcoin 地址按資金路徑保留，交易哈希只在來源中引用。", "en": "## Incident overview\nElements encoded confidential-transaction rangeproof cache keys without field separators, allowing a valid proof to be reused for different inputs. The flaw affected Liquid minting and peg-out logic, not Bitcoin mainnet or private keys.\n\n## Incident sequence\n1. On the evening of September 6, 2026, the actor submitted setup transactions to warm the cache.\n2. An inflation transaction then minted about 4,000 unbacked L-BTC.\n3. Derived Liquid UTXOs were split and exited through SideSwap and the standard peg-out path.\n4. The actor claimed to be a white hat; after patch discussions, about 3,400 BTC was reportedly returned, leaving roughly 598.5 to 600 BTC unresolved.\n\n## Fund flow\nUnbacked L-BTC → Liquid incident-derived UTXOs → peg-out transactions → Bitcoin federation reserve BTC; the final controller of the remainder is not fully disclosed.\n\n## Amount basis\nAbout 3,998.5 to 4,000 L-BTC was minted and about 3,996 to 4,000 BTC was pegged out, valued near $318.7 million to $320 million. The reported return is subsequent status for the same assets and is not added again.\n\n## Evidence boundary\nCertiK, Chainalysis, Liquid notices, and public transactions support the flaw, peg-out route, and return updates. No evidence shows a Bitcoin base-layer or federation-key compromise; actor identity and the remainder remain unresolved.\n\n## Current status\nElements patched the flaw. Liquid paused peg-in / peg-out during controlled block production; public information confirms only a partial return and not full recovery.\n\n## Addresses and transactions\nThe report provides complete Liquid and Bitcoin transaction hashes. One complete Bitcoin address is retained by fund-flow role, while transaction hashes remain references." }, "category": "bridge-exploit", "severity": "critical", "ecosystems": [ "Liquid", "Bitcoin" ], "chains": [ "Liquid", "Bitcoin" ], "lossUsd": 320000000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 3,996 至 4,000 BTC 从 Liquid 联盟储备 peg-out；媒体估值约 320M USD，部分返还口径单独记录。", "tw": "約 3,996 至 4,000 BTC 從 Liquid 聯盟儲備 peg-out；媒體估值約 320M USD，部分返還口徑單獨記錄。", "en": "About 3,996 to 4,000 BTC left the Liquid federation reserve through peg-out, valued near $320 million; reported returns are recorded separately." }, "addressDisclosure": "published", "addresses": [ { "chain": "Bitcoin", "address": "bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte", "entity": { "zh": "Liquid 事件后 Bitcoin 资金地址", "tw": "Liquid 事件後 Bitcoin 資金地址", "en": "Liquid incident post-peg-out Bitcoin address" }, "role": "stolen_funds", "category": "stolen_funds", "confidence": 0.72, "sourceUrl": "https://www.chainalysis.com/blog/320m-exploit-liquid-network/", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "公开链上路径将该地址与约 3,998 BTC 的后续转移关联，实体控制关系仍待确认。", "tw": "公開鏈上路徑將該地址與約 3,998 BTC 的後續轉移關聯，實體控制關係仍待確認。", "en": "The public route links this address to the later movement of about 3,998 BTC; entity control remains unconfirmed." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "CertiK Liquid 事件分析", "tw": "CertiK Liquid 事件分析", "en": "CertiK Liquid incident analysis" }, "url": "https://www.certik.com/blog/liquid-network-incident-analysis", "type": "research" }, { "label": { "zh": "Chainalysis Liquid 事件分析", "tw": "Chainalysis Liquid 事件分析", "en": "Chainalysis Liquid incident analysis" }, "url": "https://www.chainalysis.com/blog/320m-exploit-liquid-network/", "type": "research" }, { "label": { "zh": "Liquid 官方更新", "tw": "Liquid 官方更新", "en": "Liquid official update" }, "url": "https://x.com/Liquid_BTC/status/2097404704028545175", "type": "official" }, { "label": { "zh": "SlowMist Hacked 记录", "tw": "SlowMist Hacked 記錄", "en": "SlowMist Hacked record" }, "url": "https://hacked.slowmist.io/?c=bridge&page=1", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-292", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-296", "status": "verified", "incidentDate": "2026-09-05", "datePrecision": "day", "title": { "zh": "Dream Health Chain 质押奖励状态机漏洞", "tw": "Dream Health Chain 質押獎勵狀態機漏洞", "en": "Dream Health Chain staking-reward state-machine exploit" }, "summary": { "zh": "Dream Health Chain 的奖励状态机可被极小或零有效 DHC 存款重置，攻击者反复领取固定奖励并卖出约 542,070 DHC，损失约 71,851 USDT。", "tw": "Dream Health Chain 的獎勵狀態機可被極小或零有效 DHC 存款重置，攻擊者反覆領取固定獎勵並賣出約 542,070 DHC，損失約 71,851 USDT。", "en": "Dream Health Chain's reward state machine could be reset with a tiny or effectively zero DHC deposit. The attacker repeatedly claimed fixed rewards and sold about 542,070 DHC, for a loss of about 71,851 USDT." }, "details": { "zh": "## 事件背景\nDream Health Chain 奖励合约的领取状态没有与有效 DHC 存款充分绑定，允许重复领取共享奖池中的固定奖励。\n\n## 事件经过\n1. 2026 年 9 月 5 至 6 日，攻击者循环执行质押、存款和奖励领取。\n2. 通过极小或零有效存款重置已领取状态。\n3. 共享奖池被重复提取，约 542,070 DHC 被卖入 DHC-USDT 池。\n\n## 资金流向\nDHC 质押 / 奖励池 → 重复领取 → DHC-USDT 池卖出；完整地址和交易未恢复。\n\n## 金额口径\nSlowMist 记录损失约 71,851 USDT；DHC 数量是后续出售资产，不与 USDT 损失相加。\n\n## 证据边界\nSlowMist 事件记录和 X 告警支持奖励逻辑与金额；没有项目方完整复盘或完整链上标识符。\n\n## 处置状态\n未确认追回或退款。\n\n## 地址与交易\n公开来源没有提供适合复核的完整攻击地址或交易哈希。", "tw": "## 事件背景\nDream Health Chain 獎勵合約的領取狀態沒有與有效 DHC 存款充分綁定，允許重複領取共享獎池中的固定獎勵。\n\n## 事件經過\n1. 2026 年 9 月 5 至 6 日，攻擊者循環執行質押、存款和獎勵領取。\n2. 通過極小或零有效存款重置已領取狀態。\n3. 共享獎池被重複提取，約 542,070 DHC 被賣入 DHC-USDT 池。\n\n## 資金流向\nDHC 質押 / 獎勵池 → 重複領取 → DHC-USDT 池賣出；完整地址和交易未恢復。\n\n## 金額口徑\nSlowMist 記錄損失約 71,851 USDT；DHC 數量是後續出售資產，不與 USDT 損失相加。\n\n## 證據邊界\nSlowMist 事件記錄和 X 告警支持獎勵邏輯與金額；沒有項目方完整復盤或完整鏈上標識符。\n\n## 處置狀態\n未確認追回或退款。\n\n## 地址與交易\n公開來源沒有提供適合複核的完整攻擊地址或交易哈希。", "en": "## Incident overview\nDream Health Chain did not sufficiently bind reward-claim state to valid DHC deposits, allowing fixed rewards from a shared pool to be claimed repeatedly.\n\n## Incident sequence\n1. During September 5–6, 2026, the attacker looped staking, deposits, and reward claims.\n2. Tiny or effectively zero deposits reset the claimed state.\n3. The shared pool was repeatedly drained and about 542,070 DHC was sold into the DHC-USDT pool.\n\n## Fund flow\nDHC staking / reward pool → repeated claims → DHC-USDT pool sales; complete addresses and transactions were not recovered.\n\n## Amount basis\nThe SlowMist record cites about 71,851 USDT; the DHC quantity is a subsequent sold asset and is not added to the USDT loss.\n\n## Evidence boundary\nThe SlowMist record and X alert support the reward logic and amount; no complete project postmortem or on-chain identifier set was published.\n\n## Current status\nNo recovery or refund was confirmed.\n\n## Addresses and transactions\nPublic sources did not provide a complete attacker address or transaction hash suitable for verification." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "BNB Chain" ], "chains": [ "BNB Chain" ], "lossUsd": 71851, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 71,851 USDT；另有约 542,070 DHC 被卖入 DHC-USDT 池。", "tw": "約 71,851 USDT；另有約 542,070 DHC 被賣入 DHC-USDT 池。", "en": "About 71,851 USDT, with roughly 542,070 DHC sold into the DHC-USDT pool." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "SlowMist Dream Health Chain 告警", "tw": "SlowMist Dream Health Chain 告警", "en": "SlowMist Dream Health Chain alert" }, "url": "https://x.com/SlowMist_Team/status/2096152539767120259", "type": "research" }, { "label": { "zh": "SlowMist Hacked 记录", "tw": "SlowMist Hacked 記錄", "en": "SlowMist Hacked record" }, "url": "https://hacked.slowmist.io/?c=bridge&page=1", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-296", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-295", "status": "verified", "incidentDate": "2026-09-05", "datePrecision": "day", "title": { "zh": "Reddio RedSonic Vault 双金库记账漏洞", "tw": "Reddio RedSonic Vault 雙金庫記賬漏洞", "en": "Reddio RedSonic Vault double-counting accounting exploit" }, "summary": { "zh": "RedSonic Vault 允许无权限注册资产并在 rsvETH / rsvstETH 金库重复计算同一份 stETH。攻击者用 Balancer 闪电贷放大份额价格后提取约 9.25 ETH，估值约 22,800 USD。", "tw": "RedSonic Vault 允許無權限註冊資產並在 rsvETH / rsvstETH 金庫重複計算同一份 stETH。攻擊者用 Balancer 閃電貸放大份額價格後提取約 9.25 ETH，估值約 22,800 USD。", "en": "RedSonic Vault allowed permissionless asset registration and counted the same stETH in both rsvETH and rsvstETH vaults. A Balancer flash loan amplified share pricing and extracted about 9.25 ETH, valued near $22,800." }, "details": { "zh": "## 事件背景\nRedSonic Vault 的资产注册和跨金库记账允许同一份 stETH 同时支持 rsvETH 与 rsvstETH 份额。\n\n## 事件经过\n1. 攻击者从 Balancer 闪电借入约 1,139 WETH。\n2. 大部分 ETH 被存入 rsvETH 并取得份额。\n3. 无权限注册 stETH / rsvstETH 并存入 stETH，使 rsvETH 价格被抬高。\n4. 先赎回 rsvETH 取得超额 ETH，再赎回 rsvstETH 取回同一份 stETH，最后在 Curve 换币并偿还贷款。\n\n## 资金流向\nBalancer WETH 闪电贷 → RedSonic 金库记账操纵 → ETH / stETH 提取 → Curve 换币 → 攻击者收益。\n\n## 金额口径\n攻击者收益和金库损失约 9.25 ETH，美元估值约 22,800 至 23,000 USD；闪电贷本金不计。\n\n## 证据边界\nSlowMist、ExVulSec 相关报道和两个完整地址支持记账机制与资金路径；完整攻击交易和项目方最终对账未公开。\n\n## 处置状态\n截至报告截止时未见追回、回滚或赔付。\n\n## 地址与交易\n攻击者收益地址和 RedSonic Vault 地址均保留为地址标签，攻击交易哈希仅在来源引用中记录。", "tw": "## 事件背景\nRedSonic Vault 的資產註冊和跨金庫記賬允許同一份 stETH 同時支持 rsvETH 與 rsvstETH 份額。\n\n## 事件經過\n1. 攻擊者從 Balancer 閃電借入約 1,139 WETH。\n2. 大部分 ETH 被存入 rsvETH 並取得份額。\n3. 無權限註冊 stETH / rsvstETH 並存入 stETH，使 rsvETH 價格被抬高。\n4. 先贖回 rsvETH 取得超額 ETH，再贖回 rsvstETH 取回同一份 stETH，最後在 Curve 換幣並償還貸款。\n\n## 資金流向\nBalancer WETH 閃電貸 → RedSonic 金庫記賬操縱 → ETH / stETH 提取 → Curve 換幣 → 攻擊者收益。\n\n## 金額口徑\n攻擊者收益和金庫損失約 9.25 ETH，美元估值約 22,800 至 23,000 USD；閃電貸本金不計。\n\n## 證據邊界\nSlowMist、ExVulSec 相關報道和兩個完整地址支持記賬機制與資金路徑；完整攻擊交易和項目方最終對賬未公開。\n\n## 處置狀態\n截至報告截止時未見追回、回滾或賠付。\n\n## 地址與交易\n攻擊者收益地址和 RedSonic Vault 地址均保留為地址標籤，攻擊交易哈希僅在來源引用中記錄。", "en": "## Incident overview\nRedSonic Vault allowed permissionless asset registration and counted one stETH balance in both rsvETH and rsvstETH shares.\n\n## Incident sequence\n1. The attacker flash-borrowed about 1,139 WETH from Balancer.\n2. Most ETH was deposited into rsvETH to obtain shares.\n3. stETH / rsvstETH was registered without permission and deposited, inflating the rsvETH price.\n4. The attacker redeemed excess ETH from rsvETH, recovered the same stETH through rsvstETH, then swapped on Curve and repaid the loan.\n\n## Fund flow\nBalancer WETH flash loan → RedSonic accounting manipulation → ETH / stETH extraction → Curve conversion → attacker proceeds.\n\n## Amount basis\nAttacker proceeds and vault loss were about 9.25 ETH, valued near $22,800 to $23,000; flash-loan principal is excluded.\n\n## Evidence boundary\nSlowMist, related ExVulSec reporting, and two complete addresses support the accounting mechanism and route. The complete attack transaction and project reconciliation remain unpublished.\n\n## Current status\nNo return, rollback, or compensation was found by the report cutoff.\n\n## Addresses and transactions\nThe attacker proceeds address and RedSonic Vault address are retained as labels; the attack hash remains in the references." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 22800, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 9.25 ETH，公开估值约 22,800 至 23,000 USD。", "tw": "約 9.25 ETH，公開估值約 22,800 至 23,000 USD。", "en": "About 9.25 ETH, publicly valued at roughly $22,800 to $23,000." }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0x70f2333d21Ed7E7D105F6578227A9A747687982C", "entity": { "zh": "RedSonic Vault 攻击者收益地址", "tw": "RedSonic Vault 攻擊者收益地址", "en": "RedSonic Vault attacker proceeds address" }, "role": "attacker", "category": "hack", "confidence": 0.82, "sourceUrl": "https://x.com/SlowMist_Team/status/2096439593403089077", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "公开安全记录将该地址与 9.25 ETH 收益路径关联。", "tw": "公開安全記錄將該地址與 9.25 ETH 收益路徑關聯。", "en": "The public security record links this address to the 9.25 ETH proceeds route." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x4315990d9eeaffdfafd49958b4851f203fa1126f", "entity": { "zh": "RedSonic Vault 受影响金库", "tw": "RedSonic Vault 受影響金庫", "en": "Affected RedSonic Vault" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/SlowMist_Team/status/2096439593403089077", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址是受影响金库合约，不是攻击者地址。", "tw": "該地址是受影響金庫合約，不是攻擊者地址。", "en": "This address is the affected vault contract, not an attacker address." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "SlowMist Reddio 技术告警", "tw": "SlowMist Reddio 技術告警", "en": "SlowMist Reddio technical alert" }, "url": "https://x.com/SlowMist_Team/status/2096439593403089077", "type": "research" }, { "label": { "zh": "Reddio 事件报道", "tw": "Reddio 事件報道", "en": "Reddio incident report" }, "url": "https://blockonomi.com/redsonic-vault-exploit-drains-9-25-eth-in-ethereum-flash-loan-attack", "type": "research" }, { "label": { "zh": "SlowMist Hacked 记录", "tw": "SlowMist Hacked 記錄", "en": "SlowMist Hacked record" }, "url": "https://hacked.slowmist.io/?c=bridge&page=1", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-295", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-294", "status": "verified", "incidentDate": "2026-09-05", "datePrecision": "day", "title": { "zh": "Secured Finance 固定利率借贷订单簿记账漏洞", "tw": "Secured Finance 固定利率借貸訂單簿記賬漏洞", "en": "Secured Finance fixed-rate lending order-book accounting exploit" }, "summary": { "zh": "Secured Finance 的订单簿记账把未成交或受操纵订单当作有效价格输入，攻击者结合闪电贷和自成交提取资金。Ethereum、Arbitrum 和 Filecoin 市场随后暂停，损失主口径约 180,000 USD。", "tw": "Secured Finance 的訂單簿記賬把未成交或受操縱訂單當作有效價格輸入，攻擊者結合閃電貸和自成交提取資金。Ethereum、Arbitrum 和 Filecoin 市場隨後暫停，損失主口徑約 180,000 USD。", "en": "Secured Finance order-book accounting treated unfilled or manipulated orders as valid price inputs. The attacker combined flash loans and self-trading to extract funds; Ethereum, Arbitrum, and Filecoin markets were paused, with a primary loss basis of about $180,000." }, "details": { "zh": "## 事件背景\nSecured Finance 固定利率借贷市场的订单簿和余额计算存在价格输入边界问题，未成交订单可能被纳入抵押品估值。\n\n## 事件经过\n1. 2026 年 9 月 5 至 6 日，攻击者部署并调用攻击合约。\n2. 通过闪电贷和同区块自成交操纵订单簿价格。\n3. 系统把虚构借贷或抵押仓位当作有效，随后资金被提出。\n4. 项目暂停 Ethereum、Arbitrum 和 Filecoin 市场。\n\n## 资金流向\n闪电贷 → 订单簿价格操纵 → 虚假抵押 / 借贷余额 → USDC、WBTC、ETH 提取；完整资金路线未公开。\n\n## 金额口径\nSlowMist 与项目侧初步口径约 180,000 USD，部分交易所简报约 104,000 USD；不强行合并为两个损失。\n\n## 证据边界\nSecured Finance 更新、SlowMist 记录和多家报道支持漏洞与暂停状态；攻击链、完整地址、交易集合和最终净损失仍待复核。\n\n## 处置状态\n相关市场已暂停，未确认追回或退款。\n\n## 地址与交易\n公开资料没有提供完整攻击地址或交易哈希。", "tw": "## 事件背景\nSecured Finance 固定利率借貸市場的訂單簿和餘額計算存在價格輸入邊界問題，未成交訂單可能被納入抵押品估值。\n\n## 事件經過\n1. 2026 年 9 月 5 至 6 日，攻擊者部署並調用攻擊合約。\n2. 通過閃電貸和同區塊自成交操縱訂單簿價格。\n3. 系統把虛構借貸或抵押倉位當作有效，隨後資金被提出。\n4. 項目暫停 Ethereum、Arbitrum 和 Filecoin 市場。\n\n## 資金流向\n閃電貸 → 訂單簿價格操縱 → 虛假抵押 / 借貸餘額 → USDC、WBTC、ETH 提取；完整資金路線未公開。\n\n## 金額口徑\nSlowMist 與項目側初步口徑約 180,000 USD，部分交易所簡報約 104,000 USD；不強行合併為兩個損失。\n\n## 證據邊界\nSecured Finance 更新、SlowMist 記錄和多家報道支持漏洞與暫停狀態；攻擊鏈、完整地址、交易集合和最終淨損失仍待複核。\n\n## 處置狀態\n相關市場已暫停，未確認追回或退款。\n\n## 地址與交易\n公開資料沒有提供完整攻擊地址或交易哈希。", "en": "## Incident overview\nSecured Finance had a price-input boundary problem in its fixed-rate lending order book and balance calculations, allowing unfilled orders to influence collateral valuation.\n\n## Incident sequence\n1. The attacker deployed and called an attack contract during September 5–6, 2026.\n2. Flash loans and same-block self-trading manipulated the order-book price.\n3. The system treated fabricated lending or collateral positions as valid before funds were withdrawn.\n4. The project paused its Ethereum, Arbitrum, and Filecoin markets.\n\n## Fund flow\nFlash-loan liquidity → order-book price manipulation → fabricated collateral / lending balance → USDC, WBTC, and ETH withdrawal; the full route is unpublished.\n\n## Amount basis\nSlowMist and project-side reporting cite about $180,000, while some exchange briefs cite about $104,000. The figures are retained as a discrepancy rather than combined.\n\n## Evidence boundary\nSecured Finance updates, the SlowMist record, and multiple reports support the flaw and pause. The attack chain, complete addresses, transaction set, and final net loss require further review.\n\n## Current status\nThe affected markets are paused; no recovery or refund was confirmed.\n\n## Addresses and transactions\nPublic material did not provide a complete attacker address or transaction hash." }, "category": "oracle-manipulation", "severity": "high", "ecosystems": [ "Ethereum", "Arbitrum", "Filecoin" ], "chains": [ "Ethereum", "Arbitrum", "Filecoin" ], "lossUsd": 180000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "安全机构和项目方口径约 180,000 USD；部分交易所简报约 104,000 USD，存在来源差异。", "tw": "安全機構和項目方口徑約 180,000 USD；部分交易所簡報約 104,000 USD，存在來源差異。", "en": "Security and project reporting put the loss near $180,000; some exchange briefs cite about $104,000, a source discrepancy retained here." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "Secured Finance 官方更新", "tw": "Secured Finance 官方更新", "en": "Secured Finance official update" }, "url": "https://x.com/Secured_Fi/status/2097182727992963457", "type": "official" }, { "label": { "zh": "SlowMist Hacked 记录", "tw": "SlowMist Hacked 記錄", "en": "SlowMist Hacked record" }, "url": "https://hacked.slowmist.io/?c=bridge&page=1", "type": "research" }, { "label": { "zh": "KuCoin 事件简报", "tw": "KuCoin 事件簡報", "en": "KuCoin incident brief" }, "url": "https://www.kucoin.com/news/flash/defi-lending-market-secured-finance-hit-by-attack-losing-104-000", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-294", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-288", "status": "verified", "incidentDate": "2026-09-04", "datePrecision": "day", "title": { "zh": "Notional V1 Escrow 算术截断漏洞造成约 173 万美元损失", "tw": "Notional V1 Escrow 算術截斷漏洞造成約 173 萬美元損失", "en": "Notional V1 Escrow arithmetic truncation exploit caused about $1.73 million in losses" }, "summary": { "zh": "Notional 官方确认旧版 V1 合约遭利用。攻击路径通过自由抵押品计算中的整数截断绕过检查，提走约 69,257 DAI 和 1,658,525 USDC，并换成约 689.2 ETH。", "tw": "Notional 官方確認舊版 V1 合約遭利用。攻擊路徑通過自由抵押品計算中的整數截斷繞過檢查，提走約 69,257 DAI 和 1,658,525 USDC，並換成約 689.2 ETH。", "en": "Notional confirmed that a legacy V1 contract was exploited. An integer truncation in the free-collateral path allowed checks to be bypassed, leading to withdrawals of about 69,257 DAI and 1,658,525 USDC that were converted into roughly 689.2 ETH." }, "details": { "zh": "## 事件背景\nNotional 的旧版 V1 Escrow 合约仍持有用户资产。公开技术复核显示，自由抵押品计算中的不安全整数转换可把极大负债截断为零。\n\n## 事件经过\n攻击者构造虚假 fCash 负债，使抵押检查通过后提走 DAI 与 USDC。Notional 随后确认事件并暂停受影响合约。\n\n## 资金流向\n稳定币从 Notional V1 Escrow 路径转入接收与交换地址，随后换成约 689.2 ETH 并分批进入 Tornado Cash。\n\n## 金额口径\n官方公布用户资金损失约 170 万美元；链上数额为约 69,257.37 DAI 与 1,658,524.86 USDC。采用 SlowMist 的 173 万美元汇总口径。\n\n## 证据边界\nNotional 官方确认旧版合约被利用，但详细事后报告尚未公开。整数截断原因来自公开技术复核，后续仍以官方报告为准。\n\n## 处置状态\nNotional 已暂停受影响合约，并表示其他用户资产不受影响。项目方正在寻求追回资金，但没有公开返还证明。\n\n## 地址与交易\n受影响 Escrow proxy、资金接收地址和 Tornado Cash Router 均有完整链上值。中间接收地址按资金路径标注，不扩大为身份归因。\n\n## 2026 年 9 月 9 日技术归因更新\nCertiK 与 SlowMist 后续把 Notional V1 Escrow 的问题进一步收窄为 free-collateral 计算中的不安全整数转换和溢出路径。该更新解释了虚构负债被截断后绕过抵押检查的机制，不改变 9 月 4 日主攻击和约 173 万美元损失口径。\n\n## 更新后的证据边界\n技术归因来自后续安全机构复核；689.2 ETH 进入 Tornado Cash 是同一批盗取资金的后续移动，不增加本事件损失。\n", "tw": "## 事件背景\nNotional 的舊版 V1 Escrow 合約仍持有用戶資產。公開技術複核顯示，自由抵押品計算中的不安全整數轉換可把極大負債截斷為零。\n\n## 事件經過\n攻擊者構造虛假 fCash 負債，使抵押檢查通過後提走 DAI 與 USDC。Notional 隨後確認事件並暫停受影響合約。\n\n## 資金流向\n穩定幣從 Notional V1 Escrow 路徑轉入接收與交換地址，隨後換成約 689.2 ETH 並分批進入 Tornado Cash。\n\n## 金額口徑\n官方公佈用戶資金損失約 170 萬美元；鏈上數額為約 69,257.37 DAI 與 1,658,524.86 USDC。採用 SlowMist 的 173 萬美元彙總口徑。\n\n## 證據邊界\nNotional 官方確認舊版合約被利用，但詳細事後報告尚未公開。整數截斷原因來自公開技術複核，後續仍以官方報告為準。\n\n## 處置狀態\nNotional 已暫停受影響合約，並表示其他用戶資產不受影響。項目方正在尋求追回資金，但沒有公開返還證明。\n\n## 地址與交易\n受影響 Escrow proxy、資金接收地址和 Tornado Cash Router 均有完整鏈上值。中間接收地址按資金路徑標註，不擴大為身份歸因。\n\n## 2026 年 9 月 9 日技術歸因更新\nCertiK 與 SlowMist 後續把 Notional V1 Escrow 的問題進一步收窄為 free-collateral 計算中的不安全整數轉換和溢出路徑。該更新解釋了虛構負債被截斷後繞過抵押檢查的機制，不改變 9 月 4 日主攻擊和約 173 萬美元損失口徑。\n\n## 更新後的證據邊界\n技術歸因來自後續安全機構複核；689.2 ETH 進入 Tornado Cash 是同一批盜取資金的後續移動，不增加本事件損失。\n", "en": "## Incident overview\nNotional's legacy V1 Escrow contract still held user assets. Public technical review found that an unsafe integer conversion in the free-collateral calculation could truncate a very large liability to zero.\n\n## Incident sequence\nThe attacker created a synthetic fCash liability, bypassed collateral checks, and withdrew DAI and USDC. Notional later confirmed the incident and paused the affected contract.\n\n## Fund flow\nStablecoins left the Notional V1 Escrow path for receiving and swap addresses, were converted into about 689.2 ETH, and then entered Tornado Cash in batches.\n\n## Amount basis\nNotional reported about $1.7 million in user losses. On-chain quantities were about 69,257.37 DAI and 1,658,524.86 USDC; this record uses SlowMist's $1.73 million total.\n\n## Evidence boundary\nNotional confirmed exploitation of the legacy contract, but a detailed post-mortem was not yet public. The integer-truncation explanation comes from public technical review and remains subject to the official post-mortem.\n\n## Current status\nNotional paused the affected contract and said other user assets were not at risk. Recovery efforts were announced, but no public return was confirmed.\n\n## Addresses and transactions\nThe affected Escrow proxy, receiving addresses, and Tornado Cash router have complete on-chain identifiers. Intermediate receivers are labeled by fund-flow role without broader identity attribution.\n\n## Technical attribution update on September 9, 2026\nCertiK and SlowMist narrowed the Notional V1 Escrow issue to an unsafe integer conversion and overflow path in free-collateral calculations. The update explains how a synthetic liability was truncated and bypassed collateral checks; it does not change the September 4 attack or the roughly $1.73 million loss basis.\n\n## Updated evidence boundary\nThe technical attribution comes from later security reviews. The 689.2 ETH sent to Tornado Cash is movement of the same stolen funds and does not increase this incident's loss.\n" }, "category": "protocol-exploit", "severity": "critical", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 1730000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 69,257.37 DAI 与 1,658,524.86 USDC，合计约 173 万美元；随后换成约 689.2 ETH。", "tw": "約 69,257.37 DAI 與 1,658,524.86 USDC，合計約 173 萬美元；隨後換成約 689.2 ETH。", "en": "About 69,257.37 DAI and 1,658,524.86 USDC, totaling about $1.73 million; later converted into roughly 689.2 ETH." }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0x9abd0b8868546105F6F48298eaDC1D9c82f7f683", "entity": { "zh": "Notional V1 受影响 Escrow proxy", "tw": "Notional V1 受影響 Escrow proxy", "en": "Affected Notional V1 Escrow proxy" }, "role": "affected-contract", "category": "unknown", "confidence": 0.92, "sourceUrl": "https://x.com/NotionalFinance/status/2095905726094856391", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Notional V1 受影响 Escrow proxy", "tw": "Notional V1 受影響 Escrow proxy", "en": "Affected Notional V1 Escrow proxy" }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xDaCC235a494750193695A111D715c2ca12b5Ce38", "entity": { "zh": "Notional 被盗资金接收与交换地址", "tw": "Notional 被盜資金接收與交換地址", "en": "Notional stolen-funds receiving and swap address" }, "role": "stolen-funds-destination", "category": "stolen_funds", "confidence": 0.82, "sourceUrl": "https://x.com/PeckShieldAlert/status/2095678080241303915", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Notional 被盗资金接收与交换地址", "tw": "Notional 被盜資金接收與交換地址", "en": "Notional stolen-funds receiving and swap address" }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xC95496c917A41a394EfdAC3e0882F5903D24De69", "entity": { "zh": "Notional 被盗资金归集地址", "tw": "Notional 被盜資金歸集地址", "en": "Notional stolen-funds aggregation address" }, "role": "aggregation", "category": "stolen_funds", "confidence": 0.82, "sourceUrl": "https://x.com/PeckShieldAlert/status/2095678080241303915", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Notional 被盗资金归集地址", "tw": "Notional 被盜資金歸集地址", "en": "Notional stolen-funds aggregation address" }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xd90e2f925DA726b50C4Ed8D0Fb90Ad053324F31b", "entity": { "zh": "Tornado Cash Router", "tw": "Tornado Cash Router", "en": "Tornado Cash router" }, "role": "mixer", "category": "mixer", "confidence": 1, "sourceUrl": "https://etherscan.io/address/0xd90e2f925da726b50c4ed8d0fb90ad053324f31b", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Tornado Cash Router", "tw": "Tornado Cash Router", "en": "Tornado Cash router" }, "reviewRequired": true } ], "references": [ { "label": { "zh": "Notional 官方事件确认", "tw": "Notional 官方事件確認", "en": "Notional official incident confirmation" }, "url": "https://x.com/NotionalFinance/status/2095905726094856391", "type": "official" }, { "label": { "zh": "SlowMist Hacked 技术记录", "tw": "SlowMist Hacked 技術記錄", "en": "SlowMist Hacked technical record" }, "url": "https://hacked.slowmist.io/zh/", "type": "research" }, { "label": { "zh": "PeckShield 资金路径告警", "tw": "PeckShield 資金路徑告警", "en": "PeckShield fund-flow alert" }, "url": "https://x.com/PeckShieldAlert/status/2095678080241303915", "type": "research" }, { "label": { "zh": "Notional 主提取交易", "tw": "Notional 主提取交易", "en": "Notional primary withdrawal transaction" }, "url": "https://eth.blockscout.com/tx/0xc3f3e318f7ab2d0daaba59e6ec901d25d1fe8a89aafe2b2b62e3b9aee1a24efa", "type": "explorer" }, { "label": { "zh": "CertiK Notional 技术复核", "tw": "CertiK Notional 技術複核", "en": "CertiK Notional technical review" }, "url": "https://x.com/CertiKAlert/status/2095797115788443893", "type": "research" }, { "label": { "zh": "SlowMist Notional 技术复核", "tw": "SlowMist Notional 技術複核", "en": "SlowMist Notional technical review" }, "url": "https://x.com/SlowMist_Team/status/2096871318478336037", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-288", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-289", "status": "verified", "incidentDate": "2026-09-01", "datePrecision": "day", "title": { "zh": "GebProxyActions 访问控制缺陷导致约 5.94 ETH 被盗", "tw": "GebProxyActions 訪問控制缺陷導致約 5.94 ETH 被盜", "en": "GebProxyActions access-control flaw enabled the theft of about 5.94 ETH" }, "summary": { "zh": "部分历史 SAFE 把共享 GebProxyActions 合约登记为所有者。攻击者直接调用缺少调用者校验的 quitSystem，迁移并提取四个 SAFE 的剩余抵押品，共约 5.9436 ETH。", "tw": "部分歷史 SAFE 把共享 GebProxyActions 合約登記為所有者。攻擊者直接調用缺少調用者校驗的 quitSystem，遷移並提取四個 SAFE 的剩餘抵押品，共約 5.9436 ETH。", "en": "Several historical SAFEs registered the shared GebProxyActions contract as owner. An attacker directly called the unauthenticated quitSystem helper and withdrew residual collateral from four SAFEs, totaling about 5.9436 ETH." }, "details": { "zh": "## 事件背景\nGebProxyActions 的公开函数原本用于 DSProxy 委托调用。部分历史 SAFE 却把共享动作合约本身登记为所有者，形成可被直接调用的权限边界。\n\n## 事件经过\n攻击者处理四个已进入全局结算的 SAFE，再直接调用 quitSystem 把剩余抵押品迁移到攻击合约，随后释放抵押品、退出 WETH 并转为 ETH。\n\n## 资金流向\n四个 SAFE 的剩余抵押品经 GebProxyActions 和抵押品适配器进入攻击合约，解除 WETH 包装后转到攻击者地址。\n\n## 金额口径\n公开交易追踪给出 5.943599831844387377 ETH，按当时价格约合 14,476 美元。\n\n## 证据边界\nSlowMist 公布根因、攻击者、受影响合约和交易。源码确认 quitSystem 为公开函数，但历史 SAFE 的错误所有权状态需要结合交易追踪判断。\n\n## 处置状态\n攻击交易已完成；公开资料没有确认冻结、返还或赔付。\n\n## 地址与交易\n攻击者、GebProxyActions 和受影响 CollateralJoin1 均有完整地址；共享动作合约与受影响合约明确标注为非攻击者基础设施。", "tw": "## 事件背景\nGebProxyActions 的公開函數原本用於 DSProxy 委託調用。部分歷史 SAFE 卻把共享動作合約本身登記為所有者，形成可被直接調用的權限邊界。\n\n## 事件經過\n攻擊者處理四個已進入全局結算的 SAFE，再直接調用 quitSystem 把剩餘抵押品遷移到攻擊合約，隨後釋放抵押品、退出 WETH 並轉為 ETH。\n\n## 資金流向\n四個 SAFE 的剩餘抵押品經 GebProxyActions 和抵押品適配器進入攻擊合約，解除 WETH 包裝後轉到攻擊者地址。\n\n## 金額口徑\n公開交易追蹤給出 5.943599831844387377 ETH，按當時價格約合 14,476 美元。\n\n## 證據邊界\nSlowMist 公佈根因、攻擊者、受影響合約和交易。源碼確認 quitSystem 為公開函數，但歷史 SAFE 的錯誤所有權狀態需要結合交易追蹤判斷。\n\n## 處置狀態\n攻擊交易已完成；公開資料沒有確認凍結、返還或賠付。\n\n## 地址與交易\n攻擊者、GebProxyActions 和受影響 CollateralJoin1 均有完整地址；共享動作合約與受影響合約明確標註為非攻擊者基礎設施。", "en": "## Incident overview\nGebProxyActions public helpers were intended for DSProxy delegate calls. Several historical SAFEs instead registered the shared actions contract itself as owner, creating a direct-call authorization boundary.\n\n## Incident sequence\nThe attacker processed four globally settled SAFEs, called quitSystem directly to migrate residual collateral, freed the collateral, exited WETH, and converted it to ETH.\n\n## Fund flow\nResidual collateral from four SAFEs moved through GebProxyActions and the collateral adapter into the attack path, where WETH was unwrapped and forwarded to the attacker.\n\n## Amount basis\nPublic transaction analysis measured 5.943599831844387377 ETH, valued near $14,476 at the stated price.\n\n## Evidence boundary\nSlowMist published the root cause, attacker, affected contracts, and transaction. Source code confirms that quitSystem is public, while the historical ownership state depends on transaction-level reconstruction.\n\n## Current status\nThe theft transaction completed. No public evidence confirmed a freeze, return, or reimbursement.\n\n## Addresses and transactions\nThe attacker, GebProxyActions contract, and affected CollateralJoin1 have complete identifiers. Shared and affected contracts are explicitly labeled as non-attacker infrastructure." }, "category": "access-control", "severity": "high", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 14476, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 5.9436 ETH；按公开技术分析使用的价格约合 14,476 美元。", "tw": "約 5.9436 ETH；按公開技術分析使用的價格約合 14,476 美元。", "en": "About 5.9436 ETH, valued near $14,476 using the price basis in the public technical analysis." }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0xb929c7215c0ec8ebad5fbf73b1da63bccfff1896", "entity": { "zh": "GebProxyActions 攻击者地址", "tw": "GebProxyActions 攻擊者地址", "en": "GebProxyActions attacker" }, "role": "attacker", "category": "hack", "confidence": 0.96, "sourceUrl": "https://x.com/SlowMist_Team/status/2094986310683705835", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "GebProxyActions 攻击者地址", "tw": "GebProxyActions 攻擊者地址", "en": "GebProxyActions attacker" }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x84fe452d9fb495a335c74a225e6ad52c35eb8616", "entity": { "zh": "GebProxyActions 共享动作合约", "tw": "GebProxyActions 共享動作合約", "en": "Shared GebProxyActions contract" }, "role": "vulnerable-contract", "category": "unknown", "confidence": 1, "sourceUrl": "https://github.com/reflexer-labs/geb-proxy-actions/blob/master/src/GebProxyActions.sol", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "GebProxyActions 共享动作合约", "tw": "GebProxyActions 共享動作合約", "en": "Shared GebProxyActions contract" }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xe843783144acdf485ff86d726bcb67dd316e0bbe", "entity": { "zh": "GebProxyActions 事件受影响 CollateralJoin1", "tw": "GebProxyActions 事件受影響 CollateralJoin1", "en": "Affected CollateralJoin1 in the GebProxyActions incident" }, "role": "affected-contract", "category": "unknown", "confidence": 0.95, "sourceUrl": "https://x.com/SlowMist_Team/status/2094986310683705835", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "GebProxyActions 事件受影响 CollateralJoin1", "tw": "GebProxyActions 事件受影響 CollateralJoin1", "en": "Affected CollateralJoin1 in the GebProxyActions incident" }, "reviewRequired": true } ], "references": [ { "label": { "zh": "SlowMist 技术告警", "tw": "SlowMist 技術告警", "en": "SlowMist technical alert" }, "url": "https://x.com/SlowMist_Team/status/2094986310683705835", "type": "research" }, { "label": { "zh": "GebProxyActions 源码", "tw": "GebProxyActions 源碼", "en": "GebProxyActions source code" }, "url": "https://github.com/reflexer-labs/geb-proxy-actions/blob/master/src/GebProxyActions.sol", "type": "official" }, { "label": { "zh": "攻击交易", "tw": "攻擊交易", "en": "Attack transaction" }, "url": "https://etherscan.io/tx/0xfbce28e35c26358110dd9ed91f9ceef588acb264c3cf6c573df65ca21335058f", "type": "explorer" }, { "label": { "zh": "公开交易级技术分析", "tw": "公開交易級技術分析", "en": "Public transaction-level technical analysis" }, "url": "https://anomly.rs/reflexer-geb-proxy-actions-safe-drain", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-289", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-287", "status": "verified", "incidentDate": "2026-09-01", "datePrecision": "day", "title": { "zh": "两笔 2024 年遗留钓鱼授权造成约 18.7 万美元盗币", "tw": "兩筆 2024 年遺留釣魚授權造成約 18.7 萬美元盜幣", "en": "Two phishing approvals from 2024 enabled about $187,000 in theft" }, "summary": { "zh": "两名 Ethereum 用户此前签署的恶意授权长期未撤销。钱包重新收到 SYN 和 USDC 后，攻击者利用旧授权转走资产，公开合计为 187,046 美元。", "tw": "兩名 Ethereum 用戶此前簽署的惡意授權長期未撤銷。錢包重新收到 SYN 和 USDC 後，攻擊者利用舊授權轉走資產，公開合計為 187,046 美元。", "en": "Two Ethereum users had not revoked malicious approvals signed in 2024. After SYN and USDC reached the wallets, the old approvals were used to transfer assets worth a reported total of $187,046." }, "details": { "zh": "## 事件背景\n两名受害者分别在 2024 年签署恶意授权，此后没有撤销相关权限。攻击者等待钱包再次收到资产后使用旧授权。\n\n## 事件经过\nSYN 受害钱包在资金到账约 25 小时后被转走资产；USDC 受害钱包在资金到账约 4 天后被转走资产。两笔执行交易均在 2026 年 9 月 1 日成功上链。\n\n## 资金流向\nSYN 和 USDC 从两名受害者地址经旧授权路径转出。公开帖子没有给出完整的最终归集地址。\n\n## 金额口径\nScam Sniffer 的标题合计为 187,046 美元，两个分项相加为 187,052 美元。记录保留标题口径并披露 6 美元差异。\n\n## 证据边界\n公开来源提供两名受害者地址和两笔执行交易，但没有提供完整攻击者归集账本。受害者地址不标记为攻击者。\n\n## 处置状态\n两笔盗取已经执行；截至核验点，没有公开资金返还或冻结证明。\n\n## 地址与交易\n受害地址和交易均为完整公开值。地址标签仅表示受害关系，不表示高风险主体。", "tw": "## 事件背景\n兩名受害者分別在 2024 年簽署惡意授權，此後沒有撤銷相關權限。攻擊者等待錢包再次收到資產後使用舊授權。\n\n## 事件經過\nSYN 受害錢包在資金到賬約 25 小時後被轉走資產；USDC 受害錢包在資金到賬約 4 天后被轉走資產。兩筆執行交易均在 2026 年 9 月 1 日成功上鍊。\n\n## 資金流向\nSYN 和 USDC 從兩名受害者地址經舊授權路徑轉出。公開帖子沒有給出完整的最終歸集地址。\n\n## 金額口徑\nScam Sniffer 的標題合計為 187,046 美元，兩個分項相加為 187,052 美元。記錄保留標題口徑並披露 6 美元差異。\n\n## 證據邊界\n公開來源提供兩名受害者地址和兩筆執行交易，但沒有提供完整攻擊者歸集賬本。受害者地址不標記為攻擊者。\n\n## 處置狀態\n兩筆盜取已經執行；截至核驗點，沒有公開資金返還或凍結證明。\n\n## 地址與交易\n受害地址和交易均為完整公開值。地址標籤僅表示受害關係，不表示高風險主體。", "en": "## Incident overview\nTwo victims signed malicious approvals in 2024 and did not revoke them. The attacker waited until the wallets received assets again before using the old permissions.\n\n## Incident sequence\nThe SYN wallet was drained about 25 hours after funding, and the USDC wallet about four days after funding. Both execution transactions succeeded on September 1, 2026.\n\n## Fund flow\nSYN and USDC left the two victim wallets through the old approval paths. The public alert did not provide a complete final aggregation ledger.\n\n## Amount basis\nScam Sniffer reported a headline total of $187,046, while the two components sum to $187,052. The record keeps the headline figure and discloses the $6 difference.\n\n## Evidence boundary\nThe source provides both victim addresses and execution transactions but not a complete attacker aggregation ledger. Victim addresses are not labeled as attackers.\n\n## Current status\nBoth thefts were executed. No public evidence confirmed a return or freeze by the verification point.\n\n## Addresses and transactions\nVictim addresses and transactions are complete public identifiers. Address labels describe victim status only and do not classify the owners as risky actors." }, "category": "phishing-approval", "severity": "high", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 187046, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开标题合计为 187,046 美元；分项为 124,563 美元 SYN 和 62,489 美元 USDC，存在 6 美元舍入差异。", "tw": "公開標題合計為 187,046 美元；分項為 124,563 美元 SYN 和 62,489 美元 USDC，存在 6 美元舍入差異。", "en": "The reported headline total is $187,046; components are $124,563 in SYN and $62,489 in USDC, a $6 rounding difference." }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0x686618abb3730079601a5abead6ec24549c5ce34", "entity": { "zh": "SYN 盗币事件受害地址", "tw": "SYN 盜幣事件受害地址", "en": "Victim address in the SYN theft" }, "role": "victim", "category": "unknown", "confidence": 0.95, "sourceUrl": "https://x.com/realScamSniffer/status/2094609949171356124", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "SYN 盗币事件受害地址", "tw": "SYN 盜幣事件受害地址", "en": "Victim address in the SYN theft" }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xdfc1497ef2ca6d884ec90d2fc4fb816a5ea735f2", "entity": { "zh": "USDC 盗币事件受害地址", "tw": "USDC 盜幣事件受害地址", "en": "Victim address in the USDC theft" }, "role": "victim", "category": "unknown", "confidence": 0.95, "sourceUrl": "https://x.com/realScamSniffer/status/2094609949171356124", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "USDC 盗币事件受害地址", "tw": "USDC 盜幣事件受害地址", "en": "Victim address in the USDC theft" }, "reviewRequired": true } ], "references": [ { "label": { "zh": "Scam Sniffer 原始告警", "tw": "Scam Sniffer 原始告警", "en": "Scam Sniffer original alert" }, "url": "https://x.com/realScamSniffer/status/2094609949171356124", "type": "research" }, { "label": { "zh": "SYN 盗取交易", "tw": "SYN 盜取交易", "en": "SYN theft transaction" }, "url": "https://etherscan.io/tx/0x1c000ae7bf83d24c79ebae962561e253ed26fc7d9a908e188dc721d33597b4bb", "type": "explorer" }, { "label": { "zh": "USDC 盗取交易", "tw": "USDC 盜取交易", "en": "USDC theft transaction" }, "url": "https://etherscan.io/tx/0x430f4949d3e353cd806d6772e29246337a145be3b9cfa04596ad245b5a6c151c", "type": "explorer" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-287", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-286", "status": "verified", "incidentDate": "2026-08-31", "datePrecision": "day", "title": { "zh": "Float Protocol 因现货价格操纵损失约 2.8 万美元", "tw": "Float Protocol 因現貨價格操縱損失約 2.8 萬美元", "en": "Float Protocol lost about $28,000 to spot-price manipulation" }, "summary": { "zh": "攻击者通过闪电贷扭曲 Uniswap V3 池的现货价格，使 Float Protocol 的 Hypervisor 错误计算份额价值，并在反复存取后净得约 10.71 ETH。", "tw": "攻擊者通過閃電貸扭曲 Uniswap V3 池的現貨價格，使 Float Protocol 的 Hypervisor 錯誤計算份額價值，並在反覆存取後淨得約 10.71 ETH。", "en": "An attacker used flash loans to distort a Uniswap V3 spot price, causing Float Protocol Hypervisors to misprice shares and allowing about 10.71 ETH to be extracted through repeated deposits and withdrawals." }, "details": { "zh": "## 事件背景\n受影响的 Hypervisor 直接依赖 Uniswap V3 的 slot0 现货价格，关键计算缺少 TWAP、独立预言机和滑点保护。\n\n## 事件经过\n攻击者利用闪电贷和大额交易扭曲池内价格，再反复存入和提取被错误定价的份额，最终净得约 10.71 ETH。\n\n## 资金流向\n攻击所得从攻击合约回到攻击者地址，其中 10 ETH 随后转入 Tornado Cash Router。\n\n## 金额口径\nSlowMist 报告净损失约 10.71 ETH，按披露时估值约 28,000 美元。混币金额是损失资金的后续路径，不重复计入。\n\n## 证据边界\nSlowMist 提供根因、完整地址和攻击交易。其公开底层池字符串长度异常，因此该字符串不进入正式地址记录。\n\n## 处置状态\n公开资料没有确认资金返还、冻结或赔付；至少 10 ETH 已进入 Tornado Cash。\n\n## 地址与交易\n攻击者地址、攻击合约和两个受影响 Hypervisor 均有完整公开值。受影响合约明确标注为非攻击者。", "tw": "## 事件背景\n受影響的 Hypervisor 直接依賴 Uniswap V3 的 slot0 現貨價格，關鍵計算缺少 TWAP、獨立預言機和滑點保護。\n\n## 事件經過\n攻擊者利用閃電貸和大額交易扭曲池內價格，再反覆存入和提取被錯誤定價的份額，最終淨得約 10.71 ETH。\n\n## 資金流向\n攻擊所得從攻擊合約回到攻擊者地址，其中 10 ETH 隨後轉入 Tornado Cash Router。\n\n## 金額口徑\nSlowMist 報告淨損失約 10.71 ETH，按披露時估值約 28,000 美元。混幣金額是損失資金的後續路徑，不重複計入。\n\n## 證據邊界\nSlowMist 提供根因、完整地址和攻擊交易。其公開底層池字符串長度異常，因此該字符串不進入正式地址記錄。\n\n## 處置狀態\n公開資料沒有確認資金返還、凍結或賠付；至少 10 ETH 已進入 Tornado Cash。\n\n## 地址與交易\n攻擊者地址、攻擊合約和兩個受影響 Hypervisor 均有完整公開值。受影響合約明確標註為非攻擊者。", "en": "## Incident overview\nThe affected Hypervisors relied directly on a Uniswap V3 slot0 spot price. Critical calculations lacked TWAP, independent oracle, and slippage protections.\n\n## Incident sequence\nThe attacker used flash loans and large swaps to distort the pool price, then repeatedly deposited and withdrew mispriced shares, extracting about 10.71 ETH.\n\n## Fund flow\nProceeds returned from the attack contract to the attacker wallet, and 10 ETH later entered the Tornado Cash router.\n\n## Amount basis\nSlowMist reported a net loss of about 10.71 ETH, valued near $28,000 at disclosure. The mixer deposit represents subsequent movement of the same funds.\n\n## Evidence boundary\nSlowMist published the root cause, complete addresses, and attack transaction. Its public underlying-pool string has an invalid length and is excluded from the formal address record.\n\n## Current status\nNo public evidence confirmed a return, freeze, or reimbursement. At least 10 ETH entered Tornado Cash.\n\n## Addresses and transactions\nThe attacker, attack contract, and two affected Hypervisors have complete public identifiers. Affected contracts are explicitly labeled as non-attacker infrastructure." }, "category": "oracle-manipulation", "severity": "high", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 28000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "净损失约 10.7066 ETH，公开估值约 28,000 美元；其中 10 ETH 随后进入 Tornado Cash。", "tw": "淨損失約 10.7066 ETH，公開估值約 28,000 美元；其中 10 ETH 隨後進入 Tornado Cash。", "en": "Net loss was about 10.7066 ETH, valued near $28,000; 10 ETH later entered Tornado Cash." }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0xaea29218262dc6b0904ca077f6527c49dfd426d9", "entity": { "zh": "Float Protocol 攻击者地址", "tw": "Float Protocol 攻擊者地址", "en": "Float Protocol attacker" }, "role": "attacker", "category": "hack", "confidence": 0.95, "sourceUrl": "https://x.com/SlowMist_Team/status/2094373942291026287", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Float Protocol 攻击者地址", "tw": "Float Protocol 攻擊者地址", "en": "Float Protocol attacker" }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xb46655eb5b77de277063a75586d1883e951b6c54", "entity": { "zh": "Float Protocol 攻击合约", "tw": "Float Protocol 攻擊合約", "en": "Float Protocol attack contract" }, "role": "attacker-contract", "category": "hack", "confidence": 0.95, "sourceUrl": "https://x.com/SlowMist_Team/status/2094373942291026287", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Float Protocol 攻击合约", "tw": "Float Protocol 攻擊合約", "en": "Float Protocol attack contract" }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x85cbed523459b7f6f81c11e710df969703a8a70c", "entity": { "zh": "Float Protocol 受影响 Hypervisor", "tw": "Float Protocol 受影響 Hypervisor", "en": "Affected Float Protocol Hypervisor" }, "role": "affected-contract", "category": "unknown", "confidence": 0.95, "sourceUrl": "https://x.com/SlowMist_Team/status/2094373942291026287", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Float Protocol 受影响 Hypervisor", "tw": "Float Protocol 受影響 Hypervisor", "en": "Affected Float Protocol Hypervisor" }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xc86b1e7fa86834cac1468937cdd53ba3ccbc1153", "entity": { "zh": "Float Protocol 受影响 Hypervisor", "tw": "Float Protocol 受影響 Hypervisor", "en": "Affected Float Protocol Hypervisor" }, "role": "affected-contract", "category": "unknown", "confidence": 0.95, "sourceUrl": "https://x.com/SlowMist_Team/status/2094373942291026287", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Float Protocol 受影响 Hypervisor", "tw": "Float Protocol 受影響 Hypervisor", "en": "Affected Float Protocol Hypervisor" }, "reviewRequired": true } ], "references": [ { "label": { "zh": "SlowMist 技术告警", "tw": "SlowMist 技術告警", "en": "SlowMist technical alert" }, "url": "https://x.com/SlowMist_Team/status/2094373942291026287", "type": "research" }, { "label": { "zh": "Ethereum 攻击交易", "tw": "Ethereum 攻擊交易", "en": "Ethereum attack transaction" }, "url": "https://etherscan.io/tx/0x3d7549db65344da2a41067e17791b17fac16ec6b8e5132e82e243f6541de5cff", "type": "explorer" }, { "label": { "zh": "SlowMist Hacked 记录", "tw": "SlowMist Hacked 記錄", "en": "SlowMist Hacked record" }, "url": "https://hacked.slowmist.io/zh/", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-286", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-285", "status": "verified", "incidentDate": "2026-08-31", "datePrecision": "day", "title": { "zh": "Ankr ankrFLOW 漏洞牵连 MORE Markets 储备", "tw": "Ankr ankrFLOW 漏洞牽連 MORE Markets 儲備", "en": "Ankr ankrFLOW exploit affected MORE Markets reserves" }, "summary": { "zh": "Ankr 的 ankrFLOW 合约允许生成约 860 万枚无抵押代币，攻击者将其存入 MORE Markets 后借走约 1,550 万枚 WFLOW。Flow 官方按现货价格将储备影响修正为约 41 万美元。", "tw": "Ankr 的 ankrFLOW 合約允許生成約 860 萬枚無抵押代幣，攻擊者將其存入 MORE Markets 後借走約 1,550 萬枚 WFLOW。Flow 官方按現貨價格將儲備影響修正為約 41 萬美元。", "en": "A flaw in Ankr's ankrFLOW contract allowed about 8.6 million unbacked tokens to be created and deposited into MORE Markets, where roughly 15.5 million WFLOW was borrowed. Flow corrected the spot-value reserve impact to about $410,000." }, "details": { "zh": "## 事件背景\nFlow 官方确认问题位于 Ankr 的 ankrFLOW Solidity 合约，不是 Flow EVM 或 MORE Markets 合约漏洞。\n\n## 事件经过\n攻击者生成约 860 万枚无抵押 ankrFLOW，将其作为 MORE Markets 的抵押品，并通过借贷路径抽走约 1,550 万枚 WFLOW。\n\n## 资金流向\n无抵押 ankrFLOW 进入 MORE Markets 抵押路径，WFLOW 储备随后流向攻击者及辅助合约，并发生后续变现。\n\n## 金额口径\nFlow 将早期约 930 万美元的检测估值纠正为约 410,000 美元现货影响；攻击者在滑点后实现约 246,000 美元。\n\n## 证据边界\n官方说明确认漏洞归属和储备影响，但没有公开完整事后资金账本。储备影响与攻击者实际变现不能相加。\n\n## 处置状态\nAnkr 与 MORE Markets 暂停受影响合约。Flow 表示网络正常，并与 Ankr 协作补足储备和重平衡流动性。\n\n## 地址与交易\n公开安全记录列出攻击者地址、辅助合约、受影响池和主攻击交易。受影响池明确标注为非攻击者。", "tw": "## 事件背景\nFlow 官方確認問題位於 Ankr 的 ankrFLOW Solidity 合約，不是 Flow EVM 或 MORE Markets 合約漏洞。\n\n## 事件經過\n攻擊者生成約 860 萬枚無抵押 ankrFLOW，將其作為 MORE Markets 的抵押品，並通過借貸路徑抽走約 1,550 萬枚 WFLOW。\n\n## 資金流向\n無抵押 ankrFLOW 進入 MORE Markets 抵押路徑，WFLOW 儲備隨後流向攻擊者及輔助合約，併發生後續變現。\n\n## 金額口徑\nFlow 將早期約 930 萬美元的檢測估值糾正為約 410,000 美元現貨影響；攻擊者在滑點後實現約 246,000 美元。\n\n## 證據邊界\n官方說明確認漏洞歸屬和儲備影響，但沒有公開完整事後資金賬本。儲備影響與攻擊者實際變現不能相加。\n\n## 處置狀態\nAnkr 與 MORE Markets 暫停受影響合約。Flow 表示網絡正常，並與 Ankr 協作補足儲備和重平衡流動性。\n\n## 地址與交易\n公開安全記錄列出攻擊者地址、輔助合約、受影響池和主攻擊交易。受影響池明確標註為非攻擊者。", "en": "## Incident overview\nFlow confirmed that the flaw was in Ankr's ankrFLOW Solidity contract, not Flow EVM or the MORE Markets contracts.\n\n## Incident sequence\nThe attacker created about 8.6 million unbacked ankrFLOW, posted it as collateral on MORE Markets, and borrowed about 15.5 million WFLOW from the reserve.\n\n## Fund flow\nUnbacked ankrFLOW entered the MORE Markets collateral path. WFLOW reserves then moved to the attacker and helper contract before later conversion.\n\n## Amount basis\nFlow corrected an early detector estimate of about $9.3 million to a spot-value impact of about $410,000. The attacker realized about $246,000 after slippage.\n\n## Evidence boundary\nThe official statement confirms the affected contract and reserve impact but does not publish a complete post-incident fund ledger. Reserve impact and realized proceeds are not additive.\n\n## Current status\nAnkr and MORE Markets paused the affected contracts. Flow said the network was operating normally and that it would work with Ankr to replace reserves and rebalance liquidity.\n\n## Addresses and transactions\nPublic security records identify the attacker, helper contract, affected pool, and main attack transaction. The affected pool is explicitly labeled as non-attacker infrastructure." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "Flow EVM" ], "chains": [ "Flow EVM" ], "lossUsd": 410000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 1,550 万枚 WFLOW 离开储备，现货价值约 410,000 美元；攻击者滑点后实现约 246,000 美元。", "tw": "約 1,550 萬枚 WFLOW 離開儲備，現貨價值約 410,000 美元；攻擊者滑點後實現約 246,000 美元。", "en": "About 15.5 million WFLOW left the reserve, worth about $410,000 at spot; the attacker realized about $246,000 after slippage." }, "addressDisclosure": "published", "addresses": [ { "chain": "Flow EVM", "address": "0xa1E4B05F9A0425136045D8fC8A4978B25bB6A7Cc", "entity": { "zh": "Ankr 事件攻击者地址", "tw": "Ankr 事件攻擊者地址", "en": "Attacker address in the Ankr incident" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/blockaid_/status/2094518648123842712", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Ankr 事件攻击者地址", "tw": "Ankr 事件攻擊者地址", "en": "Attacker address in the Ankr incident" }, "reviewRequired": true }, { "chain": "Flow EVM", "address": "0xA0C2fe72aD9b640994A9c4252F25Fb058DDb3702", "entity": { "zh": "Ankr 事件攻击辅助合约", "tw": "Ankr 事件攻擊輔助合約", "en": "Attack helper in the Ankr incident" }, "role": "attacker-contract", "category": "hack", "confidence": 0.88, "sourceUrl": "https://x.com/blockaid_/status/2094518648123842712", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Ankr 事件攻击辅助合约", "tw": "Ankr 事件攻擊輔助合約", "en": "Attack helper in the Ankr incident" }, "reviewRequired": true }, { "chain": "Flow EVM", "address": "0xbC92aaC2DBBF42215248B5688eB3D3d2b32F2c8d", "entity": { "zh": "MORE Markets 受影响资金池", "tw": "MORE Markets 受影響資金池", "en": "Affected MORE Markets pool" }, "role": "affected-contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/flow_blockchain/status/2094506622429307061", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "MORE Markets 受影响资金池", "tw": "MORE Markets 受影響資金池", "en": "Affected MORE Markets pool" }, "reviewRequired": true } ], "references": [ { "label": { "zh": "Flow 官方事件说明", "tw": "Flow 官方事件說明", "en": "Flow official incident statement" }, "url": "https://x.com/flow_blockchain/status/2094506622429307061", "type": "official" }, { "label": { "zh": "Blockaid 金额纠正", "tw": "Blockaid 金額糾正", "en": "Blockaid amount correction" }, "url": "https://x.com/blockaid_/status/2094518648123842712", "type": "research" }, { "label": { "zh": "SlowMist Hacked 记录", "tw": "SlowMist Hacked 記錄", "en": "SlowMist Hacked record" }, "url": "https://hacked.slowmist.io/zh/", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-285", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-284", "status": "verified", "incidentDate": "2026-08-31", "datePrecision": "day", "title": { "zh": "Aquifer AMM 单向兑换漏洞导致约 247 万美元资产被抽走", "tw": "Aquifer AMM 單向兌換漏洞導致約 247 萬美元資產被抽走", "en": "Aquifer one-sided swap flaw drained about $2.47 million" }, "summary": { "zh": "Aquifer 在 Solana 上的兑换程序接受攻击者伪造的代币账户和调用程序，连续完成 212 笔只有输出、没有真实输入的兑换，约 247 万美元资产随后被换成 SOL 并跨链至 Ethereum。", "tw": "Aquifer 在 Solana 上的兌換程序接受攻擊者偽造的代幣賬戶和調用程序，連續完成 212 筆只有輸出、沒有真實輸入的兌換，約 247 萬美元資產隨後被換成 SOL 並跨鏈至 Ethereum。", "en": "Aquifer's Solana swap program accepted attacker-controlled token accounts and a fake token program, completing 212 swaps with real output and no real input. About $2.47 million was converted to SOL and bridged to Ethereum." }, "details": { "zh": "## 事件背景\nAquifer 是 Solana 上的交易场所。链上重建显示，程序没有验证传入账户的所有者及收款侧调用程序，攻击者因此可提交伪造的代币账户。\n\n## 事件经过\n2026 年 8 月 31 日，攻击者在约 40 分钟内完成 212 笔兑换。Aquifer 支付真实输出资产，但伪造程序在输入侧返回成功而没有转入代币。\n\n## 资金流向\nAquifer 金库资产进入攻击者控制的 Solana 地址，随后经聚合交易换成约 24,084 SOL，并跨链到 Ethereum 地址 0x2Dfe9e969796e2797278b02761dd9Ad6aE922746。\n\n## 金额口径\nBitquery 按 2026 年 9 月 1 日价格重建的损失为 2,469,729 美元。跨链后的 1,000.8 ETH 是同一批资产，不与损失金额重复相加。\n\n## 证据边界\nAquifer 没有公开程序源码。技术原因来自 212 笔交易的一致账户与调用行为；SlowMist 的早期分类与该链上重建存在差异，因此不写成私钥泄露。\n\n## 处置状态\nAquifer 通过升级权限发布白帽提议，要求在 9 月 3 日前返还至少 80%。截至公开核验点，没有证据证明资金已经返还。\n\n## 地址与交易\n公开记录确认受影响程序、攻击者 Solana 地址和跨链后的 Ethereum 接收地址。恢复地址只用于白帽提议，不标记为攻击者。", "tw": "## 事件背景\nAquifer 是 Solana 上的交易場所。鏈上重建顯示，程序沒有驗證傳入賬戶的所有者及收款側調用程序，攻擊者因此可提交偽造的代幣賬戶。\n\n## 事件經過\n2026 年 8 月 31 日，攻擊者在約 40 分鐘內完成 212 筆兌換。Aquifer 支付真實輸出資產，但偽造程序在輸入側返回成功而沒有轉入代幣。\n\n## 資金流向\nAquifer 金庫資產進入攻擊者控制的 Solana 地址，隨後經聚合交易換成約 24,084 SOL，並跨鏈到 Ethereum 地址 0x2Dfe9e969796e2797278b02761dd9Ad6aE922746。\n\n## 金額口徑\nBitquery 按 2026 年 9 月 1 日價格重建的損失為 2,469,729 美元。跨鏈後的 1,000.8 ETH 是同一批資產，不與損失金額重複相加。\n\n## 證據邊界\nAquifer 沒有公開程序源碼。技術原因來自 212 筆交易的一致賬戶與調用行為；SlowMist 的早期分類與該鏈上重建存在差異，因此不寫成私鑰洩露。\n\n## 處置狀態\nAquifer 通過升級權限發佈白帽提議，要求在 9 月 3 日前返還至少 80%。截至公開核驗點，沒有證據證明資金已經返還。\n\n## 地址與交易\n公開記錄確認受影響程序、攻擊者 Solana 地址和跨鏈後的 Ethereum 接收地址。恢復地址只用於白帽提議，不標記為攻擊者。", "en": "## Incident overview\nAquifer was a trading venue on Solana. On-chain reconstruction shows that the program failed to validate account ownership and the input-side token program, allowing attacker-crafted token accounts.\n\n## Incident sequence\nOn August 31, 2026, the attacker completed 212 swaps in about 40 minutes. Aquifer paid real output assets while the fake input program returned success without transferring tokens.\n\n## Fund flow\nAssets left Aquifer vaults for the attacker-controlled Solana wallet, were converted into about 24,084 SOL, and were bridged to 0x2Dfe9e969796e2797278b02761dd9Ad6aE922746 on Ethereum.\n\n## Amount basis\nBitquery reconstructed a loss of $2,469,729 at September 1 prices. The 1,000.8 ETH on Ethereum represents the same assets and is not added again.\n\n## Evidence boundary\nAquifer did not publish its program source. The technical explanation comes from consistent account and instruction behavior across 212 transactions. An early SlowMist classification differs from this reconstruction, so a key compromise is not stated as fact.\n\n## Current status\nAquifer used its upgrade authority to publish a white-hat offer requesting at least an 80% return by September 3. No public evidence confirmed a return by the verification point.\n\n## Addresses and transactions\nPublic records identify the affected program, the attacker-controlled Solana wallet, and the Ethereum destination. Recovery addresses are part of the offer and are not labeled as attackers." }, "category": "access-control", "severity": "critical", "ecosystems": [ "Solana", "Ethereum" ], "chains": [ "Solana", "Ethereum" ], "lossUsd": 2469729, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "18 种资产合计约 2,469,729 美元；约 24,084 SOL 跨链后形成约 1,000.8 ETH。", "tw": "18 種資產合計約 2,469,729 美元；約 24,084 SOL 跨鏈後形成約 1,000.8 ETH。", "en": "Eighteen assets totaling about $2,469,729; roughly 24,084 SOL became about 1,000.8 ETH after bridging." }, "addressDisclosure": "published", "addresses": [ { "chain": "Solana", "address": "AQU1FRd7papthgdrwPTTq5JacJh8YtwEXaBfKU3bTz45", "entity": { "zh": "Aquifer 受影响程序", "tw": "Aquifer 受影響程序", "en": "Affected Aquifer program" }, "role": "affected-contract", "category": "unknown", "confidence": 0.96, "sourceUrl": "https://bitquery.io/investigations/aquifer-solana-hack-2-5-million", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Aquifer 受影响程序", "tw": "Aquifer 受影響程序", "en": "Affected Aquifer program" }, "reviewRequired": true }, { "chain": "Solana", "address": "7fTe9pvrwXJRBHq9MaSyVPR4PgEuhqLiA93Dxf4gRk7J", "entity": { "zh": "Aquifer 攻击者控制地址", "tw": "Aquifer 攻擊者控制地址", "en": "Aquifer attacker-controlled wallet" }, "role": "attacker", "category": "hack", "confidence": 0.92, "sourceUrl": "https://x.com/DefimonAlerts/status/2094467984030826622", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Aquifer 攻击者控制地址", "tw": "Aquifer 攻擊者控制地址", "en": "Aquifer attacker-controlled wallet" }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x2Dfe9e969796e2797278b02761dd9Ad6aE922746", "entity": { "zh": "Aquifer 跨链后被盗资金接收地址", "tw": "Aquifer 跨鏈後被盜資金接收地址", "en": "Aquifer post-bridge stolen-funds receiver" }, "role": "stolen-funds-destination", "category": "stolen_funds", "confidence": 0.94, "sourceUrl": "https://bitquery.io/investigations/aquifer-solana-hack-2-5-million", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Aquifer 跨链后被盗资金接收地址", "tw": "Aquifer 跨鏈後被盜資金接收地址", "en": "Aquifer post-bridge stolen-funds receiver" }, "reviewRequired": true } ], "references": [ { "label": { "zh": "Bitquery 链上重建", "tw": "Bitquery 鏈上重建", "en": "Bitquery on-chain reconstruction" }, "url": "https://bitquery.io/investigations/aquifer-solana-hack-2-5-million", "type": "research" }, { "label": { "zh": "Aquifer 白帽链上信息", "tw": "Aquifer 白帽鏈上信息", "en": "Aquifer on-chain white-hat message" }, "url": "https://x.com/DefimonAlerts/status/2094467984030826622", "type": "official" }, { "label": { "zh": "SlowMist Hacked 交叉核验", "tw": "SlowMist Hacked 交叉核驗", "en": "SlowMist Hacked cross-check" }, "url": "https://hacked.slowmist.io/zh/", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-284", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-276", "status": "verified", "incidentDate": "2026-08-31", "datePrecision": "day", "title": { "zh": "Balancer V1 BPool 储备压缩与舍入攻击", "tw": "Balancer V1 BPool 儲備壓縮與舍入攻擊", "en": "Balancer V1 BPool reserve-compression rounding exploit" }, "summary": { "zh": "SlowMist 披露 Balancer V1 BPool 在 WBTC 储备被压缩到极低值后，joinswapPoolAmountOut 的反算和舍入可让攻击者用极少输入铸造 BPT 并退出多资产池，估计损失约 234,000 USD。", "tw": "SlowMist 披露 Balancer V1 BPool 在 WBTC 儲備被壓縮到極低值後，joinswapPoolAmountOut 的反算和舍入可讓攻擊者用極少輸入鑄造 BPT 並退出多資產池，估計損失約 234,000 USD。", "en": "SlowMist reported that after compressing a Balancer V1 BPool's WBTC reserve, rounding in joinswapPoolAmountOut allowed the attacker to mint BPT with minimal input and exit with multiple assets, for an estimated loss of about $234,000." }, "details": { "zh": "## 事件背景\nBalancer V1 BPool 的 `joinswapPoolAmountOut` 根据目标 BPT 数量反算输入 Token。SlowMist 指出在 WBTC 储备被压缩后，向下舍入可能把所需输入降到极低值。\n\n## 事件经过\n1. 2026 年 8 月 31 日，攻击者借助 Spark、Aave、Morpho 和 Uniswap V3 等流动性。\n2. 通过公开交换把目标 BPool 的 WBTC 储备压缩到尘埃级。\n3. 调用 `joinswapPoolAmountOut`，利用反算和舍入铸造约 4,408.8 BPT。\n4. 按比例退出池子，提取 DPI、USDC、WETH、WBTC 等多种资产。\n\n## 资金流向\n闪电贷资金 → Balancer V1 储备和价格状态 → BPT 铸造与退出 → 攻击者资产路径；后续归集和兑换未完整公开。\n\n## 金额口径\nSlowMist 估计约 234,000 USD；这是池内多资产提取的综合估值，不包含闪电贷本金。\n\n## 证据边界\nSlowMist 告警、源码接口和五笔 Etherscan 交易支持机制与地址。报告截止时未逐笔完成独立 Trace，项目方最终复盘仍待补充。\n\n## 处置状态\n已公开关键交易和受影响 BPool；未见 Balancer 官方最终修复、冻结或赔付安排。\n\n## 地址与交易\n攻击者 EOA、攻击执行合约和受影响 BPool 已写入地址标签；五笔攻击交易保留在来源引用中。", "tw": "## 事件背景\nBalancer V1 BPool 的 `joinswapPoolAmountOut` 根據目標 BPT 數量反算輸入 Token。SlowMist 指出在 WBTC 儲備被壓縮後，向下舍入可能把所需輸入降到極低值。\n\n## 事件經過\n1. 2026 年 8 月 31 日，攻擊者藉助 Spark、Aave、Morpho 和 Uniswap V3 等流動性。\n2. 通過公開交換把目標 BPool 的 WBTC 儲備壓縮到塵埃級。\n3. 調用 `joinswapPoolAmountOut`，利用反算和舍入鑄造約 4,408.8 BPT。\n4. 按比例退出池子，提取 DPI、USDC、WETH、WBTC 等多種資產。\n\n## 資金流向\n閃電貸資金 → Balancer V1 儲備和價格狀態 → BPT 鑄造與退出 → 攻擊者資產路徑；後續歸集和兌換未完整公開。\n\n## 金額口徑\nSlowMist 估計約 234,000 USD；這是池內多資產提取的綜合估值，不包含閃電貸本金。\n\n## 證據邊界\nSlowMist 告警、源碼接口和五筆 Etherscan 交易支持機制與地址。報告截止時未逐筆完成獨立 Trace，項目方最終復盤仍待補充。\n\n## 處置狀態\n已公開關鍵交易和受影響 BPool；未見 Balancer 官方最終修復、凍結或賠付安排。\n\n## 地址與交易\n攻擊者 EOA、攻擊執行合約和受影響 BPool 已寫入地址標籤；五筆攻擊交易保留在來源引用中。", "en": "## Incident overview\nBalancer V1 BPool's `joinswapPoolAmountOut` reverse-calculates token input from a desired BPT output. SlowMist says that after the WBTC reserve was compressed, downward rounding reduced the required input to an extreme minimum.\n\n## Incident sequence\n1. On August 31, 2026, the attacker sourced liquidity through Spark, Aave, Morpho, and Uniswap V3.\n2. Public swaps compressed the target BPool's WBTC reserve to a dust-level amount.\n3. `joinswapPoolAmountOut` was called to mint about 4,408.8 BPT using the reverse-calculation and rounding behavior.\n4. The attacker exited proportionally with DPI, USDC, WETH, WBTC, and other assets.\n\n## Fund flow\nFlash-loan liquidity → Balancer V1 reserve and price state → BPT mint and exit → attacker asset route; later aggregation and conversion remain incomplete.\n\n## Amount basis\nSlowMist estimated about $234,000 in combined pool assets extracted; flash-loan principal is excluded.\n\n## Evidence boundary\nThe SlowMist alert, source interface, and five Etherscan transactions support the mechanism and addresses. Independent transaction traces were not completed by the report cutoff, and a project postmortem is pending.\n\n## Current status\nKey transactions and the affected BPool are public. No final Balancer remediation, freeze, or compensation arrangement was found by the cutoff.\n\n## Addresses and transactions\nThe attacker EOA, execution contract, and affected BPool are retained as labels; five attack transactions remain in the references." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 234000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "SlowMist 估计约 234,000 USD 的 DPI、USDC、WETH、WBTC 等池内资产被提取。", "tw": "SlowMist 估計約 234,000 USD 的 DPI、USDC、WETH、WBTC 等池內資產被提取。", "en": "SlowMist estimated about $234,000 in DPI, USDC, WETH, WBTC, and other pool assets were extracted." }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0x338c7ec9befbb451d66fd8a468c32184f5689a41", "entity": { "zh": "Balancer V1 攻击者 EOA", "tw": "Balancer V1 攻擊者 EOA", "en": "Balancer V1 attacker EOA" }, "role": "attacker", "category": "hack", "confidence": 0.88, "sourceUrl": "https://x.com/SlowMist_Team/status/2094272540193722744", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "SlowMist 将该 EOA 列为攻击执行主体。", "tw": "SlowMist 將該 EOA 列為攻擊執行主體。", "en": "SlowMist identifies this EOA as the attack actor." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x9caa8d0e44b22f50057d2f4ce0d1446529e11be3", "entity": { "zh": "Balancer V1 攻击执行合约", "tw": "Balancer V1 攻擊執行合約", "en": "Balancer V1 attack execution contract" }, "role": "attacker_contract", "category": "hack", "confidence": 0.86, "sourceUrl": "https://x.com/SlowMist_Team/status/2094272540193722744", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "SlowMist 将该合约列为储备压缩和 BPT 铸造执行路径。", "tw": "SlowMist 將該合約列為儲備壓縮和 BPT 鑄造執行路徑。", "en": "SlowMist identifies this contract in the reserve-compression and BPT-mint path." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x2257aaac34bcb27900291f7b84ee2565a6cbac57", "entity": { "zh": "Balancer V1 BPool 受影响合约", "tw": "Balancer V1 BPool 受影響合約", "en": "Balancer V1 BPool affected contract" }, "role": "contract", "category": "unknown", "confidence": 0.92, "sourceUrl": "https://x.com/SlowMist_Team/status/2094272540193722744", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址是被利用的 BPool，不是攻击者地址。", "tw": "該地址是被利用的 BPool，不是攻擊者地址。", "en": "This address is the exploited BPool, not an attacker address." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "SlowMist Balancer V1 告警", "tw": "SlowMist Balancer V1 告警", "en": "SlowMist Balancer V1 alert" }, "url": "https://x.com/SlowMist_Team/status/2094272540193722744", "type": "research" }, { "label": { "zh": "Balancer V1 BPool 源码", "tw": "Balancer V1 BPool 源碼", "en": "Balancer V1 BPool source" }, "url": "https://github.com/balancer/balancer-core/blob/master/contracts/BPool.sol", "type": "research" }, { "label": { "zh": "Balancer 攻击交易 1", "tw": "Balancer 攻擊交易 1", "en": "Balancer attack transaction 1" }, "url": "https://etherscan.io/tx/0x72510b257cc09bde8435b83ac1636f9498ffc353583330600b5b8da43d0d1aff", "type": "explorer" }, { "label": { "zh": "Balancer 攻击交易 2", "tw": "Balancer 攻擊交易 2", "en": "Balancer attack transaction 2" }, "url": "https://etherscan.io/tx/0xeef311556b2a2a5be915d1d21785f47311faab26051d5cc832f701fd4ced2c2", "type": "explorer" }, { "label": { "zh": "Balancer 攻击交易 3", "tw": "Balancer 攻擊交易 3", "en": "Balancer attack transaction 3" }, "url": "https://etherscan.io/tx/0x37e47f0f5f4ec77e96d220410f6aece30a7589d478c6b17badeb55aa70d66628", "type": "explorer" }, { "label": { "zh": "Balancer 攻击交易 4", "tw": "Balancer 攻擊交易 4", "en": "Balancer attack transaction 4" }, "url": "https://etherscan.io/tx/0xbaedc537df2075c3edbd43bbd918363be4b9c090971ce4f9592c1ddb3061e111", "type": "explorer" }, { "label": { "zh": "Balancer 攻击交易 5", "tw": "Balancer 攻擊交易 5", "en": "Balancer attack transaction 5" }, "url": "https://etherscan.io/tx/0xb2d84f926ba84a707d91aa1e1b5fda9565d8db414eece9bd93ced733f8417332", "type": "explorer" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-276", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-275", "status": "verified", "incidentDate": "2026-08-30", "datePrecision": "day", "title": { "zh": "Tectonic Cronos TONIC 价格操纵与链暂停", "tw": "Tectonic Cronos TONIC 價格操縱與鏈暫停", "en": "Tectonic Cronos TONIC price manipulation and chain halt" }, "summary": { "zh": "Cronos 上的 Tectonic 借贷市场被利用，攻击者把低流动性 TONIC 价格推高后借出真实资产。安全机构估计约 66M 至 75M USD，约 6M USD 已桥至 Ethereum，其余大部分因链暂停滞留 Cronos。", "tw": "Cronos 上的 Tectonic 借貸市場被利用，攻擊者把低流動性 TONIC 價格推高後借出真實資產。安全機構估計約 66M 至 75M USD，約 6M USD 已橋至 Ethereum，其餘大部分因鏈暫停滯留 Cronos。", "en": "Tectonic on Cronos was exploited after the attacker inflated the price of thinly traded TONIC and borrowed liquid assets. Security researchers estimated $66 million to $75 million, with about $6 million bridged to Ethereum and most remaining on Cronos after the halt." }, "details": { "zh": "## 事件背景\nTectonic 使用低流动性 TONIC 作为抵押品。公开分析将问题描述为先推高价格、再借出 USDC、USDT、WBTC、WETH 和 CRO 等真实资产的 pump-and-borrow 路径。\n\n## 事件经过\n1. 2026 年 8 月 30 日 22:38 左右，攻击者在 Cronos 推高 TONIC 价格，约 20 分钟内上涨约 100 倍。\n2. 虚高 TONIC 被用于 Tectonic 借贷，真实资产从多个池流出。\n3. Cronos Network 识别到 Tectonic exploit 并暂停整条链。\n4. PeckShield 估计约 6M USD 已桥到 Ethereum，约 60M USD 仍留在 Cronos；CertiK 观察到约 75M USD 分布于三个地址。\n\n## 资金流向\nCronos Tectonic 借贷池 → Cronos 攻击地址和合约 → 约 6M USD 通过桥到 Ethereum；约 60M USD 因停链暂时滞留 Cronos。\n\n## 金额口径\n早期主流估计约 66M 至 75M USD；另有约 119.5M USD 的总流出或坏账口径，未作为本条主损失。\n\n## 证据边界\nCronos 和 Tectonic 官方公告、PeckShield、CertiK 与 SlowMist 记录支持攻击和停链。完整坏账、链上回滚、赔付与最终净损失仍待正式复盘。\n\n## 处置状态\nCronos 已暂停运行，Tectonic 要求用户停止交互；交易所应用被称未受影响，但不能据此推断 Tectonic 存款人无损失。\n\n## 地址与交易\n三个 Cronos 攻击相关地址已保留；约 6M USD 桥出和部分借款线索只有截断值，不写入完整标签。\n\n## 2026 年 9 月资金异动\nPeckShield 于 2026 年 9 月 4 日报告，标记为 Tectonic 攻击者的地址向 Tornado Cash 存入 2,658.9 ETH，披露估值约 665 万美元。这是 8 月 30 日攻击所得的后续移动，不构成新增损失。\n\n## 更新后的证据边界\n公开告警没有给出完整存款交易和地址，因此只保留资金异动与金额口径，不新增正式地址标签，也不把混币金额叠加到原始损失。", "tw": "## 事件背景\nTectonic 使用低流動性 TONIC 作為抵押品。公開分析將問題描述為先推高價格、再借出 USDC、USDT、WBTC、WETH 和 CRO 等真實資產的 pump-and-borrow 路徑。\n\n## 事件經過\n1. 2026 年 8 月 30 日 22:38 左右，攻擊者在 Cronos 推高 TONIC 價格，約 20 分鐘內上漲約 100 倍。\n2. 虛高 TONIC 被用於 Tectonic 借貸，真實資產從多個池流出。\n3. Cronos Network 識別到 Tectonic exploit 並暫停整條鏈。\n4. PeckShield 估計約 6M USD 已橋到 Ethereum，約 60M USD 仍留在 Cronos；CertiK 觀察到約 75M USD 分佈於三個地址。\n\n## 資金流向\nCronos Tectonic 借貸池 → Cronos 攻擊地址和合約 → 約 6M USD 通過橋到 Ethereum；約 60M USD 因停鏈暫時滯留 Cronos。\n\n## 金額口徑\n早期主流估計約 66M 至 75M USD；另有約 119.5M USD 的總流出或壞賬口徑，未作為本條主損失。\n\n## 證據邊界\nCronos 和 Tectonic 官方公告、PeckShield、CertiK 與 SlowMist 記錄支持攻擊和停鏈。完整壞賬、鏈上回滾、賠付與最終淨損失仍待正式復盤。\n\n## 處置狀態\nCronos 已暫停運行，Tectonic 要求用戶停止交互；交易所應用被稱未受影響，但不能據此推斷 Tectonic 存款人無損失。\n\n## 地址與交易\n三個 Cronos 攻擊相關地址已保留；約 6M USD 橋出和部分借款線索只有截斷值，不寫入完整標籤。\n\n## 2026 年 9 月資金異動\nPeckShield 於 2026 年 9 月 4 日報告，標記為 Tectonic 攻擊者的地址向 Tornado Cash 存入 2,658.9 ETH，披露估值約 665 萬美元。這是 8 月 30 日攻擊所得的後續移動，不構成新增損失。\n\n## 更新後的證據邊界\n公開告警沒有給出完整存款交易和地址，因此只保留資金異動與金額口徑，不新增正式地址標籤，也不把混幣金額疊加到原始損失。", "en": "## Incident overview\nTectonic used thinly traded TONIC as collateral. Public analyses describe a pump-and-borrow path: inflate TONIC, then borrow liquid USDC, USDT, WBTC, WETH, CRO, and other assets.\n\n## Incident sequence\n1. At about 22:38 Beijing time on August 30, 2026, the attacker pushed TONIC up by roughly 100x in about 20 minutes.\n2. The inflated token was supplied to Tectonic and liquid assets flowed from several markets.\n3. Cronos Network identified the Tectonic exploit and halted the chain.\n4. PeckShield estimated about $6 million bridged to Ethereum and about $60 million still on Cronos; CertiK observed about $75 million across three addresses.\n\n## Fund flow\nCronos Tectonic lending pools → Cronos attacker addresses and contract → about $6 million bridged to Ethereum; about $60 million remained temporarily stuck on Cronos during the halt.\n\n## Amount basis\nThe main early estimates range from $66 million to $75 million. A separate roughly $119.5 million gross-outflow or bad-debt figure is not used as the primary loss.\n\n## Evidence boundary\nCronos and Tectonic notices, PeckShield, CertiK, and the SlowMist record support the exploit and halt. Bad debt, rollback, compensation, and final net loss await a formal review.\n\n## Current status\nCronos was halted and Tectonic told users to stop interacting. The exchange application was reported unaffected, which does not establish that Tectonic depositors were unharmed.\n\n## Addresses and transactions\nThree Cronos attack-related addresses are retained; the bridge and borrowing clues that remain truncated are excluded from complete labels.\n\n## September 2026 fund movement\nOn September 4, 2026, PeckShield reported that an address labeled as the Tectonic exploiter deposited 2,658.9 ETH into Tornado Cash, valued near $6.65 million at disclosure. This was movement of proceeds from the August 30 attack, not a new loss.\n\n## Updated evidence boundary\nThe public alert did not provide the complete deposit transaction and address. The record therefore preserves the movement and amount basis without adding a formal address label or adding the mixer deposit to the original loss." }, "category": "oracle-manipulation", "severity": "critical", "ecosystems": [ "Cronos", "Ethereum" ], "chains": [ "Cronos", "Ethereum" ], "lossUsd": 74000000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "安全机构估计约 66M 至 75M USD；本条采用约 74M USD 的综合主口径。", "tw": "安全機構估計約 66M 至 75M USD；本條採用約 74M USD 的綜合主口徑。", "en": "Security researchers estimated $66 million to $75 million; this record uses a consolidated primary basis of about $74 million." }, "addressDisclosure": "published", "addresses": [ { "chain": "Cronos", "address": "0x7d4e7e5dcb0ccc66b4f0f8b0f30da5078ad4f2dc", "entity": { "zh": "Tectonic Cronos 攻击相关地址", "tw": "Tectonic Cronos 攻擊相關地址", "en": "Tectonic Cronos attack-related address" }, "role": "attacker", "category": "hack", "confidence": 0.78, "sourceUrl": "https://x.com/CertiKAlert/status/2094203181173817656", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "CertiK 将该地址列入 Tectonic 大额资产持有和攻击路径。", "tw": "CertiK 將該地址列入 Tectonic 大額資產持有和攻擊路徑。", "en": "CertiK includes this address in the Tectonic large-balance and attack route." }, "reviewRequired": true }, { "chain": "Cronos", "address": "0x215adfc84332d8dfdd5afc77af69cceec0bcd3fc", "entity": { "zh": "Tectonic Cronos 攻击相关地址", "tw": "Tectonic Cronos 攻擊相關地址", "en": "Tectonic Cronos attack-related address" }, "role": "attacker", "category": "hack", "confidence": 0.78, "sourceUrl": "https://x.com/CertiKAlert/status/2094203181173817656", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "CertiK 将该地址列入 Tectonic 大额资产持有和攻击路径。", "tw": "CertiK 將該地址列入 Tectonic 大額資產持有和攻擊路徑。", "en": "CertiK includes this address in the Tectonic large-balance and attack route." }, "reviewRequired": true }, { "chain": "Cronos", "address": "0x085f3115ca368aa262246d22f9476e1e2c87e8be", "entity": { "zh": "Tectonic 攻击部署合约线索", "tw": "Tectonic 攻擊部署合約線索", "en": "Tectonic suspected attack deployment contract" }, "role": "attacker_contract", "category": "unknown", "confidence": 0.66, "sourceUrl": "https://x.com/CertiKAlert/status/2094203181173817656", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "公开评论将该合约与攻击者大额持仓关联，具体控制关系待核。", "tw": "公開評論將該合約與攻擊者大額持倉關聯，具體控制關係待核。", "en": "A public comment links this contract to the attacker's large holdings; control remains unconfirmed." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "Cronos Network 官方停链披露", "tw": "Cronos Network 官方停鏈披露", "en": "Cronos Network official halt notice" }, "url": "https://x.com/CronosNetwork/status/2094072333434769703", "type": "official" }, { "label": { "zh": "Tectonic 官方风险提示", "tw": "Tectonic 官方風險提示", "en": "Tectonic official warning" }, "url": "https://x.com/TectonicFi/status/2094072821630799989", "type": "official" }, { "label": { "zh": "PeckShield 资金去向", "tw": "PeckShield 資金去向", "en": "PeckShield fund route" }, "url": "https://x.com/PeckShieldAlert/status/2094217367434015065", "type": "research" }, { "label": { "zh": "CertiK 三地址提示", "tw": "CertiK 三地址提示", "en": "CertiK three-address alert" }, "url": "https://x.com/CertiKAlert/status/2094203181173817656", "type": "research" }, { "label": { "zh": "SlowMist Hacked Zone", "tw": "SlowMist Hacked Zone", "en": "SlowMist Hacked Zone" }, "url": "https://hacked.slowmist.io/", "type": "research" }, { "label": { "zh": "PeckShield Tectonic 资金异动", "tw": "PeckShield Tectonic 資金異動", "en": "PeckShield Tectonic fund movement" }, "url": "https://x.com/PeckShieldAlert/status/2095657464251506901", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-275", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-274", "status": "verified", "incidentDate": "2026-08-29", "datePrecision": "day", "title": { "zh": "Ajna v2 Ethereum 多池清算会计操纵", "tw": "Ajna v2 Ethereum 多池清算會計操縱", "en": "Ajna v2 multi-pool liquidation accounting exploit on Ethereum" }, "summary": { "zh": "Ajna v2 多个 Ethereum 借贷池的内部清算会计被操纵，攻击者在多个抵押品池重复执行清算路径。项目方要求用户撤资并停止交互，外部监控估计损失约 775,000 USD。", "tw": "Ajna v2 多個 Ethereum 借貸池的內部清算會計被操縱，攻擊者在多個抵押品池重複執行清算路徑。項目方要求用戶撤資並停止交互，外部監控估計損失約 775,000 USD。", "en": "Internal liquidation accounting across several Ajna v2 lending pools on Ethereum was manipulated through repeated liquidation paths. Ajna told users to withdraw and stop interacting; external monitoring estimated about $775,000 in losses." }, "details": { "zh": "## 事件背景\nAjna v2 依靠 bucket、LUP 和 threshold price 等内部机制定价，不依赖外部价格预言机。公开复盘认为攻击发生在清算与结算会计路径。\n\n## 事件经过\n1. 2026 年 8 月 28 日晚间部署攻击合约，8 月 29 日 00:19 起出现提取。\n2. 攻击者在 cbETH、syrupUSDC、wstETH、rETH、WBTC、WETH / USDC 和 sDAI 等池重复执行借贷与清算组合。\n3. Ajna 官方在 8 月 29 日提醒用户撤资、还款并停止交互。\n4. Defimon 汇总多个池的损失估计约 775,000 USD。\n\n## 资金流向\nEthereum 多个 Ajna v2 池 → 异常清算路径 → 攻击者提取抵押资产；准备资金与 Tornado Cash 的关联仍未形成完整归集账本。\n\n## 金额口径\n公开估计约 775,000 至 775,400 USD，覆盖七类池。池级估值、准备资金和后续兑换不重复相加。\n\n## 证据边界\nAjna 官方风险提示、Defimon 监控和媒体复盘支持异常及金额范围。完整攻击合约、每池净损和最终受益地址仍未公开。\n\n## 处置状态\nAjna 要求用户撤出资金、偿还贷款并停止交互；协议不可升级且没有管理员暂停路径，未见冻结或追回确认。\n\n## 地址与交易\n公开来源只给出截断地址和交易线索，未将其写入完整地址标签。", "tw": "## 事件背景\nAjna v2 依靠 bucket、LUP 和 threshold price 等內部機制定價，不依賴外部價格預言機。公開復盤認為攻擊發生在清算與結算會計路徑。\n\n## 事件經過\n1. 2026 年 8 月 28 日晚間部署攻擊合約，8 月 29 日 00:19 起出現提取。\n2. 攻擊者在 cbETH、syrupUSDC、wstETH、rETH、WBTC、WETH / USDC 和 sDAI 等池重複執行借貸與清算組合。\n3. Ajna 官方在 8 月 29 日提醒用戶撤資、還款並停止交互。\n4. Defimon 彙總多個池的損失估計約 775,000 USD。\n\n## 資金流向\nEthereum 多個 Ajna v2 池 → 異常清算路徑 → 攻擊者提取抵押資產；準備資金與 Tornado Cash 的關聯仍未形成完整歸集賬本。\n\n## 金額口徑\n公開估計約 775,000 至 775,400 USD，覆蓋七類池。池級估值、準備資金和後續兌換不重複相加。\n\n## 證據邊界\nAjna 官方風險提示、Defimon 監控和媒體復盤支持異常及金額範圍。完整攻擊合約、每池淨損和最終受益地址仍未公開。\n\n## 處置狀態\nAjna 要求用戶撤出資金、償還貸款並停止交互；協議不可升級且沒有管理員暫停路徑，未見凍結或追回確認。\n\n## 地址與交易\n公開來源只給出截斷地址和交易線索，未將其寫入完整地址標籤。", "en": "## Incident overview\nAjna v2 prices positions through internal bucket, LUP, and threshold-price mechanics rather than an external oracle. Public reviews place the exploit in liquidation and settlement accounting.\n\n## Incident sequence\n1. An attack contract was deployed late on August 28, with withdrawals observed from 00:19 Beijing time on August 29, 2026.\n2. The attacker repeated borrowing and liquidation combinations across cbETH, syrupUSDC, wstETH, rETH, WBTC, WETH / USDC, and sDAI pools.\n3. Ajna told users on August 29 to withdraw, repay, and stop interacting.\n4. Defimon aggregated an estimated loss of about $775,000 across the pools.\n\n## Fund flow\nSeveral Ajna v2 Ethereum pools → abnormal liquidation path → attacker extraction of collateral; the link to Tornado Cash funding is not a complete aggregation ledger.\n\n## Amount basis\nPublic estimates range from $775,000 to $775,400 across seven pool types. Pool estimates, preparation funds, and later conversions are not added together.\n\n## Evidence boundary\nAjna's warning, Defimon monitoring, and media reviews support the anomaly and range. The complete attack contract, per-pool net loss, and final beneficiary addresses remain unpublished.\n\n## Current status\nAjna asked users to withdraw, repay, and stop interacting. The protocol is immutable and lacks an administrator pause path; no freeze or recovery was confirmed.\n\n## Addresses and transactions\nPublic sources provided only truncated address and transaction clues, which are excluded from complete address labels." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 775000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "外部监控估计多个 Ajna v2 池合计约 775,000 至 775,400 USD。", "tw": "外部監控估計多個 Ajna v2 池合計約 775,000 至 775,400 USD。", "en": "External monitoring estimated about $775,000 to $775,400 across multiple Ajna v2 pools." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "Ajna 官方风险披露", "tw": "Ajna 官方風險披露", "en": "Ajna official risk disclosure" }, "url": "https://x.com/ajnafi/status/2093563829116383734", "type": "official" }, { "label": { "zh": "Defimon 池级损失说明", "tw": "Defimon 池級損失說明", "en": "Defimon pool-level loss report" }, "url": "https://x.com/DefimonAlerts/status/2093632180656263283", "type": "research" }, { "label": { "zh": "CryptoTimes Ajna 复盘", "tw": "CryptoTimes Ajna 復盤", "en": "CryptoTimes Ajna review" }, "url": "https://cryptotimes.io/2026/08/29/ajna-v2-loses-775k-on-ethereum-after-attacker-exploits-liquidation-math", "type": "research" }, { "label": { "zh": "CryptoTicker Ajna 复盘", "tw": "CryptoTicker Ajna 復盤", "en": "CryptoTicker Ajna review" }, "url": "https://cryptoticker.io/en/ajna-defi-lending-exploit-immutable-contract", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-274", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-270", "status": "verified", "incidentDate": "2026-08-29", "datePrecision": "day", "title": { "zh": "Fogo Foundation 钱包失陷，4 亿枚 FOGO 转出", "tw": "Fogo Foundation 錢包失陷，4 億枚 FOGO 轉出", "en": "Fogo Foundation wallet compromise moved 400 million FOGO" }, "summary": { "zh": "Fogo Foundation 官方确认未知行为者从基金会控制范围转出 4 亿枚 FOGO，约占总供应 4%。链本身保持运行，美元估值约 3.88M USD，完整地址和交易哈希尚未公开。", "tw": "Fogo Foundation 官方確認未知行為者從基金會控制範圍轉出 4 億枚 FOGO，約佔總供應 4%。鏈本身保持運行，美元估值約 3.88M USD，完整地址和交易哈希尚未公開。", "en": "Fogo Foundation confirmed that an unknown actor moved 400 million FOGO from assets under foundation control, about 4% of total supply. The chain continued operating; the token amount was valued at about $3.88 million, while complete addresses and transaction hashes remain unpublished." }, "details": { "zh": "## 事件背景\nFogo Foundation 公开确认基金会钱包控制范围发生未授权资产转出，但没有说明私钥、多签设备、内部权限或合约漏洞的具体入口。\n\n## 事件经过\n1. 2026 年 8 月 29 日 09:13 前，未知行为者取得基金会资产控制能力。\n2. 约 4 亿枚 FOGO 被转给恶意行为者。\n3. 基金会立即通知交易所，并与执法和取证专家协作。\n4. Fogo 链保持正常运行，项目继续调查。\n\n## 资金流向\nFogo Foundation 控制钱包 → 恶意行为者地址；完整收款地址、交易所触点、跨链和套现路线尚未公开。\n\n## 金额口径\n4 亿枚 FOGO 是官方确认的代币数量，媒体按当时价格估计约 3.88M USD；代币数量不等于已经变现的现金损失。\n\n## 证据边界\nFogo 官方公告支持转出事实和数量，但没有公开地址、交易哈希、根因或最终损失清单。\n\n## 处置状态\n基金会已通知交易所并协作调查；截至报告截止时没有冻结、追回或赔付结果。\n\n## 地址与交易\n公开来源没有提供可核验的完整钱包地址或交易哈希。", "tw": "## 事件背景\nFogo Foundation 公開確認基金會錢包控制範圍發生未授權資產轉出，但沒有說明私鑰、多籤設備、內部權限或合約漏洞的具體入口。\n\n## 事件經過\n1. 2026 年 8 月 29 日 09:13 前，未知行為者取得基金會資產控制能力。\n2. 約 4 億枚 FOGO 被轉給惡意行為者。\n3. 基金會立即通知交易所，並與執法和取證專家協作。\n4. Fogo 鏈保持正常運行，項目繼續調查。\n\n## 資金流向\nFogo Foundation 控制錢包 → 惡意行為者地址；完整收款地址、交易所觸點、跨鏈和套現路線尚未公開。\n\n## 金額口徑\n4 億枚 FOGO 是官方確認的代幣數量，媒體按當時價格估計約 3.88M USD；代幣數量不等於已經變現的現金損失。\n\n## 證據邊界\nFogo 官方公告支持轉出事實和數量，但沒有公開地址、交易哈希、根因或最終損失清單。\n\n## 處置狀態\n基金會已通知交易所並協作調查；截至報告截止時沒有凍結、追回或賠付結果。\n\n## 地址與交易\n公開來源沒有提供可核驗的完整錢包地址或交易哈希。", "en": "## Incident overview\nFogo Foundation confirmed an unauthorized transfer from assets under foundation control, but did not identify a private key, multisignature device, internal permission, or contract entry point.\n\n## Incident sequence\n1. Before 09:13 Beijing time on August 29, 2026, an unknown actor obtained control of foundation assets.\n2. About 400 million FOGO was sent to a malicious actor.\n3. The foundation notified exchanges and coordinated with law-enforcement and forensic teams.\n4. The Fogo chain continued operating while the investigation proceeded.\n\n## Fund flow\nFogo Foundation-controlled wallet → malicious actor address; the complete receiver, exchange touchpoints, bridge route, and liquidation path remain unpublished.\n\n## Amount basis\nThe foundation confirmed 400 million FOGO. Media valued the token amount at about $3.88 million at the time; token quantity is not the same as realized cash loss.\n\n## Evidence boundary\nThe Fogo notice supports the transfer and quantity, but does not publish addresses, transaction hashes, root cause, or a final loss list.\n\n## Current status\nThe foundation notified exchanges and is cooperating with investigators. No freeze, recovery, or compensation result was public by the report cutoff.\n\n## Addresses and transactions\nNo complete verifiable wallet address or transaction hash was published." }, "category": "access-control", "severity": "critical", "ecosystems": [ "Fogo" ], "chains": [ "Fogo" ], "lossUsd": 3880000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "官方确认转出 400,000,000 FOGO；媒体按时间价格估计约 3.88M USD。", "tw": "官方確認轉出 400,000,000 FOGO；媒體按時間價格估計約 3.88M USD。", "en": "The foundation confirmed 400,000,000 FOGO moved; media valued the amount at about $3.88 million at the time." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "Fogo 官方公告", "tw": "Fogo 官方公告", "en": "Fogo official notice" }, "url": "https://x.com/fogo/status/2093507386300637306", "type": "official" }, { "label": { "zh": "Fogo 事件交叉报道", "tw": "Fogo 事件交叉報道", "en": "Fogo incident cross-check" }, "url": "https://www.cryptotimes.io/2026/08/29/fogo-foundation-hacked-400m-tokens-stolen-as-fogo-drops-18/", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-270", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-269", "status": "verified", "incidentDate": "2026-08-29", "datePrecision": "day", "title": { "zh": "Avici / Rain Solana 卡余额合约授权漏洞", "tw": "Avici / Rain Solana 卡餘額合約授權漏洞", "en": "Avici / Rain Solana card-balance contract authorization exploit" }, "summary": { "zh": "Rain 旧版 Solana 卡余额合约的授权路径被利用，攻击者通过签名提交和管理员加入流程批量提款。Avici 确认 1,685 名用户、500,859.22 USD 卡余额受影响并宣布退款；更广链上路径估计约 1.02M USD，不能与官方口径相加。", "tw": "Rain 舊版 Solana 卡餘額合約的授權路徑被利用，攻擊者通過簽名提交和管理員加入流程批量提款。Avici 確認 1,685 名用戶、500,859.22 USD 卡餘額受影響並宣佈退款；更廣鏈上路徑估計約 1.02M USD，不能與官方口徑相加。", "en": "An outdated Rain Solana card-balance contract was exploited through its authorization path, allowing batch withdrawals after crafted signature and administrator calls. Avici confirmed 1,685 users and $500,859.22 in affected card balances and announced refunds; a broader on-chain estimate of about $1.02 million is not additive." }, "details": { "zh": "## 事件背景\nRain 的旧版 Solana 卡余额合约存在授权校验缺陷。受影响的是已经充值到卡余额合约的资金，不是用户自托管 Solana 或 EVM 钱包。\n\n## 事件经过\n1. 2026 年 8 月 29 日 00:49 左右，攻击者对相关卡余额程序发起批量调用。\n2. 攻击路径包含 `SubmitSignatures`、`AddCollateralAdmin` 和 `WithdrawCollateralAsset`，随后取得提款权限。\n3. Avici 在约两小时内公开确认提款异常，Rain 随后升级旧版合约。\n4. Avici 核对出 1,685 名用户和 500,859.22 USD 卡余额受影响，并公开说明退款和现金返还进度。\n\n## 资金流向\n用户卡余额合约 → Solana 攻击钱包 → SOL / USDC 兑换与拆分 → Ethereum 后段地址 → Tornado Cash。约 418 ETH 的链上研究口径覆盖范围更广，不等同于 Avici 单一用户结算额。\n\n## 金额口径\n500,859.22 USD 是 Avici 用户卡余额核对口径；CertiK 约 1.02M USD 是跨项目和链上路径估计。两者不重复相加，10% cashback 也不计入盗损。\n\n## 证据边界\nAvici、Rain 官方说明，CertiK、The Defiant 和链上交易共同支持漏洞和资金路线。全部受影响账户、每笔提款和链后段控制关系仍未完整公开。\n\n## 处置状态\nRain 已升级旧版程序，Avici 表示已完成受影响卡余额退款并报告相关事项；后段进入 Tornado Cash 的资金没有公开追回确认。\n\n## 地址与交易\nSolana 攻击钱包、资金中转和拆分接收地址、Ethereum 中转地址以及受影响程序均保留为相关地址；截断值不写入标签。", "tw": "## 事件背景\nRain 的舊版 Solana 卡餘額合約存在授權校驗缺陷。受影響的是已經充值到卡餘額合約的資金，不是用戶自託管 Solana 或 EVM 錢包。\n\n## 事件經過\n1. 2026 年 8 月 29 日 00:49 左右，攻擊者對相關卡餘額程序發起批量調用。\n2. 攻擊路徑包含 `SubmitSignatures`、`AddCollateralAdmin` 和 `WithdrawCollateralAsset`，隨後取得提款權限。\n3. Avici 在約兩小時內公開確認提款異常，Rain 隨後升級舊版合約。\n4. Avici 核對出 1,685 名用戶和 500,859.22 USD 卡餘額受影響，並公開說明退款和現金返還進度。\n\n## 資金流向\n用戶卡餘額合約 → Solana 攻擊錢包 → SOL / USDC 兌換與拆分 → Ethereum 後段地址 → Tornado Cash。約 418 ETH 的鏈上研究口徑覆蓋範圍更廣，不等同於 Avici 單一用戶結算額。\n\n## 金額口徑\n500,859.22 USD 是 Avici 用戶卡餘額核對口徑；CertiK 約 1.02M USD 是跨項目和鏈上路徑估計。兩者不重複相加，10% cashback 也不計入盜損。\n\n## 證據邊界\nAvici、Rain 官方說明，CertiK、The Defiant 和鏈上交易共同支持漏洞和資金路線。全部受影響賬戶、每筆提款和鏈後段控制關係仍未完整公開。\n\n## 處置狀態\nRain 已升級舊版程序，Avici 表示已完成受影響卡餘額退款並報告相關事項；後段進入 Tornado Cash 的資金沒有公開追回確認。\n\n## 地址與交易\nSolana 攻擊錢包、資金中轉和拆分接收地址、Ethereum 中轉地址以及受影響程序均保留為相關地址；截斷值不寫入標籤。", "en": "## Incident overview\nAn authorization flaw in an outdated Rain Solana card-balance contract was exploited. The affected funds were already deposited to card-balance contracts, not users' self-custodied Solana or EVM wallets.\n\n## Incident sequence\n1. At about 00:49 Beijing time on August 29, 2026, the attacker started batch calls against the card-balance program.\n2. The path used `SubmitSignatures`, `AddCollateralAdmin`, and `WithdrawCollateralAsset` to obtain withdrawal authority.\n3. Avici acknowledged the withdrawal anomaly within about two hours, and Rain upgraded the old contract version.\n4. Avici reconciled 1,685 users and $500,859.22 in affected card balances and published refund and cashback updates.\n\n## Fund flow\nUser card-balance contracts → Solana attack wallet → SOL / USDC conversion and splits → later Ethereum address → Tornado Cash. The roughly 418 ETH on-chain estimate covers a broader scope and is not the Avici-only reconciliation.\n\n## Amount basis\n$500,859.22 is Avici's affected card-balance reconciliation; CertiK's roughly $1.02 million estimate covers a broader project and on-chain route. They are not added together, and cashback is not theft loss.\n\n## Evidence boundary\nAvici and Rain notices, CertiK and The Defiant reporting, and on-chain transactions support the flaw and fund route. The complete affected-account list, each withdrawal, and control of later addresses remain unpublished.\n\n## Current status\nRain upgraded the old program. Avici stated that affected card balances were refunded and reported the matter to investigators; no public recovery confirmation exists for funds that entered Tornado Cash.\n\n## Addresses and transactions\nThe Solana attack wallet, relay and split receivers, later Ethereum relay, and affected program are retained as related addresses; truncated values are excluded from labels." }, "category": "access-control", "severity": "critical", "ecosystems": [ "Solana", "Ethereum" ], "chains": [ "Solana", "Ethereum" ], "lossUsd": 500859.22, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "Avici 核对受影响卡余额 500,859.22 USD；更广链上路径约 1.02M USD，不作为额外损失相加。", "tw": "Avici 核對受影響卡餘額 500,859.22 USD；更廣鏈上路徑約 1.02M USD，不作為額外損失相加。", "en": "Avici reconciled $500,859.22 in affected card balances; the broader on-chain estimate of about $1.02 million is not an additional loss." }, "addressDisclosure": "published", "addresses": [ { "chain": "Solana", "address": "FVNFzqAny8spWdPmYw6RQ9TkYa29ueFFiqCFD1gQnCEj", "entity": { "zh": "Avici / Rain 攻击执行钱包", "tw": "Avici / Rain 攻擊執行錢包", "en": "Avici / Rain attack execution wallet" }, "role": "attacker", "category": "hack", "confidence": 0.86, "sourceUrl": "https://x.com/CertiKAlert/status/2093428949334266091", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "安全机构将该钱包与卡余额提款和资金换币路径关联。", "tw": "安全機構將該錢包與卡餘額提款和資金換幣路徑關聯。", "en": "Security researchers link this wallet to card-balance withdrawals and the conversion route." }, "reviewRequired": true }, { "chain": "Solana", "address": "MsaXH6cGDahPQDwJjFYod7RW8QLVDZGByywWvwQ9TFu", "entity": { "zh": "Avici / Rain Solana 资金中转地址", "tw": "Avici / Rain Solana 資金中轉地址", "en": "Avici / Rain Solana relay address" }, "role": "relay", "category": "stolen_funds", "confidence": 0.84, "sourceUrl": "https://x.com/CertiKAlert/status/2093428949334266091", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "公开链上分析记录该地址接收约 10,000 SOL 后继续拆分。", "tw": "公開鏈上分析記錄該地址接收約 10,000 SOL 後繼續拆分。", "en": "On-chain analysis records this address receiving about 10,000 SOL before splitting it." }, "reviewRequired": true }, { "chain": "Solana", "address": "5pVN5XZB8cYBjNLFrsBCPWkCQBan5K5Mq2dWGzwPgGJV", "entity": { "zh": "Avici / Rain Solana 拆分接收地址", "tw": "Avici / Rain Solana 拆分接收地址", "en": "Avici / Rain Solana split receiver" }, "role": "receiver", "category": "stolen_funds", "confidence": 0.78, "sourceUrl": "https://solscan.io/tx/4pmHmZD8fE7H4eyhDBPqwrpmtgeHdcvB5zCk8aFVoejUvqQHDbEBcE8z1NScRenqxA3KhKAbHAFKPdmK8HbvvMyn", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址出现在 10,000 SOL 拆分交易的接收路径中，控制关系未确认。", "tw": "該地址出現在 10,000 SOL 拆分交易的接收路徑中，控制關係未確認。", "en": "This address appears in the 10,000 SOL split route; control is not confirmed." }, "reviewRequired": true }, { "chain": "Solana", "address": "EUuUbDcafPrmVTD5M6qoJAoyyNbihBhugADAxRMn5he9", "entity": { "zh": "Avici / Rain Solana 拆分接收地址", "tw": "Avici / Rain Solana 拆分接收地址", "en": "Avici / Rain Solana split receiver" }, "role": "receiver", "category": "stolen_funds", "confidence": 0.78, "sourceUrl": "https://solscan.io/tx/4pmHmZD8fE7H4eyhDBPqwrpmtgeHdcvB5zCk8aFVoejUvqQHDbEBcE8z1NScRenqxA3KhKAbHAFKPdmK8HbvvMyn", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址出现在 10,000 SOL 拆分交易的接收路径中，控制关系未确认。", "tw": "該地址出現在 10,000 SOL 拆分交易的接收路徑中，控制關係未確認。", "en": "This address appears in the 10,000 SOL split route; control is not confirmed." }, "reviewRequired": true }, { "chain": "Solana", "address": "7XigoEaHxpoHp819fnajGqsz329Lve9c2SXSq8KaFRVf", "entity": { "zh": "Avici / Rain Solana 后续接收地址", "tw": "Avici / Rain Solana 後續接收地址", "en": "Avici / Rain later Solana receiver" }, "role": "receiver", "category": "stolen_funds", "confidence": 0.72, "sourceUrl": "https://solscan.io/tx/1Ttk3itN1GugbhpnjzAmeWLsX9AymKPNsX669ndGFJ8L8FpcrZSEKtdb8u6n2S34pLMt7ZT7sT9Bx17Cf54ZwDA", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "公开交易记录该地址接收后续 SOL，控制关系未确认。", "tw": "公開交易記錄該地址接收後續 SOL，控制關係未確認。", "en": "Public transactions show later SOL received by this address; control is not confirmed." }, "reviewRequired": true }, { "chain": "Solana", "address": "26DkA98jjctzPkBEteUsN935CR4dsKx3XvjrtE7MeL4a", "entity": { "zh": "Rain 旧版卡余额程序", "tw": "Rain 舊版卡餘額程序", "en": "Rain legacy card-balance program" }, "role": "contract", "category": "unknown", "confidence": 0.82, "sourceUrl": "https://x.com/avici/status/2093439613201482068", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该程序是 Avici 与 Rain 说明中受影响的旧版卡余额基础设施，不是攻击者地址。", "tw": "該程序是 Avici 與 Rain 說明中受影響的舊版卡餘額基礎設施，不是攻擊者地址。", "en": "This program is the affected legacy card-balance infrastructure described by Avici and Rain, not an attacker address." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x2cE21E4921d3Eb116526c3651Dac0257657338D5", "entity": { "zh": "Avici / Rain Ethereum 后段地址", "tw": "Avici / Rain Ethereum 後段地址", "en": "Avici / Rain later Ethereum address" }, "role": "relay", "category": "stolen_funds", "confidence": 0.7, "sourceUrl": "https://x.com/CertiKAlert/status/2093428954795258002", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "CertiK 将该地址与约 418 ETH 进入混币器前的路径关联。", "tw": "CertiK 將該地址與約 418 ETH 進入混幣器前的路徑關聯。", "en": "CertiK associates this address with the route before about 418 ETH entered a mixer." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "Avici 官方首次披露", "tw": "Avici 官方首次披露", "en": "Avici initial official disclosure" }, "url": "https://x.com/avici/status/2093408878663000074", "type": "official" }, { "label": { "zh": "Avici 退款与升级更新", "tw": "Avici 退款與升級更新", "en": "Avici refund and upgrade update" }, "url": "https://x.com/avici/status/2093439613201482068", "type": "official" }, { "label": { "zh": "Rain 官方说明", "tw": "Rain 官方說明", "en": "Rain official statement" }, "url": "https://x.com/raincards/status/2093435073081053518", "type": "official" }, { "label": { "zh": "CertiK 资金路径", "tw": "CertiK 資金路徑", "en": "CertiK fund route" }, "url": "https://x.com/CertiKAlert/status/2093428952224186680", "type": "research" }, { "label": { "zh": "CertiK Tornado Cash 更新", "tw": "CertiK Tornado Cash 更新", "en": "CertiK Tornado Cash update" }, "url": "https://x.com/CertiKAlert/status/2093428954795258002", "type": "research" }, { "label": { "zh": "The Defiant 链上复核", "tw": "The Defiant 鏈上覆核", "en": "The Defiant on-chain review" }, "url": "https://thedefiant.io/news/hacks/attacker-drains-more-than-usd1-million-from-avici-users-in-live-solana-neobank-attack", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-269", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-273", "status": "verified", "incidentDate": "2026-08-27", "datePrecision": "day", "title": { "zh": "Moonwell Base MAMO 薄流动性价格操纵", "tw": "Moonwell Base MAMO 薄流動性價格操縱", "en": "Moonwell Base MAMO thin-liquidity price manipulation exploit" }, "summary": { "zh": "Moonwell Base 借贷市场的 MAMO 薄流动性价格被推高，攻击者以虚高抵押品借出 cbBTC、USDC 等真实资产。安全机构估计约 8.79M USD，Moonwell 随后限制相关市场。", "tw": "Moonwell Base 借貸市場的 MAMO 薄流動性價格被推高，攻擊者以虛高抵押品借出 cbBTC、USDC 等真實資產。安全機構估計約 8.79M USD，Moonwell 隨後限制相關市場。", "en": "The price of thinly traded MAMO collateral in Moonwell's Base lending markets was inflated, allowing the attacker to borrow real assets such as cbBTC and USDC. Security researchers estimated about $8.79 million, and Moonwell restricted the affected markets." }, "details": { "zh": "## 事件背景\nMoonwell 对 MAMO 使用薄市场价格作为抵押估值。攻击者操纵现货价格，使 MAMO 抵押品虚高，再从真实资产市场借出资产。\n\n## 事件经过\n1. 2026 年 8 月 27 日 17:20:11 起，攻击者准备资金并推高 MAMO 价格。\n2. 虚高的 MAMO 被存入 Moonwell 作为抵押品。\n3. 攻击者从 mUSDC、mcbBTC 等市场借出 cbBTC、USDC、DAI 等真实资产。\n4. 资金向 Ethereum 归集地址移动，Moonwell 将相关借贷和供应上限降至极低值。\n\n## 资金流向\nBase MAMO 市场 → Moonwell 借贷市场 → 攻击者 Base 地址 → Ethereum 归集地址；桥接、资产拆分和最终交易所落点未完整公开。\n\n## 金额口径\nSlowMist 及其他安全机构估计约 8.70M 至 8.79M USD；较早的 50.6 cbBTC 估计与后续观测是同一事件的不同阶段口径，不重复相加。\n\n## 证据边界\nMoonwell 官方处置、多家安全机构分析和 Base 交易支持价格操纵及借贷资产外流。坏账承担、最终净损失和归集控制关系仍待完整复盘。\n\n## 处置状态\nMoonwell 已限制新增借贷和 MAMO / WELL 供应；截至截止时没有最终赔付或追回公告。\n\n## 地址与交易\nBase 攻击者、受影响借贷与抵押品市场、Ethereum 归集地址、执行合约和关键交易均保留。", "tw": "## 事件背景\nMoonwell 對 MAMO 使用薄市場價格作為抵押估值。攻擊者操縱現貨價格，使 MAMO 抵押品虛高，再從真實資產市場借出資產。\n\n## 事件經過\n1. 2026 年 8 月 27 日 17:20:11 起，攻擊者準備資金並推高 MAMO 價格。\n2. 虛高的 MAMO 被存入 Moonwell 作為抵押品。\n3. 攻擊者從 mUSDC、mcbBTC 等市場借出 cbBTC、USDC、DAI 等真實資產。\n4. 資金向 Ethereum 歸集地址移動，Moonwell 將相關借貸和供應上限降至極低值。\n\n## 資金流向\nBase MAMO 市場 → Moonwell 借貸市場 → 攻擊者 Base 地址 → Ethereum 歸集地址；橋接、資產拆分和最終交易所落點未完整公開。\n\n## 金額口徑\nSlowMist 及其他安全機構估計約 8.70M 至 8.79M USD；較早的 50.6 cbBTC 估計與後續觀測是同一事件的不同階段口徑，不重複相加。\n\n## 證據邊界\nMoonwell 官方處置、多家安全機構分析和 Base 交易支持價格操縱及借貸資產外流。壞賬承擔、最終淨損失和歸集控制關係仍待完整復盤。\n\n## 處置狀態\nMoonwell 已限制新增借貸和 MAMO / WELL 供應；截至截止時沒有最終賠付或追回公告。\n\n## 地址與交易\nBase 攻擊者、受影響借貸與抵押品市場、Ethereum 歸集地址、執行合約和關鍵交易均保留。", "en": "## Incident overview\nMoonwell valued MAMO using a thin spot market. The attacker inflated its price, used it as collateral, and borrowed liquid assets from Moonwell markets.\n\n## Incident sequence\n1. From 17:20:11 Beijing time on August 27, 2026, the attacker prepared funds and pushed the MAMO price higher.\n2. The inflated MAMO was supplied as collateral to Moonwell.\n3. The attacker borrowed cbBTC, USDC, DAI, and other liquid assets from markets including mUSDC and mcbBTC.\n4. Funds moved toward an Ethereum aggregation address, and Moonwell reduced related borrow and supply caps to minimal values.\n\n## Fund flow\nBase MAMO market → Moonwell lending markets → attacker Base address → Ethereum aggregation address; the bridge, asset splits, and final exchange endpoint remain incomplete.\n\n## Amount basis\nSlowMist and other security researchers estimated about $8.70 million to $8.79 million. An earlier 50.6 cbBTC estimate and later observed outflows describe different stages of the same incident and are not added together.\n\n## Evidence boundary\nMoonwell response, multiple security analyses, and Base transactions support the price manipulation and asset outflows. Bad-debt allocation, final net loss, and control of the aggregation route await a complete review.\n\n## Current status\nMoonwell restricted new borrowing and MAMO / WELL supply. No final compensation or recovery notice was public by the cutoff.\n\n## Addresses and transactions\nThe Base attacker, affected lending and collateral markets, Ethereum aggregation address, execution contract, and key transactions are retained." }, "category": "oracle-manipulation", "severity": "critical", "ecosystems": [ "Base", "Ethereum" ], "chains": [ "Base", "Ethereum" ], "lossUsd": 8790000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "安全机构估计约 8.70M 至 8.79M USD 的真实资产被借出；采用较新观测口径 8.79M USD。", "tw": "安全機構估計約 8.70M 至 8.79M USD 的真實資產被借出；採用較新觀測口徑 8.79M USD。", "en": "Security researchers estimated $8.70 million to $8.79 million in liquid assets borrowed; this record uses the later $8.79 million observation." }, "addressDisclosure": "published", "addresses": [ { "chain": "Base", "address": "0x719eae70d4a83f35bf82a2740699f5db84be919d", "entity": { "zh": "Moonwell MAMO 攻击者 EOA", "tw": "Moonwell MAMO 攻擊者 EOA", "en": "Moonwell MAMO attacker EOA" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/SlowMist_Team/status/2092949807912689915", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "安全机构将该地址列为价格操纵和借款接收方。", "tw": "安全機構將該地址列為價格操縱和借款接收方。", "en": "Security researchers identify this address as the price-manipulation and borrowing recipient." }, "reviewRequired": true }, { "chain": "Base", "address": "0xf877acafa28c19b96727966690b2f44d35ad5976", "entity": { "zh": "Moonwell 借贷市场合约", "tw": "Moonwell 借貸市場合約", "en": "Moonwell lending market contract" }, "role": "contract", "category": "unknown", "confidence": 0.88, "sourceUrl": "https://x.com/SlowMist_Team/status/2092949807912689915", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址是受影响的 Moonwell 借贷市场，不是攻击者地址。", "tw": "該地址是受影響的 Moonwell 借貸市場，不是攻擊者地址。", "en": "This is an affected Moonwell lending market, not an attacker address." }, "reviewRequired": true }, { "chain": "Base", "address": "0x2f90bb22eb3979f5ffad31ea6c3f0792ca66da32", "entity": { "zh": "Moonwell MAMO 抵押品市场", "tw": "Moonwell MAMO 抵押品市場", "en": "Moonwell MAMO collateral market" }, "role": "contract", "category": "unknown", "confidence": 0.88, "sourceUrl": "https://x.com/SlowMist_Team/status/2092949807912689915", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址是被操纵价格的 MAMO 市场，不是攻击者地址。", "tw": "該地址是被操縱價格的 MAMO 市場，不是攻擊者地址。", "en": "This is the MAMO market whose price was manipulated, not an attacker address." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xD71dD9B6e634412713c47fe7aE02c628e338C384", "entity": { "zh": "Moonwell Ethereum 归集地址", "tw": "Moonwell Ethereum 歸集地址", "en": "Moonwell Ethereum aggregation address" }, "role": "aggregation", "category": "stolen_funds", "confidence": 0.82, "sourceUrl": "https://x.com/CertiKAlert/status/2092917519946539061", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "安全机构将该地址与跨链后的资产归集关联。", "tw": "安全機構將該地址與跨鏈後的資產歸集關聯。", "en": "Security researchers link this address to post-bridge asset aggregation." }, "reviewRequired": true }, { "chain": "Base", "address": "0xAbDA3Cfe3ce2668b7829AAccBE594Abb326BCe4F", "entity": { "zh": "Moonwell 攻击执行合约", "tw": "Moonwell 攻擊執行合約", "en": "Moonwell attack execution contract" }, "role": "attacker_contract", "category": "hack", "confidence": 0.76, "sourceUrl": "https://x.com/GoPlusSecurity/status/2092987438595551445", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "公开复盘将该合约与攻击执行路径关联，控制关系仍待复核。", "tw": "公開復盤將該合約與攻擊執行路徑關聯，控制關係仍待複核。", "en": "The public review links this contract to the execution path; control remains subject to review." }, "reviewRequired": true }, { "chain": "Base", "address": "0xEdc817A28E8B93B03976FBd4a3dDBc9f7D176c22", "entity": { "zh": "Moonwell mUSDC 受影响市场", "tw": "Moonwell mUSDC 受影響市場", "en": "Moonwell affected mUSDC market" }, "role": "contract", "category": "unknown", "confidence": 0.86, "sourceUrl": "https://x.com/GoPlusSecurity/status/2092987438595551445", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址是被借出真实资产的 mUSDC 市场，不是攻击者地址。", "tw": "該地址是被借出真實資產的 mUSDC 市場，不是攻擊者地址。", "en": "This is the mUSDC market from which liquid assets were borrowed, not an attacker address." }, "reviewRequired": true }, { "chain": "Base", "address": "0x627Fe393Bc6EdDA28e99AE648fD6fF362514304b", "entity": { "zh": "Moonwell mwstETH 受影响市场", "tw": "Moonwell mwstETH 受影響市場", "en": "Moonwell affected mwstETH market" }, "role": "contract", "category": "unknown", "confidence": 0.84, "sourceUrl": "https://x.com/GoPlusSecurity/status/2092987438595551445", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址是公开复盘列出的受影响市场，不是攻击者地址。", "tw": "該地址是公開復盤列出的受影響市場，不是攻擊者地址。", "en": "This address is an affected market listed in the public review, not an attacker address." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "Moonwell 官方处置", "tw": "Moonwell 官方處置", "en": "Moonwell official response" }, "url": "https://x.com/MoonwellDeFi/status/2092935617688805818", "type": "official" }, { "label": { "zh": "SlowMist Moonwell 技术说明", "tw": "SlowMist Moonwell 技術說明", "en": "SlowMist Moonwell analysis" }, "url": "https://x.com/SlowMist_Team/status/2092949807912689915", "type": "research" }, { "label": { "zh": "CertiK Moonwell 告警", "tw": "CertiK Moonwell 告警", "en": "CertiK Moonwell alert" }, "url": "https://x.com/CertiKAlert/status/2092917519946539061", "type": "research" }, { "label": { "zh": "Moonwell Base 关键交易", "tw": "Moonwell Base 關鍵交易", "en": "Moonwell Base key transaction" }, "url": "https://basescan.org/tx/0xafb6f0fa257b115a5c813bf787b4c1535e63888b1d0dbeb1f3788f557f51798f", "type": "explorer" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-273", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-272", "status": "verified", "incidentDate": "2026-08-27", "datePrecision": "day", "title": { "zh": "CCC Token LP 会计逻辑攻击", "tw": "CCC Token LP 會計邏輯攻擊", "en": "CCC Token LP accounting exploit on BNB Chain" }, "summary": { "zh": "BNB Chain 上的 CCC Token sell 路径可直接改变 LP 中的 Token 储备，攻击者利用该逻辑造成价格异常并抽取流动性。TenArmor 估计涉资约 117,000 USD。", "tw": "BNB Chain 上的 CCC Token sell 路徑可直接改變 LP 中的 Token 儲備，攻擊者利用該邏輯造成價格異常並抽取流動性。TenArmor 估計涉資約 117,000 USD。", "en": "A CCC Token sell path on BNB Chain could alter the token reserve held by its LP. The attacker used the accounting behavior to create a price anomaly and extract liquidity; TenArmor estimated about $117,000 at stake." }, "details": { "zh": "## 事件背景\nCCC 合约的 `sell()` 函数可对 LP Pair 持有的 CCC 执行异常销毁，使储备和价格关系偏离正常状态。\n\n## 事件经过\n1. 2026 年 8 月 27 日 20:31:31，关键攻击交易在 BNB Chain 成功。\n2. 攻击者调用卖出路径并销毁 LP 内的 CCC。\n3. 储备关系和价格出现异常，相关合约继续执行利润分配。\n4. TenArmor 随后估计损失约 117,000 USD，完整权限入口仍待项目方说明。\n\n## 资金流向\nCCC / WBNB LP → 异常储备和价格路径 → 攻击执行地址及利润持有合约；后续跨链、混币器和交易所落点未公开。\n\n## 金额口径\n117,000 USD 是 TenArmor 的监控估值，未提供资产拆分、攻击者净利润或 LP 最终净损失明细。\n\n## 证据边界\n安全机构告警、成功交易和合约地址支持攻击动作。攻击者为何能调用该路径、完整获利对账和项目方定性仍未公开。\n\n## 处置状态\n关键交易已成功；截至截止时未见冻结、追回、补偿或完整官方复盘。\n\n## 地址与交易\n攻击执行地址、代理、实现、受影响 Pair、CCC Token 和利润分配相关合约均保留为相关地址。", "tw": "## 事件背景\nCCC 合約的 `sell()` 函數可對 LP Pair 持有的 CCC 執行異常銷燬，使儲備和價格關係偏離正常狀態。\n\n## 事件經過\n1. 2026 年 8 月 27 日 20:31:31，關鍵攻擊交易在 BNB Chain 成功。\n2. 攻擊者調用賣出路徑並銷燬 LP 內的 CCC。\n3. 儲備關係和價格出現異常，相關合約繼續執行利潤分配。\n4. TenArmor 隨後估計損失約 117,000 USD，完整權限入口仍待項目方說明。\n\n## 資金流向\nCCC / WBNB LP → 異常儲備和價格路徑 → 攻擊執行地址及利潤持有合約；後續跨鏈、混幣器和交易所落點未公開。\n\n## 金額口徑\n117,000 USD 是 TenArmor 的監控估值，未提供資產拆分、攻擊者淨利潤或 LP 最終淨損失明細。\n\n## 證據邊界\n安全機構告警、成功交易和合約地址支持攻擊動作。攻擊者為何能調用該路徑、完整獲利對賬和項目方定性仍未公開。\n\n## 處置狀態\n關鍵交易已成功；截至截止時未見凍結、追回、補償或完整官方復盤。\n\n## 地址與交易\n攻擊執行地址、代理、實現、受影響 Pair、CCC Token 和利潤分配相關合約均保留為相關地址。", "en": "## Incident overview\nThe CCC contract's `sell()` function could burn CCC held by the LP pair, breaking the normal relationship between reserves and price.\n\n## Incident sequence\n1. The key attack transaction succeeded on BNB Chain at 20:31:31 Beijing time on August 27, 2026.\n2. The attacker invoked the sell path and burned CCC held by the LP.\n3. Reserves and price became anomalous while related distribution contracts executed.\n4. TenArmor estimated about $117,000, while the complete permission path remains to be explained by the project.\n\n## Fund flow\nCCC / WBNB LP → abnormal reserve and price path → attack execution address and profit-holding contracts; later bridge, mixer, and exchange endpoints are unpublished.\n\n## Amount basis\nThe $117,000 figure is TenArmor's monitoring estimate; no asset split, attacker net profit, or final LP loss reconciliation was provided.\n\n## Evidence boundary\nThe security alert, successful transaction, and contract addresses support the attack action. The caller privilege, full profit reconciliation, and project conclusion remain unpublished.\n\n## Current status\nThe key transaction succeeded. No freeze, recovery, compensation, or complete official postmortem was found by the cutoff.\n\n## Addresses and transactions\nThe execution address, proxy, implementation, affected pair, CCC token, and profit-distribution contracts are retained as related addresses." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "BNB Chain" ], "chains": [ "BNB Chain" ], "lossUsd": 117000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "TenArmor 估计约 117,000 USD 涉及 CCC / WBNB LP 异常流动性提取。", "tw": "TenArmor 估計約 117,000 USD 涉及 CCC / WBNB LP 異常流動性提取。", "en": "TenArmor estimated about $117,000 in abnormal liquidity extraction from the CCC / WBNB LP." }, "addressDisclosure": "published", "addresses": [ { "chain": "BNB Chain", "address": "0x7977bdeee3a79dc85cc18739692e796b5d2513c4", "entity": { "zh": "CCC 攻击执行地址", "tw": "CCC 攻擊執行地址", "en": "CCC attack execution address" }, "role": "attacker", "category": "hack", "confidence": 0.84, "sourceUrl": "https://bscscan.com/tx/0x89d8050641019a5a75fa3dafb4f64fb153e4dd30c0f1f51d06a6cc206d3ead43", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "关键交易发送方被安全机构列入攻击执行路径。", "tw": "關鍵交易發送方被安全機構列入攻擊執行路徑。", "en": "The key transaction sender is included in the attack execution path by security researchers." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x7738b4d7c25e9a7092ae1ab402343b20340daeaf", "entity": { "zh": "CCC 攻击调用目标合约", "tw": "CCC 攻擊調用目標合約", "en": "CCC attack call target" }, "role": "contract", "category": "unknown", "confidence": 0.78, "sourceUrl": "https://bscscan.com/tx/0x89d8050641019a5a75fa3dafb4f64fb153e4dd30c0f1f51d06a6cc206d3ead43", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该合约是关键交易调用目标，具体权限角色待复核。", "tw": "該合約是關鍵交易調用目標，具體權限角色待複核。", "en": "This contract was the key transaction target; its exact permission role remains under review." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xf523224c6171f81c54b93f474ed4c78de91241c7", "entity": { "zh": "CCC 被利用代理", "tw": "CCC 被利用代理", "en": "CCC exploited proxy" }, "role": "contract", "category": "unknown", "confidence": 0.82, "sourceUrl": "https://x.com/SlowMist_Team/status/2093219144896557483", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址是安全机构复盘中的受影响代理，不是攻击者地址。", "tw": "該地址是安全機構復盤中的受影響代理，不是攻擊者地址。", "en": "This address is the affected proxy in the security review, not an attacker address." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x4287742e50fad6d3351000fd31632412ab29a9ac", "entity": { "zh": "CCC 易受攻击实现合约", "tw": "CCC 易受攻擊實現合約", "en": "CCC vulnerable implementation" }, "role": "contract", "category": "unknown", "confidence": 0.82, "sourceUrl": "https://x.com/SlowMist_Team/status/2093219144896557483", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址是安全机构标出的实现合约，不是攻击者地址。", "tw": "該地址是安全機構標出的實現合約，不是攻擊者地址。", "en": "This address is the implementation contract identified by the security review, not an attacker address." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x1dbe9458a6840784d5defd62c6b71386100097c0", "entity": { "zh": "CCC / WBNB 受影响 Pair", "tw": "CCC / WBNB 受影響 Pair", "en": "CCC / WBNB affected pair" }, "role": "contract", "category": "unknown", "confidence": 0.88, "sourceUrl": "https://x.com/SlowMist_Team/status/2093219144896557483", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址是被利用的流动性 Pair，不是攻击者地址。", "tw": "該地址是被利用的流動性 Pair，不是攻擊者地址。", "en": "This address is the exploited liquidity pair, not an attacker address." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xb9b845f718c32f37e8af8b887ae4eec816c93ccc", "entity": { "zh": "CCC Token 合约", "tw": "CCC Token 合約", "en": "CCC Token contract" }, "role": "contract", "category": "unknown", "confidence": 0.88, "sourceUrl": "https://x.com/SlowMist_Team/status/2093219144896557483", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址是涉及异常 sell 逻辑的 Token 合约。", "tw": "該地址是涉及異常 sell 邏輯的 Token 合約。", "en": "This is the token contract containing the abnormal sell logic." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xbabf70e515ae71a2177e624994a68d10c61d7a9f", "entity": { "zh": "CCC 利润分配和资金持有合约", "tw": "CCC 利潤分配和資金持有合約", "en": "CCC profit-distribution and fund-holding contract" }, "role": "related", "category": "unknown", "confidence": 0.72, "sourceUrl": "https://x.com/SlowMist_Team/status/2093219144896557483", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "公开复盘把该地址与利润分配或资金持有路径关联，角色仍待核。", "tw": "公開復盤把該地址與利潤分配或資金持有路徑關聯，角色仍待核。", "en": "The public review links this address to profit distribution or fund holding; its exact role remains unconfirmed." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xca882106194ede1a5014c0fa1532234d084b72a9", "entity": { "zh": "CCC 分配者所有者地址", "tw": "CCC 分配者所有者地址", "en": "CCC distributor owner address" }, "role": "related", "category": "unknown", "confidence": 0.68, "sourceUrl": "https://x.com/SlowMist_Team/status/2093219144896557483", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "公开复盘把该地址与分配者控制路径关联，身份待核。", "tw": "公開復盤把該地址與分配者控制路徑關聯，身份待核。", "en": "The public review links this address to the distributor control path; identity remains unconfirmed." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "TenArmor CCC 告警", "tw": "TenArmor CCC 告警", "en": "TenArmor CCC alert" }, "url": "https://x.com/TenArmorAlert/status/2093164984092274886", "type": "research" }, { "label": { "zh": "SlowMist CCC 复核", "tw": "SlowMist CCC 複核", "en": "SlowMist CCC review" }, "url": "https://x.com/SlowMist_Team/status/2093219144896557483", "type": "research" }, { "label": { "zh": "CCC 关键 BNB Chain 交易", "tw": "CCC 關鍵 BNB Chain 交易", "en": "CCC key BNB Chain transaction" }, "url": "https://bscscan.com/tx/0x89d8050641019a5a75fa3dafb4f64fb153e4dd30c0f1f51d06a6cc206d3ead43", "type": "explorer" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-272", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-271", "status": "verified", "incidentDate": "2026-08-26", "datePrecision": "day", "title": { "zh": "TRON 地址投毒攻击簇影响 15 名受害者", "tw": "TRON 地址投毒攻擊簇影響 15 名受害者", "en": "TRON address-poisoning campaign affected 15 victims" }, "summary": { "zh": "Specter 披露一组持续四周的 TRON 地址投毒攻击，15 名受害者合计损失约 9.4M USD。窗口内可核的 USDD 流入约 3,191,402.34，但不能直接视为窗口新增净损失。", "tw": "Specter 披露一組持續四周的 TRON 地址投毒攻擊，15 名受害者合計損失約 9.4M USD。窗口內可核的 USDD 流入約 3,191,402.34，但不能直接視為窗口新增淨損失。", "en": "Specter disclosed a four-week TRON address-poisoning campaign affecting 15 victims with an aggregate loss of about $9.4 million. Verifiable in-window USDD inflows totaled about 3,191,402.34, but cannot be treated as new net loss for the window." }, "details": { "zh": "## 事件背景\n攻击者向用户交易历史制造首尾相似的投毒地址，诱导用户复制错误收款地址，再把收到的资产换成 USDD 并归集。\n\n## 事件经过\n1. 攻击簇覆盖此前四周，窗口内可核的大额流入从 2026 年 8 月 26 日 19:03 延续到 8 月 28 日 18:36。\n2. 公开研究显示多名用户发生大额误转，资金进入同一 TRON 归集地址。\n3. 归集地址随后转出 2,000,000 USDD，完整受害交易仍未公开。\n\n## 资金流向\n受害者或来源角色待核地址 → TRON USDD 归集地址 → 新目的地址。窗口内四笔公开流入合计约 3,191,402.34 USDD，不能与四周总损失重复相加。\n\n## 金额口径\n9.4M USD 是 Specter 对 15 名受害者四周总损失的聚合估计；3,191,402.34 USDD 是窗口内可核流入，不代表全部新增损失。\n\n## 证据边界\nSpecter 归因、TRON API 交易和归集地址支持攻击簇与资金动作。来源地址角色、全量受害者和最终归属仍待逐笔确认。\n\n## 处置状态\n未见发行方冻结、交易所扣押或追回公告；归集地址后续去向仍在核查。\n\n## 地址与交易\n归集地址、四笔流入来源和转出目的地址均以相关角色保存；交易哈希放在来源引用，不作为地址标签。", "tw": "## 事件背景\n攻擊者向用戶交易歷史製造首尾相似的投毒地址，誘導用戶複製錯誤收款地址，再把收到的資產換成 USDD 並歸集。\n\n## 事件經過\n1. 攻擊簇覆蓋此前四周，窗口內可核的大額流入從 2026 年 8 月 26 日 19:03 延續到 8 月 28 日 18:36。\n2. 公開研究顯示多名用戶發生大額誤轉，資金進入同一 TRON 歸集地址。\n3. 歸集地址隨後轉出 2,000,000 USDD，完整受害交易仍未公開。\n\n## 資金流向\n受害者或來源角色待核地址 → TRON USDD 歸集地址 → 新目的地址。窗口內四筆公開流入合計約 3,191,402.34 USDD，不能與四周總損失重複相加。\n\n## 金額口徑\n9.4M USD 是 Specter 對 15 名受害者四周總損失的聚合估計；3,191,402.34 USDD 是窗口內可核流入，不代表全部新增損失。\n\n## 證據邊界\nSpecter 歸因、TRON API 交易和歸集地址支持攻擊簇與資金動作。來源地址角色、全量受害者和最終歸屬仍待逐筆確認。\n\n## 處置狀態\n未見發行方凍結、交易所扣押或追回公告；歸集地址後續去向仍在核查。\n\n## 地址與交易\n歸集地址、四筆流入來源和轉出目的地址均以相關角色保存；交易哈希放在來源引用，不作為地址標籤。", "en": "## Incident overview\nThe actors seeded look-alike addresses into user transaction histories, induced users to copy the wrong recipient, and converted the received assets to USDD for aggregation.\n\n## Incident sequence\n1. The campaign spans the prior four weeks; verifiable large inflows in this window ran from August 26 at 19:03 to August 28 at 18:36 Beijing time.\n2. Public research shows multiple large mis-transfers into one TRON aggregation address.\n3. The aggregation address later sent 2,000,000 USDD onward, while the complete victim transactions remain unpublished.\n\n## Fund flow\nVictim or role-unresolved source addresses → TRON USDD aggregation address → new destination. Four public in-window inflows totaled about 3,191,402.34 USDD and are not added to the four-week loss estimate.\n\n## Amount basis\nThe $9.4 million figure is Specter's four-week aggregate estimate for 15 victims. The 3,191,402.34 USDD is a verifiable in-window inflow and does not represent all new loss.\n\n## Evidence boundary\nSpecter attribution, TRON API transactions, and the aggregation address support the campaign and fund movements. Source roles, the full victim set, and final ownership require transaction-level confirmation.\n\n## Current status\nNo issuer freeze, exchange seizure, or recovery notice was found; the aggregation address route remains under review.\n\n## Addresses and transactions\nThe aggregation address, four inflow sources, and onward destination are retained with related roles; transaction hashes remain in the references rather than address labels." }, "category": "wallet-vulnerability", "severity": "high", "ecosystems": [ "TRON" ], "chains": [ "TRON" ], "lossUsd": 9400000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "Specter 估计四周聚合损失约 9.4M USD；窗口内可核流入约 3,191,402.34 USDD 不另计。", "tw": "Specter 估計四周聚合損失約 9.4M USD；窗口內可核流入約 3,191,402.34 USDD 不另計。", "en": "Specter estimated about $9.4 million over four weeks; the verifiable in-window inflow of about 3,191,402.34 USDD is not added separately." }, "addressDisclosure": "published", "addresses": [ { "chain": "TRON", "address": "TYGr1k1YUwtvhsKFCqpq4aRxZbbTMUD48t", "entity": { "zh": "TRON 地址投毒攻击簇归集地址", "tw": "TRON 地址投毒攻擊簇歸集地址", "en": "TRON address-poisoning aggregation address" }, "role": "aggregation", "category": "stolen_funds", "confidence": 0.86, "sourceUrl": "https://x.com/SpecterAnalyst/status/2092937573798691325", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Specter 将该地址列为投毒攻击簇的 USDD 归集节点。", "tw": "Specter 將該地址列為投毒攻擊簇的 USDD 歸集節點。", "en": "Specter identifies this address as the USDD aggregation node for the poisoning campaign." }, "reviewRequired": true }, { "chain": "TRON", "address": "TDDDHi26zb2NhGRH6gwEa414RAvNrCr9Ps", "entity": { "zh": "TRON 投毒攻击簇流入来源地址", "tw": "TRON 投毒攻擊簇流入來源地址", "en": "TRON poisoning-campaign inflow source" }, "role": "source", "category": "unknown", "confidence": 0.7, "sourceUrl": "https://tronscan.org/#/transaction/0554c4eb7f6aa79a65e7dec7cb3f89872f2fa619751920574fda9fb48375b3be", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址向归集地址转入约 2,527,862.34 USDD，受害或攻击角色尚未确认。", "tw": "該地址向歸集地址轉入約 2,527,862.34 USDD，受害或攻擊角色尚未確認。", "en": "This address sent about 2,527,862.34 USDD to the aggregation address; victim or attacker role is unconfirmed." }, "reviewRequired": true }, { "chain": "TRON", "address": "TTTyhbCZrVP3UdaCtACykLyUkBueYEYEYE", "entity": { "zh": "TRON 投毒攻击簇流入来源地址", "tw": "TRON 投毒攻擊簇流入來源地址", "en": "TRON poisoning-campaign inflow source" }, "role": "source", "category": "unknown", "confidence": 0.7, "sourceUrl": "https://tronscan.org/#/transaction/bfa73945d7972fbc5a7e68f08521118f92a433e7ca3017c496fd2e60f92afec6", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址向归集地址转入 63,550 USDD，角色尚未确认。", "tw": "該地址向歸集地址轉入 63,550 USDD，角色尚未確認。", "en": "This address sent 63,550 USDD to the aggregation address; its role is unconfirmed." }, "reviewRequired": true }, { "chain": "TRON", "address": "TEe8Dg9HYjMaQ5Tf3TBC1GGA1jtriEZ98s", "entity": { "zh": "TRON 投毒攻击簇流入来源地址", "tw": "TRON 投毒攻擊簇流入來源地址", "en": "TRON poisoning-campaign inflow source" }, "role": "source", "category": "unknown", "confidence": 0.7, "sourceUrl": "https://tronscan.org/#/transaction/3b34c6062f761cf5e7d610f4873b35b8d5f8484e2070277aed13394dd037566a", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址向归集地址转入 100,000 USDD，角色尚未确认。", "tw": "該地址向歸集地址轉入 100,000 USDD，角色尚未確認。", "en": "This address sent 100,000 USDD to the aggregation address; its role is unconfirmed." }, "reviewRequired": true }, { "chain": "TRON", "address": "TYEdRFZFw8kX4YZW91L9iwP7HpCH2e1QS9", "entity": { "zh": "TRON 投毒攻击簇流入来源地址", "tw": "TRON 投毒攻擊簇流入來源地址", "en": "TRON poisoning-campaign inflow source" }, "role": "source", "category": "unknown", "confidence": 0.7, "sourceUrl": "https://tronscan.org/#/transaction/3feaf72e882a6bb8df87f2b76f4dca46f335251c3fed1ccd39c74c580e017a17", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址向归集地址转入 499,990 USDD，角色尚未确认。", "tw": "該地址向歸集地址轉入 499,990 USDD，角色尚未確認。", "en": "This address sent 499,990 USDD to the aggregation address; its role is unconfirmed." }, "reviewRequired": true }, { "chain": "TRON", "address": "TXDQNURp781LkNG7mRiU6sDoNRerzjh8sz", "entity": { "zh": "TRON 投毒攻击簇转出目的地址", "tw": "TRON 投毒攻擊簇轉出目的地址", "en": "TRON poisoning-campaign onward destination" }, "role": "destination", "category": "unknown", "confidence": 0.68, "sourceUrl": "https://tronscan.org/#/transaction/e96fd546364d76dad62170dc66ba78e8793e426d773b5bab7a95d9b29b797c91", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "归集地址向该地址转出 2,000,000 USDD，最终归属尚未确认。", "tw": "歸集地址向該地址轉出 2,000,000 USDD，最終歸屬尚未確認。", "en": "The aggregation address sent 2,000,000 USDD here; final ownership is unconfirmed." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "Specter 攻击簇分析", "tw": "Specter 攻擊簇分析", "en": "Specter campaign analysis" }, "url": "https://x.com/SpecterAnalyst/status/2092937573798691325", "type": "research" }, { "label": { "zh": "TRON 归集地址", "tw": "TRON 歸集地址", "en": "TRON aggregation address" }, "url": "https://tronscan.org/#/address/TYGr1k1YUwtvhsKFCqpq4aRxZbbTMUD48t", "type": "explorer" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-271", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-265", "status": "verified", "incidentDate": "2026-08-26", "datePrecision": "day", "title": { "zh": "Enjin Managed Delegate Proxy 存储槽冲突导致管理权被接管", "tw": "Enjin Managed Delegate Proxy 存儲槽衝突導致管理權被接管", "en": "Enjin Managed Delegate Proxy storage collision enabled an administrative takeover" }, "summary": { "zh": "Ethereum 上的 Enjin Managed Delegate Proxy 因 DELEGATECALL 存储槽冲突和未保护的初始化函数被接管，攻击者注册恶意 Adapter 并转移资产，SlowMist 估计损失约 162,000 USD。", "tw": "Ethereum 上的 Enjin Managed Delegate Proxy 因 DELEGATECALL 存儲槽衝突和未保護的初始化函數被接管，攻擊者註冊惡意 Adapter 並轉移資產，SlowMist 估計損失約 162,000 USD。", "en": "An Enjin Managed Delegate Proxy on Ethereum was taken over through a DELEGATECALL storage collision and an unprotected initializer. The attacker registered a malicious adapter and transferred assets; SlowMist estimated about $162,000 in losses." }, "details": { "zh": "## 事件背景\n代理合约允许不同存储布局的 Adapter 通过 `DELEGATECALL` 执行。已注册 Adapter 的初始化函数写入与代理 `pendingManager` 相同的槽位，形成权限接管条件。\n\n## 事件经过\n1. 2026 年 8 月 26 日 02:41:59，攻击者部署并调用攻击路径。\n2. `initialize(uint256)` 在代理上下文写入攻击者地址。\n3. 攻击者调用 `acceptManager()` 取得管理权。\n4. 恶意 Adapter 随后绕过所有者授权，转移 Crypto Items 资产并执行 `melt`。\n\n## 资金流向\n受影响代理和用户资产 → 恶意 Adapter / 攻击合约 → `melt` 清算路径；公开复盘未给出后续交易所、桥或混币器落点。\n\n## 金额口径\nSlowMist 估计约 162,000 USD；媒体出现约 142,000 USD 的时间价格差，两者不相加。\n\n## 证据边界\nSlowMist 技术说明、完整地址和成功交易支持存储冲突、权限接管与资产转移。项目方最终损失清单、冻结和赔付状态尚未公开。\n\n## 处置状态\n关键攻击交易已成功；截至报告截止时没有发现 Enjin 针对该事件的完整官方复盘、冻结或返还公告。\n\n## 地址与交易\n攻击者 EOA、攻击合约、受影响 Managed Delegate Proxy 和成功攻击交易已列入地址标签与来源。", "tw": "## 事件背景\n代理合約允許不同存儲佈局的 Adapter 通過 `DELEGATECALL` 執行。已註冊 Adapter 的初始化函數寫入與代理 `pendingManager` 相同的槽位，形成權限接管條件。\n\n## 事件經過\n1. 2026 年 8 月 26 日 02:41:59，攻擊者部署並調用攻擊路徑。\n2. `initialize(uint256)` 在代理上下文寫入攻擊者地址。\n3. 攻擊者調用 `acceptManager()` 取得管理權。\n4. 惡意 Adapter 隨後繞過所有者授權，轉移 Crypto Items 資產並執行 `melt`。\n\n## 資金流向\n受影響代理和用戶資產 → 惡意 Adapter / 攻擊合約 → `melt` 清算路徑；公開復盤未給出後續交易所、橋或混幣器落點。\n\n## 金額口徑\nSlowMist 估計約 162,000 USD；媒體出現約 142,000 USD 的時間價格差，兩者不相加。\n\n## 證據邊界\nSlowMist 技術說明、完整地址和成功交易支持存儲衝突、權限接管與資產轉移。項目方最終損失清單、凍結和賠付狀態尚未公開。\n\n## 處置狀態\n關鍵攻擊交易已成功；截至報告截止時沒有發現 Enjin 針對該事件的完整官方復盤、凍結或返還公告。\n\n## 地址與交易\n攻擊者 EOA、攻擊合約、受影響 Managed Delegate Proxy 和成功攻擊交易已列入地址標籤與來源。", "en": "## Incident overview\nThe proxy allowed adapters with different storage layouts to execute through `DELEGATECALL`. A registered adapter initializer wrote to the same slot used by the proxy's `pendingManager`, creating a takeover path.\n\n## Incident sequence\n1. The attacker deployed and invoked the path at 02:41:59 Beijing time on August 26, 2026.\n2. `initialize(uint256)` wrote the attacker address in the proxy context.\n3. The attacker called `acceptManager()` and obtained manager privileges.\n4. A malicious adapter bypassed owner authorization, transferred Crypto Items assets, and used the `melt` path.\n\n## Fund flow\nAffected proxy and user assets → malicious adapter / attack contract → `melt` liquidation path; no later exchange, bridge, or mixer endpoint was disclosed.\n\n## Amount basis\nSlowMist estimated about $162,000; a media estimate of about $142,000 reflects a different time-price snapshot and is not additive.\n\n## Evidence boundary\nSlowMist's technical explanation, complete addresses, and a successful transaction support the storage collision, takeover, and asset transfer. The final project loss list, freeze, and compensation status remain unpublished.\n\n## Current status\nThe key attack transaction succeeded. No complete Enjin postmortem, freeze, or return notice was found by the report cutoff.\n\n## Addresses and transactions\nThe attacker EOA, attack contract, affected Managed Delegate Proxy, and successful attack transaction are retained with source references." }, "category": "access-control", "severity": "high", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 162000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "SlowMist 估计约 162,000 USD 的 Crypto Items / ENJ 支撑资产被转移。", "tw": "SlowMist 估計約 162,000 USD 的 Crypto Items / ENJ 支撐資產被轉移。", "en": "SlowMist estimated about $162,000 in Crypto Items / ENJ-backed assets were transferred." }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0x5ec1ba7892d11059c39557b762a97dd695778ca5", "entity": { "zh": "Enjin 攻击者 EOA", "tw": "Enjin 攻擊者 EOA", "en": "Enjin attacker EOA" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/SlowMist_Team/status/2092455321654694355", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "SlowMist 将该地址列为攻击交易发起方。", "tw": "SlowMist 將該地址列為攻擊交易發起方。", "en": "SlowMist identifies this address as the attack transaction sender." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x7083ddece38216c7741fa76c75326bea744ed321", "entity": { "zh": "Enjin 攻击执行合约", "tw": "Enjin 攻擊執行合約", "en": "Enjin attack execution contract" }, "role": "attacker_contract", "category": "hack", "confidence": 0.86, "sourceUrl": "https://x.com/SlowMist_Team/status/2092455321654694355", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该合约执行 Adapter 初始化、权限接管和资产转移路径。", "tw": "該合約執行 Adapter 初始化、權限接管和資產轉移路徑。", "en": "This contract executed the adapter initialization, takeover, and asset-transfer path." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x268c039a3127d3107c014f0dc6c390a53e6db27f", "entity": { "zh": "Enjin Managed Delegate Proxy", "tw": "Enjin Managed Delegate Proxy", "en": "Enjin Managed Delegate Proxy" }, "role": "contract", "category": "unknown", "confidence": 0.92, "sourceUrl": "https://x.com/SlowMist_Team/status/2092455321654694355", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址是存储槽冲突和管理权接管的受影响代理，不是攻击者地址。", "tw": "該地址是存儲槽衝突和管理權接管的受影響代理，不是攻擊者地址。", "en": "This is the affected proxy for the storage collision and takeover, not an attacker address." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "SlowMist Enjin 技术告警", "tw": "SlowMist Enjin 技術告警", "en": "SlowMist Enjin technical alert" }, "url": "https://x.com/SlowMist_Team/status/2092455321654694355", "type": "research" }, { "label": { "zh": "Enjin 攻击交易", "tw": "Enjin 攻擊交易", "en": "Enjin attack transaction" }, "url": "https://etherscan.io/tx/0xd4a382da03c99ce3084661b913b50b525a4b283f66f510bcf1040152830b2a7e", "type": "explorer" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-265", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-268", "status": "verified", "incidentDate": "2026-08-25", "datePrecision": "day", "title": { "zh": "CometDEX BLND-USDC 池在 Stellar 上被利用", "tw": "CometDEX BLND-USDC 池在 Stellar 上被利用", "en": "CometDEX BLND-USDC pool exploited on Stellar" }, "summary": { "zh": "Stellar 上的 CometDEX BLND-USDC 池因同资产 USDC → USDC 交换造成储备计算异常，被重复利用约 36 次。SlowMist 口径约 717,518.92 USD，Blend 普通存款池未受影响，但 backstop 存款人受损。", "tw": "Stellar 上的 CometDEX BLND-USDC 池因同資產 USDC → USDC 交換造成儲備計算異常，被重複利用約 36 次。SlowMist 口徑約 717,518.92 USD，Blend 普通存款池未受影響，但 backstop 存款人受損。", "en": "CometDEX's BLND-USDC pool on Stellar was exploited through a reserve-accounting flaw involving repeated USDC-to-USDC swaps. SlowMist reported about $717,518.92; Blend's ordinary deposit pools were unaffected, while backstop depositors were impacted." }, "details": { "zh": "## 事件背景\nComet AMM 的 BLND-USDC 池存在同资产交换和储备计算缺陷。攻击者利用 Blend 闪电贷重复执行相同流程，使池内会计余额偏离真实储备。\n\n## 事件经过\n1. 2026 年 8 月 25 日，Blend 先警告 Comet BLND-USDC 池发生异常。\n2. 攻击者从 Blend 池取得流动性，重复执行约 36 次同资产交换。\n3. 储备计算被扭曲，攻击者提取超额 USDC。\n4. Blend 后续说明普通 Blend 合约与存款池未受影响，受影响的是持有 Comet LP 份额的 backstop 存款人。\n\n## 资金流向\nBlend 流动性 → CometDEX BLND-USDC 池 → 攻击者提取路径；后续兑换、跨链和交易所落点未完整公开。\n\n## 金额口径\nSlowMist 记录约 717,518.92 USD；Defimon 早期估计约 750,000 USD。两者是不同时间点和来源的估值，不重复相加。\n\n## 证据边界\nBlend 官方公告、Defimon 分析和 SlowMist 记录支持池被利用、影响边界与主要地址。Ethereum 联络地址与 Stellar 攻击控制关系仍待最终复盘。\n\n## 处置状态\nBlend 普通合约和普通存款池保持安全口径；backstop 存款人损失待最终复盘。公开协商提出返还 85% 并保留 15% 白帽赏金，但没有返还确认。\n\n## 地址与交易\nStellar 受影响池、Ethereum 归因地址、Stellar 协商账户和 Ethereum Messenger 地址均保留为相关地址，不把协商方标为攻击者。", "tw": "## 事件背景\nComet AMM 的 BLND-USDC 池存在同資產交換和儲備計算缺陷。攻擊者利用 Blend 閃電貸重複執行相同流程，使池內會計餘額偏離真實儲備。\n\n## 事件經過\n1. 2026 年 8 月 25 日，Blend 先警告 Comet BLND-USDC 池發生異常。\n2. 攻擊者從 Blend 池取得流動性，重複執行約 36 次同資產交換。\n3. 儲備計算被扭曲，攻擊者提取超額 USDC。\n4. Blend 後續說明普通 Blend 合約與存款池未受影響，受影響的是持有 Comet LP 份額的 backstop 存款人。\n\n## 資金流向\nBlend 流動性 → CometDEX BLND-USDC 池 → 攻擊者提取路徑；後續兌換、跨鏈和交易所落點未完整公開。\n\n## 金額口徑\nSlowMist 記錄約 717,518.92 USD；Defimon 早期估計約 750,000 USD。兩者是不同時間點和來源的估值，不重複相加。\n\n## 證據邊界\nBlend 官方公告、Defimon 分析和 SlowMist 記錄支持池被利用、影響邊界與主要地址。Ethereum 聯絡地址與 Stellar 攻擊控制關係仍待最終復盤。\n\n## 處置狀態\nBlend 普通合約和普通存款池保持安全口徑；backstop 存款人損失待最終復盤。公開協商提出返還 85% 並保留 15% 白帽賞金，但沒有返還確認。\n\n## 地址與交易\nStellar 受影響池、Ethereum 歸因地址、Stellar 協商賬戶和 Ethereum Messenger 地址均保留為相關地址，不把協商方標為攻擊者。", "en": "## Incident overview\nThe Comet AMM BLND-USDC pool had a same-asset swap and reserve-accounting flaw. The attacker used Blend liquidity to repeat the process and make accounting diverge from actual reserves.\n\n## Incident sequence\n1. Blend warned of an incident affecting the Comet BLND-USDC pool on August 25, 2026.\n2. The attacker used liquidity from a Blend pool and repeated the same-asset swap process about 36 times.\n3. Reserve calculations were corrupted and excess USDC was extracted.\n4. Blend later clarified that its ordinary contracts and deposit pools were unaffected, while backstop depositors holding Comet LP shares were impacted.\n\n## Fund flow\nBlend liquidity → CometDEX BLND-USDC pool → attacker extraction route; later conversion, cross-chain, and exchange endpoints remain incomplete.\n\n## Amount basis\nSlowMist reported about $717,518.92, while an earlier Defimon estimate was about $750,000. They are different source and time estimates and are not added together.\n\n## Evidence boundary\nBlend notices, Defimon analysis, and the SlowMist record support the pool exploit, impact boundary, and principal addresses. The relationship between the Ethereum contact address and Stellar control remains subject to final review.\n\n## Current status\nBlend's ordinary contracts and deposit pools remained safe according to its notices; backstop depositor losses await a final accounting. A public negotiation requested 85% return with a 15% white-hat bounty, but no return was confirmed.\n\n## Addresses and transactions\nThe affected Stellar pool, Ethereum attribution address, Stellar negotiation account, and Ethereum Messenger are retained as related addresses; negotiation parties are not labeled attackers." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "Stellar", "Ethereum" ], "chains": [ "Stellar", "Ethereum" ], "lossUsd": 717518.92, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "SlowMist 估计约 717,518.92 USD；Defimon 早期口径约 750,000 USD，均指同一池的不同估值。", "tw": "SlowMist 估計約 717,518.92 USD；Defimon 早期口徑約 750,000 USD，均指同一池的不同估值。", "en": "SlowMist estimated about $717,518.92; an earlier Defimon estimate was about $750,000 for the same pool and is not additive." }, "addressDisclosure": "published", "addresses": [ { "chain": "Stellar", "address": "CAS3FL6TLZKDGGSISDBWGGPXT3NRR4DYTZD7YOD3HMYO6LTJUVGRVEAM", "entity": { "zh": "CometDEX BLND-USDC 受影响池", "tw": "CometDEX BLND-USDC 受影響池", "en": "CometDEX BLND-USDC affected pool" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/DefimonAlerts/status/2092344641534271648", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Defimon 将该地址列为被利用的 Stellar 池，不是攻击者地址。", "tw": "Defimon 將該地址列為被利用的 Stellar 池，不是攻擊者地址。", "en": "Defimon identifies this address as the exploited Stellar pool, not an attacker address." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x0ff9ebafc1ef4a0aa479533dff8ecb10492df7da", "entity": { "zh": "Comet 归因地址", "tw": "Comet 歸因地址", "en": "Comet attributed address" }, "role": "related", "category": "unknown", "confidence": 0.68, "sourceUrl": "https://x.com/DefimonAlerts/status/2092344641534271648", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Defimon 将该地址与攻击者路径关联，但与 Stellar 控制关系仍待确认。", "tw": "Defimon 將該地址與攻擊者路徑關聯，但與 Stellar 控制關係仍待確認。", "en": "Defimon links this address to the attack route, but control of the Stellar activity remains unconfirmed." }, "reviewRequired": true }, { "chain": "Stellar", "address": "GBCAS7XIGDRZY4BMABJMGGW7J3YTITRRV5BTEMFQE5ZZSSVWHHX2ZSS4", "entity": { "zh": "YieldBlox Security Council 协商账户", "tw": "YieldBlox Security Council 協商賬戶", "en": "YieldBlox Security Council negotiation account" }, "role": "negotiation", "category": "service", "confidence": 0.9, "sourceUrl": "https://x.com/DefimonAlerts/status/2092344641534271648", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该账户用于公开白帽返还协商，不是攻击者地址。", "tw": "該賬戶用於公開白帽返還協商，不是攻擊者地址。", "en": "This account was used for public white-hat return negotiations and is not an attacker address." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x456c2f5f3536b1d9238f4654d5242b0df8f978af", "entity": { "zh": "YieldBlox Messenger 联络地址", "tw": "YieldBlox Messenger 聯絡地址", "en": "YieldBlox Messenger contact address" }, "role": "negotiation", "category": "service", "confidence": 0.84, "sourceUrl": "https://x.com/DefimonAlerts/status/2092344641534271648", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址用于协商通信，不能据此认定为攻击者。", "tw": "該地址用於協商通信，不能據此認定為攻擊者。", "en": "This address was used for negotiation communication and is not thereby an attacker address." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "Blend 首次警报", "tw": "Blend 首次警報", "en": "Blend initial warning" }, "url": "https://x.com/blend_capital/status/2092125330437763553", "type": "official" }, { "label": { "zh": "Blend 影响边界澄清", "tw": "Blend 影響邊界澄清", "en": "Blend impact clarification" }, "url": "https://x.com/blend_capital/status/2092288347766984713", "type": "official" }, { "label": { "zh": "Defimon Comet 分析", "tw": "Defimon Comet 分析", "en": "Defimon Comet analysis" }, "url": "https://x.com/DefimonAlerts/status/2092344641534271648", "type": "research" }, { "label": { "zh": "SlowMist Hacked Zone", "tw": "SlowMist Hacked Zone", "en": "SlowMist Hacked Zone" }, "url": "https://hacked.slowmist.io/", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-268", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-267", "status": "verified", "incidentDate": "2026-08-25", "datePrecision": "day", "title": { "zh": "PacaSwap SWAP / DAG 池被 metagraph 漏洞抽干", "tw": "PacaSwap SWAP / DAG 池被 metagraph 漏洞抽乾", "en": "PacaSwap SWAP / DAG pools drained through a metagraph vulnerability" }, "summary": { "zh": "PacaSwap 官方确认 SWAP / DAG 流动性池被 metagraph 漏洞抽干并暂停 Bridge。项目方承诺承担受影响 LP 损失，但没有公开美元金额、攻击地址或交易哈希。", "tw": "PacaSwap 官方確認 SWAP / DAG 流動性池被 metagraph 漏洞抽乾並暫停 Bridge。項目方承諾承擔受影響 LP 損失，但沒有公開美元金額、攻擊地址或交易哈希。", "en": "PacaSwap confirmed that its SWAP / DAG liquidity pools were drained through a metagraph vulnerability and paused the Bridge. The project said it would cover affected LP losses, but disclosed no USD amount, attacker address, or transaction hash." }, "details": { "zh": "## 事件背景\nPacaSwap 的 metagraph 逻辑存在可被利用的漏洞。公开公告确认 SWAP / DAG 池受影响，Hypergraph 未受影响。\n\n## 事件经过\n1. 2026 年 8 月 25 日约 04:30，项目宣布调查安全事件并将 metagraph 下线。\n2. Bridge 被预防性关闭，Hypergraph 保持运行。\n3. 约 08:04，项目确认攻击者利用漏洞抽干 SWAP / DAG 池，并表示已经识别和修补问题。\n\n## 资金流向\nSWAP / DAG 流动性池 → 攻击者路径；公开公告没有提供完整地址、交易哈希、桥接、混币器或交易所落点。\n\n## 金额口径\n项目方没有公开 SWAP、DAG 数量或美元价值，只承诺承担受影响 LP 损失；承诺金额不能视为已追回。\n\n## 证据边界\nPacaSwap 连续官方公告支持攻击存在和处置动作，但没有代码级根因、完整账本或攻击者身份。\n\n## 处置状态\nmetagraph 和 Bridge 进入暂停与修补，Hypergraph 未受影响。补偿快照、金额和发放时间尚未公开。\n\n## 地址与交易\n公开来源没有提供可核验的完整链上地址或交易哈希。", "tw": "## 事件背景\nPacaSwap 的 metagraph 邏輯存在可被利用的漏洞。公開公告確認 SWAP / DAG 池受影響，Hypergraph 未受影響。\n\n## 事件經過\n1. 2026 年 8 月 25 日約 04:30，項目宣佈調查安全事件並將 metagraph 下線。\n2. Bridge 被預防性關閉，Hypergraph 保持運行。\n3. 約 08:04，項目確認攻擊者利用漏洞抽乾 SWAP / DAG 池，並表示已經識別和修補問題。\n\n## 資金流向\nSWAP / DAG 流動性池 → 攻擊者路徑；公開公告沒有提供完整地址、交易哈希、橋接、混幣器或交易所落點。\n\n## 金額口徑\n項目方沒有公開 SWAP、DAG 數量或美元價值，只承諾承擔受影響 LP 損失；承諾金額不能視為已追回。\n\n## 證據邊界\nPacaSwap 連續官方公告支持攻擊存在和處置動作，但沒有代碼級根因、完整賬本或攻擊者身份。\n\n## 處置狀態\nmetagraph 和 Bridge 進入暫停與修補，Hypergraph 未受影響。補償快照、金額和發放時間尚未公開。\n\n## 地址與交易\n公開來源沒有提供可核驗的完整鏈上地址或交易哈希。", "en": "## Incident overview\nPacaSwap's metagraph logic contained an exploitable flaw. Official notices confirmed impact to the SWAP / DAG pools while Hypergraph remained unaffected.\n\n## Incident sequence\n1. At about 04:30 Beijing time on August 25, 2026, PacaSwap announced an investigation and took the metagraph offline.\n2. The Bridge was closed as a precaution while Hypergraph continued operating.\n3. At about 08:04, PacaSwap confirmed that an attacker had drained the SWAP / DAG pools and said the flaw had been identified and patched.\n\n## Fund flow\nSWAP / DAG liquidity pools → attacker route; the official notices disclose no complete address, transaction hash, bridge, mixer, or exchange endpoint.\n\n## Amount basis\nPacaSwap disclosed no SWAP, DAG, or USD amount and only promised to cover affected LP losses; a promise is not verified recovery.\n\n## Evidence boundary\nPacaSwap's consecutive official notices support the attack and response, but do not provide code-level root cause, a complete ledger, or attacker identity.\n\n## Current status\nThe metagraph and Bridge entered suspension and remediation while Hypergraph remained unaffected. The compensation snapshot, amount, and payment timing are unpublished.\n\n## Addresses and transactions\nNo complete verifiable on-chain address or transaction hash was published." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "PacaSwap 官方确认 SWAP / DAG 池被抽干，但没有公开美元损失口径。", "tw": "PacaSwap 官方確認 SWAP / DAG 池被抽乾，但沒有公開美元損失口徑。", "en": "PacaSwap confirmed that the SWAP / DAG pools were drained, but disclosed no USD loss basis." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "PacaSwap 首次安全公告", "tw": "PacaSwap 首次安全公告", "en": "PacaSwap initial security notice" }, "url": "https://x.com/PacaSwap/status/2091986448304279906", "type": "official" }, { "label": { "zh": "PacaSwap 攻击确认", "tw": "PacaSwap 攻擊確認", "en": "PacaSwap exploit confirmation" }, "url": "https://x.com/PacaSwap/status/2092040461200564546", "type": "official" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-267", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-266", "status": "verified", "incidentDate": "2026-08-25", "datePrecision": "day", "title": { "zh": "Trezor 利用多家加密服务泄露数据的新钓鱼浪潮", "tw": "Trezor 利用多家加密服務洩露數據的新釣魚浪潮", "en": "Trezor confirms a new phishing wave using data leaked from multiple crypto services" }, "summary": { "zh": "Trezor 官方确认出现利用多家加密服务泄露数据的新一轮精准钓鱼活动。当前没有公开确认的新增链上损失，但活动已构成面向多链钱包用户的恶意传播威胁。", "tw": "Trezor 官方確認出現利用多家加密服務洩露數據的新一輪精準釣魚活動。當前沒有公開確認的新增鏈上損失，但活動已構成面向多鏈錢包用戶的惡意傳播威脅。", "en": "Trezor confirmed a new targeted phishing wave using data leaked from multiple crypto services. No new on-chain loss has been publicly confirmed, but the campaign is an active malicious distribution threat to multi-chain wallet users." }, "details": { "zh": "## 事件背景\n攻击者把不同加密服务泄露的邮箱、客户资料或账户信息组合使用，制作看似真实的 Trezor 通知或安全提醒，诱导用户进入仿冒页面。\n\n## 事件经过\n1. 2026 年 8 月 25 日，用户公开收到疑似 Trezor 钓鱼邮件。\n2. Trezor 回应称正在看到新一轮钓鱼浪潮，并确认攻击者可能组合使用多家服务的泄露数据。\n3. Trezor 同时说明过去第三方工具曾涉及 Newsletter 邮箱泄露，并已采取防复发措施。\n\n## 资金流向\n邮件或仿冒站 → 助记词、私钥或恶意签名 → 多链钱包。报告窗口内没有公开可核的受害地址、交易哈希或新增资金损失。\n\n## 金额口径\n本窗口没有确认新增美元损失；潜在受害人数、泄露字段和资金规模均未公开。\n\n## 证据边界\nTrezor 官方确认活动存在，但没有确认所有数据来自自身系统，也没有公布每封邮件的来源、受害人数或链上结果。\n\n## 处置状态\n钓鱼活动仍需持续防范。用户应通过书签访问官网，拒绝输入助记词或私钥，并为高价值账户使用硬件安全密钥。\n\n## 地址与交易\n这是链下邮件和身份数据传播事件，公开来源没有提供适合核验的链上地址或交易哈希。", "tw": "## 事件背景\n攻擊者把不同加密服務洩露的郵箱、客戶資料或賬戶信息組合使用，製作看似真實的 Trezor 通知或安全提醒，誘導用戶進入仿冒頁面。\n\n## 事件經過\n1. 2026 年 8 月 25 日，用戶公開收到疑似 Trezor 釣魚郵件。\n2. Trezor 回應稱正在看到新一輪釣魚浪潮，並確認攻擊者可能組合使用多家服務的洩露數據。\n3. Trezor 同時說明過去第三方工具曾涉及 Newsletter 郵箱洩露，並已採取防復發措施。\n\n## 資金流向\n郵件或仿冒站 → 助記詞、私鑰或惡意簽名 → 多鏈錢包。報告窗口內沒有公開可核的受害地址、交易哈希或新增資金損失。\n\n## 金額口徑\n本窗口沒有確認新增美元損失；潛在受害人數、洩露字段和資金規模均未公開。\n\n## 證據邊界\nTrezor 官方確認活動存在，但沒有確認所有數據來自自身系統，也沒有公佈每封郵件的來源、受害人數或鏈上結果。\n\n## 處置狀態\n釣魚活動仍需持續防範。用戶應通過書籤訪問官網，拒絕輸入助記詞或私鑰，併為高價值賬戶使用硬件安全密鑰。\n\n## 地址與交易\n這是鏈下郵件和身份數據傳播事件，公開來源沒有提供適合核驗的鏈上地址或交易哈希。", "en": "## Incident overview\nAttackers combined leaked email, customer, or account data from different crypto services to make convincing Trezor notices and lure users to look-alike pages.\n\n## Incident sequence\n1. Users publicly reported suspected Trezor phishing emails on August 25, 2026.\n2. Trezor said it was seeing a new phishing wave and that the actors may be combining data leaked from multiple services.\n3. Trezor also noted that a third-party tool had previously exposed Newsletter emails and said it had taken preventative measures.\n\n## Fund flow\nEmail or look-alike site → seed phrase, private key, or malicious signature → multi-chain wallet. No verifiable victim address, transaction hash, or new loss was disclosed for this window.\n\n## Amount basis\nNo new USD loss was confirmed for this window; victim count, leaked fields, and financial impact remain undisclosed.\n\n## Evidence boundary\nTrezor confirmed the campaign, but did not confirm that all data came from its own systems or publish the source of each message, victim count, or on-chain result.\n\n## Current status\nThe phishing campaign remains an active warning. Users should use bookmarked official sites, never enter a seed phrase or private key, and protect high-value accounts with hardware security keys.\n\n## Addresses and transactions\nThis is an off-chain email and identity-data campaign; no suitable on-chain addresses or transaction hashes were published." }, "category": "phishing-approval", "severity": "high", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": 0, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "本窗口没有公开确认的新增链上损失；事件属于已确认的恶意钓鱼传播活动。", "tw": "本窗口沒有公開確認的新增鏈上損失；事件屬於已確認的惡意釣魚傳播活動。", "en": "No new on-chain loss was publicly confirmed for this window; the event is a confirmed malicious phishing campaign." }, "addressDisclosure": "not-applicable", "addresses": [], "references": [ { "label": { "zh": "Trezor 官方钓鱼回应", "tw": "Trezor 官方釣魚回應", "en": "Trezor official phishing response" }, "url": "https://x.com/Trezor/status/2092228166823682261", "type": "official" }, { "label": { "zh": "Trezor 安全更新", "tw": "Trezor 安全更新", "en": "Trezor security update" }, "url": "https://blog.trezor.io/trezor-security-update-stay-vigilant-against-potential-phishing-attack-bb05015a21f8", "type": "official" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-266", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-264", "status": "verified", "incidentDate": "2026-08-25", "datePrecision": "day", "title": { "zh": "FH / FHToken PancakeSwap V2 卖出税逻辑被利用", "tw": "FH / FHToken PancakeSwap V2 賣出稅邏輯被利用", "en": "FH / FHToken PancakeSwap V2 sell-tax logic exploit" }, "summary": { "zh": "BNB Chain 上的 FH / USDT PancakeSwap V2 池被循环买卖利用，FHToken 卖出税逻辑错误地改写池储备，安全机构估计损失约 20,000 USD。", "tw": "BNB Chain 上的 FH / USDT PancakeSwap V2 池被循環買賣利用，FHToken 賣出稅邏輯錯誤地改寫池儲備，安全機構估計損失約 20,000 USD。", "en": "The FH / USDT PancakeSwap V2 pool on BNB Chain was exploited through repeated buy-and-sell calls. A FHToken sell-tax flaw corrupted pool reserves, with security researchers estimating about $20,000 in losses." }, "details": { "zh": "## 事件背景\nFHToken 的 `_transfer` 在识别卖出时从池子余额执行销毁和分配，并在卖家净额进入池子前调用 `sync()`，造成储备记录与真实余额错配。\n\n## 事件经过\n1. 2026 年 8 月 25 日 17:54:52，攻击交易在 BNB Chain 成功上链。\n2. 攻击者反复买入和卖出 FHToken，触发错误的卖出税路径。\n3. 池余额被错误扣减后提前同步，储备关系持续偏离。\n4. 攻击者循环抽取 USDT，SlowMist 随后公布根因和完整地址。\n\n## 资金流向\nFH / USDT 流动性池 → 攻击者交易路径；公开来源没有给出后续桥接、混币器或交易所落点。\n\n## 金额口径\n安全机构估计约 20,000 USD，按池中被抽取的 USDT 口径；交易量、代币销毁量和攻击者净利润不重复计算。\n\n## 证据边界\nSlowMist 技术说明和成功交易支持漏洞机制、攻击者、池和 Token 地址。项目方最终损失对账、补偿和后续资金路线仍未公开。\n\n## 处置状态\n攻击已经发生；截止报告时没有项目方冻结、返还或赔付公告，相关池和 Token 仍需视为高风险。\n\n## 地址与交易\n攻击者 EOA、FH / USDT 池、FHToken 合约和成功攻击交易的完整标识符已列入标签与来源。", "tw": "## 事件背景\nFHToken 的 `_transfer` 在識別賣出時從池子餘額執行銷燬和分配，並在賣家淨額進入池子前調用 `sync()`，造成儲備記錄與真實餘額錯配。\n\n## 事件經過\n1. 2026 年 8 月 25 日 17:54:52，攻擊交易在 BNB Chain 成功上鍊。\n2. 攻擊者反覆買入和賣出 FHToken，觸發錯誤的賣出稅路徑。\n3. 池餘額被錯誤扣減後提前同步，儲備關係持續偏離。\n4. 攻擊者循環抽取 USDT，SlowMist 隨後公佈根因和完整地址。\n\n## 資金流向\nFH / USDT 流動性池 → 攻擊者交易路徑；公開來源沒有給出後續橋接、混幣器或交易所落點。\n\n## 金額口徑\n安全機構估計約 20,000 USD，按池中被抽取的 USDT 口徑；交易量、代幣銷燬量和攻擊者淨利潤不重複計算。\n\n## 證據邊界\nSlowMist 技術說明和成功交易支持漏洞機制、攻擊者、池和 Token 地址。項目方最終損失對賬、補償和後續資金路線仍未公開。\n\n## 處置狀態\n攻擊已經發生；截止報告時沒有項目方凍結、返還或賠付公告，相關池和 Token 仍需視為高風險。\n\n## 地址與交易\n攻擊者 EOA、FH / USDT 池、FHToken 合約和成功攻擊交易的完整標識符已列入標籤與來源。", "en": "## Incident overview\nWhen FHToken identified a sell, its `_transfer` path burned and distributed tokens from the pool balance and called `sync()` before the seller net amount arrived, creating a reserve-to-balance mismatch.\n\n## Incident sequence\n1. The attack transaction succeeded on BNB Chain at 17:54:52 Beijing time on August 25, 2026.\n2. The attacker repeatedly bought and sold FHToken to trigger the faulty sell-tax path.\n3. Pool balances were changed and synchronized at the wrong point, causing the reserve relationship to drift.\n4. The attacker looped to extract USDT, after which SlowMist published the root cause and complete addresses.\n\n## Fund flow\nFH / USDT liquidity pool → attacker transaction route; public sources do not show a later bridge, mixer, or exchange endpoint.\n\n## Amount basis\nSecurity researchers estimate about $20,000 based on USDT extracted from the pool. Trading volume, burned token quantity, and attacker profit are not added together.\n\n## Evidence boundary\nSlowMist's technical explanation and the successful transaction support the mechanism, attacker, pool, and token addresses. A project-level loss reconciliation, compensation, and later fund route remain unpublished.\n\n## Current status\nThe exploit occurred. No project freeze, return, or compensation notice was found by the report cutoff; the pool and token should be treated as high risk.\n\n## Addresses and transactions\nThe attacker EOA, FH / USDT pool, FHToken contract, and the successful attack transaction are retained with their source references." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "BNB Chain" ], "chains": [ "BNB Chain" ], "lossUsd": 20000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "安全机构估计约 20,000 USD 的 USDT 从 FH / USDT 池流出。", "tw": "安全機構估計約 20,000 USD 的 USDT 從 FH / USDT 池流出。", "en": "Security researchers estimate about $20,000 in USDT was extracted from the FH / USDT pool." }, "addressDisclosure": "published", "addresses": [ { "chain": "BNB Chain", "address": "0x7fa3bc0d5667ffd14d7acd6ce5f2432ac13a6fda", "entity": { "zh": "FH 攻击交易发起地址", "tw": "FH 攻擊交易發起地址", "en": "FH attack transaction sender" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/SlowMist_Team/status/2092457395666751707", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "SlowMist 将该 EOA 列为循环买卖攻击发起方。", "tw": "SlowMist 將該 EOA 列為循環買賣攻擊發起方。", "en": "SlowMist identifies this EOA as the origin of the buy-and-sell exploit." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x8f2d1a3992856a860304f1b86534b6b129cc4df7", "entity": { "zh": "FH / USDT PancakeSwap V2 池", "tw": "FH / USDT PancakeSwap V2 池", "en": "FH / USDT PancakeSwap V2 pool" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/SlowMist_Team/status/2092457395666751707", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址是被利用的 FH / USDT 流动性池，不是攻击者地址。", "tw": "該地址是被利用的 FH / USDT 流動性池，不是攻擊者地址。", "en": "This address is the exploited FH / USDT liquidity pool, not an attacker address." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xdcf0dfe0053677a67610c6d08ea1f5c78df8ca37", "entity": { "zh": "FHToken 合约", "tw": "FHToken 合約", "en": "FHToken contract" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/SlowMist_Team/status/2092457395666751707", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "SlowMist 将该地址与带税逻辑漏洞的 FHToken 对应。", "tw": "SlowMist 將該地址與帶稅邏輯漏洞的 FHToken 對應。", "en": "SlowMist associates this address with the FHToken contract containing the sell-tax flaw." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "SlowMist FH 技术告警", "tw": "SlowMist FH 技術告警", "en": "SlowMist FH technical alert" }, "url": "https://x.com/SlowMist_Team/status/2092457395666751707", "type": "research" }, { "label": { "zh": "BNB Chain 攻击交易", "tw": "BNB Chain 攻擊交易", "en": "BNB Chain attack transaction" }, "url": "https://bscscan.com/tx/0x7a3cadc2f33e000b0091307df62db2f5cc79ab8e0b022fd84de9e1c2c0745bd2", "type": "explorer" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-264", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-263", "status": "verified", "incidentDate": "2026-08-25", "datePrecision": "day", "title": { "zh": "Realio / realio.fund 多链托管钱包持续被扫", "tw": "Realio / realio.fund 多鏈託管錢包持續被掃", "en": "Realio / realio.fund custody wallets drained across multiple chains" }, "summary": { "zh": "Realio 的 realio.fund 控制钱包自 8 月 25 日起在五条链出现持续异常转出。社区账本记录 127,918,788 RIO，报告给出的可流动资产约 263,596 USD；项目方确认 WebApp 被攻击并暂停相关服务。", "tw": "Realio 的 realio.fund 控制錢包自 8 月 25 日起在五條鏈出現持續異常轉出。社區賬本記錄 127,918,788 RIO，報告給出的可流動資產約 263,596 USD；項目方確認 WebApp 被攻擊並暫停相關服務。", "en": "Realio-controlled realio.fund wallets showed continuing anomalous outflows across five chains from August 25. A community ledger recorded 127,918,788 RIO and about $263,596 in liquid assets; Realio confirmed an attack and paused the affected WebApp." }, "details": { "zh": "## 事件背景\nRealio 官方确认 realio.fund WebApp 遭到攻击。社区逐链记录显示，受影响范围包括储备、国库和托管子账户；自托管 RIO 没有被同一证据链指向。\n\n## 事件经过\n1. 2026 年 8 月 25 日 11:31 起，Stellar、Ethereum、BNB Chain、Algorand 和 Realio Network 相继出现归集与扫转。\n2. 8 月 26 日官方首度确认并暂停 WebApp，但 Ethereum 与 BNB Chain 在之后仍出现第二波活动。\n3. 8 月 27 至 28 日，部分 RIO 进入 DEX、疑似交易所存款形态和新的归集地址。\n4. 8 月 29 日社区更新称约 43 小时没有新扫转，项目准备分阶段恢复和处理申领。\n\n## 资金流向\nrealio.fund 控制的钱包和储备 → 五条链的共同归集地址 → DEX 流动性池、兑换路径和疑似 MEXC / KuCoin 存款形态。Algorand 与 Realio Network 仍保留大量 RIO，部分网络因暂停出块暂时无法移动。\n\n## 金额口径\n社区账本记录约 127,918,788 RIO 转出，其中约 14,198,576 RIO 来自用户侧。报告同时估计可变现或持有的流动资产约 263,596 USD；代币数量、名义估值和流动资产不能相加，本条采用较保守的流动资产口径。\n\n## 证据边界\nRealio 官方公告、逐链社区账本和区块浏览器共同支持攻击存在、时间线与主要归集地址。具体入口、签名设备、供应商和交易所最终处置尚未公开，新的存款形态也不等于已经完成归因。\n\n## 处置状态\n项目已停用 WebApp、关闭部分桥接并联系交易所；未见全部资金冻结、司法接管或返还的公开回执。原生链暂停导致的暂时不可移动不等于追回。\n\n## 地址与交易\nEthereum 与 BNB Chain 共同归集地址、Algorand 接收账户、Stellar 接收账户、Realio Network 接收账户以及 BNB Chain 的 RIO 合约均列在地址标签中；官方请求 Binance 调查的交易哈希保留在来源引用。", "tw": "## 事件背景\nRealio 官方確認 realio.fund WebApp 遭到攻擊。社區逐鏈記錄顯示，受影響範圍包括儲備、國庫和託管子賬戶；自託管 RIO 沒有被同一證據鏈指向。\n\n## 事件經過\n1. 2026 年 8 月 25 日 11:31 起，Stellar、Ethereum、BNB Chain、Algorand 和 Realio Network 相繼出現歸集與掃轉。\n2. 8 月 26 日官方首度確認並暫停 WebApp，但 Ethereum 與 BNB Chain 在之後仍出現第二波活動。\n3. 8 月 27 至 28 日，部分 RIO 進入 DEX、疑似交易所存款形態和新的歸集地址。\n4. 8 月 29 日社區更新稱約 43 小時沒有新掃轉，項目準備分階段恢復和處理申領。\n\n## 資金流向\nrealio.fund 控制的錢包和儲備 → 五條鏈的共同歸集地址 → DEX 流動性池、兌換路徑和疑似 MEXC / KuCoin 存款形態。Algorand 與 Realio Network 仍保留大量 RIO，部分網絡因暫停出塊暫時無法移動。\n\n## 金額口徑\n社區賬本記錄約 127,918,788 RIO 轉出，其中約 14,198,576 RIO 來自用戶側。報告同時估計可變現或持有的流動資產約 263,596 USD；代幣數量、名義估值和流動資產不能相加，本條採用較保守的流動資產口徑。\n\n## 證據邊界\nRealio 官方公告、逐鏈社區賬本和區塊瀏覽器共同支持攻擊存在、時間線與主要歸集地址。具體入口、簽名設備、供應商和交易所最終處置尚未公開，新的存款形態也不等於已經完成歸因。\n\n## 處置狀態\n項目已停用 WebApp、關閉部分橋接並聯系交易所；未見全部資金凍結、司法接管或返還的公開回執。原生鏈暫停導致的暫時不可移動不等於追回。\n\n## 地址與交易\nEthereum 與 BNB Chain 共同歸集地址、Algorand 接收賬戶、Stellar 接收賬戶、Realio Network 接收賬戶以及 BNB Chain 的 RIO 合約均列在地址標籤中；官方請求 Binance 調查的交易哈希保留在來源引用。", "en": "## Incident overview\nRealio confirmed that the realio.fund WebApp was attacked. Cross-chain records point to reserve, treasury, and custodial subaccounts, while the same evidence does not point to self-custodied RIO.\n\n## Incident sequence\n1. From 11:31 Beijing time on August 25, aggregation and draining appeared on Stellar, Ethereum, BNB Chain, Algorand, and Realio Network.\n2. Realio confirmed the incident on August 26 and paused the WebApp, but a second wave continued on Ethereum and BNB Chain afterward.\n3. During August 27 and 28, some RIO moved through DEX liquidity pools, suspected exchange deposit patterns, and new aggregation addresses.\n4. A community update on August 29 reported about 43 hours without new drains while Realio prepared staged recovery and claims handling.\n\n## Fund flow\nrealio.fund-controlled wallets and reserves → common aggregation addresses on five chains → DEX liquidity pools, conversion routes, and suspected MEXC / KuCoin deposit patterns. Large RIO balances remained on Algorand and Realio Network, where a paused chain temporarily prevented movement.\n\n## Amount basis\nThe community ledger recorded about 127,918,788 RIO moved, including about 14,198,576 RIO attributed to user-side balances. It also estimated about $263,596 in liquid assets. Token quantity, nominal valuation, and liquid assets are not additive; this record uses the conservative liquid-asset basis.\n\n## Evidence boundary\nRealio statements, the cross-chain community ledger, and explorers support the incident, timeline, and principal aggregation addresses. The entry point, signing devices, vendors, and final exchange actions remain undisclosed, and a suspected deposit pattern is not final attribution.\n\n## Current status\nRealio disabled the WebApp, closed selected bridges, and contacted exchanges. No public receipt confirms a complete freeze, judicial custody, or return. Temporary immobility caused by a halted chain is not recovery.\n\n## Addresses and transactions\nThe shared Ethereum and BNB Chain aggregation address, Algorand and Stellar receivers, the Realio Network receiver, and the BNB Chain RIO contract are retained as labeled addresses. The transaction cited in Realio's Binance request is preserved in the references." }, "category": "access-control", "severity": "critical", "ecosystems": [ "Ethereum", "BNB Chain", "Algorand", "Stellar", "Realio Network" ], "chains": [ "Ethereum", "BNB Chain", "Algorand", "Stellar", "Realio Network" ], "lossUsd": 263596, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 127,918,788 RIO 转出；报告给出的可流动资产约 263,596 USD，实际净损失仍待结算。", "tw": "約 127,918,788 RIO 轉出；報告給出的可流動資產約 263,596 USD，實際淨損失仍待結算。", "en": "About 127,918,788 RIO moved; the report estimates about $263,596 in liquid assets, while the final net loss remains unresolved." }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0xbe827abf934cf7f4547e3285f100c39bf690a404", "entity": { "zh": "Realio Ethereum 归集地址", "tw": "Realio Ethereum 歸集地址", "en": "Realio Ethereum aggregation address" }, "role": "aggregation", "category": "stolen_funds", "confidence": 0.88, "sourceUrl": "https://realiostats.com/incident", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "逐链账本将该地址列为 Realio 资产的归集节点。", "tw": "逐鏈賬本將該地址列為 Realio 資產的歸集節點。", "en": "The cross-chain ledger lists this address as an aggregation node for Realio assets." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xbe827abf934cf7f4547e3285f100c39bf690a404", "entity": { "zh": "Realio BNB Chain 归集地址", "tw": "Realio BNB Chain 歸集地址", "en": "Realio BNB Chain aggregation address" }, "role": "aggregation", "category": "stolen_funds", "confidence": 0.88, "sourceUrl": "https://realiostats.com/incident", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "同一形状地址在 BNB Chain 上承接 Realio 资产，角色来自逐链账本。", "tw": "同一形狀地址在 BNB Chain 上承接 Realio 資產，角色來自逐鏈賬本。", "en": "The same-shaped address received Realio assets on BNB Chain according to the cross-chain ledger." }, "reviewRequired": true }, { "chain": "Algorand", "address": "RCES4II33PXVDX4ISQ3TWUZN5DP7JM6ZTDBJLARYQH53O4OLN5QTNYUJ6A", "entity": { "zh": "Realio Algorand 接收账户", "tw": "Realio Algorand 接收賬戶", "en": "Realio Algorand receiving account" }, "role": "aggregation", "category": "stolen_funds", "confidence": 0.84, "sourceUrl": "https://realiostats.com/incident", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "逐链账本记录该账户汇集储备和托管用户资产。", "tw": "逐鏈賬本記錄該賬戶彙集儲備和託管用戶資產。", "en": "The cross-chain ledger records this account aggregating reserve and custodial user assets." }, "reviewRequired": true }, { "chain": "Stellar", "address": "GBDMMICWFVSSU5YIKIVWG6EP3U65R2GIF7BICN3JIBES5NVGFZFLWXKZ", "entity": { "zh": "Realio Stellar 接收账户", "tw": "Realio Stellar 接收賬戶", "en": "Realio Stellar receiving account" }, "role": "aggregation", "category": "stolen_funds", "confidence": 0.84, "sourceUrl": "https://realiostats.com/incident", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "逐链账本记录该账户接收并出售 RIO。", "tw": "逐鏈賬本記錄該賬戶接收並出售 RIO。", "en": "The cross-chain ledger records this account receiving and selling RIO." }, "reviewRequired": true }, { "chain": "Realio Network", "address": "realio1uzkdrfnjv53rt0cf4ltszffpd7mvkpd2cv794j", "entity": { "zh": "Realio Network 归集地址", "tw": "Realio Network 歸集地址", "en": "Realio Network aggregation address" }, "role": "aggregation", "category": "stolen_funds", "confidence": 0.82, "sourceUrl": "https://realiostats.com/incident", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "公开账本将该地址列为原生链归集节点；网络暂停期间暂时不能移动。", "tw": "公開賬本將該地址列為原生鏈歸集節點；網絡暫停期間暫時不能移動。", "en": "The public ledger lists this as a native-chain aggregation node; movement was temporarily unavailable while the network was paused." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x94a8b4ee5cd64c79d0ee816f467ea73009f51aa0", "entity": { "zh": "Realio RIO 合约", "tw": "Realio RIO 合約", "en": "Realio RIO contract" }, "role": "contract", "category": "unknown", "confidence": 0.78, "sourceUrl": "https://realiostats.com/incident", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "公开账本将该地址用于 RIO 合约和日志复核，不是攻击者地址。", "tw": "公開賬本將該地址用於 RIO 合約和日誌複核，不是攻擊者地址。", "en": "The public ledger uses this address for RIO contract and log review; it is not an attacker address." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "Realio 官方攻击公告", "tw": "Realio 官方攻擊公告", "en": "Realio official incident notice" }, "url": "https://x.com/realio_network/status/2092288120918044688", "type": "official" }, { "label": { "zh": "Realio 逐链事件账本", "tw": "Realio 逐鏈事件賬本", "en": "Realio cross-chain incident ledger" }, "url": "https://realiostats.com/incident", "type": "research" }, { "label": { "zh": "Realio 请求 Binance 调查", "tw": "Realio 請求 Binance 調查", "en": "Realio request for Binance investigation" }, "url": "https://x.com/realio_network/status/2092339791509717163", "type": "official" }, { "label": { "zh": "GoPlus 跨窗口复核", "tw": "GoPlus 跨窗口複核", "en": "GoPlus cross-window review" }, "url": "https://x.com/GoPlusSecurity/status/2092918981900558463", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-263", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-256", "status": "verified", "incidentDate": "2026-08-23", "datePrecision": "day", "title": { "zh": "Arrakis V1 G-UNI 金库原子流动性三明治攻击", "tw": "Arrakis V1 G-UNI 金庫原子流動性三明治攻擊", "en": "Arrakis V1 G-UNI vault suffered an atomic liquidity-sandwich attack" }, "summary": { "zh": "攻击者利用 2021 年遗留 G-UNI ENS–WETH 金库状态依赖的 Uniswap V3 铸造/销毁记账，通过原子流动性操作抽取约 2.94 WETH，估值约 7,100 美元。Arrakis Pro 金库不受影响。", "tw": "攻擊者利用 2021 年遺留 G-UNI ENS–WETH 金庫狀態依賴的 Uniswap V3 鑄造/銷燬記賬，通過原子流動性操作抽取約 2.94 WETH，估值約 7,100 美元。Arrakis Pro 金庫不受影響。", "en": "An attacker exploited state-dependent Uniswap V3 mint/burn accounting in a 2021 legacy G-UNI ENS–WETH vault, extracting about 2.94 WETH valued near $7,100 through atomic liquidity operations. Arrakis Pro vaults were unaffected." }, "details": { "zh": "## 事件背景\n遗留 G-UNI 金库的状态依赖记账允许攻击者在同一原子交易中铸造份额、操纵池状态、累积费用后销毁份额。Arrakis 官方确认只影响 2021 年遗留公共金库系统。\n\n## 事件经过\n1. 攻击者从 Morpho 闪电贷获得流动性。\n2. 攻击合约对 legacy G-UNI ENS–WETH 金库和指定 Uniswap V3 池执行原子铸造、价格/费用状态改变和销毁。\n3. burn() 在改变后状态下收集费用并按份额分配余额。\n4. 攻击交易成功，SlowMist 估计损失 2.94 WETH。\n\n## 资金流向\nMorpho 闪电贷 → 攻击合约 → 遗留 G-UNI 金库 / Uniswap V3 池 → WETH 攻击收益；未发现后续混币或 CEX 路径。\n\n## 金额口径\nSlowMist 给出 2.94 WETH，DeFiLlama 估值约 7,100 美元；不把两种表达相加，也不计闪电贷本金。\n\n## 证据边界\nArrakis 官方、SlowMist 和 DeFiLlama 支持遗留范围、根因、地址和交易；完整赔付、追回和全部池状态未公开。\n\n## 处置状态\nArrakis Pro 不受影响；遗留 G-UNI 系统不可变且管理角色已放弃，大部分资金已撤出。\n\n## 地址与交易\n攻击 EOA、攻击合约、金库 Proxy / Implementation、Uniswap 池和 Morpho 来源地址已列入标签；攻击交易保存在来源引用中。\n\n## 2026-08-24 技术披露更新\nSlowMist、DeFiHackLabs 和 Arrakis 官方进一步确认这是 8 月 23 日发生的遗留 G-UNI 金库原子流动性三明治攻击，净提取约 2.9414 ETH/WETH。Arrakis Pro 不受影响，旧系统不可变且大部分资金已撤出。\n\n## 更新时间证据边界\n披露时间在本窗口内，攻击时间早于本窗口；完整损失清单、补偿和追回状态未公开。", "tw": "## 事件背景\n遺留 G-UNI 金庫的狀態依賴記賬允許攻擊者在同一原子交易中鑄造份額、操縱池狀態、累積費用後銷燬份額。Arrakis 官方確認隻影響 2021 年遺留公共金庫系統。\n\n## 事件經過\n1. 攻擊者從 Morpho 閃電貸獲得流動性。\n2. 攻擊合約對 legacy G-UNI ENS–WETH 金庫和指定 Uniswap V3 池執行原子鑄造、價格/費用狀態改變和銷燬。\n3. burn() 在改變後狀態下收集費用並按份額分配餘額。\n4. 攻擊交易成功，SlowMist 估計損失 2.94 WETH。\n\n## 資金流向\nMorpho 閃電貸 → 攻擊合約 → 遺留 G-UNI 金庫 / Uniswap V3 池 → WETH 攻擊收益；未發現後續混幣或 CEX 路徑。\n\n## 金額口徑\nSlowMist 給出 2.94 WETH，DeFiLlama 估值約 7,100 美元；不把兩種表達相加，也不計閃電貸本金。\n\n## 證據邊界\nArrakis 官方、SlowMist 和 DeFiLlama 支持遺留範圍、根因、地址和交易；完整賠付、追回和全部池狀態未公開。\n\n## 處置狀態\nArrakis Pro 不受影響；遺留 G-UNI 系統不可變且管理角色已放棄，大部分資金已撤出。\n\n## 地址與交易\n攻擊 EOA、攻擊合約、金庫 Proxy / Implementation、Uniswap 池和 Morpho 來源地址已列入標籤；攻擊交易保存在來源引用中。\n\n## 2026-08-24 技術披露更新\nSlowMist、DeFiHackLabs 和 Arrakis 官方進一步確認這是 8 月 23 日發生的遺留 G-UNI 金庫原子流動性三明治攻擊，淨提取約 2.9414 ETH/WETH。Arrakis Pro 不受影響，舊系統不可變且大部分資金已撤出。\n\n## 更新時間證據邊界\n披露時間在本窗口內，攻擊時間早於本窗口；完整損失清單、補償和追回狀態未公開。", "en": "## Incident overview\nState-dependent accounting in a legacy G-UNI vault allowed an attacker to mint shares, alter pool state, accumulate fees, and burn shares within one atomic transaction. Arrakis confirmed the affected system was a 2021 legacy public-vault system.\n\n## Incident sequence\n1. The attacker sourced liquidity from a Morpho flash loan.\n2. The attack contract performed atomic mint, pool price/fee-state changes, and burn operations against the legacy G-UNI ENS–WETH vault and a Uniswap V3 pool.\n3. burn() collected fees and distributed liquidity, fees, and idle balances under the changed state.\n4. The attack transaction succeeded; SlowMist estimated 2.94 WETH loss.\n\n## Fund flow\nMorpho flash loan → attack contract → legacy G-UNI vault / Uniswap V3 pool → WETH proceeds; no later mixer or CEX route was found.\n\n## Amount basis\nSlowMist reported 2.94 WETH and DeFiLlama valued it near $7,100; these are not added and flash-loan principal is excluded.\n\n## Evidence boundary\nArrakis, SlowMist, and DeFiLlama support the legacy scope, root cause, addresses, and transaction. Complete compensation, recovery, and all pool-state details remain undisclosed.\n\n## Current status\nArrakis Pro was unaffected; the legacy G-UNI system is immutable, administration was abandoned, and most funds had already been withdrawn.\n\n## Addresses and transaction\nThe attacker EOA, attack contract, vault Proxy / Implementation, Uniswap pool, and Morpho source are preserved in address labels; the attack transaction is in the references.\n\n## August 24 technical-disclosure update\nSlowMist, DeFiHackLabs, and Arrakis further confirmed an August 23 atomic liquidity-sandwich attack against a legacy G-UNI vault, with about 2.9414 ETH/WETH net extraction. Arrakis Pro was unaffected, and the legacy system is immutable with most funds already withdrawn.\n\n## Timing evidence boundary\nThe disclosure was inside this window, but the attack predates it; a complete loss list, compensation, and recovery status were not public." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 7100, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 2.94 WETH，估值约 7,100 美元；不含闪电贷本金。", "tw": "約 2.94 WETH，估值約 7,100 美元；不含閃電貸本金。", "en": "About 2.94 WETH valued near $7,100; flash-loan principal is excluded." }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0xa3b096e4df1247794599a37af8f5b8cb05d5eb44", "entity": { "zh": "Arrakis 攻击者 EOA", "tw": "Arrakis 攻擊者 EOA", "en": "Arrakis attacker EOA" }, "role": "attack-executor", "category": "stolen_funds", "confidence": 0.92, "sourceUrl": "https://etherscan.io/address/0xa3b096e4df1247794599a37af8f5b8cb05d5eb44", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "SlowMist 将该 EOA 与成功攻击交易关联。", "tw": "SlowMist 將該 EOA 與成功攻擊交易關聯。", "en": "SlowMist linked this EOA to the successful attack transaction." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x028d9c17b1a097e7e115a6400203df86339baf4a", "entity": { "zh": "Arrakis 攻击合约", "tw": "Arrakis 攻擊合約", "en": "Arrakis attack contract" }, "role": "attack-contract", "category": "hack", "confidence": 0.94, "sourceUrl": "https://etherscan.io/address/0x028d9c17b1a097e7e115a6400203df86339baf4a", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "SlowMist 将该合约列为攻击执行组件。", "tw": "SlowMist 將該合約列為攻擊執行組件。", "en": "SlowMist identified this contract as the attack execution component." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x7c687f775a3b73bbab0e15832f24caab5d53bdde", "entity": { "zh": "Arrakis 遗留 G-UNI 金库 Proxy", "tw": "Arrakis 遺留 G-UNI 金庫 Proxy", "en": "Arrakis legacy G-UNI vault Proxy" }, "role": "affected-contract", "category": "unknown", "confidence": 0.94, "sourceUrl": "https://etherscan.io/address/0x7c687f775a3b73bbab0e15832f24caab5d53bdde", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址是受影响遗留金库 Proxy，不是攻击者地址。", "tw": "該地址是受影響遺留金庫 Proxy，不是攻擊者地址。", "en": "This is the affected legacy-vault Proxy, not an attacker address." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xd68b055fb444d136e3ac4df023f4c42334f06395", "entity": { "zh": "Arrakis 遗留 G-UNI 金库 Implementation", "tw": "Arrakis 遺留 G-UNI 金庫 Implementation", "en": "Arrakis legacy G-UNI vault Implementation" }, "role": "affected-contract", "category": "unknown", "confidence": 0.94, "sourceUrl": "https://etherscan.io/address/0xd68b055fb444d136e3ac4df023f4c42334f06395", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址是受影响遗留金库 Implementation，不是攻击者地址。", "tw": "該地址是受影響遺留金庫 Implementation，不是攻擊者地址。", "en": "This is the affected legacy-vault Implementation, not an attacker address." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xb9c4a5522a2f8ba9e2ff7063df8c02ed443337a3", "entity": { "zh": "被操纵 Uniswap V3 池", "tw": "被操縱 Uniswap V3 池", "en": "Manipulated Uniswap V3 pool" }, "role": "affected-pool", "category": "unknown", "confidence": 0.92, "sourceUrl": "https://etherscan.io/address/0xb9c4a5522a2f8ba9e2ff7063df8c02ed443337a3", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址是被操纵池，不是攻击者地址。", "tw": "該地址是被操縱池，不是攻擊者地址。", "en": "This is the manipulated pool, not an attacker address." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xbbbbbbbbbb9cc5e90e3b3af64bdaf62c37eeffcb", "entity": { "zh": "Morpho 闪电贷来源（非黑客）", "tw": "Morpho 閃電貸來源（非黑客）", "en": "Morpho flash-loan source (not a hacker address)" }, "role": "flash-loan-source", "category": "unknown", "confidence": 0.98, "sourceUrl": "https://etherscan.io/address/0xbbbbbbbbbb9cc5e90e3b3af64bdaf62c37eeffcb", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址是闪电贷来源，不代表控制者是攻击者。", "tw": "該地址是閃電貸來源，不代表控制者是攻擊者。", "en": "This is the flash-loan source and does not identify its controller as the attacker." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "SlowMist Arrakis 警报", "tw": "SlowMist Arrakis 警報", "en": "SlowMist Arrakis alert" }, "url": "https://x.com/SlowMist_Team/status/2091738634210996429", "type": "research" }, { "label": { "zh": "Arrakis 官方澄清", "tw": "Arrakis 官方澄清", "en": "Arrakis official clarification" }, "url": "https://x.com/ArrakisFinance/status/2091557562399514673", "type": "official" }, { "label": { "zh": "Arrakis 攻击交易", "tw": "Arrakis 攻擊交易", "en": "Arrakis attack transaction" }, "url": "https://etherscan.io/tx/0x6ae3af4b2f25a56594de99cfb31369150dd9ac059c49efe04b9e3e0163dbc672", "type": "explorer" }, { "label": { "zh": "DeFiLlama Arrakis 记录", "tw": "DeFiLlama Arrakis 記錄", "en": "DeFiLlama Arrakis record" }, "url": "https://api.llama.fi/hacks", "type": "research" }, { "label": { "zh": "DeFiHackLabs Arrakis PoC", "tw": "DeFiHackLabs Arrakis PoC", "en": "DeFiHackLabs Arrakis PoC" }, "url": "https://github.com/SunWeb3Sec/DeFiHackLabs/commit/d5167541cd4c982cd4d29e583089b2a1a5caa6e6", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-256", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-255", "status": "verified", "incidentDate": "2026-08-23", "datePrecision": "day", "title": { "zh": "Term Labs / Term Meta Vaults 治理攻击，约 850 万美元被抽走", "tw": "Term Labs / Term Meta Vaults 治理攻擊，約 850 萬美元被抽走", "en": "Term Labs / Term Meta Vaults governance attack drained about $8.5 million" }, "summary": { "zh": "攻击者通过低成本 tmvETH / gtmvETH 投票权路径影响 Term Vault 治理并抽走约 850 万美元，包括约 2,843 ETH 和约 168 万美元稳定币。Term 已关闭 Meta Vaults、撤销 DAO 治理角色并禁止新增存款，提款仍可进行。", "tw": "攻擊者通過低成本 tmvETH / gtmvETH 投票權路徑影響 Term Vault 治理並抽走約 850 萬美元，包括約 2,843 ETH 和約 168 萬美元穩定幣。Term 已關閉 Meta Vaults、撤銷 DAO 治理角色並禁止新增存款，提款仍可進行。", "en": "An attacker used a low-cost tmvETH / gtmvETH voting-power path to influence Term Vault governance and drain about $8.5 million, including about 2,843 ETH and $1.68 million in stablecoins. Term closed Meta Vaults, revoked DAO roles, and blocked new deposits while withdrawals remain available." }, "details": { "zh": "## 事件背景\nTerm Vault 治理投票权设计允许攻击者以少量 ETH 获得包装资产和投票权，进而影响 Vault 角色与资金权限。\n\n## 事件经过\n1. 8 月 23 日发现 Term 保险库受到治理漏洞影响。\n2. 攻击者用约 0.5 ETH 兑换并包装为投票权资产。\n3. 治理路径影响 Vault 角色后抽走约 2,843 ETH 和约 168 万美元稳定币。\n4. Term 关闭全部 Meta Vaults、撤销 DAO 治理角色并禁止新增存款。\n\n## 资金流向\nTornado Cash 来源约 2 ETH → tmvETH / gtmvETH 投票权路径 → Term Meta Vaults → 0xD5183d8BfC65a50863C62aF2538198A8288FFc13 持有 ETH 与稳定币。\n\n## 金额口径\nPeckShield 和 CertiK 估计约 850 万美元，包括约 2,843 ETH（约 687 万美元）和约 168 万美元 USDC / DAI；不同资产口径不相加。\n\n## 证据边界\nTerm、PeckShield、CertiK 和 GoPlus 支持治理路径与金额；完整攻击交易、全部受影响 Vault 和最终追回金额未完整公开。\n\n## 处置状态\nMeta Vaults 已不可逆关闭，DAO 治理角色撤销，禁止新增存款，提款仍可进行；项目称底层 Term 协议和直接借贷市场未受影响。\n\n## 地址与交易\n攻击收益持有地址：0xD5183d8BfC65a50863C62aF2538198A8288FFc13。治理投票权和关键链上动作交易保存在来源引用中。\n\n## 2026-08-25 资金异动更新\nTerm 攻击收益归集地址在窗口内向中转地址分三次发送 100 ETH，并另发少量 Gas；中转地址随后分三笔各向 Tornado Cash Router 存入 100 ETH，总计 300 ETH。该动作是 8 月 23 日治理攻击的后续资金异动，不是新增攻击。\n\n## 更新证据边界\nPeckShield 的旧案归因与链上存款交易支持金额和路径；混币后的出口、追回和受益人未公开。", "tw": "## 事件背景\nTerm Vault 治理投票權設計允許攻擊者以少量 ETH 獲得包裝資產和投票權，進而影響 Vault 角色與資金權限。\n\n## 事件經過\n1. 8 月 23 日發現 Term 保險庫受到治理漏洞影響。\n2. 攻擊者用約 0.5 ETH 兌換並包裝為投票權資產。\n3. 治理路徑影響 Vault 角色後抽走約 2,843 ETH 和約 168 萬美元穩定幣。\n4. Term 關閉全部 Meta Vaults、撤銷 DAO 治理角色並禁止新增存款。\n\n## 資金流向\nTornado Cash 來源約 2 ETH → tmvETH / gtmvETH 投票權路徑 → Term Meta Vaults → 0xD5183d8BfC65a50863C62aF2538198A8288FFc13 持有 ETH 與穩定幣。\n\n## 金額口徑\nPeckShield 和 CertiK 估計約 850 萬美元，包括約 2,843 ETH（約 687 萬美元）和約 168 萬美元 USDC / DAI；不同資產口徑不相加。\n\n## 證據邊界\nTerm、PeckShield、CertiK 和 GoPlus 支持治理路徑與金額；完整攻擊交易、全部受影響 Vault 和最終追回金額未完整公開。\n\n## 處置狀態\nMeta Vaults 已不可逆關閉，DAO 治理角色撤銷，禁止新增存款，提款仍可進行；項目稱底層 Term 協議和直接借貸市場未受影響。\n\n## 地址與交易\n攻擊收益持有地址：0xD5183d8BfC65a50863C62aF2538198A8288FFc13。治理投票權和關鍵鏈上動作交易保存在來源引用中。\n\n## 2026-08-25 資金異動更新\nTerm 攻擊收益歸集地址在窗口內向中轉地址分三次發送 100 ETH，並另發少量 Gas；中轉地址隨後分三筆各向 Tornado Cash Router 存入 100 ETH，總計 300 ETH。該動作是 8 月 23 日治理攻擊的後續資金異動，不是新增攻擊。\n\n## 更新證據邊界\nPeckShield 的舊案歸因與鏈上存款交易支持金額和路徑；混幣後的出口、追回和受益人未公開。", "en": "## Incident overview\nTerm Vault governance allowed an attacker to obtain voting power from a small amount of ETH and influence Vault roles and fund permissions.\n\n## Incident sequence\n1. Term identified a governance vulnerability affecting its Vaults on August 23.\n2. The attacker converted about 0.5 ETH into wrapped voting-power assets.\n3. Governance paths affected Vault roles and drained about 2,843 ETH and $1.68 million in stablecoins.\n4. Term closed all Meta Vaults, revoked DAO roles, and blocked new deposits.\n\n## Fund flow\nAbout 2 ETH from Tornado Cash → tmvETH / gtmvETH voting-power path → Term Meta Vaults → 0xD5183d8BfC65a50863C62aF2538198A8288FFc13 holding ETH and stablecoins.\n\n## Amount basis\nPeckShield and CertiK estimated about $8.5M, including about 2,843 ETH (about $6.87M) and $1.68M USDC / DAI; asset bases are not added.\n\n## Evidence boundary\nTerm, PeckShield, CertiK, and GoPlus support the governance path and amount. Complete attack transactions, all affected Vaults, and final recovery remain undisclosed.\n\n## Current status\nMeta Vaults were permanently closed, DAO governance roles revoked, and new deposits blocked while withdrawals remain available. Term said the underlying protocol and direct lending markets were unaffected.\n\n## Addresses and transactions\nAttack-profit holding address: 0xD5183d8BfC65a50863C62aF2538198A8288FFc13. Voting-power and key on-chain-action transactions are preserved in the references.\n\n## August 25 fund-movement update\nThe Term attack-profit aggregation address sent three 100 ETH transfers plus a small gas transfer to an intermediate address. The intermediate address then made three 100 ETH deposits into the Tornado Cash Router, totaling 300 ETH. This is follow-up movement from the August 23 governance attack, not a new attack.\n\n## Updated evidence boundary\nPeckShield attribution and on-chain deposit transactions support the amount and path; mixer exits, recovery, and beneficiaries remain undisclosed." }, "category": "governance-attack", "severity": "critical", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 8500000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 850 万美元；约 2,843 ETH 与约 168 万美元 USDC/DAI 是同一事件的资产构成。", "tw": "約 850 萬美元；約 2,843 ETH 與約 168 萬美元 USDC/DAI 是同一事件的資產構成。", "en": "About $8.5M; approximately 2,843 ETH and $1.68M USDC/DAI are components of the same event." }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0xD5183d8BfC65a50863C62aF2538198A8288FFc13", "entity": { "zh": "Term 攻击收益持有地址", "tw": "Term 攻擊收益持有地址", "en": "Term attack-profit holding address" }, "role": "stolen-funds-receiving", "category": "stolen_funds", "confidence": 0.92, "sourceUrl": "https://etherscan.io/address/0xD5183d8BfC65a50863C62aF2538198A8288FFc13", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "CertiK 和 PeckShield 将该地址与约 2,843 ETH 和稳定币持有路径关联。", "tw": "CertiK 和 PeckShield 將該地址與約 2,843 ETH 和穩定幣持有路徑關聯。", "en": "CertiK and PeckShield linked this address to the path holding about 2,843 ETH and stablecoins." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xc14007663a5bb9f13d4d2aee8c6fe9075ef1d83e", "entity": { "zh": "Term 旧案资金中转地址", "tw": "Term 舊案資金中轉地址", "en": "Term old-case fund relay address" }, "role": "relay", "category": "stolen_funds", "confidence": 0.9, "sourceUrl": "https://etherscan.io/address/0xc14007663a5bb9f13d4d2aee8c6fe9075ef1d83e", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "PeckShield 将该地址与 Term 旧案后续资金中转关联。", "tw": "PeckShield 將該地址與 Term 舊案後續資金中轉關聯。", "en": "PeckShield linked this address to the Term old-case follow-up relay." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xd90e2f925da726b50c4ed8d0fb90ad053324f31b", "entity": { "zh": "Tornado Cash Router（非黑客基础设施）", "tw": "Tornado Cash Router（非黑客基礎設施）", "en": "Tornado Cash Router (not hacker infrastructure)" }, "role": "mixer-contract", "category": "mixer", "confidence": 0.99, "sourceUrl": "https://etherscan.io/address/0xd90e2f925da726b50c4ed8d0fb90ad053324f31b", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址是混币器基础设施，不代表控制者是攻击者。", "tw": "該地址是混幣器基礎設施，不代表控制者是攻擊者。", "en": "This is mixer infrastructure and does not identify its controller as an attacker." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "Term Labs 初始确认", "tw": "Term Labs 初始確認", "en": "Term Labs initial confirmation" }, "url": "https://x.com/term_labs/status/2091428394130886740", "type": "official" }, { "label": { "zh": "Term Labs 关闭 Meta Vaults 更新", "tw": "Term Labs 關閉 Meta Vaults 更新", "en": "Term Labs Meta Vault closure update" }, "url": "https://x.com/term_labs/status/2091667425129304215", "type": "official" }, { "label": { "zh": "PeckShield Term 分析", "tw": "PeckShield Term 分析", "en": "PeckShield Term analysis" }, "url": "https://x.com/PeckShieldAlert/status/2091452165932175659", "type": "research" }, { "label": { "zh": "CertiK Term 分析", "tw": "CertiK Term 分析", "en": "CertiK Term analysis" }, "url": "https://x.com/CertiKAlert/status/2091433962795106499", "type": "research" }, { "label": { "zh": "GoPlus 治理攻击分析", "tw": "GoPlus 治理攻擊分析", "en": "GoPlus governance-attack analysis" }, "url": "https://x.com/GoPlusSecurity/status/2091701988174200969", "type": "research" }, { "label": { "zh": "GoPlus 交易证据", "tw": "GoPlus 交易證據", "en": "GoPlus transaction evidence" }, "url": "https://x.com/GoPlusSecurity/status/2091701993136115802", "type": "research" }, { "label": { "zh": "DeFiLlama Term 记录", "tw": "DeFiLlama Term 記錄", "en": "DeFiLlama Term record" }, "url": "https://api.llama.fi/hacks", "type": "research" }, { "label": { "zh": "PeckShield Term 300 ETH 异动", "tw": "PeckShield Term 300 ETH 異動", "en": "PeckShield Term 300 ETH movement" }, "url": "https://x.com/PeckShieldAlert/status/2092047363162673357", "type": "research" }, { "label": { "zh": "Re Term 资产未受影响声明", "tw": "Re Term 資產未受影響聲明", "en": "Re Term unaffected-assets statement" }, "url": "https://x.com/re/status/2091635758172111112", "type": "official" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-255", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-254", "status": "verified", "incidentDate": "2026-08-22", "datePrecision": "day", "title": { "zh": "The Sandbox SAND OFT 权限劫持与异常铸币", "tw": "The Sandbox SAND OFT 權限劫持與異常鑄幣", "en": "The Sandbox SAND OFT suffered delegate hijacking and unauthorized minting" }, "summary": { "zh": "Base 上的 SAND OFT approveAndCall / LayerZero delegate 路径被滥用，攻击者铸造大量无抵押 SAND。The Sandbox 官方确认已遏制，Ethereum 与 Polygon 上的 SAND 未受影响，GoPlus 估计受流动性与储备约束的实际损失约 67 万美元。", "tw": "Base 上的 SAND OFT approveAndCall / LayerZero delegate 路徑被濫用，攻擊者鑄造大量無抵押 SAND。The Sandbox 官方確認已遏制，Ethereum 與 Polygon 上的 SAND 未受影響，GoPlus 估計受流動性與儲備約束的實際損失約 67 萬美元。", "en": "The Base SAND OFT approveAndCall / LayerZero delegate path was abused to mint large amounts of unbacked SAND. The Sandbox confirmed containment; SAND on Ethereum and Polygon was unaffected. GoPlus estimated actual loss constrained by liquidity and reserves at about $670,000." }, "details": { "zh": "## 事件背景\nBase 上的 SAND OFT 跨链接收和 delegate 权限路径存在缺陷，攻击者可伪造或滥用 lzReceive 流程铸造无抵押 SAND。\n\n## 事件经过\n1. 2026 年 8 月 22 日 07:42 左右出现异常铸币。\n2. Blockaid 在 12:14 披露攻击仍在进行，PeckShield 随后给出两个地址的数量快照。\n3. The Sandbox 于 15:22 确认漏洞已识别并完全遏制。\n4. 官方称 Ethereum 和 Polygon 上的 SAND 未受影响，用户钱包未被入侵。\n\n## 资金流向\n异常铸币 → Base 上三个攻击相关地址；名义铸币量受流动性、桥储备和交易所限制，不能直接等同实际损失。\n\n## 金额口径\nBlockaid 约 49B SAND 是名义铸币面值，PeckShield 时点约 14.9B，GoPlus 估计实际流动性/储备损失约 67 万美元。三种口径不相加。\n\n## 证据边界\nBlockaid、PeckShield、GoPlus 和 The Sandbox 官方共同支持路径与遏制定性；逐笔铸币账本、最终销毁、赔偿和桥恢复细节仍未完整公开。\n\n## 处置状态\n官方称漏洞已遏制，用户钱包未被入侵；后续桥和合约处置等待官方继续披露。\n\n## 地址与交易\n攻击相关地址：0x638Ccb18370eE228378a565c1d4D0F9620d7F296、0xAbE09907D2038181fc5Fb0ff0c961c147Cda4D22、0xFF7cE6fBa49Dd3e6E8af5ef15D7d1ef3D87B1023；受影响 OFTSand 合约：0xac531Eb26Ca1d21b85126De8FB87E80E09002DcF。示例铸币交易保存在来源引用中。\n\n## 2026 年 8 月 27 日官方复盘与一比一补偿\nThe Sandbox 后续复盘确认旧桥配置和任意调用组合导致异常铸币与 Ethereum vault 提取。官方将旧桥永久关闭，并宣布对事件前合法桥接持有人按一比一的 Ethereum SAND 方案补偿；这属于 8 月 22 日攻击的处置更新。\n", "tw": "## 事件背景\nBase 上的 SAND OFT 跨鏈接收和 delegate 權限路徑存在缺陷，攻擊者可偽造或濫用 lzReceive 流程鑄造無抵押 SAND。\n\n## 事件經過\n1. 2026 年 8 月 22 日 07:42 左右出現異常鑄幣。\n2. Blockaid 在 12:14 披露攻擊仍在進行，PeckShield 隨後給出兩個地址的數量快照。\n3. The Sandbox 於 15:22 確認漏洞已識別並完全遏制。\n4. 官方稱 Ethereum 和 Polygon 上的 SAND 未受影響，用戶錢包未被入侵。\n\n## 資金流向\n異常鑄幣 → Base 上三個攻擊相關地址；名義鑄幣量受流動性、橋儲備和交易所限制，不能直接等同實際損失。\n\n## 金額口徑\nBlockaid 約 49B SAND 是名義鑄幣面值，PeckShield 時點約 14.9B，GoPlus 估計實際流動性/儲備損失約 67 萬美元。三種口徑不相加。\n\n## 證據邊界\nBlockaid、PeckShield、GoPlus 和 The Sandbox 官方共同支持路徑與遏制定性；逐筆鑄幣賬本、最終銷燬、賠償和橋恢復細節仍未完整公開。\n\n## 處置狀態\n官方稱漏洞已遏制，用戶錢包未被入侵；後續橋和合約處置等待官方繼續披露。\n\n## 地址與交易\n攻擊相關地址：0x638Ccb18370eE228378a565c1d4D0F9620d7F296、0xAbE09907D2038181fc5Fb0ff0c961c147Cda4D22、0xFF7cE6fBa49Dd3e6E8af5ef15D7d1ef3D87B1023；受影響 OFTSand 合約：0xac531Eb26Ca1d21b85126De8FB87E80E09002DcF。示例鑄幣交易保存在來源引用中。\n\n## 2026 年 8 月 27 日官方復盤與一比一補償\nThe Sandbox 後續復盤確認舊橋配置和任意調用組合導致異常鑄幣與 Ethereum vault 提取。官方將舊橋永久關閉，並宣佈對事件前合法橋接持有人按一比一的 Ethereum SAND 方案補償；這屬於 8 月 22 日攻擊的處置更新。\n", "en": "## Incident overview\nA flaw in the Base SAND OFT cross-chain receive and delegate path allowed attackers to mint unbacked SAND through an abused approveAndCall / lzReceive flow.\n\n## Incident sequence\n1. Abnormal minting appeared around 07:42 Beijing time on August 22, 2026.\n2. Blockaid reported an ongoing attack at 12:14, and PeckShield later published address-balance snapshots.\n3. The Sandbox confirmed at 15:22 that the flaw was identified and fully contained.\n4. The project said SAND on Ethereum and Polygon was unaffected and user wallets were not compromised.\n\n## Fund flow\nUnauthorized minting → three Base attack-related addresses. Nominal minted value is constrained by liquidity, bridge reserves, and exchange controls and is not directly actual loss.\n\n## Amount basis\nBlockaid's about 49B SAND is nominal minted face value, PeckShield reported about 14.9B at its snapshot, and GoPlus estimated actual liquidity/reserve-constrained loss near $670,000. These bases are not added.\n\n## Evidence boundary\nBlockaid, PeckShield, GoPlus, and The Sandbox support the path and containment. A transaction-level mint ledger, final burns, compensation, and bridge-recovery details remain incomplete.\n\n## Current status\nThe project said the flaw was contained and user wallets were not compromised; further bridge and contract handling remains subject to official updates.\n\n## Addresses and transaction\nAttack-related: 0x638Ccb18370eE228378a565c1d4D0F9620d7F296, 0xAbE09907D2038181fc5Fb0ff0c961c147Cda4D22, and 0xFF7cE6fBa49Dd3e6E8af5ef15D7d1ef3D87B1023; affected OFTSand contract: 0xac531Eb26Ca1d21b85126De8FB87E80E09002DcF. An example mint transaction is preserved in the references.\n\n## Official review and one-to-one compensation on August 27, 2026\nThe Sandbox later confirmed that the legacy bridge configuration and arbitrary-call combination caused the unbacked minting and Ethereum vault withdrawal. It permanently closed the legacy bridge and announced one-to-one Ethereum SAND compensation for eligible pre-incident bridge holders; this is a response update to the August 22 attack.\n" }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "Base", "BNB Chain" ], "chains": [ "Base", "BNB Chain" ], "lossUsd": 670000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "异常铸币面值约 49B SAND；GoPlus 估计实际流动性/储备损失约 67 万美元，不把名义面值计为损失。", "tw": "異常鑄幣面值約 49B SAND；GoPlus 估計實際流動性/儲備損失約 67 萬美元，不把名義面值計為損失。", "en": "Nominal minting was about 49B SAND; GoPlus estimated actual liquidity/reserve-constrained loss at about $670,000, not the nominal face value." }, "addressDisclosure": "published", "addresses": [ { "chain": "Base", "address": "0x638Ccb18370eE228378a565c1d4D0F9620d7F296", "entity": { "zh": "SAND OFT 异常铸币接收地址", "tw": "SAND OFT 異常鑄幣接收地址", "en": "SAND OFT unauthorized-mint receiving address" }, "role": "attack-related-receiving", "category": "stolen_funds", "confidence": 0.9, "sourceUrl": "https://base.blockscout.com/address/0x638Ccb18370eE228378a565c1d4D0F9620d7F296", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Blockaid 将该地址与异常铸币接收路径关联。", "tw": "Blockaid 將該地址與異常鑄幣接收路徑關聯。", "en": "Blockaid linked this address to the unauthorized-mint receiving path." }, "reviewRequired": true }, { "chain": "Base", "address": "0xAbE09907D2038181fc5Fb0ff0c961c147Cda4D22", "entity": { "zh": "SAND OFT 异常铸币接收地址", "tw": "SAND OFT 異常鑄幣接收地址", "en": "SAND OFT unauthorized-mint receiving address" }, "role": "attack-related-receiving", "category": "stolen_funds", "confidence": 0.9, "sourceUrl": "https://base.blockscout.com/address/0xAbE09907D2038181fc5Fb0ff0c961c147Cda4D22", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Blockaid 将该地址与异常铸币接收路径关联。", "tw": "Blockaid 將該地址與異常鑄幣接收路徑關聯。", "en": "Blockaid linked this address to the unauthorized-mint receiving path." }, "reviewRequired": true }, { "chain": "Base", "address": "0xFF7cE6fBa49Dd3e6E8af5ef15D7d1ef3D87B1023", "entity": { "zh": "SAND OFT 异常铸币相关地址", "tw": "SAND OFT 異常鑄幣相關地址", "en": "SAND OFT unauthorized-mint related address" }, "role": "attack-related", "category": "unknown", "confidence": 0.86, "sourceUrl": "https://base.blockscout.com/address/0xFF7cE6fBa49Dd3e6E8af5ef15D7d1ef3D87B1023", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Blockaid 将该地址列为相关地址，具体角色待核。", "tw": "Blockaid 將該地址列為相關地址，具體角色待核。", "en": "Blockaid listed this as a related address; its exact role remains open." }, "reviewRequired": true }, { "chain": "Base", "address": "0xac531Eb26Ca1d21b85126De8FB87E80E09002DcF", "entity": { "zh": "The Sandbox OFTSand 受影响合约（非黑客）", "tw": "The Sandbox OFTSand 受影響合約（非黑客）", "en": "Affected The Sandbox OFTSand contract (not a hacker address)" }, "role": "affected-contract", "category": "unknown", "confidence": 1, "sourceUrl": "https://base.blockscout.com/address/0xac531Eb26Ca1d21b85126De8FB87E80E09002DcF", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "这是受影响 Token 合约，不是攻击者地址。", "tw": "這是受影響 Token 合約，不是攻擊者地址。", "en": "This is the affected token contract, not an attacker address." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "Blockaid SAND OFT 首报", "tw": "Blockaid SAND OFT 首報", "en": "Blockaid SAND OFT initial report" }, "url": "https://x.com/blockaid_/status/2091016046555582891", "type": "research" }, { "label": { "zh": "Blockaid 地址/交易补充", "tw": "Blockaid 地址/交易補充", "en": "Blockaid address/transaction supplement" }, "url": "https://x.com/blockaid_/status/2091016146698883105", "type": "research" }, { "label": { "zh": "PeckShield SAND OFT", "tw": "PeckShield SAND OFT", "en": "PeckShield SAND OFT report" }, "url": "https://x.com/PeckShieldAlert/status/2091037704314339331", "type": "research" }, { "label": { "zh": "The Sandbox 官方确认", "tw": "The Sandbox 官方確認", "en": "The Sandbox official confirmation" }, "url": "https://x.com/TheSandboxGame/status/2091063415649251821", "type": "official" }, { "label": { "zh": "GoPlus SAND OFT 分析", "tw": "GoPlus SAND OFT 分析", "en": "GoPlus SAND OFT analysis" }, "url": "https://x.com/GoPlusSecurity/status/2091350029617500439", "type": "research" }, { "label": { "zh": "SAND OFT 合约", "tw": "SAND OFT 合約", "en": "SAND OFT contract" }, "url": "https://base.blockscout.com/address/0xac531Eb26Ca1d21b85126De8FB87E80E09002DcF", "type": "explorer" }, { "label": { "zh": "The Sandbox 官方复盘", "tw": "The Sandbox 官方復盤", "en": "The Sandbox official review" }, "url": "https://x.com/TheSandboxGame/status/2092905959723045174", "type": "official" }, { "label": { "zh": "The Sandbox 补偿摘要", "tw": "The Sandbox 補償摘要", "en": "The Sandbox compensation summary" }, "url": "https://x.com/TheSandboxGame/status/2092913216972017801", "type": "official" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-254", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-253", "status": "verified", "incidentDate": "2026-08-22", "datePrecision": "day", "title": { "zh": "Bofur Capital 标记地址遭地址投毒，损失约 200 万 USDC", "tw": "Bofur Capital 標記地址遭地址投毒，損失約 200 萬 USDC", "en": "Bofur Capital-labeled address lost about $2 million USDC to address poisoning" }, "summary": { "zh": "攻击者通过尘埃转账和相似前后缀地址污染历史记录，Bofur Capital 标记的 Ethereum 地址从 Compound 提款后误将 2,000,000 USDC 转入投毒地址，随后换成约 1,999,939.4763 DAI。", "tw": "攻擊者通過塵埃轉賬和相似前後綴地址汙染歷史記錄，Bofur Capital 標記的 Ethereum 地址從 Compound 提款後誤將 2,000,000 USDC 轉入投毒地址，隨後換成約 1,999,939.4763 DAI。", "en": "Dust transfers and look-alike addresses polluted transaction history. After a Bofur Capital-labeled Ethereum address withdrew from Compound, it mis-sent 2,000,000 USDC to the poisoned address, which was later swapped into about 1,999,939.4763 DAI." }, "details": { "zh": "## 事件背景\n攻击者通过 0.0002 USDC 尘埃交易和相似地址污染历史记录，诱导受害者复制错误收款地址。Compound 只是提款来源，不是协议漏洞受害者。\n\n## 事件经过\n1. 8 月 21 日 04:20 左右，投毒地址向受害地址发送 0.0002 USDC。\n2. 8 月 22 日 00:01，受害地址从 Compound USDCv3 提取 2,000,000 USDC。\n3. 00:31，2,000,000 USDC 误转至投毒地址。\n4. 资金随后经中转和 CoW 兑换为约 1,999,939.4763 DAI。\n\n## 资金流向\nCompound USDCv3 → Bofur 标记受害地址 → 投毒地址 → 中转 / CoW → DAI 归集地址。\n\n## 金额口径\n2,000,000 USDC 是损失交易金额，约 1,999,939.4763 DAI 是后续资产形态，不重复相加。\n\n## 证据边界\nScamSniffer、PeckShield 和 Blockscout 支持地址、交易和路径；Bofur Capital 标签来自 PeckShield，未见受害方第一方公告。\n\n## 处置状态\n资金已换成 DAI，公开资料未显示冻结、追回或发行方处置。\n\n## 地址与交易\n受害地址 0x7Ba7f4773fa7890BaD57879F0a1Faa0eDffB3520；投毒地址 0xF0e6A49668dE1195B931A3717c9cc36fc19721aF；正确预期地址 0xF0e67A1896E814E30c011e36174de28CAA9Ab1aF；DAI 归集 0xe2eBfD6f329A6330aB7EEE68ce1328C21d31816a。损失、归集和 CoW 交易保存在来源引用中。", "tw": "## 事件背景\n攻擊者通過 0.0002 USDC 塵埃交易和相似地址汙染歷史記錄，誘導受害者複製錯誤收款地址。Compound 只是提款來源，不是協議漏洞受害者。\n\n## 事件經過\n1. 8 月 21 日 04:20 左右，投毒地址向受害地址發送 0.0002 USDC。\n2. 8 月 22 日 00:01，受害地址從 Compound USDCv3 提取 2,000,000 USDC。\n3. 00:31，2,000,000 USDC 誤轉至投毒地址。\n4. 資金隨後經中轉和 CoW 兌換為約 1,999,939.4763 DAI。\n\n## 資金流向\nCompound USDCv3 → Bofur 標記受害地址 → 投毒地址 → 中轉 / CoW → DAI 歸集地址。\n\n## 金額口徑\n2,000,000 USDC 是損失交易金額，約 1,999,939.4763 DAI 是後續資產形態，不重複相加。\n\n## 證據邊界\nScamSniffer、PeckShield 和 Blockscout 支持地址、交易和路徑；Bofur Capital 標籤來自 PeckShield，未見受害方第一方公告。\n\n## 處置狀態\n資金已換成 DAI，公開資料未顯示凍結、追回或發行方處置。\n\n## 地址與交易\n受害地址 0x7Ba7f4773fa7890BaD57879F0a1Faa0eDffB3520；投毒地址 0xF0e6A49668dE1195B931A3717c9cc36fc19721aF；正確預期地址 0xF0e67A1896E814E30c011e36174de28CAA9Ab1aF；DAI 歸集 0xe2eBfD6f329A6330aB7EEE68ce1328C21d31816a。損失、歸集和 CoW 交易保存在來源引用中。", "en": "## Incident overview\nDust transfers and look-alike addresses polluted the history of a Bofur Capital-labeled Ethereum address. After a Compound withdrawal, the victim mis-sent 2,000,000 USDC to the poisoned address, which later swapped it into about 1,999,939.4763 DAI.\n\n## Incident sequence\n1. Around 04:20 on August 21, the poison address sent 0.0002 USDC to the victim.\n2. At 00:01 on August 22, the victim withdrew 2,000,000 USDC from Compound USDCv3.\n3. At 00:31, the USDC was mis-sent to the poisoned address.\n4. The funds moved through a relay and CoW into about 1,999,939.4763 DAI.\n\n## Fund flow\nCompound USDCv3 → Bofur-labeled victim → poisoned address → relay / CoW → DAI aggregation address.\n\n## Amount basis\n2,000,000 USDC is the loss transfer, while about 1,999,939.4763 DAI is the later asset form and is not added again.\n\n## Evidence boundary\nScamSniffer, PeckShield, and Blockscout support the addresses, transactions, and route. The Bofur Capital label comes from PeckShield, with no first-party victim statement found.\n\n## Current status\nThe funds were swapped into DAI, with no public freeze, recovery, or issuer action.\n\n## Addresses and transactions\nVictim: 0x7Ba7f4773fa7890BaD57879F0a1Faa0eDffB3520; poison: 0xF0e6A49668dE1195B931A3717c9cc36fc19721aF; expected address: 0xF0e67A1896E814E30c011e36174de28CAA9Ab1aF; DAI aggregation: 0xe2eBfD6f329A6330aB7EEE68ce1328C21d31816a. Loss, aggregation, and CoW transactions are in the references." }, "category": "wallet-vulnerability", "severity": "high", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 2000000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "损失交易转出 2,000,000 USDC；后续约 1,999,939.4763 DAI 不重复计入。", "tw": "損失交易轉出 2,000,000 USDC；後續約 1,999,939.4763 DAI 不重複計入。", "en": "The loss transfer was 2,000,000 USDC; the later approximately 1,999,939.4763 DAI is not added again." }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0x7Ba7f4773fa7890BaD57879F0a1Faa0eDffB3520", "entity": { "zh": "Bofur Capital 标记受害地址", "tw": "Bofur Capital 標記受害地址", "en": "Bofur Capital-labeled victim address" }, "role": "victim", "category": "unknown", "confidence": 0.94, "sourceUrl": "https://eth.blockscout.com/address/0x7Ba7f4773fa7890BaD57879F0a1Faa0eDffB3520", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "PeckShield 标签与完整损失交易显示该地址是误转来源。", "tw": "PeckShield 標籤與完整損失交易顯示該地址是誤轉來源。", "en": "The PeckShield label and complete loss transaction identify this as the mis-transfer source." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xF0e6A49668dE1195B931A3717c9cc36fc19721aF", "entity": { "zh": "地址投毒收款地址", "tw": "地址投毒收款地址", "en": "Address-poisoning receiving address" }, "role": "stolen-funds-receiving", "category": "stolen_funds", "confidence": 0.96, "sourceUrl": "https://eth.blockscout.com/address/0xF0e6A49668dE1195B931A3717c9cc36fc19721aF", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "2,000,000 USDC 误转至该地址。", "tw": "2,000,000 USDC 誤轉至該地址。", "en": "The 2,000,000 USDC was mis-sent to this address." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xF0e67A1896E814E30c011e36174de28CAA9Ab1aF", "entity": { "zh": "正确预期收款地址（非黑客）", "tw": "正確預期收款地址（非黑客）", "en": "Correct expected recipient (not a hacker address)" }, "role": "expected-recipient", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://eth.blockscout.com/address/0xF0e67A1896E814E30c011e36174de28CAA9Ab1aF", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址用于说明相似前后缀投毒，不是攻击者地址。", "tw": "該地址用於說明相似前後綴投毒，不是攻擊者地址。", "en": "This address demonstrates the look-alike poisoning and is not an attacker address." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xe2eBfD6f329A6330aB7EEE68ce1328C21d31816a", "entity": { "zh": "Bofur 盗损 DAI 归集地址", "tw": "Bofur 盜損 DAI 歸集地址", "en": "Bofur stolen-DAI aggregation address" }, "role": "downstream-receiving", "category": "stolen_funds", "confidence": 0.9, "sourceUrl": "https://eth.blockscout.com/address/0xe2eBfD6f329A6330aB7EEE68ce1328C21d31816a", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "PeckShield 将约 1,999,939.4763 DAI 归集到该地址。", "tw": "PeckShield 將約 1,999,939.4763 DAI 歸集到該地址。", "en": "PeckShield linked about 1,999,939.4763 DAI to this address." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48", "entity": { "zh": "Ethereum canonical USDC 合约（非黑客）", "tw": "Ethereum canonical USDC 合約（非黑客）", "en": "Canonical Ethereum USDC contract (not a hacker address)" }, "role": "token-contract", "category": "unknown", "confidence": 1, "sourceUrl": "https://etherscan.io/address/0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "这是 USDC Token 合约。", "tw": "這是 USDC Token 合約。", "en": "This is the USDC token contract." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x6B175474E89094C44Da98b954EedeAC495271d0F", "entity": { "zh": "Ethereum canonical DAI 合约（非黑客）", "tw": "Ethereum canonical DAI 合約（非黑客）", "en": "Canonical Ethereum DAI contract (not a hacker address)" }, "role": "token-contract", "category": "unknown", "confidence": 1, "sourceUrl": "https://etherscan.io/address/0x6B175474E89094C44Da98b954EedeAC495271d0F", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "这是 DAI Token 合约。", "tw": "這是 DAI Token 合約。", "en": "This is the DAI token contract." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "ScamSniffer Bofur 首帖", "tw": "ScamSniffer Bofur 首帖", "en": "ScamSniffer Bofur alert" }, "url": "https://x.com/realScamSniffer/status/2090951067584581838", "type": "research" }, { "label": { "zh": "ScamSniffer Bofur 地址线程", "tw": "ScamSniffer Bofur 地址線程", "en": "ScamSniffer Bofur address thread" }, "url": "https://x.com/realScamSniffer/status/2090951079861395890", "type": "research" }, { "label": { "zh": "PeckShield Bofur 补充", "tw": "PeckShield Bofur 補充", "en": "PeckShield Bofur supplement" }, "url": "https://x.com/PeckShieldAlert/status/2090963523656622353", "type": "research" }, { "label": { "zh": "Bofur 损失交易", "tw": "Bofur 損失交易", "en": "Bofur loss transaction" }, "url": "https://eth.blockscout.com/tx/0x59b7e095ac27c198ccbc21a70b7c24b8b258db921305a8735d2106b89fc6b6a6", "type": "explorer" }, { "label": { "zh": "Bofur DAI 归集交易", "tw": "Bofur DAI 歸集交易", "en": "Bofur DAI aggregation transaction" }, "url": "https://eth.blockscout.com/tx/0xbffcc1965fa2bc9dd102182b8d15c5f40e137889bc711818fe4edeca16bdd019", "type": "explorer" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-253", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-252", "status": "verified", "incidentDate": "2026-08-21", "datePrecision": "day", "title": { "zh": "MANTRA Chain Cosmos-EVM 漏洞利用与主网停机", "tw": "MANTRA Chain Cosmos-EVM 漏洞利用與主網停機", "en": "MANTRA Chain Cosmos-EVM vulnerability exploitation caused a mainnet pause" }, "summary": { "zh": "MANTRA 官方确认上游 Cosmos-EVM 模块漏洞被利用，主网在区块 17,449,398 附近暂停，两个 MANTRA 管理钱包受影响。官方称用户、交易所和合作方资金未受直接影响，主网随后恢复出块并部署 v8.4.0。", "tw": "MANTRA 官方確認上游 Cosmos-EVM 模塊漏洞被利用，主網在區塊 17,449,398 附近暫停，兩個 MANTRA 管理錢包受影響。官方稱用戶、交易所和合作方資金未受直接影響，主網隨後恢復出塊並部署 v8.4.0。", "en": "MANTRA confirmed exploitation of an upstream Cosmos-EVM module vulnerability. The mainnet paused near block 17,449,398 and two MANTRA management wallets were affected. MANTRA said user, exchange, and partner funds were not directly affected; the chain later resumed block production with v8.4.0." }, "details": { "zh": "## 事件背景\nMANTRA 所用上游 Cosmos-EVM 依赖出现漏洞，攻击影响管理钱包和链级运行，但官方未披露完整钱包、交易或转移金额。\n\n## 事件经过\n1. 2026 年 8 月 21 日 07:44 左右发现异常并暂停主网。\n2. 区块、交易、跨链充值提现和质押暂时冻结。\n3. 团队定位 EVM 模块漏洞并准备 v8.4.0。\n4. 8 月 22 日约 13:30 恢复出块，随后进入监控状态。\n\n## 资金流向\n完整受影响管理钱包和攻击交易未公开；官方称用户余额未改变。\n\n## 金额口径\n没有确认用户、交易所或合作方损失，公开记录以 0 美元表示已确认事件但用户资金零损失。\n\n## 证据边界\n官方确认漏洞利用和停机；无法确认管理钱包标识、攻击者地址或资金移动。8 月 22 日 13:59 的正式 Monitoring 更新晚于第一份报告截止时间，但恢复动作发生在截止前。\n\n## 处置状态\n主网恢复出块，v8.4.0 修补漏洞；无回滚，官方称停机期间无状态变更。\n\n## 链上标识\n完整地址和交易哈希未公开。\n\n## 2026 年 8 月 25 日至 28 日共享模块复盘\nCosmos Labs 后续公开 GHSA-7g4w-cg88-2cq2，确认共享 Cosmos EVM 模块的余额和 vesting 处理缺陷影响多条链。MANTRA 的 8 月 21 日停机仍是本条根事件，后续复盘不新增一条攻击记录。\n", "tw": "## 事件背景\nMANTRA 所用上游 Cosmos-EVM 依賴出現漏洞，攻擊影響管理錢包和鏈級運行，但官方未披露完整錢包、交易或轉移金額。\n\n## 事件經過\n1. 2026 年 8 月 21 日 07:44 左右發現異常並暫停主網。\n2. 區塊、交易、跨鏈充值提現和質押暫時凍結。\n3. 團隊定位 EVM 模塊漏洞並準備 v8.4.0。\n4. 8 月 22 日約 13:30 恢復出塊，隨後進入監控狀態。\n\n## 資金流向\n完整受影響管理錢包和攻擊交易未公開；官方稱用戶餘額未改變。\n\n## 金額口徑\n沒有確認用戶、交易所或合作方損失，公開記錄以 0 美元表示已確認事件但用戶資金零損失。\n\n## 證據邊界\n官方確認漏洞利用和停機；無法確認管理錢包標識、攻擊者地址或資金移動。8 月 22 日 13:59 的正式 Monitoring 更新晚於第一份報告截止時間，但恢復動作發生在截止前。\n\n## 處置狀態\n主網恢復出塊，v8.4.0 修補漏洞；無回滾，官方稱停機期間無狀態變更。\n\n## 鏈上標識\n完整地址和交易哈希未公開。\n\n## 2026 年 8 月 25 日至 28 日共享模塊復盤\nCosmos Labs 後續公開 GHSA-7g4w-cg88-2cq2，確認共享 Cosmos EVM 模塊的餘額和 vesting 處理缺陷影響多條鏈。MANTRA 的 8 月 21 日停機仍是本條根事件，後續復盤不新增一條攻擊記錄。\n", "en": "## Incident overview\nAn upstream Cosmos-EVM dependency used by MANTRA had a vulnerability. The incident affected management wallets and chain operation, but complete wallets, transactions, and transfer amounts were not disclosed.\n\n## Incident sequence\n1. An anomaly was detected and the mainnet paused around 07:44 Beijing time on August 21, 2026.\n2. Blocks, transactions, cross-chain deposits and withdrawals, and staking were temporarily frozen.\n3. The team identified the EVM-module issue and prepared v8.4.0.\n4. Block production resumed around 13:30 on August 22 and the chain entered monitoring.\n\n## Fund flow\nComplete affected management wallets and attack transactions were not public; MANTRA said user balances were unchanged.\n\n## Amount basis\nNo user, exchange, or partner loss was confirmed. The public record uses zero dollars to represent a confirmed security event with zero confirmed user loss.\n\n## Evidence boundary\nThe project confirmed exploitation and downtime, but not wallet identifiers, attacker addresses, or fund movement. The 13:59 Monitoring update was after the first report cutoff, while the recovery action occurred before it.\n\n## Current status\nThe chain resumed block production and v8.4.0 patched the vulnerability; there was no rollback and no state change during the pause according to the project.\n\n## On-chain identifiers\nComplete addresses and transaction hashes were not disclosed.\n\n## Shared-module review from August 25 to 28, 2026\nCosmos Labs later published GHSA-7g4w-cg88-2cq2 and confirmed a balance and vesting-handling flaw in a shared Cosmos EVM module affecting multiple chains. MANTRA's August 21 halt remains the root event; the review does not create another attack record.\n" }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "Cosmos" ], "chains": [ "Cosmos" ], "lossUsd": 0, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "两个管理钱包受影响；官方称用户资金未改变，已确认用户损失为 0。", "tw": "兩個管理錢包受影響；官方稱用戶資金未改變，已確認用戶損失為 0。", "en": "Two management wallets were affected; the project said user funds were unchanged, with confirmed user loss of 0." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "MANTRA 初始公告", "tw": "MANTRA 初始公告", "en": "MANTRA initial announcement" }, "url": "https://x.com/MANTRA_Chain/status/2090592265765077162", "type": "official" }, { "label": { "zh": "MANTRA 后续恢复更新", "tw": "MANTRA 後續恢復更新", "en": "MANTRA recovery update" }, "url": "https://x.com/MANTRA_Chain/status/2090883795297992889", "type": "official" }, { "label": { "zh": "MANTRA 状态页", "tw": "MANTRA 狀態頁", "en": "MANTRA status page" }, "url": "https://status.mantrachain.io/incidents/01M0GRZSN99Q68QTFZT2QH4MDV", "type": "official" }, { "label": { "zh": "Cosmos-EVM 安全公告", "tw": "Cosmos-EVM 安全公告", "en": "Cosmos-EVM security advisory" }, "url": "https://github.com/cosmos/evm/security/advisories/GHSA-54gx-3cgr-7mfm", "type": "official" }, { "label": { "zh": "Cosmos Labs 安全公告", "tw": "Cosmos Labs 安全公告", "en": "Cosmos Labs security notice" }, "url": "https://x.com/cosmoslabs_io/status/2091935066381582390", "type": "official" }, { "label": { "zh": "Cosmos EVM GHSA-7g4w-cg88-2cq2", "tw": "Cosmos EVM GHSA-7g4w-cg88-2cq2", "en": "Cosmos EVM GHSA-7g4w-cg88-2cq2" }, "url": "https://github.com/cosmos/evm/security/advisories/GHSA-7g4w-cg88-2cq2", "type": "official" }, { "label": { "zh": "Cosmos Labs 复盘", "tw": "Cosmos Labs 復盤", "en": "Cosmos Labs postmortem" }, "url": "https://github.com/cosmos/security/blob/main/communications/cosmos_evm_GHSA-7g4w-cg88-2cq2_post_mortem.md", "type": "official" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-252", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-251", "status": "verified", "incidentDate": "2026-08-20", "datePrecision": "day", "title": { "zh": "Rust crates.io 供应链恶意包事件", "tw": "Rust crates.io 供應鏈惡意包事件", "en": "Malicious Rust crates.io packages compromised the developer supply chain" }, "summary": { "zh": "Rust 官方安全响应确认 arrayref、internment 和 append-only-vec 恶意版本被发布，构建时会引入并执行恶意依赖。版本已删除并锁定账号，未确认具体加密项目或链上资金损失。", "tw": "Rust 官方安全響應確認 arrayref、internment 和 append-only-vec 惡意版本被髮布，構建時會引入並執行惡意依賴。版本已刪除並鎖定賬號，未確認具體加密項目或鏈上資金損失。", "en": "Rust security response confirmed malicious versions of arrayref, internment, and append-only-vec were published and could execute a malicious dependency during builds. The versions were removed and the account was locked; no specific crypto project or on-chain loss was confirmed." }, "details": { "zh": "## 事件背景\n合法 crates.io 维护者账号或其开发环境疑似被入侵，恶意版本通过 proc-macro 依赖在构建时执行跨平台载荷。\n\n## 事件经过\n1. arrayref@0.3.10 于 07:15 UTC 发布并在线约 86 分钟。\n2. internment@0.8.7 于 07:34:07 UTC 发布并在线约 90 分钟。\n3. append-only-vec@0.1.9 于 07:37:49 UTC 发布并在线约 107 分钟。\n4. Rust 团队删除相关恶意 crate、锁定账号并发布响应。\n5. SlowMist 补充构建时 RCE、主机画像、浏览器数据和凭证泄露风险。\n\n## 资金流向\n没有确认链上资金路径；潜在路径是开发/CI 主机执行 payload → 凭证或浏览器数据外泄 → 多链钱包风险，但后续未被公开证实。\n\n## 影响范围\nRust、Solana 及多链开发/CI 环境，风险对象包括钱包、API key、SSH key 和源码凭证。\n\n## 金额口径\n没有公开确认盗币额，恶意版本只在线短时间；不把潜在凭证风险写成已发生链上损失。\n\n## 证据边界\nRust 官方确认恶意包及处置，SlowMist 提供 IOC；没有确认具体感染人数、加密项目或受害交易。\n\n## 处置状态\n恶意版本已删除，用户应检查 Cargo.lock 和缓存、轮换可能暴露的凭证并从可信环境重建。\n\n## 链上标识\n公开资料没有可适用的区块链地址或交易哈希。", "tw": "## 事件背景\n合法 crates.io 維護者賬號或其開發環境疑似被入侵，惡意版本通過 proc-macro 依賴在構建時執行跨平臺載荷。\n\n## 事件經過\n1. arrayref@0.3.10 於 07:15 UTC 發佈並在線約 86 分鐘。\n2. internment@0.8.7 於 07:34:07 UTC 發佈並在線約 90 分鐘。\n3. append-only-vec@0.1.9 於 07:37:49 UTC 發佈並在線約 107 分鐘。\n4. Rust 團隊刪除相關惡意 crate、鎖定賬號併發布響應。\n5. SlowMist 補充構建時 RCE、主機畫像、瀏覽器數據和憑證洩露風險。\n\n## 資金流向\n沒有確認鏈上資金路徑；潛在路徑是開發/CI 主機執行 payload → 憑證或瀏覽器數據外洩 → 多鏈錢包風險，但後續未被公開證實。\n\n## 影響範圍\nRust、Solana 及多鏈開發/CI 環境，風險對象包括錢包、API key、SSH key 和源碼憑證。\n\n## 金額口徑\n沒有公開確認盜幣額，惡意版本只在線短時間；不把潛在憑證風險寫成已發生鏈上損失。\n\n## 證據邊界\nRust 官方確認惡意包及處置，SlowMist 提供 IOC；沒有確認具體感染人數、加密項目或受害交易。\n\n## 處置狀態\n惡意版本已刪除，用戶應檢查 Cargo.lock 和緩存、輪換可能暴露的憑證並從可信環境重建。\n\n## 鏈上標識\n公開資料沒有可適用的區塊鏈地址或交易哈希。", "en": "## Incident overview\nA legitimate crates.io maintainer account or development environment was likely compromised, and malicious versions executed a cross-platform payload through a proc-macro dependency during builds.\n\n## Incident sequence\n1. arrayref@0.3.10 was published at 07:15 UTC and remained online for about 86 minutes.\n2. internment@0.8.7 was published at 07:34:07 UTC and remained online for about 90 minutes.\n3. append-only-vec@0.1.9 was published at 07:37:49 UTC and remained online for about 107 minutes.\n4. Rust removed the malicious crates, locked the account, and issued a response.\n5. SlowMist added build-time RCE, host profiling, browser-data, and credential-exposure risks.\n\n## Fund flow\nNo on-chain fund path was confirmed. A possible path is build/CI host execution → credential or browser-data exposure → multi-chain wallet risk, but the downstream was not publicly confirmed.\n\n## Impact scope\nRust, Solana, and multi-chain development/CI environments, with wallets, API keys, SSH keys, and source credentials at risk.\n\n## Amount basis\nNo theft amount was confirmed. The malicious versions were online briefly, and potential credential risk is not written as completed on-chain loss.\n\n## Evidence boundary\nRust officially confirmed the packages and response, while SlowMist supplied IOCs. Infection count, crypto project, and victim transactions were not confirmed.\n\n## Current status\nThe malicious versions were removed; users should inspect Cargo.lock and caches, rotate exposed credentials, and rebuild from a trusted environment.\n\n## On-chain identifiers\nNo applicable blockchain address or transaction hash was public." }, "category": "supply-chain", "severity": "high", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "供应链恶意包风险；未确认链上损失。", "tw": "供應鏈惡意包風險；未確認鏈上損失。", "en": "Malicious supply-chain package risk; no on-chain loss was confirmed." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "Rust 官方安全响应", "tw": "Rust 官方安全響應", "en": "Rust official security response" }, "url": "https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/", "type": "official" }, { "label": { "zh": "SlowMist Rust 包告警", "tw": "SlowMist Rust 包告警", "en": "SlowMist Rust package alert" }, "url": "https://x.com/SlowMist_Team/status/2090750091250540894", "type": "research" }, { "label": { "zh": "RustSec 线索", "tw": "RustSec 線索", "en": "RustSec lead" }, "url": "https://github.com/rustsec/advisory-db/issues/3161", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-251", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-246", "status": "verified", "incidentDate": "2026-08-19", "datePrecision": "day", "title": { "zh": "Solidity Pro VS Code 扩展投毒，面向 Web3 开发者的供应链威胁", "tw": "Solidity Pro VS Code 擴展投毒，面向 Web3 開發者的供應鏈威脅", "en": "Solidity Pro VS Code extension poisoning targeted Web3 developers" }, "summary": { "zh": "SlowMist 披露 Solidity Pro VS Code 扩展历史版本存在恶意活动，风险面覆盖浏览器钱包、本地私钥/助记词、API key、SSH key 和源码凭证。该事件属于已公开的恶意开发工具供应链活动，尚未确认单一链上受害交易。", "tw": "SlowMist 披露 Solidity Pro VS Code 擴展歷史版本存在惡意活動，風險面覆蓋瀏覽器錢包、本地私鑰/助記詞、API key、SSH key 和源碼憑證。該事件屬於已公開的惡意開發工具供應鏈活動，尚未確認單一鏈上受害交易。", "en": "SlowMist disclosed malicious activity in historical Solidity Pro VS Code extension versions, exposing browser wallets, local private keys and seed phrases, API keys, SSH keys, and source-control credentials. It is a disclosed malicious developer-tool supply-chain campaign, but no single on-chain victim transaction has been confirmed." }, "details": { "zh": "## 事件背景\nSolidity Pro 是面向 Solidity / Web3 开发者的 VS Code 扩展。SlowMist 披露历史版本存在投毒风险，恶意扩展可成为开发环境进入钱包和工程凭证的前置入口。\n\n## 事件经过\n1. 恶意版本以 Solidity / Web3 开发辅助工具外观进入开发者环境。\n2. 公开技术分析提示远程 payload、凭证收集或远程更新风险。\n3. 只扫描最新版本可能漏掉历史感染，受影响开发者应卸载、隔离机器并轮换 API、SSH、源码平台和钱包凭证。\n\n## 影响范围\n风险对象包括浏览器钱包、本地私钥 / 助记词、API key、SSH key 和源码平台凭证；公开材料没有给出确切感染人数。\n\n## 金额口径\n没有公开可核的总损失，也没有确认单一链上受害交易；本事件不虚构美元损失。\n\n## 证据边界\nSlowMist X 披露和 Medium 技术分析支持恶意扩展及发布者线索。具体 C2、完整 IOC、受害钱包和链上损失仍未公开。\n\n## 处置状态\n建议卸载恶意版本、隔离已安装设备并轮换开发与钱包密钥；后续链上盗损如被核实，应单独建立地址和交易档案。\n\n## 链上标识\nhelper-beeps.solidity-pro 与 web3devtoolsx.solidity-pro 是扩展发布者标识，不是区块链地址；没有适用的链上地址或交易哈希。", "tw": "## 事件背景\nSolidity Pro 是面向 Solidity / Web3 開發者的 VS Code 擴展。SlowMist 披露歷史版本存在投毒風險，惡意擴展可成為開發環境進入錢包和工程憑證的前置入口。\n\n## 事件經過\n1. 惡意版本以 Solidity / Web3 開發輔助工具外觀進入開發者環境。\n2. 公開技術分析提示遠程 payload、憑證收集或遠程更新風險。\n3. 只掃描最新版本可能漏掉歷史感染，受影響開發者應卸載、隔離機器並輪換 API、SSH、源碼平臺和錢包憑證。\n\n## 影響範圍\n風險對象包括瀏覽器錢包、本地私鑰 / 助記詞、API key、SSH key 和源碼平臺憑證；公開材料沒有給出確切感染人數。\n\n## 金額口徑\n沒有公開可核的總損失，也沒有確認單一鏈上受害交易；本事件不虛構美元損失。\n\n## 證據邊界\nSlowMist X 披露和 Medium 技術分析支持惡意擴展及發佈者線索。具體 C2、完整 IOC、受害錢包和鏈上損失仍未公開。\n\n## 處置狀態\n建議卸載惡意版本、隔離已安裝設備並輪換開發與錢包密鑰；後續鏈上盜損如被核實，應單獨建立地址和交易檔案。\n\n## 鏈上標識\nhelper-beeps.solidity-pro 與 web3devtoolsx.solidity-pro 是擴展發佈者標識，不是區塊鏈地址；沒有適用的鏈上地址或交易哈希。", "en": "## Incident overview\nSolidity Pro is a VS Code extension for Solidity and Web3 developers. SlowMist disclosed poisoning risk in historical versions, making the extension a possible entry point into wallets and engineering credentials.\n\n## Incident sequence\n1. Malicious versions entered developer environments under the appearance of a Solidity / Web3 helper.\n2. Public analysis described remote payload, credential collection, or remote-update risks.\n3. Scanning only the latest version can miss historical infection; affected developers should uninstall, isolate systems, and rotate API, SSH, source-control, and wallet credentials.\n\n## Impact scope\nThe risk surface includes browser wallets, local private keys and seed phrases, API keys, SSH keys, and source-control credentials; no exact infection count was public.\n\n## Amount basis\nNo verifiable total loss or single on-chain victim transaction was confirmed, so no USD loss is fabricated.\n\n## Evidence boundary\nSlowMist's X disclosure and Medium analysis support the malicious-extension and publisher clues. The specific C2, complete IOC list, victim wallets, and on-chain losses remain undisclosed.\n\n## Current status\nRecommended response is to uninstall malicious versions, isolate installed systems, and rotate development and wallet credentials. Any later verified theft should receive its own address and transaction record.\n\n## On-chain identifiers\nhelper-beeps.solidity-pro and web3devtoolsx.solidity-pro are extension publisher identifiers, not blockchain addresses; no applicable on-chain address or transaction hash was disclosed." }, "category": "supply-chain", "severity": "high", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "开发者供应链威胁；未确认链上损失总额。", "tw": "開發者供應鏈威脅；未確認鏈上損失總額。", "en": "Developer supply-chain threat; no confirmed total on-chain loss." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "SlowMist Solidity Pro X 告警", "tw": "SlowMist Solidity Pro X 告警", "en": "SlowMist Solidity Pro X alert" }, "url": "https://x.com/SlowMist_Team/status/2089972822886207885", "type": "research" }, { "label": { "zh": "SlowMist Solidity Pro 技术分析", "tw": "SlowMist Solidity Pro 技術分析", "en": "SlowMist Solidity Pro technical analysis" }, "url": "https://medium.com/@slowmist/beware-of-solidity-pro-a-targeted-poisoning-attack-on-web3-developers-4c91a9892198", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-246", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-245", "status": "verified", "incidentDate": "2026-08-19", "datePrecision": "day", "title": { "zh": "MAYAChain 虚假补贴记账与组合型跨链流动性攻击", "tw": "MAYAChain 虛假補貼記賬與組合型跨鏈流動性攻擊", "en": "MAYAChain false-subsidy accounting and composable cross-chain liquidity attack" }, "summary": { "zh": "MAYAChain 发生组合型协议攻击：虚假补贴和记账验证缺陷令 ARB.LINK 池出现无真实资产支撑的内部余额，攻击者通过流动性添加/移除抽取 CACAO 和 LINK，并将部分价值跨链转成 Bitcoin、Ethereum、Arbitrum 与 THORChain 侧资产。已确认转出 L1 价值约 1,356,218 美元，攻击者总价值约 1,647,599 美元。", "tw": "MAYAChain 發生組合型協議攻擊：虛假補貼和記賬驗證缺陷令 ARB.LINK 池出現無真實資產支撐的內部餘額，攻擊者通過流動性添加/移除抽取 CACAO 和 LINK，並將部分價值跨鏈轉成 Bitcoin、Ethereum、Arbitrum 與 THORChain 側資產。已確認轉出 L1 價值約 1,356,218 美元，攻擊者總價值約 1,647,599 美元。", "en": "MAYAChain suffered a composable protocol attack in which false-subsidy and accounting-validation flaws created unsupported internal ARB.LINK balances. The attacker extracted CACAO and LINK through liquidity operations and moved value to Bitcoin, Ethereum, Arbitrum, and THORChain. Confirmed L1 outflows were about $1,356,218, while total attacker-held value was estimated at about $1,647,599." }, "details": { "zh": "## 事件背景\nMAYAChain 入站交易、补贴语义、池记账和流动性单位计算之间缺少一致性约束，多个边界条件被串联利用。项目关联技术报告将事件归纳为六个漏洞组合，而不是单一函数缺陷。\n\n## 事件经过\n1. 2026 年 8 月 19 日 01:30 左右，攻击者建立可用于后续操作的 CACAO / LP 状态。\n2. 虚假补贴令 ARB.LINK 池内部 LINK 记账增加约 100 万枚，真实储备没有同步增加。\n3. 攻击者通过添加/移除流动性抽取约 48.87M CACAO 和 98.82 LINK。\n4. 部分价值跨链转为约 20.834 BTC 以及 Arbitrum、Ethereum、THORChain 侧资产。\n5. MAYAChain 全局暂停并进入补丁、重启和流动性方案讨论。\n\n## 资金流向\nMAYAChain 虚增 ARB.LINK 记账 → 流动性路径抽取 CACAO / LINK → 跨链出站 → Bitcoin、Arbitrum、Ethereum、THORChain 侧资产。已转出 L1 价值与攻击者总持仓是不同口径。\n\n## 金额口径\n项目关联报告列出已提取到 L1 约 1,356,218 美元，攻击者 L1 资产、MAYA LP / 存款和剩余 CACAO 合计约 1,647,599 美元，外部初报约 170 万美元。48.87M CACAO 攻击前名义价值约 560 万美元，不等于已实现现金收入。网站采用约 1,356,218 美元作为已确认转出估值。\n\n## 证据边界\nAaluxx 关联技术报告、CertiK、PeckShield 和 SolidityScan 支持根因、交易和资金路径。MAYA 项目主账号尚未公开完整事故终局；两笔关键 MAYA 交易的旧浏览器可用性不稳定，不把浏览器错误解释为交易不存在。\n\n## 处置状态\nMAYAChain 已暂停并进入修复/恢复阶段。公开资料未证明全部资金已冻结、追回或完成用户赔付。\n\n## 地址与交易\n攻击相关地址：maya1dl3rg2jsur5aehq8e06yda87cfr6uk5x0u4sp7；Bitcoin 落点：bc1q0hsgwunccczelq05ucpmfz268eyy5jr2y5l646；Arbitrum：0xa2f5426bb971773ed423331c29593d6dc0d4d667；Ethereum：0x0053df3017F43751F6eb1DA2DB16F1D4Bd9B8aF8、0x455ED0837262E883cfF2717732831F3Af7A10C4c；THORChain：thor1wwa4tfylutk50c0hvhxzeyqt7k66q9nld0vft9。两笔关键 MAYA 交易保存在来源引用中。", "tw": "## 事件背景\nMAYAChain 入站交易、補貼語義、池記賬和流動性單位計算之間缺少一致性約束，多個邊界條件被串聯利用。項目關聯技術報告將事件歸納為六個漏洞組合，而不是單一函數缺陷。\n\n## 事件經過\n1. 2026 年 8 月 19 日 01:30 左右，攻擊者建立可用於後續操作的 CACAO / LP 狀態。\n2. 虛假補貼令 ARB.LINK 池內部 LINK 記賬增加約 100 萬枚，真實儲備沒有同步增加。\n3. 攻擊者通過添加/移除流動性抽取約 48.87M CACAO 和 98.82 LINK。\n4. 部分價值跨鏈轉為約 20.834 BTC 以及 Arbitrum、Ethereum、THORChain 側資產。\n5. MAYAChain 全局暫停並進入補丁、重啟和流動性方案討論。\n\n## 資金流向\nMAYAChain 虛增 ARB.LINK 記賬 → 流動性路徑抽取 CACAO / LINK → 跨鏈出站 → Bitcoin、Arbitrum、Ethereum、THORChain 側資產。已轉出 L1 價值與攻擊者總持倉是不同口徑。\n\n## 金額口徑\n項目關聯報告列出已提取到 L1 約 1,356,218 美元，攻擊者 L1 資產、MAYA LP / 存款和剩餘 CACAO 合計約 1,647,599 美元，外部初報約 170 萬美元。48.87M CACAO 攻擊前名義價值約 560 萬美元，不等於已實現現金收入。網站採用約 1,356,218 美元作為已確認轉出估值。\n\n## 證據邊界\nAaluxx 關聯技術報告、CertiK、PeckShield 和 SolidityScan 支持根因、交易和資金路徑。MAYA 項目主賬號尚未公開完整事故終局；兩筆關鍵 MAYA 交易的舊瀏覽器可用性不穩定，不把瀏覽器錯誤解釋為交易不存在。\n\n## 處置狀態\nMAYAChain 已暫停並進入修復/恢復階段。公開資料未證明全部資金已凍結、追回或完成用戶賠付。\n\n## 地址與交易\n攻擊相關地址：maya1dl3rg2jsur5aehq8e06yda87cfr6uk5x0u4sp7；Bitcoin 落點：bc1q0hsgwunccczelq05ucpmfz268eyy5jr2y5l646；Arbitrum：0xa2f5426bb971773ed423331c29593d6dc0d4d667；Ethereum：0x0053df3017F43751F6eb1DA2DB16F1D4Bd9B8aF8、0x455ED0837262E883cfF2717732831F3Af7A10C4c；THORChain：thor1wwa4tfylutk50c0hvhxzeyqt7k66q9nld0vft9。兩筆關鍵 MAYA 交易保存在來源引用中。", "en": "## Incident overview\nMAYAChain lacked consistency constraints across inbound processing, subsidy semantics, pool accounting, and liquidity-unit calculation. Multiple edge conditions were chained together, rather than exploiting one isolated function.\n\n## Incident sequence\n1. At about 01:30 Beijing time on August 19, 2026, the attacker prepared CACAO and LP state for later operations.\n2. A false subsidy increased internal LINK accounting in the ARB.LINK pool by about one million tokens without matching reserves.\n3. Liquidity add/remove operations extracted about 48.87M CACAO and 98.82 LINK.\n4. Value moved cross-chain into about 20.834 BTC and assets on Arbitrum, Ethereum, and THORChain.\n5. MAYAChain paused globally and began patch, restart, and liquidity planning.\n\n## Fund flow\nUnsupported ARB.LINK accounting → CACAO / LINK extraction through liquidity operations → cross-chain exits → Bitcoin, Arbitrum, Ethereum, and THORChain assets. Confirmed L1 outflow and total attacker-held value are different bases.\n\n## Amount basis\nThe project-linked report gives about $1,356,218 extracted to L1, about $1,647,599 in attacker L1 assets, MAYA LP / deposits, and remaining CACAO, and an external initial estimate near $1.7M. The pre-attack nominal $5.6M CACAO value is not realized cash income. The website uses approximately $1,356,218 as the confirmed outflow estimate.\n\n## Evidence boundary\nThe Aaluxx-linked technical report, CertiK, PeckShield, and SolidityScan support the root cause, transactions, and fund path. MAYA's main account has not published a final incident conclusion; two key MAYA transactions have unstable legacy explorer availability, which is not treated as evidence that they do not exist.\n\n## Current status\nMAYAChain is paused and in remediation and recovery planning. Public material does not show that all funds were frozen, recovered, or compensated.\n\n## Addresses and transactions\nAttack-related: maya1dl3rg2jsur5aehq8e06yda87cfr6uk5x0u4sp7; Bitcoin landing: bc1q0hsgwunccczelq05ucpmfz268eyy5jr2y5l646; Arbitrum: 0xa2f5426bb971773ed423331c29593d6dc0d4d667; Ethereum: 0x0053df3017F43751F6eb1DA2DB16F1D4Bd9B8aF8 and 0x455ED0837262E883cfF2717732831F3Af7A10C4c; THORChain: thor1wwa4tfylutk50c0hvhxzeyqt7k66q9nld0vft9. The two key MAYA transactions are preserved in the references." }, "category": "protocol-exploit", "severity": "critical", "ecosystems": [ "MAYAChain", "Bitcoin", "Arbitrum", "Ethereum", "THORChain" ], "chains": [ "MAYAChain", "Bitcoin", "Arbitrum", "Ethereum", "THORChain" ], "lossUsd": 1356218, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "已确认跨链转出约 1,356,218 美元；攻击者总价值约 1,647,599 美元，外部初报约 170 万美元，三者不重复相加。", "tw": "已確認跨鏈轉出約 1,356,218 美元；攻擊者總價值約 1,647,599 美元，外部初報約 170 萬美元，三者不重複相加。", "en": "Confirmed cross-chain L1 outflow was about $1,356,218; total attacker-held value was about $1,647,599 and the external initial estimate was about $1.7M. These bases are not added together." }, "addressDisclosure": "published", "addresses": [ { "chain": "MAYAChain", "address": "maya1dl3rg2jsur5aehq8e06yda87cfr6uk5x0u4sp7", "entity": { "zh": "MAYAChain 攻击相关地址", "tw": "MAYAChain 攻擊相關地址", "en": "MAYAChain attack-related address" }, "role": "attack-related-source", "category": "stolen_funds", "confidence": 0.88, "sourceUrl": "https://x.com/CertiKAlert/status/2089900489752318181", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "多源监控和项目关联技术报告将该地址与协议交互和流动性抽取路径关联。", "tw": "多源監控和項目關聯技術報告將該地址與協議交互和流動性抽取路徑關聯。", "en": "Multiple monitors and the project-linked technical report place this address in the protocol-interaction and liquidity-extraction path." }, "reviewRequired": true }, { "chain": "Bitcoin", "address": "bc1q0hsgwunccczelq05ucpmfz268eyy5jr2y5l646", "entity": { "zh": "MAYAChain 跨链攻击资金落点（约 20.834 BTC）", "tw": "MAYAChain 跨鏈攻擊資金落點（約 20.834 BTC）", "en": "MAYAChain cross-chain attack landing address (about 20.834 BTC)" }, "role": "stolen-funds-receiving", "category": "stolen_funds", "confidence": 0.94, "sourceUrl": "https://mempool.space/address/bc1q0hsgwunccczelq05ucpmfz268eyy5jr2y5l646", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "PeckShield 和项目关联报告将该地址列为 Bitcoin 侧主要硬资产落点。", "tw": "PeckShield 和項目關聯報告將該地址列為 Bitcoin 側主要硬資產落點。", "en": "PeckShield and the project-linked report identify this as a major Bitcoin-side hard-asset landing address." }, "reviewRequired": true }, { "chain": "Arbitrum", "address": "0xa2f5426bb971773ed423331c29593d6dc0d4d667", "entity": { "zh": "MAYAChain 跨链攻击资金接收地址", "tw": "MAYAChain 跨鏈攻擊資金接收地址", "en": "MAYAChain cross-chain attack receiving address" }, "role": "stolen-funds-receiving", "category": "stolen_funds", "confidence": 0.86, "sourceUrl": "https://arbiscan.io/address/0xa2f5426bb971773ed423331c29593d6dc0d4d667", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "公开跨链路径将该地址列为 Arbitrum 侧资产落点；控制人未确认。", "tw": "公開跨鏈路徑將該地址列為 Arbitrum 側資產落點；控制人未確認。", "en": "The public cross-chain path lists this as an Arbitrum-side asset landing address; controller identity is unconfirmed." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x0053df3017F43751F6eb1DA2DB16F1D4Bd9B8aF8", "entity": { "zh": "MAYAChain 跨链资金接收/中转地址", "tw": "MAYAChain 跨鏈資金接收/中轉地址", "en": "MAYAChain cross-chain receiving / relay address" }, "role": "relay", "category": "stolen_funds", "confidence": 0.84, "sourceUrl": "https://etherscan.io/address/0x0053df3017F43751F6eb1DA2DB16F1D4Bd9B8aF8", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "公开资金路径显示该地址参与 Ethereum 侧接收或中转；实体控制权未确认。", "tw": "公開資金路徑顯示該地址參與 Ethereum 側接收或中轉；實體控制權未確認。", "en": "The public fund path places this address in Ethereum-side receiving or relay activity; entity control is unconfirmed." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x455ED0837262E883cfF2717732831F3Af7A10C4c", "entity": { "zh": "MAYAChain 跨链资金接收/中转地址", "tw": "MAYAChain 跨鏈資金接收/中轉地址", "en": "MAYAChain cross-chain receiving / relay address" }, "role": "relay", "category": "stolen_funds", "confidence": 0.84, "sourceUrl": "https://etherscan.io/address/0x455ED0837262E883cfF2717732831F3Af7A10C4c", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "公开资金路径显示该地址参与 Ethereum 侧接收或中转；实体控制权未确认。", "tw": "公開資金路徑顯示該地址參與 Ethereum 側接收或中轉；實體控制權未確認。", "en": "The public fund path places this address in Ethereum-side receiving or relay activity; entity control is unconfirmed." }, "reviewRequired": true }, { "chain": "THORChain", "address": "thor1wwa4tfylutk50c0hvhxzeyqt7k66q9nld0vft9", "entity": { "zh": "MAYAChain 跨链资金接收地址", "tw": "MAYAChain 跨鏈資金接收地址", "en": "MAYAChain cross-chain receiving address" }, "role": "stolen-funds-receiving", "category": "stolen_funds", "confidence": 0.8, "sourceUrl": "https://thornode.ninerealms.com/thorchain/txs", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "项目关联报告将该地址列入 THORChain 侧跨链落点，完整控制关系仍待核验。", "tw": "項目關聯報告將該地址列入 THORChain 側跨鏈落點，完整控制關係仍待核驗。", "en": "The project-linked report lists this as a THORChain-side landing address; full control attribution remains open." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "Aaluxx MAYA 受损表态", "tw": "Aaluxx MAYA 受損表態", "en": "Aaluxx MAYA incident statement" }, "url": "https://x.com/AaluxxMyth/status/2089792721086996703", "type": "research" }, { "label": { "zh": "Aaluxx MAYA 技术报告链接", "tw": "Aaluxx MAYA 技術報告鏈接", "en": "Aaluxx MAYA technical-report link" }, "url": "https://x.com/AaluxxMyth/status/2089936092839432379", "type": "research" }, { "label": { "zh": "MAYA 关联技术报告", "tw": "MAYA 關聯技術報告", "en": "MAYA linked technical report" }, "url": "https://claude.ai/code/artifact/469af51b-8f6c-44f0-a213-f7520c9f4b2d", "type": "research" }, { "label": { "zh": "CertiK MAYA 分析", "tw": "CertiK MAYA 分析", "en": "CertiK MAYA analysis" }, "url": "https://x.com/CertiKAlert/status/2089900489752318181", "type": "research" }, { "label": { "zh": "PeckShield MAYA 资金落点", "tw": "PeckShield MAYA 資金落點", "en": "PeckShield MAYA fund landing analysis" }, "url": "https://x.com/PeckShieldAlert/status/2089911342484566506", "type": "research" }, { "label": { "zh": "SolidityScan MAYA 跟进", "tw": "SolidityScan MAYA 跟進", "en": "SolidityScan MAYA follow-up" }, "url": "https://x.com/SolidityScan/status/2089933887086473555", "type": "research" }, { "label": { "zh": "MAYA 关键交易一", "tw": "MAYA 關鍵交易一", "en": "MAYA key transaction one" }, "url": "https://www.mayascan.org/tx/516BA14D6976EC7B8A3087E1C52B195433EF0F9D85F4B9520675BC4FEB99E9B7", "type": "explorer" }, { "label": { "zh": "MAYA 关键交易二", "tw": "MAYA 關鍵交易二", "en": "MAYA key transaction two" }, "url": "https://www.mayascan.org/tx/888AF3EBE9A9A0DBA0F64FE4FD77793E69872466691387A786C9FE19E2693519", "type": "explorer" }, { "label": { "zh": "SlowMist Hacked Zone MAYA 记录", "tw": "SlowMist Hacked Zone MAYA 記錄", "en": "SlowMist Hacked Zone MAYA record" }, "url": "https://hacked.slowmist.io/", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-245", "sourceLabel": "德尔泰公开安全情报档案", "aliases": [ "DCI-2026-250" ] }, { "id": "DCI-2026-238", "status": "verified", "incidentDate": "2026-08-17", "datePrecision": "day", "title": { "zh": "BitMart 中文官方 X 账号被接管", "tw": "BitMart 中文官方 X 賬號被接管", "en": "BitMart Chinese official X account was taken over" }, "summary": { "zh": "BitMart 关联负责人确认中文官方 X 账号被盗，异常内容并非现任员工发布。原始恶意帖子已不可用，未发现可核验的链上盗币或用户资产损失。", "tw": "BitMart 關聯負責人確認中文官方 X 賬號被盜，異常內容並非現任員工發佈。原始惡意帖子已不可用，未發現可核驗的鏈上盜幣或用戶資產損失。", "en": "A BitMart-linked executive confirmed that the Chinese official X account was compromised and that the abnormal content was not posted by a current employee. The original malicious post is unavailable, and no verifiable on-chain theft or user-asset loss was found." }, "details": { "zh": "## 事件背景\n这是交易所官方社交账号基础设施的接管事件，不是已确认的交易所托管系统或链上钱包被攻击。\n\n## 事件经过\n1. BitMart 中文官方账号发布异常内容。\n2. 关联负责人于 2026 年 8 月 17 日 18:19:41 确认账号被盗并否认员工发布。\n3. 原始异常帖子随后删除或不可用。\n4. 截至冻结时间未找到完整链上盗币证据。\n\n## 资金流向\n无完整地址或交易哈希；事件属于链下社交账号基础设施。\n\n## 金额口径\n没有已证实链上损失。社区提现投诉、工资争议或删帖猜测不作为资金损失。\n\n## 证据边界\n账号接管事实有 BitMart 关联负责人确认；入侵入口、恢复时间、攻击者身份和用户影响范围未公开。\n\n## 处置状态\n账号接管已确认，公开资料未给出完整恢复、赔付或用户资产处置结果。\n\n## 链上标识\n该事件没有公开适用的区块链地址或交易哈希。", "tw": "## 事件背景\n這是交易所官方社交賬號基礎設施的接管事件，不是已確認的交易所託管系統或鏈上錢包被攻擊。\n\n## 事件經過\n1. BitMart 中文官方賬號發佈異常內容。\n2. 關聯負責人於 2026 年 8 月 17 日 18:19:41 確認賬號被盜並否認員工發佈。\n3. 原始異常帖子隨後刪除或不可用。\n4. 截至凍結時間未找到完整鏈上盜幣證據。\n\n## 資金流向\n無完整地址或交易哈希；事件屬於鏈下社交賬號基礎設施。\n\n## 金額口徑\n沒有已證實鏈上損失。社區提現投訴、工資爭議或刪帖猜測不作為資金損失。\n\n## 證據邊界\n賬號接管事實有 BitMart 關聯負責人確認；入侵入口、恢復時間、攻擊者身份和用戶影響範圍未公開。\n\n## 處置狀態\n賬號接管已確認，公開資料未給出完整恢復、賠付或用戶資產處置結果。\n\n## 鏈上標識\n該事件沒有公開適用的區塊鏈地址或交易哈希。", "en": "## Incident overview\nThis is a takeover of an exchange's official social-account infrastructure, not a confirmed compromise of the exchange custody system or an on-chain wallet.\n\n## Incident sequence\n1. The BitMart Chinese official account posted abnormal content.\n2. At 18:19:41 Beijing time on August 17, 2026, a linked executive confirmed the account was compromised and denied that a current employee posted the content.\n3. The original abnormal post was later deleted or became unavailable.\n4. No complete on-chain theft evidence was found by the cutoff.\n\n## Fund flow\nNo complete address or transaction hash was public; the event is limited to off-chain social-account infrastructure.\n\n## Amount basis\nNo confirmed on-chain loss was found. Withdrawal complaints, wage disputes, and deletion speculation are not treated as asset loss.\n\n## Evidence boundary\nThe takeover was confirmed by a BitMart-linked executive. The entry point, recovery time, attacker identity, and user impact remain undisclosed.\n\n## Current status\nThe account takeover is confirmed, but no complete recovery, compensation, or user-asset disposition result was public.\n\n## On-chain identifiers\nNo applicable blockchain address or transaction hash was disclosed for this account-infrastructure event." }, "category": "account-takeover", "severity": "high", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": 0, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "账号接管已确认；未发现可核验链上损失。", "tw": "賬號接管已確認；未發現可核驗鏈上損失。", "en": "The account takeover is confirmed; no verifiable on-chain loss was found." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "BitMart 中文账号接管确认", "tw": "BitMart 中文賬號接管確認", "en": "BitMart Chinese-account takeover confirmation" }, "url": "https://x.com/sheldonbitmart/status/2089296097906946247", "type": "official" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-238", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-237", "status": "verified", "incidentDate": "2026-08-17", "datePrecision": "day", "title": { "zh": "Solana 新人钱包被盗约 6.209 SOL", "tw": "Solana 新人錢包被盜約 6.209 SOL", "en": "New Solana wallet was drained of about 6.209 SOL" }, "summary": { "zh": "链上交易显示一个 Solana 钱包转出 6.209202768 SOL，接收地址收到相应金额。私钥曾被导入交易 Bot，但公开证据无法确认 Bot、剪贴板、终端木马或社工是具体泄露点。", "tw": "鏈上交易顯示一個 Solana 錢包轉出 6.209202768 SOL，接收地址收到相應金額。私鑰曾被導入交易 Bot，但公開證據無法確認 Bot、剪貼板、終端木馬或社工是具體洩露點。", "en": "An on-chain transaction shows a Solana wallet sending 6.209202768 SOL to a receiving address. The private key had been imported into a trading bot, but public evidence does not identify the bot, clipboard, endpoint malware, or social engineering as the specific leak path." }, "details": { "zh": "## 事件背景\n这是一起具有完整交易、源地址和接收地址的个人 Solana 钱包盗转。受害者曾把私钥导入 PepeBoost Bot，但未发现异常链接、陌生授权或不明安装包。\n\n## 事件经过\n1. 私钥被导入交易 Bot。\n2. 2026 年 8 月 17 日 18:04:58，源钱包发起系统转账。\n3. 交易成功，6.209202768 SOL 进入接收地址。\n4. 21:42 左右，中文 X 账号公开交易哈希和地址。\n\n## 资金流向\n5UxoiEejCc9AEqbV4K5XPojYQzPQ5fGg2zS2qCXVmK3D → 69342XKBFwcBtiy28ZBmN4F8rMZp9ybpUekwDrYSfMSr。后续归集、交易所和跨链路径未公开。\n\n## 金额口径\nRPC 核验源账户减少 6.209202768 SOL，接收地址增加相应金额；帖子概述为约 6 SOL。未将 SOL 强行换算成美元损失。\n\n## 证据边界\n完整交易、源地址、接收地址和成功状态可核验。可以确认私钥控制权被滥用，但不能把 PepeBoost Bot 或其运营方写成已确认根因。\n\n## 处置状态\n资金已转出，公开资料未显示冻结、追回或接收地址实体归因。\n\n## 地址与交易\n受害地址：5UxoiEejCc9AEqbV4K5XPojYQzPQ5fGg2zS2qCXVmK3D；接收地址：69342XKBFwcBtiy28ZBmN4F8rMZp9ybpUekwDrYSfMSr；交易：2ARW2oJKncthT8UMvEyhXbe9hwoemjeGd2QPRzDnacmkBqLoHKoKYnmJJVZn7EwDoHHtFZaGdLG89yULupPyEduf。", "tw": "## 事件背景\n這是一起具有完整交易、源地址和接收地址的個人 Solana 錢包盜轉。受害者曾把私鑰導入 PepeBoost Bot，但未發現異常鏈接、陌生授權或不明安裝包。\n\n## 事件經過\n1. 私鑰被導入交易 Bot。\n2. 2026 年 8 月 17 日 18:04:58，源錢包發起系統轉賬。\n3. 交易成功，6.209202768 SOL 進入接收地址。\n4. 21:42 左右，中文 X 賬號公開交易哈希和地址。\n\n## 資金流向\n5UxoiEejCc9AEqbV4K5XPojYQzPQ5fGg2zS2qCXVmK3D → 69342XKBFwcBtiy28ZBmN4F8rMZp9ybpUekwDrYSfMSr。後續歸集、交易所和跨鏈路徑未公開。\n\n## 金額口徑\nRPC 核驗源賬戶減少 6.209202768 SOL，接收地址增加相應金額；帖子概述為約 6 SOL。未將 SOL 強行換算成美元損失。\n\n## 證據邊界\n完整交易、源地址、接收地址和成功狀態可核驗。可以確認私鑰控制權被濫用，但不能把 PepeBoost Bot 或其運營方寫成已確認根因。\n\n## 處置狀態\n資金已轉出，公開資料未顯示凍結、追回或接收地址實體歸因。\n\n## 地址與交易\n受害地址：5UxoiEejCc9AEqbV4K5XPojYQzPQ5fGg2zS2qCXVmK3D；接收地址：69342XKBFwcBtiy28ZBmN4F8rMZp9ybpUekwDrYSfMSr；交易：2ARW2oJKncthT8UMvEyhXbe9hwoemjeGd2QPRzDnacmkBqLoHKoKYnmJJVZn7EwDoHHtFZaGdLG89yULupPyEduf。", "en": "## Incident overview\nThis is a personal Solana-wallet transfer with a complete transaction, source address, and receiving address. The victim had imported a private key into PepeBoost Bot, but no abnormal link, unknown approval, or unrecognized package was identified.\n\n## Incident sequence\n1. The private key was imported into a trading bot.\n2. At 18:04:58 Beijing time on August 17, 2026, the source wallet initiated a system transfer.\n3. The transaction succeeded and 6.209202768 SOL reached the receiver.\n4. A Chinese-language X account published the transaction hash and addresses around 21:42.\n\n## Fund flow\n5UxoiEejCc9AEqbV4K5XPojYQzPQ5fGg2zS2qCXVmK3D → 69342XKBFwcBtiy28ZBmN4F8rMZp9ybpUekwDrYSfMSr. No later aggregation, exchange, or cross-chain route was public.\n\n## Amount basis\nRPC verification shows 6.209202768 SOL leaving the source and the corresponding amount reaching the receiver; the post rounded it to about 6 SOL. SOL is not forcibly converted into a USD loss.\n\n## Evidence boundary\nThe complete transaction, source, receiver, and success status are verifiable. Private-key control was abused, but the public evidence does not establish PepeBoost Bot or its operator as the root cause.\n\n## Current status\nThe funds moved out, with no public freeze, recovery, or entity attribution for the receiving address.\n\n## Addresses and transaction\nVictim: 5UxoiEejCc9AEqbV4K5XPojYQzPQ5fGg2zS2qCXVmK3D; receiver: 69342XKBFwcBtiy28ZBmN4F8rMZp9ybpUekwDrYSfMSr; transaction: 2ARW2oJKncthT8UMvEyhXbe9hwoemjeGd2QPRzDnacmkBqLoHKoKYnmJJVZn7EwDoHHtFZaGdLG89yULupPyEduf." }, "category": "wallet-vulnerability", "severity": "high", "ecosystems": [ "Solana" ], "chains": [ "Solana" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "链上转出 6.209202768 SOL；美元损失未换算。", "tw": "鏈上轉出 6.209202768 SOL；美元損失未換算。", "en": "6.209202768 SOL moved on-chain; no USD conversion is applied." }, "addressDisclosure": "published", "addresses": [ { "chain": "Solana", "address": "5UxoiEejCc9AEqbV4K5XPojYQzPQ5fGg2zS2qCXVmK3D", "entity": { "zh": "Solana 受害钱包", "tw": "Solana 受害錢包", "en": "Solana victim wallet" }, "role": "victim", "category": "unknown", "confidence": 0.96, "sourceUrl": "https://solscan.io/account/5UxoiEejCc9AEqbV4K5XPojYQzPQ5fGg2zS2qCXVmK3D", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "完整交易从该源钱包转出 6.209202768 SOL。", "tw": "完整交易從該源錢包轉出 6.209202768 SOL。", "en": "The complete transaction sent 6.209202768 SOL from this source wallet." }, "reviewRequired": true }, { "chain": "Solana", "address": "69342XKBFwcBtiy28ZBmN4F8rMZp9ybpUekwDrYSfMSr", "entity": { "zh": "Solana 被盗资产接收地址", "tw": "Solana 被盜資產接收地址", "en": "Solana stolen-asset receiving address" }, "role": "stolen-funds-receiving", "category": "stolen_funds", "confidence": 0.9, "sourceUrl": "https://solscan.io/account/69342XKBFwcBtiy28ZBmN4F8rMZp9ybpUekwDrYSfMSr", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址在同一成功交易中收到相应 SOL，后续控制人待核。", "tw": "該地址在同一成功交易中收到相應 SOL，後續控制人待核。", "en": "This address received the corresponding SOL in the same successful transaction; controller attribution remains open." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "Solana 钱包盗转原帖", "tw": "Solana 錢包盜轉原帖", "en": "Solana wallet-drain source post" }, "url": "https://x.com/0xshimei/status/2089347138031694329", "type": "research" }, { "label": { "zh": "Solana 完整盗转交易", "tw": "Solana 完整盜轉交易", "en": "Complete Solana theft transaction" }, "url": "https://solscan.io/tx/2ARW2oJKncthT8UMvEyhXbe9hwoemjeGd2QPRzDnacmkBqLoHKoKYnmJJVZn7EwDoHHtFZaGdLG89yULupPyEduf", "type": "explorer" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-237", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-234", "status": "verified", "incidentDate": "2026-08-16", "datePrecision": "day", "title": { "zh": "SafePal 订单追踪插件数据泄露，约 39,798 名客户受影响", "tw": "SafePal 訂單追蹤插件數據洩露，約 39,798 名客戶受影響", "en": "SafePal order-tracking plugin data breach affected about 39,798 customers" }, "summary": { "zh": "SafePal 官方披露订单追踪插件发生未授权访问，约 39,798 名历史下单客户的姓名、邮箱、配送地址、电话和购买详情受到影响；种子、私钥、钱包密码、支付卡和政府证件号未涉及。", "tw": "SafePal 官方披露訂單追蹤插件發生未授權訪問，約 39,798 名歷史下單客戶的姓名、郵箱、配送地址、電話和購買詳情受到影響；種子、私鑰、錢包密碼、支付卡和政府證件號未涉及。", "en": "SafePal disclosed unauthorized access in its order-tracking plugin, affecting information for about 39,798 historical customers, including names, emails, delivery addresses, phone numbers, and purchase details. Seeds, private keys, wallet passwords, payment cards, and government IDs were not involved." }, "details": { "zh": "## 事件背景\nSafePal 订单追踪插件存在缺陷，导致部分历史订单信息被未授权访问。受影响订单日期为 2025 年 3 月 2 日至 2026 年 4 月 11 日，但具体入侵时间未公开。\n\n## 事件经过\n1. 订单追踪插件缺陷造成未授权访问。\n2. 约 39,798 名历史下单客户的个人信息和购买详情暴露。\n3. SafePal 增加安全措施并修复问题。\n4. 官方通过邮件和订单号加国家核验页面通知客户，提醒防范定向钓鱼。\n\n## 资金流向\n这是链下订单和个人信息暴露，没有已确认的链上资金流或钱包资产损失。\n\n## 金额口径\n受影响人数约 39,798 人，不等于被盗钱包数量或美元损失；公开资料未确认由该事件直接造成的资产损失。\n\n## 证据边界\nSafePal 官方 X 和安全更新支持泄露范围、修复和未涉及凭证的说明。具体漏洞、攻击者身份和访问日志未公开。\n\n## 处置状态\n缺陷已修复并增加安全措施，受影响客户已获通知。官方提醒不要向任何人提供种子、私钥或密码。\n\n## 链上标识\n该事件属于链下订单追踪插件，不适用区块链地址和交易哈希。\n\n## 2026-08-17 SlowMist 更新\nSlowMist 在本窗口内跟进 SafePal 订单追踪插件事件，重点提示针对受影响客户的定向邮件、短信和电话钓鱼风险。SafePal 原始披露发生于 2026 年 8 月 16 日，因此没有新增一个独立事件。", "tw": "## 事件背景\nSafePal 訂單追蹤插件存在缺陷，導致部分歷史訂單信息被未授權訪問。受影響訂單日期為 2025 年 3 月 2 日至 2026 年 4 月 11 日，但具體入侵時間未公開。\n\n## 事件經過\n1. 訂單追蹤插件缺陷造成未授權訪問。\n2. 約 39,798 名歷史下單客戶的個人信息和購買詳情暴露。\n3. SafePal 增加安全措施並修復問題。\n4. 官方通過郵件和訂單號加國家核驗頁面通知客戶，提醒防範定向釣魚。\n\n## 資金流向\n這是鏈下訂單和個人信息暴露，沒有已確認的鏈上資金流或錢包資產損失。\n\n## 金額口徑\n受影響人數約 39,798 人，不等於被盜錢包數量或美元損失；公開資料未確認由該事件直接造成的資產損失。\n\n## 證據邊界\nSafePal 官方 X 和安全更新支持洩露範圍、修復和未涉及憑證的說明。具體漏洞、攻擊者身份和訪問日誌未公開。\n\n## 處置狀態\n缺陷已修復並增加安全措施，受影響客戶已獲通知。官方提醒不要向任何人提供種子、私鑰或密碼。\n\n## 鏈上標識\n該事件屬於鏈下訂單追蹤插件，不適用區塊鏈地址和交易哈希。\n\n## 2026-08-17 SlowMist 更新\nSlowMist 在本窗口內跟進 SafePal 訂單追蹤插件事件，重點提示針對受影響客戶的定向郵件、短信和電話釣魚風險。SafePal 原始披露發生於 2026 年 8 月 16 日，因此沒有新增一個獨立事件。", "en": "## Incident overview\nA flaw in the SafePal order-tracking plugin allowed unauthorized access to some historical order information. The affected order period was March 2, 2025 through April 11, 2026, while the intrusion time was not disclosed.\n\n## Incident sequence\n1. A defect in the order-tracking plugin enabled unauthorized access.\n2. Personal and purchase information for about 39,798 historical customers was exposed.\n3. SafePal added security measures and fixed the issue.\n4. Customers were notified by email and an order-number plus country verification page, with warnings about targeted phishing.\n\n## Fund flow\nThis was an off-chain order and personal-information exposure; no confirmed on-chain fund flow or wallet-asset loss was found.\n\n## Amount basis\nThe affected-customer count is about 39,798, not a wallet-theft count or USD loss. Public material did not confirm direct asset loss from this event.\n\n## Evidence boundary\nSafePal's official X post and security update support the scope, remediation, and statement that credentials were not involved. The specific vulnerability, attacker identity, and access logs were not public.\n\n## Current status\nThe flaw was fixed and additional security measures were added. Affected customers were notified, and SafePal warned users not to share seeds, private keys, or passwords.\n\n## On-chain identifiers\nThis is an off-chain order-tracking plugin event; blockchain addresses and transaction hashes do not apply.\n\n## August 17 SlowMist update\nDuring this window, SlowMist followed up on the SafePal order-tracking plugin incident and highlighted targeted email, SMS, and phone phishing risks for affected customers. SafePal's original disclosure was on August 16, so no separate incident is created." }, "category": "supply-chain", "severity": "high", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 39,798 名客户个人信息受影响；未确认链上或钱包资产损失。", "tw": "約 39,798 名客戶個人信息受影響；未確認鏈上或錢包資產損失。", "en": "Personal information for about 39,798 customers was affected; no on-chain or wallet-asset loss was confirmed." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "SafePal 官方披露", "tw": "SafePal 官方披露", "en": "SafePal official disclosure" }, "url": "https://x.com/SafePal/status/2088937173139812792", "type": "official" }, { "label": { "zh": "SafePal 官方安全更新", "tw": "SafePal 官方安全更新", "en": "SafePal official security update" }, "url": "https://www.safepal.com/blog/security-update", "type": "official" }, { "label": { "zh": "SlowMist SafePal 后续警报", "tw": "SlowMist SafePal 後續警報", "en": "SlowMist SafePal follow-up alert" }, "url": "https://x.com/SlowMist_Team/status/2089197314883944648", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-234", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-233", "status": "verified", "incidentDate": "2026-08-16", "datePrecision": "day", "title": { "zh": "FoxLpBondsPool 现货报价操纵与陈旧会计值导致约 11.87 万美元损失", "tw": "FoxLpBondsPool 現貨報價操縱與陳舊會計值導致約 11.87 萬美元損失", "en": "FoxLpBondsPool spot-price manipulation and stale accounting caused about $118,700 in loss" }, "summary": { "zh": "BNB Chain 上的 FoxLpBondsPool 先读取可操纵的 PancakePair 现货报价，再用陈旧的 _stakeAmount 触发 Treasury 铸造过量 Fox 奖励，攻击者在同一交易中卖回获利约 11.87 万美元。", "tw": "BNB Chain 上的 FoxLpBondsPool 先讀取可操縱的 PancakePair 現貨報價，再用陳舊的 _stakeAmount 觸發 Treasury 鑄造過量 Fox 獎勵，攻擊者在同一交易中賣回獲利約 11.87 萬美元。", "en": "On BNB Chain, FoxLpBondsPool read a manipulable PancakePair spot price and reused a stale _stakeAmount, causing Treasury to mint excessive Fox rewards. The attacker sold the new Fox in the same transaction for an estimated $118,700 gain." }, "details": { "zh": "## 事件背景\nFoxLpBondsPool 的 stake() 使用 PancakePair 现货报价计算并锁定 _stakeAmount，后续 addLiquidity() 改变储备却没有重算该会计值。Treasury 盲信陈旧值并铸造奖励。\n\n## 事件经过\n1. 2026 年 8 月 16 日 07:32:59，攻击者使用闪电贷放大可用资金。\n2. stake() 读取可操纵报价并锁定高估的 _stakeAmount。\n3. 大额 USDT → Fox 交换扭曲 PancakePair 储备。\n4. Treasury 按陈旧值铸出 Fox 和邀请奖励。\n5. 攻击者在同一交易把新铸 Fox 卖回交易对。\n\n## 资金流向\n攻击 EOA → 攻击合约 → FoxLpBondsPool / Treasury / USDT-Fox PancakePair → 新铸 Fox 奖励 → 同一交易卖回交易对。闪电贷本金不计入损失。\n\n## 金额口径\nSlowMist 估算约 118,700 美元，代表攻击者获利或事件损失估值，不是闪电贷名义本金、交易总量或所有池子储备。\n\n## 证据边界\nSlowMist 给出完整根因、地址和交易，BSC RPC 与 BscScan 核验成功状态。项目方尚未公开完整修复、赔付、冻结或追回结论。\n\n## 处置状态\n攻击交易成功；截至报告冻结时间，没有公开暂停、补偿、追回或修复完成公告。\n\n## 地址与交易\n攻击 EOA、攻击执行合约、受影响交易对、FoxLpBondsPool 和 Treasury 均已列入地址标签。攻击交易为 0x8e1775cbfd44db29744cc6687ff1822d2c47321de6e94062f789ad6181ad5514。", "tw": "## 事件背景\nFoxLpBondsPool 的 stake() 使用 PancakePair 現貨報價計算並鎖定 _stakeAmount，後續 addLiquidity() 改變儲備卻沒有重算該會計值。Treasury 盲信陳舊值並鑄造獎勵。\n\n## 事件經過\n1. 2026 年 8 月 16 日 07:32:59，攻擊者使用閃電貸放大可用資金。\n2. stake() 讀取可操縱報價並鎖定高估的 _stakeAmount。\n3. 大額 USDT → Fox 交換扭曲 PancakePair 儲備。\n4. Treasury 按陳舊值鑄出 Fox 和邀請獎勵。\n5. 攻擊者在同一交易把新鑄 Fox 賣回交易對。\n\n## 資金流向\n攻擊 EOA → 攻擊合約 → FoxLpBondsPool / Treasury / USDT-Fox PancakePair → 新鑄 Fox 獎勵 → 同一交易賣回交易對。閃電貸本金不計入損失。\n\n## 金額口徑\nSlowMist 估算約 118,700 美元，代表攻擊者獲利或事件損失估值，不是閃電貸名義本金、交易總量或所有池子儲備。\n\n## 證據邊界\nSlowMist 給出完整根因、地址和交易，BSC RPC 與 BscScan 核驗成功狀態。項目方尚未公開完整修復、賠付、凍結或追回結論。\n\n## 處置狀態\n攻擊交易成功；截至報告凍結時間，沒有公開暫停、補償、追回或修復完成公告。\n\n## 地址與交易\n攻擊 EOA、攻擊執行合約、受影響交易對、FoxLpBondsPool 和 Treasury 均已列入地址標籤。攻擊交易為 0x8e1775cbfd44db29744cc6687ff1822d2c47321de6e94062f789ad6181ad5514。", "en": "## Incident overview\nFoxLpBondsPool's stake() read a manipulable PancakePair spot price and locked _stakeAmount. Later reserve changes were not reflected in that accounting value, so Treasury minted excessive rewards.\n\n## Incident sequence\n1. At 07:32:59 Beijing time on August 16, 2026, the attacker amplified capital with a flash loan.\n2. stake() read the manipulable price and locked an inflated _stakeAmount.\n3. A large USDT-to-Fox swap distorted the PancakePair reserves.\n4. Treasury minted Fox and invitation rewards from the stale value.\n5. The attacker sold the newly minted Fox back into the pair in the same transaction.\n\n## Fund flow\nAttacker EOA → attack contract → FoxLpBondsPool / Treasury / USDT-Fox PancakePair → newly minted Fox rewards → same-transaction sale. Flash-loan principal is not treated as loss.\n\n## Amount basis\nSlowMist estimated about $118,700, representing the event-loss or attacker-profit estimate rather than flash-loan notional, total trading volume, or all pool reserves.\n\n## Evidence boundary\nSlowMist supplied the root cause, addresses, and transaction, while BSC RPC and BscScan confirmed success. The project has not published a complete remediation, compensation, freeze, or recovery conclusion.\n\n## Current status\nThe attack transaction succeeded. No public pause, compensation, recovery, or completed remediation notice was found by the report cutoff.\n\n## Addresses and transaction\nThe attacker EOA, execution contract, affected pair, FoxLpBondsPool, and Treasury are preserved in address labels. Attack transaction: 0x8e1775cbfd44db29744cc6687ff1822d2c47321de6e94062f789ad6181ad5514." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "BNB Chain" ], "chains": [ "BNB Chain" ], "lossUsd": 118700, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开估算约 118,700 美元；不含闪电贷名义本金和交易总量。", "tw": "公開估算約 118,700 美元；不含閃電貸名義本金和交易總量。", "en": "Public estimate of about $118,700; flash-loan notional and total trading volume are excluded." }, "addressDisclosure": "published", "addresses": [ { "chain": "BNB Chain", "address": "0x5670d36f00bc7f6860b6afddb288e3668efc0ef9", "entity": { "zh": "Fox 攻击者 EOA", "tw": "Fox 攻擊者 EOA", "en": "Fox attacker EOA" }, "role": "attack-executor", "category": "stolen_funds", "confidence": 0.92, "sourceUrl": "https://bscscan.com/address/0x5670d36f00bc7f6860b6afddb288e3668efc0ef9", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "SlowMist 将该 EOA 与成功攻击交易和攻击合约调用关联。", "tw": "SlowMist 將該 EOA 與成功攻擊交易和攻擊合約調用關聯。", "en": "SlowMist linked this EOA to the successful attack transaction and attack-contract call." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x3a82a2a77061017927e5331fffd07c0308a1d2da", "entity": { "zh": "Fox 攻击执行合约", "tw": "Fox 攻擊執行合約", "en": "Fox attack execution contract" }, "role": "attack-contract", "category": "hack", "confidence": 0.95, "sourceUrl": "https://bscscan.com/address/0x3a82a2a77061017927e5331fffd07c0308a1d2da", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "SlowMist 根因分析将该合约列为攻击执行组件。", "tw": "SlowMist 根因分析將該合約列為攻擊執行組件。", "en": "SlowMist's root-cause analysis identifies this contract as the attack execution component." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xaab18bcdee287aea288c0560612caadf7c328803", "entity": { "zh": "Fox / USDT PancakePair 受影响合约", "tw": "Fox / USDT PancakePair 受影響合約", "en": "Affected Fox / USDT PancakePair" }, "role": "affected-contract", "category": "unknown", "confidence": 0.94, "sourceUrl": "https://bscscan.com/address/0xaab18bcdee287aea288c0560612caadf7c328803", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该合约是被操纵现货报价的交易对，不是攻击者地址。", "tw": "該合約是被操縱現貨報價的交易對，不是攻擊者地址。", "en": "This contract was the manipulated spot-price pair, not an attacker address." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x58e2a853bb14e46befd3148bd4280370fea4655a", "entity": { "zh": "FoxLpBondsPool 受影响合约", "tw": "FoxLpBondsPool 受影響合約", "en": "Affected FoxLpBondsPool contract" }, "role": "affected-contract", "category": "unknown", "confidence": 0.94, "sourceUrl": "https://bscscan.com/address/0x58e2a853bb14e46befd3148bd4280370fea4655a", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该合约在陈旧会计值路径中被利用，不是攻击者身份。", "tw": "該合約在陳舊會計值路徑中被利用，不是攻擊者身份。", "en": "This contract was exploited through the stale-accounting path and is not an attacker identity." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x87614d97808dcdecb069fe8489848fa1c001e04d", "entity": { "zh": "Fox Treasury 受影响合约", "tw": "Fox Treasury 受影響合約", "en": "Affected Fox Treasury contract" }, "role": "affected-contract", "category": "unknown", "confidence": 0.94, "sourceUrl": "https://bscscan.com/address/0x87614d97808dcdecb069fe8489848fa1c001e04d", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该 Treasury 按错误会计值铸造奖励，不是攻击者地址。", "tw": "該 Treasury 按錯誤會計值鑄造獎勵，不是攻擊者地址。", "en": "This Treasury minted rewards from the incorrect accounting value and is not an attacker address." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "SlowMist Fox 根因分析", "tw": "SlowMist Fox 根因分析", "en": "SlowMist Fox root-cause analysis" }, "url": "https://x.com/SlowMist_Team/status/2089196291800908164", "type": "research" }, { "label": { "zh": "Fox 攻击交易", "tw": "Fox 攻擊交易", "en": "Fox attack transaction" }, "url": "https://bscscan.com/tx/0x8e1775cbfd44db29744cc6687ff1822d2c47321de6e94062f789ad6181ad5514", "type": "explorer" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-233", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-232", "status": "verified", "incidentDate": "2026-08-13", "datePrecision": "day", "title": { "zh": "Trezor 物流商 ShipMonk 数据泄露，13,689 名客户受影响", "tw": "Trezor 物流商 ShipMonk 數據洩露，13,689 名客戶受影響", "en": "Trezor logistics provider ShipMonk data breach affected 13,689 customers" }, "summary": { "zh": "Trezor 官方披露物流提供商 ShipMonk 的第三方环境发生未授权访问，11,742 名客户的姓名、邮箱、电话和配送地址完整暴露，另 1,947 名客户暴露姓名、城市和邮箱。钱包、设备和备份词未被认定受损。", "tw": "Trezor 官方披露物流提供商 ShipMonk 的第三方環境發生未授權訪問，11,742 名客戶的姓名、郵箱、電話和配送地址完整暴露，另 1,947 名客戶暴露姓名、城市和郵箱。錢包、設備和備份詞未被認定受損。", "en": "Trezor disclosed unauthorized access in a third-party ShipMonk logistics environment. Full names, emails, phone numbers, and delivery addresses were exposed for 11,742 customers, while names, cities, and emails were exposed for another 1,947. Wallets, devices, and backup words were not identified as compromised." }, "details": { "zh": "## 事件背景\nShipMonk 物流履约环境发生数据泄露，影响近期硬件钱包订单客户。Trezor 系统、设备和钱包备份保持安全。\n\n## 事件经过\n1. 第三方物流环境发生未授权访问，具体入侵时间未公开。\n2. 受影响订单范围约为 2026 年 5 月 10 日至 8 月 8 日。\n3. 11,742 名客户暴露姓名、邮箱、电话和配送地址，1,947 名客户暴露姓名、城市和邮箱。\n4. Trezor 逐一通知受影响客户并发布钓鱼防范提醒。\n\n## 资金流向\n这是链下身份和配送数据暴露，没有已确认的链上资金流或钱包资产损失。\n\n## 金额口径\n受影响客户共 13,689 人；公开资料未确认由该事件直接造成的美元损失，不能把潜在钓鱼风险写成已发生盗损。\n\n## 证据边界\nTrezor 官方 X 和官方博客支持泄露范围与钱包未受损结论。物流商具体漏洞、攻击者身份和完整访问日志未公开。\n\n## 处置状态\nTrezor 已通知客户并继续调查，提醒客户不要在任何网站输入钱包备份、私钥或密码。\n\n## 链上标识\n该事件属于链下供应链基础设施，不适用区块链地址和交易哈希。", "tw": "## 事件背景\nShipMonk 物流履約環境發生數據洩露，影響近期硬件錢包訂單客戶。Trezor 系統、設備和錢包備份保持安全。\n\n## 事件經過\n1. 第三方物流環境發生未授權訪問，具體入侵時間未公開。\n2. 受影響訂單範圍約為 2026 年 5 月 10 日至 8 月 8 日。\n3. 11,742 名客戶暴露姓名、郵箱、電話和配送地址，1,947 名客戶暴露姓名、城市和郵箱。\n4. Trezor 逐一通知受影響客戶併發布釣魚防範提醒。\n\n## 資金流向\n這是鏈下身份和配送數據暴露，沒有已確認的鏈上資金流或錢包資產損失。\n\n## 金額口徑\n受影響客戶共 13,689 人；公開資料未確認由該事件直接造成的美元損失，不能把潛在釣魚風險寫成已發生盜損。\n\n## 證據邊界\nTrezor 官方 X 和官方博客支持洩露範圍與錢包未受損結論。物流商具體漏洞、攻擊者身份和完整訪問日誌未公開。\n\n## 處置狀態\nTrezor 已通知客戶並繼續調查，提醒客戶不要在任何網站輸入錢包備份、私鑰或密碼。\n\n## 鏈上標識\n該事件屬於鏈下供應鏈基礎設施，不適用區塊鏈地址和交易哈希。", "en": "## Incident overview\nA third-party ShipMonk fulfillment environment suffered a data breach affecting recent hardware-wallet orders. Trezor systems, devices, and wallet backups remained secure.\n\n## Incident sequence\n1. An unauthorized access event occurred in the third-party logistics environment; the intrusion time was not disclosed.\n2. The affected order period was approximately May 10 through August 8, 2026.\n3. Full names, emails, phone numbers, and delivery addresses were exposed for 11,742 customers, while names, cities, and emails were exposed for 1,947.\n4. Trezor notified affected customers individually and issued phishing guidance.\n\n## Fund flow\nThis was an off-chain identity and delivery-data exposure; no confirmed on-chain fund flow or wallet-asset loss was found.\n\n## Amount basis\nThe affected-customer count is 13,689. Public material did not confirm a direct USD loss, and potential phishing risk is not written as completed theft.\n\n## Evidence boundary\nTrezor's official X post and blog support the exposure scope and the statement that wallets were not compromised. The logistics vulnerability, attacker identity, and complete access logs were not public.\n\n## Current status\nTrezor notified customers and continues its investigation. It warns users never to enter wallet backups, private keys, or passwords on a website.\n\n## On-chain identifiers\nThis is an off-chain supply-chain infrastructure event; blockchain addresses and transaction hashes do not apply." }, "category": "supply-chain", "severity": "high", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "13,689 名客户的订单个人信息受影响；未确认链上资金损失。", "tw": "13,689 名客戶的訂單個人信息受影響；未確認鏈上資金損失。", "en": "Order personal data for 13,689 customers was affected; no on-chain financial loss was confirmed." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "Trezor 官方披露", "tw": "Trezor 官方披露", "en": "Trezor official disclosure" }, "url": "https://x.com/Trezor/status/2087885428313543059", "type": "official" }, { "label": { "zh": "Trezor 物流商事件说明", "tw": "Trezor 物流商事件說明", "en": "Trezor logistics-provider incident notice" }, "url": "https://trezor.io/blog/news/recent-customer-data-exposed-in-shipping-provider-incident", "type": "official" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-232", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-231", "status": "verified", "incidentDate": "2026-08-13", "datePrecision": "day", "title": { "zh": "Arbitrum 恶意 increaseAllowance 授权盗币约 55 万 USDC", "tw": "Arbitrum 惡意 increaseAllowance 授權盜幣約 55 萬 USDC", "en": "Malicious increaseAllowance approval drained about $550,000 in USDC on Arbitrum" }, "summary": { "zh": "受害地址签署无限额 increaseAllowance 后，攻击者在 6 秒内通过 multicall 执行三笔 transferFrom，转走约 550,019.146870 USDC。安全帖约写 549,744 USDC，链上 Transfer 合计作为精确口径。", "tw": "受害地址簽署無限額 increaseAllowance 後，攻擊者在 6 秒內通過 multicall 執行三筆 transferFrom，轉走約 550,019.146870 USDC。安全帖約寫 549,744 USDC，鏈上 Transfer 合計作為精確口徑。", "en": "After a victim signed an effectively unlimited increaseAllowance, the attacker used multicall to execute three transferFrom calls six seconds later and moved about 550,019.146870 USDC. The alert rounded the amount to 549,744 USDC; the on-chain Transfer sum is retained as the precise basis." }, "details": { "zh": "## 事件背景\n这是一次 Arbitrum USDC 授权盗币。受害者把无限额 increaseAllowance 授予未验证 spender，攻击者随后快速调用 transferFrom。\n\n## 事件经过\n1. 2026 年 8 月 13 日 12:20:18，受害地址签署 increaseAllowance。\n2. 授权 spender 为 0x525dd9c729323fd842fcfebd63659a4ee56444e1。\n3. 6 秒后，攻击 EOA 调用该合约执行 multicall。\n4. 三笔 USDC 分别转至三个接收地址。\n\n## 资金流向\n0xa707d3d5d174f59d2c2b81491bdc5650e55f065b → 恶意 spender / multicall → 三个接收地址。未发现已核实的跨链、Circle 黑名单或返还。\n\n## 金额口径\n安全帖约写 549,744 USDC；Arbitrum 浏览器三笔 Transfer 为 27,500.957343、82,502.872030 和 440,015.317497 USDC，合计 550,019.146870 USDC。网站采用链上合计作为损失数值，两种口径不重复相加。\n\n## 证据边界\nScamSniffer、GoPlus、Arbiscan 和完整授权 / 盗币交易共同支持机制、地址和金额。Token 合约不标为黑客地址；资产已拆分不等于已追回。\n\n## 处置状态\n资产已拆分到三个地址，公开证据未显示 Circle 黑名单、冻结、返还或追回。\n\n## 地址与交易\n受害地址、攻击 EOA、spender 合约、三个接收地址和 Arbitrum USDC Token 合约均已列入地址标签。授权交易为 0x2396ca9a44af91534a9b2c90635ce3fc6d407980b50f563dd422a2b0d2db07f3，盗币交易为 0xd0920a30a4f2e554e9d3a73dbcc12e8fc825dd874f23bc79f2a476408a7a11b0。", "tw": "## 事件背景\n這是一次 Arbitrum USDC 授權盜幣。受害者把無限額 increaseAllowance 授予未驗證 spender，攻擊者隨後快速調用 transferFrom。\n\n## 事件經過\n1. 2026 年 8 月 13 日 12:20:18，受害地址簽署 increaseAllowance。\n2. 授權 spender 為 0x525dd9c729323fd842fcfebd63659a4ee56444e1。\n3. 6 秒後，攻擊 EOA 調用該合約執行 multicall。\n4. 三筆 USDC 分別轉至三個接收地址。\n\n## 資金流向\n0xa707d3d5d174f59d2c2b81491bdc5650e55f065b → 惡意 spender / multicall → 三個接收地址。未發現已核實的跨鏈、Circle 黑名單或返還。\n\n## 金額口徑\n安全帖約寫 549,744 USDC；Arbitrum 瀏覽器三筆 Transfer 為 27,500.957343、82,502.872030 和 440,015.317497 USDC，合計 550,019.146870 USDC。網站採用鏈上合計作為損失數值，兩種口徑不重複相加。\n\n## 證據邊界\nScamSniffer、GoPlus、Arbiscan 和完整授權 / 盜幣交易共同支持機制、地址和金額。Token 合約不標為黑客地址；資產已拆分不等於已追回。\n\n## 處置狀態\n資產已拆分到三個地址，公開證據未顯示 Circle 黑名單、凍結、返還或追回。\n\n## 地址與交易\n受害地址、攻擊 EOA、spender 合約、三個接收地址和 Arbitrum USDC Token 合約均已列入地址標籤。授權交易為 0x2396ca9a44af91534a9b2c90635ce3fc6d407980b50f563dd422a2b0d2db07f3，盜幣交易為 0xd0920a30a4f2e554e9d3a73dbcc12e8fc825dd874f23bc79f2a476408a7a11b0。", "en": "## Incident overview\nThis was an Arbitrum USDC approval theft. The victim granted an effectively unlimited increaseAllowance to an unverified spender, which quickly called transferFrom.\n\n## Incident sequence\n1. At 12:20:18 Beijing time on August 13, 2026, the victim signed increaseAllowance.\n2. The spender was 0x525dd9c729323fd842fcfebd63659a4ee56444e1.\n3. Six seconds later, the attack EOA called the contract through multicall.\n4. Three USDC transfers were sent to three receiving addresses.\n\n## Fund flow\n0xa707d3d5d174f59d2c2b81491bdc5650e55f065b → malicious spender / multicall → three receiving addresses. No verified cross-chain route, Circle blacklist, or return was found.\n\n## Amount basis\nThe alert rounded the amount to 549,744 USDC. Arbiscan decoded three Transfers of 27,500.957343, 82,502.872030, and 440,015.317497 USDC, totaling 550,019.146870 USDC. The website uses the on-chain total, and the two bases are not added together.\n\n## Evidence boundary\nScamSniffer, GoPlus, Arbiscan, and the complete approval and theft transactions support the mechanism, addresses, and amount. The token contract is not labeled as a hacker address, and split funds are not recovery.\n\n## Current status\nThe assets were split among three addresses. No Circle blacklist, freeze, return, or recovery was public.\n\n## Addresses and transactions\nThe victim, attack EOA, spender contract, three receivers, and Arbitrum USDC token contract are preserved in the address labels. Approval transaction: 0x2396ca9a44af91534a9b2c90635ce3fc6d407980b50f563dd422a2b0d2db07f3. Theft transaction: 0xd0920a30a4f2e554e9d3a73dbcc12e8fc825dd874f23bc79f2a476408a7a11b0." }, "category": "phishing-approval", "severity": "high", "ecosystems": [ "Arbitrum" ], "chains": [ "Arbitrum" ], "lossUsd": 550019.14687, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "链上三笔 Transfer 合计 550,019.146870 USDC；安全帖约写 549,744 USDC，两者为同一事件的不同口径。", "tw": "鏈上三筆 Transfer 合計 550,019.146870 USDC；安全帖約寫 549,744 USDC，兩者為同一事件的不同口徑。", "en": "The three on-chain Transfers total 550,019.146870 USDC; the alert rounded the same event to 549,744 USDC." }, "addressDisclosure": "published", "addresses": [ { "chain": "Arbitrum", "address": "0xa707d3d5d174f59d2c2b81491bdc5650e55f065b", "entity": { "zh": "Arbitrum USDC 受害地址", "tw": "Arbitrum USDC 受害地址", "en": "Arbitrum USDC victim address" }, "role": "victim", "category": "unknown", "confidence": 0.96, "sourceUrl": "https://arbiscan.io/address/0xa707d3d5d174f59d2c2b81491bdc5650e55f065b", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "授权交易和后续 transferFrom 交易均从该地址转出 USDC。", "tw": "授權交易和後續 transferFrom 交易均從該地址轉出 USDC。", "en": "The approval and subsequent transferFrom transaction both withdrew USDC from this address." }, "reviewRequired": true }, { "chain": "Arbitrum", "address": "0x9bcd8076840378a6edffc97ed824621c48d9104a", "entity": { "zh": "Arbitrum 攻击调用 EOA", "tw": "Arbitrum 攻擊調用 EOA", "en": "Arbitrum attack-calling EOA" }, "role": "attack-executor", "category": "stolen_funds", "confidence": 0.9, "sourceUrl": "https://arbiscan.io/address/0x9bcd8076840378a6edffc97ed824621c48d9104a", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "公开浏览器和安全机构将该 EOA 与成功的 multicall 盗币交易关联。", "tw": "公開瀏覽器和安全機構將該 EOA 與成功的 multicall 盜幣交易關聯。", "en": "The explorer and security researchers link this EOA to the successful multicall theft transaction." }, "reviewRequired": true }, { "chain": "Arbitrum", "address": "0x525dd9c729323fd842fcfebd63659a4ee56444e1", "entity": { "zh": "Arbitrum 恶意 spender / multicall 合约", "tw": "Arbitrum 惡意 spender / multicall 合約", "en": "Arbitrum malicious spender / multicall contract" }, "role": "attack-contract", "category": "hack", "confidence": 0.94, "sourceUrl": "https://arbiscan.io/address/0x525dd9c729323fd842fcfebd63659a4ee56444e1", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "受害地址授予该合约无限 increaseAllowance，随后由其执行 transferFrom。", "tw": "受害地址授予該合約無限 increaseAllowance，隨後由其執行 transferFrom。", "en": "The victim granted this contract an effectively unlimited increaseAllowance, after which it executed transferFrom." }, "reviewRequired": true }, { "chain": "Arbitrum", "address": "0x6fe314fd4cf845f35fc461ed98e2fb8d9356b566", "entity": { "zh": "Arbitrum 被盗 USDC 接收地址（27,500.957343 USDC）", "tw": "Arbitrum 被盜 USDC 接收地址（27,500.957343 USDC）", "en": "Arbitrum stolen-USDC receiver (27,500.957343 USDC)" }, "role": "stolen-funds-receiving", "category": "stolen_funds", "confidence": 0.94, "sourceUrl": "https://arbiscan.io/address/0x6fe314fd4cf845f35fc461ed98e2fb8d9356b566", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "成功盗币交易的第一笔 USDC Transfer 接收地址。", "tw": "成功盜幣交易的第一筆 USDC Transfer 接收地址。", "en": "The receiving address for the first USDC Transfer in the successful theft transaction." }, "reviewRequired": true }, { "chain": "Arbitrum", "address": "0x93b6b24dc6e6a1d5d72399e3a35498c4dba1d6d1", "entity": { "zh": "Arbitrum 被盗 USDC 接收地址（82,502.872030 USDC）", "tw": "Arbitrum 被盜 USDC 接收地址（82,502.872030 USDC）", "en": "Arbitrum stolen-USDC receiver (82,502.872030 USDC)" }, "role": "stolen-funds-receiving", "category": "stolen_funds", "confidence": 0.94, "sourceUrl": "https://arbiscan.io/address/0x93b6b24dc6e6a1d5d72399e3a35498c4dba1d6d1", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "成功盗币交易的第二笔 USDC Transfer 接收地址。", "tw": "成功盜幣交易的第二筆 USDC Transfer 接收地址。", "en": "The receiving address for the second USDC Transfer in the successful theft transaction." }, "reviewRequired": true }, { "chain": "Arbitrum", "address": "0x98b2761559a348968c994d9856dcfc96b6f13c55", "entity": { "zh": "Arbitrum 被盗 USDC 接收地址（440,015.317497 USDC）", "tw": "Arbitrum 被盜 USDC 接收地址（440,015.317497 USDC）", "en": "Arbitrum stolen-USDC receiver (440,015.317497 USDC)" }, "role": "stolen-funds-receiving", "category": "stolen_funds", "confidence": 0.94, "sourceUrl": "https://arbiscan.io/address/0x98b2761559a348968c994d9856dcfc96b6f13c55", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "成功盗币交易的第三笔 USDC Transfer 接收地址。", "tw": "成功盜幣交易的第三筆 USDC Transfer 接收地址。", "en": "The receiving address for the third USDC Transfer in the successful theft transaction." }, "reviewRequired": true }, { "chain": "Arbitrum", "address": "0xaf88d065e77c8cc2239327c5edb3a432268e5831", "entity": { "zh": "Arbitrum USDC 官方 Token 合约", "tw": "Arbitrum USDC 官方 Token 合約", "en": "Official Arbitrum USDC token contract" }, "role": "token-contract", "category": "unknown", "confidence": 1, "sourceUrl": "https://arbiscan.io/address/0xaf88d065e77c8cc2239327c5edb3a432268e5831", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "这是资产 Token 合约，不是黑客或接收地址。", "tw": "這是資產 Token 合約，不是黑客或接收地址。", "en": "This is the asset token contract, not a hacker or receiving address." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "ScamSniffer Arbitrum 授权盗币告警", "tw": "ScamSniffer Arbitrum 授權盜幣告警", "en": "ScamSniffer Arbitrum approval-theft alert" }, "url": "https://x.com/realScamSniffer/status/2087800074017648983", "type": "research" }, { "label": { "zh": "GoPlus Arbitrum 钓鱼地址补充", "tw": "GoPlus Arbitrum 釣魚地址補充", "en": "GoPlus Arbitrum phishing-address supplement" }, "url": "https://x.com/GoPlusSecurity/status/2087948256743686387", "type": "research" }, { "label": { "zh": "Arbitrum 恶意授权交易", "tw": "Arbitrum 惡意授權交易", "en": "Arbitrum malicious approval transaction" }, "url": "https://arbiscan.io/tx/0x2396ca9a44af91534a9b2c90635ce3fc6d407980b50f563dd422a2b0d2db07f3", "type": "explorer" }, { "label": { "zh": "Arbitrum 成功盗币交易", "tw": "Arbitrum 成功盜幣交易", "en": "Arbitrum successful theft transaction" }, "url": "https://arbiscan.io/tx/0xd0920a30a4f2e554e9d3a73dbcc12e8fc825dd874f23bc79f2a476408a7a11b0", "type": "explorer" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-231", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-230", "status": "verified", "incidentDate": "2026-08-13", "datePrecision": "day", "title": { "zh": "TLBL 巨鲸疑似私钥泄露，约 2,500 万—2,560 万美元被清空", "tw": "TLBL 巨鯨疑似私鑰洩露，約 2,500 萬—2,560 萬美元被清空", "en": "TLBL whale wallets were likely compromised through private-key exposure, losing about $25–25.6 million" }, "summary": { "zh": "两个公开 Ethereum 钱包在约 15 分钟内被清空，资产随后换成约 2,000 万 DAI 和约 3,000 ETH。安全机构倾向疑似私钥泄露，但受害者未发布终端取证；2,500 万—2,560 万美元是不同时间点的估值范围。", "tw": "兩個公開 Ethereum 錢包在約 15 分鐘內被清空，資產隨後換成約 2,000 萬 DAI 和約 3,000 ETH。安全機構傾向疑似私鑰洩露，但受害者未發佈終端取證；2,500 萬—2,560 萬美元是不同時間點的估值範圍。", "en": "Two public Ethereum wallets were drained within approximately 15 minutes, after which the assets were swapped into about 20 million DAI and 3,000 ETH. Security researchers favor likely private-key exposure, but the victim has not published endpoint forensics; $25–25.6 million is a valuation range from different reporting points." }, "details": { "zh": "## 事件背景\n两个 TLBL 关联 Ethereum 钱包在短时间内同时转出稳定币、WBTC、aUSDC、LDO、sUSDe 和原生 ETH，行为与单纯授权盗币不同。\n\n## 事件经过\n1. 2026 年 8 月 13 日 05:05 左右，两个钱包在约 15 分钟内被清空。\n2. 攻击者通过归集地址接收资产，并在约一小时内兑换为 DAI 与 ETH。\n3. 约 2,000 万 DAI 转往分流地址，约 3,000 ETH 留在主归集地址。\n4. 公开证据尚未显示发行方冻结、返还或官方受害者声明。\n\n## 资金流向\n两个受害钱包 → 0x8feb0c6ef08b20ba19c04f951d4408bb5a1f95ae → 资产兑换 → 0x61ce24326d713641583e6a337a69bef7458fcf76 持有约 2,000 万 DAI，主归集地址保留约 3,000 ETH。\n\n## 金额口径\nScamSniffer 估计约 2,500 万美元，Specter 和 PeckShield 估计约 2,560 万美元。网站采用约 2,560 万美元作为损失估值，详细记录保留两种口径，不把 2023 年约 2,423 万美元旧案相加。\n\n## 证据边界\n完整受害地址、归集地址和关键交易可由公开线程及 Ethereum 浏览器核验。私钥泄露是基于原生 ETH 同时被转走的高可信推断，不是受害者终端取证结论；第三个钱包只有截断线索，未列入正式地址。\n\n## 处置状态\n资金已换成 DAI 和 ETH，公开资料未显示冻结、追回、赔付或抓捕。攻击者控制人、受害者身份和最终外流路径仍未完全公开。\n\n## 地址与交易\n受害地址：0x13e382dfe53207e9ce2eeeab330f69da2794179e、0xcb3de9c898b59ff239edd6bf30cc44058e24eb47；主归集地址：0x8feb0c6ef08b20ba19c04f951d4408bb5a1f95ae；DAI 分流地址：0x61ce24326d713641583e6a337a69bef7458fcf76。关键归集交易为 0x42d5f901719e3a5da57bb5ec6f7c0caa3a0f8189564a78a8915916ddc1dc7565。", "tw": "## 事件背景\n兩個 TLBL 關聯 Ethereum 錢包在短時間內同時轉出穩定幣、WBTC、aUSDC、LDO、sUSDe 和原生 ETH，行為與單純授權盜幣不同。\n\n## 事件經過\n1. 2026 年 8 月 13 日 05:05 左右，兩個錢包在約 15 分鐘內被清空。\n2. 攻擊者通過歸集地址接收資產，並在約一小時內兌換為 DAI 與 ETH。\n3. 約 2,000 萬 DAI 轉往分流地址，約 3,000 ETH 留在主歸集地址。\n4. 公開證據尚未顯示發行方凍結、返還或官方受害者聲明。\n\n## 資金流向\n兩個受害錢包 → 0x8feb0c6ef08b20ba19c04f951d4408bb5a1f95ae → 資產兌換 → 0x61ce24326d713641583e6a337a69bef7458fcf76 持有約 2,000 萬 DAI，主歸集地址保留約 3,000 ETH。\n\n## 金額口徑\nScamSniffer 估計約 2,500 萬美元，Specter 和 PeckShield 估計約 2,560 萬美元。網站採用約 2,560 萬美元作為損失估值，詳細記錄保留兩種口徑，不把 2023 年約 2,423 萬美元舊案相加。\n\n## 證據邊界\n完整受害地址、歸集地址和關鍵交易可由公開線程及 Ethereum 瀏覽器核驗。私鑰洩露是基於原生 ETH 同時被轉走的高可信推斷，不是受害者終端取證結論；第三個錢包只有截斷線索，未列入正式地址。\n\n## 處置狀態\n資金已換成 DAI 和 ETH，公開資料未顯示凍結、追回、賠付或抓捕。攻擊者控制人、受害者身份和最終外流路徑仍未完全公開。\n\n## 地址與交易\n受害地址：0x13e382dfe53207e9ce2eeeab330f69da2794179e、0xcb3de9c898b59ff239edd6bf30cc44058e24eb47；主歸集地址：0x8feb0c6ef08b20ba19c04f951d4408bb5a1f95ae；DAI 分流地址：0x61ce24326d713641583e6a337a69bef7458fcf76。關鍵歸集交易為 0x42d5f901719e3a5da57bb5ec6f7c0caa3a0f8189564a78a8915916ddc1dc7565。", "en": "## Incident overview\nTwo TLBL-linked Ethereum wallets moved stablecoins, WBTC, aUSDC, LDO, sUSDe, and native ETH within a short period, which differs from a token-only approval theft.\n\n## Incident sequence\n1. At about 05:05 Beijing time on August 13, 2026, two wallets were drained within approximately 15 minutes.\n2. The attacker received the assets at an aggregation address and swapped most of them into DAI and ETH within about an hour.\n3. About 20 million DAI moved to a diversion address, while about 3,000 ETH remained at the main aggregation address.\n4. No issuer freeze, return, or official victim statement was public.\n\n## Fund flow\nTwo victim wallets → 0x8feb0c6ef08b20ba19c04f951d4408bb5a1f95ae → asset swaps → 0x61ce24326d713641583e6a337a69bef7458fcf76 holding about 20 million DAI, with about 3,000 ETH remaining at the primary aggregation address.\n\n## Amount basis\nScamSniffer estimated about $25 million, while Specter and PeckShield estimated about $25.6 million. The website uses approximately $25.6 million as the loss estimate, while preserving both bases and excluding the approximately $24.23 million 2023 case.\n\n## Evidence boundary\nThe complete victim addresses, aggregation addresses, and key transaction are checkable against the public thread and Ethereum explorer. Private-key exposure is a high-confidence inference from native ETH being drained as well, not an endpoint-forensics conclusion; a third wallet appears only as a truncated clue.\n\n## Current status\nThe funds were swapped into DAI and ETH. Public material did not show a freeze, recovery, compensation, or arrest. Controller identity, victim identity, and the final onward route remain incomplete.\n\n## Addresses and transaction\nVictims: 0x13e382dfe53207e9ce2eeeab330f69da2794179e and 0xcb3de9c898b59ff239edd6bf30cc44058e24eb47; primary aggregation: 0x8feb0c6ef08b20ba19c04f951d4408bb5a1f95ae; DAI diversion: 0x61ce24326d713641583e6a337a69bef7458fcf76. Key aggregation transaction: 0x42d5f901719e3a5da57bb5ec6f7c0caa3a0f8189564a78a8915916ddc1dc7565." }, "category": "key-compromise", "severity": "critical", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 25600000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 2,500 万—2,560 万美元；网站采用约 2,560 万美元估值，具体净损失仍待受害者或链上完整核算。", "tw": "約 2,500 萬—2,560 萬美元；網站採用約 2,560 萬美元估值，具體淨損失仍待受害者或鏈上完整核算。", "en": "About $25–25.6 million; the website uses approximately $25.6 million while the final net loss remains subject to victim and full on-chain reconciliation." }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0x13e382dfe53207e9ce2eeeab330f69da2794179e", "entity": { "zh": "TLBL 受害钱包（本次被清空，亦关联 2023 年旧案）", "tw": "TLBL 受害錢包（本次被清空，亦關聯 2023 年舊案）", "en": "TLBL victim wallet drained in this event and linked to the 2023 case" }, "role": "victim", "category": "unknown", "confidence": 0.94, "sourceUrl": "https://x.com/realScamSniffer/status/2087672805160898600", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "ScamSniffer 公开线程将该地址列为本次被清空钱包；与 2023 年旧案的关联不改变本次事件身份。", "tw": "ScamSniffer 公開線程將該地址列為本次被清空錢包；與 2023 年舊案的關聯不改變本次事件身份。", "en": "The public ScamSniffer thread lists this address as a wallet drained in this event; its link to the 2023 case does not merge the two incidents." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xcb3de9c898b59ff239edd6bf30cc44058e24eb47", "entity": { "zh": "TLBL 受害钱包", "tw": "TLBL 受害錢包", "en": "TLBL victim wallet" }, "role": "victim", "category": "unknown", "confidence": 0.94, "sourceUrl": "https://x.com/realScamSniffer/status/2087672805160898600", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "ScamSniffer 公开线程将该地址列为本次约 15 分钟内被清空的第二个钱包。", "tw": "ScamSniffer 公開線程將該地址列為本次約 15 分鐘內被清空的第二個錢包。", "en": "The public ScamSniffer thread lists this address as the second wallet drained within approximately 15 minutes." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x8feb0c6ef08b20ba19c04f951d4408bb5a1f95ae", "entity": { "zh": "TLBL 攻击相关主归集地址", "tw": "TLBL 攻擊相關主歸集地址", "en": "TLBL attack-related primary aggregation address" }, "role": "attack-related-receiving", "category": "stolen_funds", "confidence": 0.9, "sourceUrl": "https://etherscan.io/address/0x8feb0c6ef08b20ba19c04f951d4408bb5a1f95ae", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "公开链上路径显示该地址接收本次被盗资产并保留约 3,000 ETH；控制人身份未公开确认。", "tw": "公開鏈上路徑顯示該地址接收本次被盜資產並保留約 3,000 ETH；控制人身份未公開確認。", "en": "The public on-chain path shows this address receiving the stolen assets and retaining about 3,000 ETH; controller identity is not confirmed." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x61ce24326d713641583e6a337a69bef7458fcf76", "entity": { "zh": "TLBL DAI 分流接收地址", "tw": "TLBL DAI 分流接收地址", "en": "TLBL DAI diversion receiving address" }, "role": "downstream-receiving", "category": "stolen_funds", "confidence": 0.86, "sourceUrl": "https://etherscan.io/address/0x61ce24326d713641583e6a337a69bef7458fcf76", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "安全机构将该地址与约 2,000 万 DAI 分流路径关联；实体控制权未公开确认。", "tw": "安全機構將該地址與約 2,000 萬 DAI 分流路徑關聯；實體控制權未公開確認。", "en": "Security researchers linked this address to the diversion path holding about 20 million DAI; entity control is not confirmed." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "ScamSniffer TLBL 初报", "tw": "ScamSniffer TLBL 初報", "en": "ScamSniffer TLBL initial alert" }, "url": "https://x.com/realScamSniffer/status/2087672792611459478", "type": "research" }, { "label": { "zh": "ScamSniffer 完整线程与资金路径", "tw": "ScamSniffer 完整線程與資金路徑", "en": "ScamSniffer full thread and fund path" }, "url": "https://x.com/realScamSniffer/status/2087672805160898600", "type": "research" }, { "label": { "zh": "CertiK TLBL 跟进", "tw": "CertiK TLBL 跟進", "en": "CertiK TLBL follow-up" }, "url": "https://x.com/CertiKAlert/status/2087708110303699367", "type": "research" }, { "label": { "zh": "TLBL 关键归集交易", "tw": "TLBL 關鍵歸集交易", "en": "TLBL key aggregation transaction" }, "url": "https://etherscan.io/tx/0x42d5f901719e3a5da57bb5ec6f7c0caa3a0f8189564a78a8915916ddc1dc7565", "type": "explorer" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-230", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-228", "status": "verified", "incidentDate": "2026-08-12", "datePrecision": "day", "title": { "zh": "Harmony 跨分片收据重放导致异常铸币", "tw": "Harmony 跨分片收據重放導致異常鑄幣", "en": "Harmony cross-shard receipt replay caused unauthorized minting" }, "summary": { "zh": "Harmony 官方法证更新确认首个异常活动位于 2026 年 8 月 12 日 07:25:41 的 Shard 0 区块 92,730,036，首波两次空区块铸币合计 40 亿 ONE；六笔、四钱包的完整重建口径为 3,010,000,100,000 ONE。跨分片收据重放是已确认主缺陷，空签名法定人数是仍待最终归因的辅助缺陷；没有公开最终冻结或美元净损失。", "tw": "Harmony 官方法證更新確認首個異常活動位於 2026 年 8 月 12 日 07:25:41 的 Shard 0 區塊 92,730,036，首波兩次空區塊鑄幣合計 40 億 ONE；六筆、四錢包的完整重建口徑為 3,010,000,100,000 ONE。跨分片收據重放是已確認主缺陷，空簽名法定人數是仍待最終歸因的輔助缺陷；沒有公開最終凍結或美元淨損失。", "en": "Harmony's forensic update placed the first anomalous activity at Shard 0 block 92,730,036 on August 12, 2026 at 07:25:41. The first wave minted 4 billion ONE in two empty blocks, while a six-transaction, four-wallet reconstruction totals 3,010,000,100,000 ONE. Cross-shard receipt replay is the confirmed primary flaw; the empty-signature quorum issue remains a secondary attribution under review. No final freeze or net USD loss was public." }, "details": { "zh": "## 事件背景\nHarmony 在 2026 年 8 月 12 日确认发生未经授权的 ONE 铸币。项目方先与交易所协作阻止和冻结相关资金，再暂停 Harmony Bridge 并要求验证者升级补丁。\n\n## 事件经过\n1. 攻击者在 Harmony 上未经授权铸造约 40 亿枚 ONE。\n2. GoPlus 和链上分析称其中约 28 亿枚 ONE 快速进入交易所并出售，ONE 在数分钟内跌超 35%。\n3. Harmony 公布四组资金源地址，请交易所阻止并冻结追溯至这些地址的资金。\n4. 项目方暂停 Bridge，要求验证者升级 v2026.1.1，以阻止继续铸币，并评估已铸造代币的处理和回滚选项。\n\n## 资金流向\n未授权铸币 → 四组项目方公布的资金源地址 → 约 28 亿枚 ONE 进入多个交易所并被出售。交易所名称、充值地址和最终出口尚未完整公开；项目方的冻结请求不等于已确认冻结。\n\n## 金额口径\n40 亿枚 ONE 是异常铸币数量，28 亿枚 ONE 是安全机构称进入交易所并出售的数量，二者都不是可直接换算的美元净损失。没有公开可靠的最终美元损失、已冻结金额或追回金额。\n\n## 证据边界\nHarmony 官方确认事件、暂停 Bridge、验证者升级和四组地址；CertiK 与 GoPlus 交叉确认非法铸币规模。首笔异常铸币交易、完整攻击方法、交易所冻结执行结果和最终责任归因尚未公开。\n\n## 处置状态\nHarmony Bridge 已暂停，验证者补丁 v2026.1.1 已发布并要求升级。项目方仍评估回滚及已铸造代币处理；这起事件不把“请求冻结”写成“已冻结成功”，也不把 ONE 数量写成美元损失。\n\n## 完整地址账本\n以下每组的 Harmony bech32 地址与 EVM 十六进制地址是同一账户的两种表示，不是八个独立钱包：\n\n1. one1uap8dx2z0qsjxqthm5flgcxkeepsz3gsrghnfn / 0xe7427699427821230177dd13f460d6ce43014510\n2. one17u300a40ll5wphd8kj5hktryhdjq3ml9f4phy4 / 0xf722f7f6afffe8e0dda7b4a97b2c64bb6408efe5\n3. one1a5hur07z5vtvzhr35zkw8tfqedemkz8t88xgd7 / 0xed2fc1bfc2a316c15c71a0ace3ad20cb73bb08eb\n4. one1h56hkxmua0uzfv07fu04cudvtrl35u96pq47vy / 0xbd357b1b7cebf824b1fe4f1f5c71ac58ff1a70ba\n\n主攻击交易 ID 截至报告冻结时间未恢复，不根据地址历史挑选交易冒充主攻击交易。\n\n## 2026-08-14 法证更新\nHarmony 官方后续文章将首个异常活动定位到 Shard 0 区块 92,730,036，时间为 2026 年 8 月 12 日 07:25:41（北京时间）。两次首波空区块铸币发生在 08:02:59 和 09:01:17，合计 4,000,000,000 ONE；六笔、四钱包完整重建口径为 3,010,000,100,000 ONE。\n\n## 根因与处置校正\n已确认主缺陷是跨分片收据重放：未认证的 ShardID 与 BlockNum 让已处理收据被重复计入。预质押法定人数缺陷是第二条辅助路径，官方仍在判断攻击是否实际利用。补丁 v2026.1.1 于 14:30 部署并生效，Shard 0 停在区块 92,753,555 以推进回滚；项目方联系交易所阻止资金，但没有公开全部地址的实际冻结回执。\n\n## 新增交易证据\n官方公开的一笔完整资金移动交易为 0xf3d4e8b12479ae14cd5eae973a5f61b07d567b142a6ca1385471d5c288242c7f；它记录 30 亿 ONE 地址向下游转出 28 亿 ONE。其余异常铸币交易在官方文章中仍未逐项完整列出。", "tw": "## 事件背景\nHarmony 在 2026 年 8 月 12 日確認發生未經授權的 ONE 鑄幣。項目方先與交易所協作阻止和凍結相關資金，再暫停 Harmony Bridge 並要求驗證者升級補丁。\n\n## 事件經過\n1. 攻擊者在 Harmony 上未經授權鑄造約 40 億枚 ONE。\n2. GoPlus 和鏈上分析稱其中約 28 億枚 ONE 快速進入交易所並出售，ONE 在數分鐘內跌超 35%。\n3. Harmony 公佈四組資金源地址，請交易所阻止並凍結追溯至這些地址的資金。\n4. 項目方暫停 Bridge，要求驗證者升級 v2026.1.1，以阻止繼續鑄幣，並評估已鑄造代幣的處理和回滾選項。\n\n## 資金流向\n未授權鑄幣 → 四組項目方公佈的資金源地址 → 約 28 億枚 ONE 進入多個交易所並被出售。交易所名稱、充值地址和最終出口尚未完整公開；項目方的凍結請求不等於已確認凍結。\n\n## 金額口徑\n40 億枚 ONE 是異常鑄幣數量，28 億枚 ONE 是安全機構稱進入交易所並出售的數量，二者都不是可直接換算的美元淨損失。沒有公開可靠的最終美元損失、已凍結金額或追回金額。\n\n## 證據邊界\nHarmony 官方確認事件、暫停 Bridge、驗證者升級和四組地址；CertiK 與 GoPlus 交叉確認非法鑄幣規模。首筆異常鑄幣交易、完整攻擊方法、交易所凍結執行結果和最終責任歸因尚未公開。\n\n## 處置狀態\nHarmony Bridge 已暫停，驗證者補丁 v2026.1.1 已發佈並要求升級。項目方仍評估回滾及已鑄造代幣處理；這起事件不把“請求凍結”寫成“已凍結成功”，也不把 ONE 數量寫成美元損失。\n\n## 完整地址賬本\n以下每組的 Harmony bech32 地址與 EVM 十六進制地址是同一賬戶的兩種表示，不是八個獨立錢包：\n\n1. one1uap8dx2z0qsjxqthm5flgcxkeepsz3gsrghnfn / 0xe7427699427821230177dd13f460d6ce43014510\n2. one17u300a40ll5wphd8kj5hktryhdjq3ml9f4phy4 / 0xf722f7f6afffe8e0dda7b4a97b2c64bb6408efe5\n3. one1a5hur07z5vtvzhr35zkw8tfqedemkz8t88xgd7 / 0xed2fc1bfc2a316c15c71a0ace3ad20cb73bb08eb\n4. one1h56hkxmua0uzfv07fu04cudvtrl35u96pq47vy / 0xbd357b1b7cebf824b1fe4f1f5c71ac58ff1a70ba\n\n主攻擊交易 ID 截至報告凍結時間未恢復，不根據地址歷史挑選交易冒充主攻擊交易。\n\n## 2026-08-14 法證更新\nHarmony 官方後續文章將首個異常活動定位到 Shard 0 區塊 92,730,036，時間為 2026 年 8 月 12 日 07:25:41（北京時間）。兩次首波空區塊鑄幣發生在 08:02:59 和 09:01:17，合計 4,000,000,000 ONE；六筆、四錢包完整重建口徑為 3,010,000,100,000 ONE。\n\n## 根因與處置校正\n已確認主缺陷是跨分片收據重放：未認證的 ShardID 與 BlockNum 讓已處理收據被重複計入。預質押法定人數缺陷是第二條輔助路徑，官方仍在判斷攻擊是否實際利用。補丁 v2026.1.1 於 14:30 部署並生效，Shard 0 停在區塊 92,753,555 以推進回滾；項目方聯繫交易所阻止資金，但沒有公開全部地址的實際凍結回執。\n\n## 新增交易證據\n官方公開的一筆完整資金移動交易為 0xf3d4e8b12479ae14cd5eae973a5f61b07d567b142a6ca1385471d5c288242c7f；它記錄 30 億 ONE 地址向下遊轉出 28 億 ONE。其餘異常鑄幣交易在官方文章中仍未逐項完整列出。", "en": "## Incident overview\nHarmony confirmed unauthorized ONE minting on August 12, 2026. The project first coordinated with exchanges to block and freeze related funds, then paused the Harmony Bridge and required validators to upgrade a patch.\n\n## Incident sequence\n1. The attacker unauthorizedly minted approximately 4 billion ONE on Harmony.\n2. GoPlus and on-chain analysis reported that about 2.8 billion ONE quickly entered exchanges and was sold, while ONE fell more than 35% within minutes.\n3. Harmony published four source-address groups and asked exchanges to block and freeze funds traceable to them.\n4. Harmony paused the bridge and required validators to upgrade to v2026.1.1 to stop further minting, while evaluating treatment of the minted tokens and a rollback option.\n\n## Fund flow\nUnauthorized minting → four project-published source-address groups → approximately 2.8 billion ONE sent to multiple exchanges and sold. Exchange names, deposit addresses, and final exits were not fully disclosed; a freeze request is not proof of an executed freeze.\n\n## Amount basis\nThe 4 billion ONE figure is an anomalous mint quantity, and 2.8 billion ONE is the quantity that security analysis said entered exchanges and was sold. Neither figure is a directly convertible net USD loss. No reliable final USD loss, frozen amount, or recovery amount was public.\n\n## Evidence boundary\nHarmony officially confirmed the event, bridge pause, validator upgrade, and four address groups; CertiK and GoPlus cross-checked the unauthorized-mint scale. The first anomalous mint transaction, complete exploit method, exchange freeze execution, and final attribution remain undisclosed.\n\n## Current status\nThe Harmony Bridge is paused and validator patch v2026.1.1 was released for upgrade. Harmony is still evaluating rollback and treatment of minted tokens. This record does not turn a freeze request into a confirmed freeze or ONE quantity into USD loss.\n\n## Complete address ledger\nEach pair below is one account represented as a Harmony bech32 address and an EVM hexadecimal address, not eight separate wallets:\n\n1. one1uap8dx2z0qsjxqthm5flgcxkeepsz3gsrghnfn / 0xe7427699427821230177dd13f460d6ce43014510\n2. one17u300a40ll5wphd8kj5hktryhdjq3ml9f4phy4 / 0xf722f7f6afffe8e0dda7b4a97b2c64bb6408efe5\n3. one1a5hur07z5vtvzhr35zkw8tfqedemkz8t88xgd7 / 0xed2fc1bfc2a316c15c71a0ace3ad20cb73bb08eb\n4. one1h56hkxmua0uzfv07fu04cudvtrl35u96pq47vy / 0xbd357b1b7cebf824b1fe4f1f5c71ac58ff1a70ba\n\nThe primary attack transaction ID was not recovered by the report cutoff; no transaction was selected from address history as a substitute.\n\n## August 14 forensic update\nHarmony's follow-up article placed the first anomalous activity at Shard 0 block 92,730,036 on August 12, 2026 at 07:25:41 Beijing time. The two first-wave empty-block mints occurred at 08:02:59 and 09:01:17 and totaled 4,000,000,000 ONE; a six-transaction, four-wallet reconstruction totals 3,010,000,100,000 ONE.\n\n## Corrected root cause and response\nThe confirmed primary flaw was cross-shard receipt replay: unauthenticated ShardID and BlockNum fields allowed processed receipts to be counted again. A pre-staking quorum defect is a secondary path whose use by the attacker remains under review. Patch v2026.1.1 was deployed and active at 14:30, and Shard 0 stopped at block 92,753,555 for rollback work. Harmony contacted exchanges to block funds, but no complete address-level freeze receipts were public.\n\n## New transaction evidence\nOne complete public fund-movement transaction is 0xf3d4e8b12479ae14cd5eae973a5f61b07d567b142a6ca1385471d5c288242c7f; it records 2.8 billion ONE moving downstream from the 3 billion ONE address. The remaining anomalous-mint transactions were not itemized completely in the official article." }, "category": "protocol-exploit", "severity": "critical", "ecosystems": [ "Harmony" ], "chains": [ "Harmony" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "首波异常铸币合计 4,000,000,000 ONE；完整重建口径为 3,010,000,100,000 ONE。两者都是名义增发量，不直接等同美元损失；最终冻结和损失尚未确认。", "tw": "首波異常鑄幣合計 4,000,000,000 ONE；完整重建口徑為 3,010,000,100,000 ONE。兩者都是名義增髮量，不直接等同美元損失；最終凍結和損失尚未確認。", "en": "The first wave minted 4,000,000,000 ONE and the full reconstruction totals 3,010,000,100,000 ONE. Both are nominal mint quantities rather than direct USD loss; final freezing and loss remain unconfirmed." }, "addressDisclosure": "published", "addresses": [ { "chain": "Harmony", "address": "one1uap8dx2z0qsjxqthm5flgcxkeepsz3gsrghnfn", "entity": { "zh": "Harmony 攻击相关资金源（bech32 表示）", "tw": "Harmony 攻擊相關資金源（bech32 表示）", "en": "Harmony attack-related source (bech32 form)" }, "role": "attack-related-source", "category": "stolen_funds", "confidence": 0.92, "sourceUrl": "https://x.com/harmonyprotocol/status/2087410115200889135", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Harmony 官方将该地址列入交易所阻止和冻结请求；冻结执行结果未公开。", "tw": "Harmony 官方將該地址列入交易所阻止和凍結請求；凍結執行結果未公開。", "en": "Harmony listed this address in its exchange block-and-freeze request; execution of the freeze was not disclosed." }, "reviewRequired": true }, { "chain": "Harmony", "address": "0xe7427699427821230177dd13f460d6ce43014510", "entity": { "zh": "Harmony 攻击相关资金源（EVM 表示）", "tw": "Harmony 攻擊相關資金源（EVM 表示）", "en": "Harmony attack-related source (EVM form)" }, "role": "attack-related-source", "category": "stolen_funds", "confidence": 0.92, "sourceUrl": "https://x.com/harmonyprotocol/status/2087410115200889135", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "这是同一 Harmony 账户的 EVM 表示；项目方请求交易所阻止和冻结，执行结果未公开。", "tw": "這是同一 Harmony 賬戶的 EVM 表示；項目方請求交易所阻止和凍結，執行結果未公開。", "en": "This is the EVM form of the same Harmony account; Harmony requested exchange blocking and freezing, but execution was not disclosed." }, "reviewRequired": true }, { "chain": "Harmony", "address": "one17u300a40ll5wphd8kj5hktryhdjq3ml9f4phy4", "entity": { "zh": "Harmony 攻击相关资金源（bech32 表示）", "tw": "Harmony 攻擊相關資金源（bech32 表示）", "en": "Harmony attack-related source (bech32 form)" }, "role": "attack-related-source", "category": "stolen_funds", "confidence": 0.92, "sourceUrl": "https://x.com/harmonyprotocol/status/2087410115200889135", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Harmony 官方将该地址列入交易所阻止和冻结请求；冻结执行结果未公开。", "tw": "Harmony 官方將該地址列入交易所阻止和凍結請求；凍結執行結果未公開。", "en": "Harmony listed this address in its exchange block-and-freeze request; execution of the freeze was not disclosed." }, "reviewRequired": true }, { "chain": "Harmony", "address": "0xf722f7f6afffe8e0dda7b4a97b2c64bb6408efe5", "entity": { "zh": "Harmony 攻击相关资金源（EVM 表示）", "tw": "Harmony 攻擊相關資金源（EVM 表示）", "en": "Harmony attack-related source (EVM form)" }, "role": "attack-related-source", "category": "stolen_funds", "confidence": 0.92, "sourceUrl": "https://x.com/harmonyprotocol/status/2087410115200889135", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "这是同一 Harmony 账户的 EVM 表示；项目方请求交易所阻止和冻结，执行结果未公开。", "tw": "這是同一 Harmony 賬戶的 EVM 表示；項目方請求交易所阻止和凍結，執行結果未公開。", "en": "This is the EVM form of the same Harmony account; Harmony requested exchange blocking and freezing, but execution was not disclosed." }, "reviewRequired": true }, { "chain": "Harmony", "address": "one1a5hur07z5vtvzhr35zkw8tfqedemkz8t88xgd7", "entity": { "zh": "Harmony 攻击相关资金源（bech32 表示）", "tw": "Harmony 攻擊相關資金源（bech32 表示）", "en": "Harmony attack-related source (bech32 form)" }, "role": "attack-related-source", "category": "stolen_funds", "confidence": 0.92, "sourceUrl": "https://x.com/harmonyprotocol/status/2087410115200889135", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Harmony 官方将该地址列入交易所阻止和冻结请求；冻结执行结果未公开。", "tw": "Harmony 官方將該地址列入交易所阻止和凍結請求；凍結執行結果未公開。", "en": "Harmony listed this address in its exchange block-and-freeze request; execution of the freeze was not disclosed." }, "reviewRequired": true }, { "chain": "Harmony", "address": "0xed2fc1bfc2a316c15c71a0ace3ad20cb73bb08eb", "entity": { "zh": "Harmony 攻击相关资金源（EVM 表示）", "tw": "Harmony 攻擊相關資金源（EVM 表示）", "en": "Harmony attack-related source (EVM form)" }, "role": "attack-related-source", "category": "stolen_funds", "confidence": 0.92, "sourceUrl": "https://x.com/harmonyprotocol/status/2087410115200889135", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "这是同一 Harmony 账户的 EVM 表示；项目方请求交易所阻止和冻结，执行结果未公开。", "tw": "這是同一 Harmony 賬戶的 EVM 表示；項目方請求交易所阻止和凍結，執行結果未公開。", "en": "This is the EVM form of the same Harmony account; Harmony requested exchange blocking and freezing, but execution was not disclosed." }, "reviewRequired": true }, { "chain": "Harmony", "address": "one1h56hkxmua0uzfv07fu04cudvtrl35u96pq47vy", "entity": { "zh": "Harmony 攻击相关资金源（bech32 表示）", "tw": "Harmony 攻擊相關資金源（bech32 表示）", "en": "Harmony attack-related source (bech32 form)" }, "role": "attack-related-source", "category": "stolen_funds", "confidence": 0.92, "sourceUrl": "https://x.com/harmonyprotocol/status/2087410115200889135", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Harmony 官方将该地址列入交易所阻止和冻结请求；冻结执行结果未公开。", "tw": "Harmony 官方將該地址列入交易所阻止和凍結請求；凍結執行結果未公開。", "en": "Harmony listed this address in its exchange block-and-freeze request; execution of the freeze was not disclosed." }, "reviewRequired": true }, { "chain": "Harmony", "address": "0xbd357b1b7cebf824b1fe4f1f5c71ac58ff1a70ba", "entity": { "zh": "Harmony 攻击相关资金源（EVM 表示）", "tw": "Harmony 攻擊相關資金源（EVM 表示）", "en": "Harmony attack-related source (EVM form)" }, "role": "attack-related-source", "category": "stolen_funds", "confidence": 0.92, "sourceUrl": "https://x.com/harmonyprotocol/status/2087410115200889135", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "这是同一 Harmony 账户的 EVM 表示；项目方请求交易所阻止和冻结，执行结果未公开。", "tw": "這是同一 Harmony 賬戶的 EVM 表示；項目方請求交易所阻止和凍結，執行結果未公開。", "en": "This is the EVM form of the same Harmony account; Harmony requested exchange blocking and freezing, but execution was not disclosed." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "Harmony 首次处置、补丁与回滚选项", "tw": "Harmony 首次處置、補丁與回滾選項", "en": "Harmony initial response, patch, and rollback options" }, "url": "https://x.com/harmonyprotocol/status/2087395174263705704", "type": "official" }, { "label": { "zh": "Harmony 四组地址与交易所冻结请求", "tw": "Harmony 四組地址與交易所凍結請求", "en": "Harmony four address groups and exchange freeze request" }, "url": "https://x.com/harmonyprotocol/status/2087410115200889135", "type": "official" }, { "label": { "zh": "Harmony 暂停 Bridge", "tw": "Harmony 暫停 Bridge", "en": "Harmony bridge suspension" }, "url": "https://x.com/harmonyprotocol/status/2087428693933367768", "type": "official" }, { "label": { "zh": "Harmony 验证者升级 v2026.1.1", "tw": "Harmony 驗證者升級 v2026.1.1", "en": "Harmony validator upgrade v2026.1.1" }, "url": "https://x.com/harmonyprotocol/status/2087428910829261013", "type": "official" }, { "label": { "zh": "CertiK Harmony 铸币告警", "tw": "CertiK Harmony 鑄幣告警", "en": "CertiK Harmony minting alert" }, "url": "https://x.com/CertiKAlert/status/2087423075633815576", "type": "research" }, { "label": { "zh": "GoPlus Harmony 资金与价格分析", "tw": "GoPlus Harmony 資金與價格分析", "en": "GoPlus Harmony fund and price analysis" }, "url": "https://x.com/GoPlusSecurity/status/2087433698224312484", "type": "research" }, { "label": { "zh": "Harmony 8 月 14 日官方法证更新", "tw": "Harmony 8 月 14 日官方法證更新", "en": "Harmony August 14 forensic update" }, "url": "https://x.com/harmonyprotocol/status/2088078119269978281", "type": "official" }, { "label": { "zh": "CertiK Harmony 数量更新", "tw": "CertiK Harmony 數量更新", "en": "CertiK Harmony quantity update" }, "url": "https://x.com/CertiKAlert/status/2087450799874224439", "type": "research" }, { "label": { "zh": "CertiK Harmony 技术根因", "tw": "CertiK Harmony 技術根因", "en": "CertiK Harmony technical root cause" }, "url": "https://x.com/CertiKAlert/status/2087480911621439671", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-228", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-229", "status": "verified", "incidentDate": "2026-08-11", "datePrecision": "day", "title": { "zh": "Solana 地址投毒导致约 10 万 USDT 误转", "tw": "Solana 地址投毒導致約 10 萬 USDT 誤轉", "en": "Solana address poisoning caused an approximately $100,000 USDT mis-transfer" }, "summary": { "zh": "Cyvers 披露一起地址投毒事件，受害者从交易历史复制仿冒地址后误转约 100,012.89 USDT，攻击者随后将 USDT 换成约 52.8 ETH。原帖中的攻击者、受害者和损失交易标识符被截图省略，不能猜补为完整地址。", "tw": "Cyvers 披露一起地址投毒事件，受害者從交易歷史複製仿冒地址後誤轉約 100,012.89 USDT，攻擊者隨後將 USDT 換成約 52.8 ETH。原帖中的攻擊者、受害者和損失交易標識符被截圖省略，不能猜補為完整地址。", "en": "Cyvers disclosed an address-poisoning incident in which a victim copied an impersonating address from transaction history and mis-sent approximately 100,012.89 USDT. The attacker then swapped the USDT for about 52.8 ETH. The attacker, victim, and loss-transaction identifiers were truncated in the source image and are not guessed." }, "details": { "zh": "## 事件背景\n攻击者先通过小额或仿冒交易污染受害者的钱包历史，使仿冒地址与常用收款地址在首尾字符上相近。受害者随后从历史记录复制地址并误转稳定币。\n\n## 事件经过\n1. 2026 年 6 月 3 日，攻击者开始对受害钱包实施投毒准备。\n2. 2026 年 8 月 11 日，受害者从交易历史复制错误地址并误转 USDT。\n3. Cyvers 将事件标记为 Critical / Address Poisoning，截图显示损失为 $100,012.89。\n4. 攻击者随后将 USDT 换成约 52.8 ETH，以降低潜在冻结风险。\n\n## 资金流向\n受害者钱包 → 仿冒收款地址 → Solana USDT 被换为约 52.8 ETH。桥、兑换协议、攻击者最终地址和后续出口尚未公开；没有公开冻结、返还或追回结果。\n\n## 金额口径\n截图给出的精确损失为 $100,012.89，正文将其四舍五入为约 $100,000；二者是同一事件的不同表达，不重复相加。约 52.8 ETH 是后续资产形态，不另计为损失。\n\n## 证据边界\nCyvers 告警和截图支持地址投毒机制、金额和 USDT 换 ETH 的路径。正文自动把 USDT 链接到 Solana USDT mint 地址，该地址是资产合约标识，不是攻击者地址；截图中的攻击者、受害者和交易哈希均含省略号，无法恢复完整值。\n\n## 处置状态\n截至报告冻结时间，资金已换成 ETH，没有公开发行方冻结、交易所冻结、返还或追回证据。攻击者、受害者身份和最终 ETH 接收地址仍未披露。\n\n## 地址与交易账本\n正式地址和交易账本留空，因为公开来源只给出截断值：攻击者 `0xae7c08af…9f4e2c85`、受害者 `0x9b4ded0a…d2f51d83`、损失交易 `0x2add15a3cc21d79…9f9520a2ae94ecce`。这些线索不进入完整地址标签，也不把 Solana USDT mint `Es9vMFrzaCERmJfrF4H2FYD4KCoNkY11McCe8BenwNYB` 标为黑客地址。", "tw": "## 事件背景\n攻擊者先通過小額或仿冒交易汙染受害者的錢包歷史，使仿冒地址與常用收款地址在首尾字符上相近。受害者隨後從歷史記錄複製地址並誤轉穩定幣。\n\n## 事件經過\n1. 2026 年 6 月 3 日，攻擊者開始對受害錢包實施投毒準備。\n2. 2026 年 8 月 11 日，受害者從交易歷史複製錯誤地址並誤轉 USDT。\n3. Cyvers 將事件標記為 Critical / Address Poisoning，截圖顯示損失為 $100,012.89。\n4. 攻擊者隨後將 USDT 換成約 52.8 ETH，以降低潛在凍結風險。\n\n## 資金流向\n受害者錢包 → 仿冒收款地址 → Solana USDT 被換為約 52.8 ETH。橋、兌換協議、攻擊者最終地址和後續出口尚未公開；沒有公開凍結、返還或追回結果。\n\n## 金額口徑\n截圖給出的精確損失為 $100,012.89，正文將其四捨五入為約 $100,000；二者是同一事件的不同表達，不重複相加。約 52.8 ETH 是後續資產形態，不另計為損失。\n\n## 證據邊界\nCyvers 告警和截圖支持地址投毒機制、金額和 USDT 換 ETH 的路徑。正文自動把 USDT 鏈接到 Solana USDT mint 地址，該地址是資產合約標識，不是攻擊者地址；截圖中的攻擊者、受害者和交易哈希均含省略號，無法恢復完整值。\n\n## 處置狀態\n截至報告凍結時間，資金已換成 ETH，沒有公開發行方凍結、交易所凍結、返還或追回證據。攻擊者、受害者身份和最終 ETH 接收地址仍未披露。\n\n## 地址與交易賬本\n正式地址和交易賬本留空，因為公開來源只給出截斷值：攻擊者 `0xae7c08af…9f4e2c85`、受害者 `0x9b4ded0a…d2f51d83`、損失交易 `0x2add15a3cc21d79…9f9520a2ae94ecce`。這些線索不進入完整地址標籤，也不把 Solana USDT mint `Es9vMFrzaCERmJfrF4H2FYD4KCoNkY11McCe8BenwNYB` 標為黑客地址。", "en": "## Incident overview\nThe attacker first polluted the victim wallet history with small or impersonating transfers, making a look-alike address share recognizable leading and trailing characters with a regular recipient. The victim later copied the address from history and mis-sent stablecoins.\n\n## Incident sequence\n1. On June 3, 2026, the attacker began preparing the wallet-poisoning activity.\n2. On August 11, 2026, the victim copied the wrong address from transaction history and sent USDT.\n3. Cyvers marked the case Critical / Address Poisoning, and the screenshot showed a loss of $100,012.89.\n4. The attacker then swapped the USDT for approximately 52.8 ETH to reduce potential freeze exposure.\n\n## Fund flow\nVictim wallet → impersonating recipient → Solana USDT swapped for approximately 52.8 ETH. The bridge, conversion protocol, final attacker address, and onward route were not public; no freeze, return, or recovery was confirmed.\n\n## Amount basis\nThe screenshot gives the precise loss as $100,012.89, while the post rounds it to about $100,000; these are two expressions of the same event and are not added together. The approximately 52.8 ETH is the later asset form, not additional loss.\n\n## Evidence boundary\nThe Cyvers alert and screenshot support the poisoning mechanism, amount, and USDT-to-ETH path. The post automatically linked USDT to the Solana USDT mint, which is an asset-contract identifier rather than an attacker address. Attacker, victim, and transaction identifiers in the image are truncated and cannot be reconstructed.\n\n## Current status\nBy the report cutoff, the funds had been swapped to ETH, with no public issuer freeze, exchange freeze, return, or recovery evidence. The attacker, victim, and final ETH recipient remain undisclosed.\n\n## Address and transaction ledger\nThe formal address and transaction ledger is empty because the public source only shows truncated values: attacker `0xae7c08af…9f4e2c85`, victim `0x9b4ded0a…d2f51d83`, and loss transaction `0x2add15a3cc21d79…9f9520a2ae94ecce`. These clues are not entered into complete address labels, and the Solana USDT mint `Es9vMFrzaCERmJfrF4H2FYD4KCoNkY11McCe8BenwNYB` is not labeled as a hacker address." }, "category": "wallet-theft", "severity": "high", "ecosystems": [ "Solana", "Ethereum" ], "chains": [ "Solana", "Ethereum" ], "lossUsd": 100012.89, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 100,012.89 USDT（正文约写为 $100,000）；攻击者随后换为约 52.8 ETH。", "tw": "約 100,012.89 USDT（正文約寫為 $100,000）；攻擊者隨後換為約 52.8 ETH。", "en": "Approximately 100,012.89 USDT (rounded in the post to $100,000); the attacker later swapped it for about 52.8 ETH." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "Cyvers 地址投毒告警", "tw": "Cyvers 地址投毒告警", "en": "Cyvers address-poisoning alert" }, "url": "https://x.com/CyversAlerts/status/2087172620328243330", "type": "research" }, { "label": { "zh": "Cyvers 原帖证据图", "tw": "Cyvers 原帖證據圖", "en": "Cyvers source evidence image" }, "url": "https://pbs.twimg.com/media/HPcfeTIXcAAp8Zu.jpg", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-229", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-225", "status": "verified", "incidentDate": "2026-08-09", "datePrecision": "day", "title": { "zh": "Oraichain EVM 跨链转账漏洞导致 ORAI 未授权增发", "tw": "Oraichain EVM 跨鏈轉賬漏洞導致 ORAI 未授權增發", "en": "Oraichain EVM cross-chain transfer flaw enabled unauthorized ORAI minting" }, "summary": { "zh": "SlowMist Hacked Zone 与 Oraichain 官方说明显示，EVM 跨链转账漏洞导致 ORAI 未授权增发，网络随后暂停并进入销毁和核对流程；公开资料没有给出可核的损失金额。", "tw": "SlowMist Hacked Zone 與 Oraichain 官方說明顯示，EVM 跨鏈轉賬漏洞導致 ORAI 未授權增發，網絡隨後暫停並進入銷燬和核對流程；公開資料沒有給出可核的損失金額。", "en": "SlowMist Hacked Zone and Oraichain’s official notice describe an EVM cross-chain transfer flaw that enabled unauthorized ORAI minting. The network was paused for remediation, burning, and reconciliation; no verifiable loss amount was disclosed." }, "details": { "zh": "## 事件背景\nOraichain 的 EVM 跨链转账路径出现漏洞，攻击者能够制造未经授权的 ORAI 余额。该事件属于跨链协议漏洞，不等同于已确认的用户净损失。\n\n## 事件经过\n1. 攻击者利用 EVM 跨链转账逻辑产生未经授权的 ORAI。\n2. Oraichain 在 8 月 9 日发现异常并暂停网络相关功能。\n3. 团队核对受影响余额并准备销毁未经授权的数量。\n4. 后续恢复以官方核对和链上执行结果为准。\n\n## 资金流向\nEVM 跨链转账路径 → 未授权 ORAI 余额；公开来源没有提供完整攻击地址、交易标识符或可确认的兑换和归集路线。\n\n## 金额口径\n公开 SlowMist 条目和 Oraichain 通知没有给出可靠的美元损失或最终用户损失；未经授权增发数量不能直接换算成已实现损失。\n\n## 证据边界\n官方说明支持漏洞、网络暂停、销毁和核对措施；完整攻击调用、地址和最终影响范围仍待后续公告。\n\n## 处置状态\n网络进入修复和核对流程，团队计划销毁未经授权余额并恢复正常服务；最终结果以官方执行记录为准。", "tw": "## 事件背景\nOraichain 的 EVM 跨鏈轉賬路徑出現漏洞，攻擊者能夠製造未經授權的 ORAI 餘額。該事件屬於跨鏈協議漏洞，不等同於已確認的用戶淨損失。\n\n## 事件經過\n1. 攻擊者利用 EVM 跨鏈轉賬邏輯產生未經授權的 ORAI。\n2. Oraichain 在 8 月 9 日發現異常並暫停網絡相關功能。\n3. 團隊核對受影響餘額並準備銷燬未經授權的數量。\n4. 後續恢復以官方核對和鏈上執行結果為準。\n\n## 資金流向\nEVM 跨鏈轉賬路徑 → 未授權 ORAI 餘額；公開來源沒有提供完整攻擊地址、交易標識符或可確認的兌換和歸集路線。\n\n## 金額口徑\n公開 SlowMist 條目和 Oraichain 通知沒有給出可靠的美元損失或最終用戶損失；未經授權增發數量不能直接換算成已實現損失。\n\n## 證據邊界\n官方說明支持漏洞、網絡暫停、銷燬和核對措施；完整攻擊調用、地址和最終影響範圍仍待後續公告。\n\n## 處置狀態\n網絡進入修復和核對流程，團隊計劃銷燬未經授權餘額並恢復正常服務；最終結果以官方執行記錄為準。", "en": "## Incident overview\nA flaw in Oraichain’s EVM cross-chain transfer path enabled unauthorized ORAI balances. This is a cross-chain protocol vulnerability and is not the same as a confirmed net user loss.\n\n## Incident sequence\n1. The attacker used the EVM cross-chain transfer logic to create unauthorized ORAI.\n2. Oraichain detected the anomaly on August 9 and paused related network functions.\n3. The team reconciled affected balances and prepared to burn unauthorized amounts.\n4. Recovery depends on the official reconciliation and on-chain execution record.\n\n## Fund flow\nEVM cross-chain transfer path → unauthorized ORAI balances; public sources did not provide complete attack addresses, transaction identifiers, or a verified swap and aggregation route.\n\n## Amount basis\nThe SlowMist entry and Oraichain notice did not provide a reliable USD loss or final user-loss amount; unauthorized minting cannot be directly treated as realized loss.\n\n## Evidence boundary\nThe official notice supports the vulnerability, pause, burn, and reconciliation measures. Complete calls, addresses, and final impact remain subject to later updates.\n\n## Current status\nThe network entered remediation and reconciliation, with a plan to burn unauthorized balances and resume service; the final result depends on official execution records." }, "category": "bridge-exploit", "severity": "high", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开资料未给出可核的美元损失；未经授权增发数量与已实现损失严格分开。", "tw": "公開資料未給出可核的美元損失；未經授權增發數量與已實現損失嚴格分開。", "en": "No verifiable USD loss was disclosed; unauthorized minting is kept separate from realized loss." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "Oraichain 官方安全说明", "tw": "Oraichain 官方安全說明", "en": "Oraichain official security notice" }, "url": "https://x.com/oraichain/status/2086774707882451012", "type": "official" }, { "label": { "zh": "SlowMist Hacked Zone", "tw": "SlowMist Hacked Zone", "en": "SlowMist Hacked Zone" }, "url": "https://hacked.slowmist.io/", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-225", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-224", "status": "verified", "incidentDate": "2026-08-09", "datePrecision": "day", "title": { "zh": "Bifrost 三个 Farming Pool 共享 Guardian Vault 被利用", "tw": "Bifrost 三個 Farming Pool 共享 Guardian Vault 被利用", "en": "Bifrost shared Guardian Vault exploited across three farming pools" }, "summary": { "zh": "Bifrost 确认三个 Farming Pool 的共享 Guardian Vault 被利用，涉及 881,150 DOT，公开估值约 720,000 USD。vDOT 底层 DOT 储备保持 1:1，完整攻击标识符尚未公开。", "tw": "Bifrost 確認三個 Farming Pool 的共享 Guardian Vault 被利用，涉及 881,150 DOT，公開估值約 720,000 USD。vDOT 底層 DOT 儲備保持 1:1，完整攻擊標識符尚未公開。", "en": "Bifrost confirmed exploitation of a shared Guardian Vault across three farming pools involving 881,150 DOT, publicly valued at about $720,000. The underlying vDOT reserve remained 1:1 backed, and complete attack identifiers were not disclosed." }, "details": { "zh": "## 事件背景\n公开技术分析把根因指向 Farming 计量机制的异常奖励放大，影响 vDOT 单币、vASTR / ASTR 和 vMANTA / MANTA 三个池共用的 Guardian Vault。\n\n## 事件经过\n1. 攻击者利用 Farming 层机制从共享 Guardian Vault 提取 DOT。\n2. Bifrost 按链上数据核验受影响头寸并推进资产恢复。\n3. 官方说明 vDOT 底层质押资产、铸造和赎回仍保持 1:1 支持。\n4. 项目方随后公布补救框架。\n\n## 资金流向\n共享 Guardian Vault → 攻击方路径；桥、混币器、交易所充值和最终归集地址没有公开，不对后续路线作推断。\n\n## 金额口径\n受影响资产为 881,150 DOT，披露估值约 720,000 USD；该金额不等同 vDOT 底层储备损失。\n\n## 证据边界\n项目官方确认事件、影响池和储备边界；完整攻击地址、Extrinsic 和最终损失构成仍未公开。\n\n## 处置状态\n项目方正在调查、恢复资产并设计补救方案；截至报告截止时点，完整追回额和补偿方案未公开。", "tw": "## 事件背景\n公開技術分析把根因指向 Farming 計量機制的異常獎勵放大，影響 vDOT 單幣、vASTR / ASTR 和 vMANTA / MANTA 三個池共用的 Guardian Vault。\n\n## 事件經過\n1. 攻擊者利用 Farming 層機制從共享 Guardian Vault 提取 DOT。\n2. Bifrost 按鏈上數據核驗受影響頭寸並推進資產恢復。\n3. 官方說明 vDOT 底層質押資產、鑄造和贖回仍保持 1:1 支持。\n4. 項目方隨後公佈補救框架。\n\n## 資金流向\n共享 Guardian Vault → 攻擊方路徑；橋、混幣器、交易所充值和最終歸集地址沒有公開，不對後續路線作推斷。\n\n## 金額口徑\n受影響資產為 881,150 DOT，披露估值約 720,000 USD；該金額不等同 vDOT 底層儲備損失。\n\n## 證據邊界\n項目官方確認事件、影響池和儲備邊界；完整攻擊地址、Extrinsic 和最終損失構成仍未公開。\n\n## 處置狀態\n項目方正在調查、恢復資產並設計補救方案；截至報告截止時點，完整追回額和補償方案未公開。", "en": "## Incident overview\nPublic technical analysis attributed the issue to abnormal reward amplification in the farming accounting mechanism, affecting the vDOT single-coin, vASTR / ASTR, and vMANTA / MANTA pools that shared a Guardian Vault.\n\n## Incident sequence\n1. The attacker used the farming layer to withdraw DOT from the shared Guardian Vault.\n2. Bifrost verified affected positions from on-chain data and began asset recovery.\n3. The project said the underlying vDOT staking reserve, minting, and redemption remained 1:1 backed.\n4. The project later published a remediation framework.\n\n## Fund flow\nShared Guardian Vault → attacker route; bridges, mixers, exchange deposits, and final aggregation addresses were not disclosed and are not inferred here.\n\n## Amount basis\nThe affected assets were 881,150 DOT, publicly valued at about $720,000; this does not equal a loss of the underlying vDOT reserve.\n\n## Evidence boundary\nBifrost confirmed the event, affected pools, and reserve boundary. Complete attack addresses, Extrinsics, and the final loss composition remain undisclosed.\n\n## Current status\nThe project is investigating, recovering assets, and designing remediation. A complete recovery amount and compensation plan were not public by the report cutoff." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": 720000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "881,150 DOT，披露估值约 720,000 USD；vDOT 底层储备未被认定为损失。", "tw": "881,150 DOT，披露估值約 720,000 USD；vDOT 底層儲備未被認定為損失。", "en": "881,150 DOT, publicly valued at about $720,000; the underlying vDOT reserve was not identified as lost." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "Bifrost 官方首报", "tw": "Bifrost 官方首報", "en": "Bifrost initial official notice" }, "url": "https://x.com/Bifrost/status/2086268772042842599", "type": "official" }, { "label": { "zh": "Bifrost 受影响用户与补救流程", "tw": "Bifrost 受影響用戶與補救流程", "en": "Bifrost affected users and remediation" }, "url": "https://x.com/Bifrost/status/2086268843174031535", "type": "official" }, { "label": { "zh": "Bifrost vDOT 储备说明", "tw": "Bifrost vDOT 儲備說明", "en": "Bifrost vDOT reserve statement" }, "url": "https://x.com/Bifrost/status/2086268855211724895", "type": "official" }, { "label": { "zh": "Wei Tang 技术分析", "tw": "Wei Tang 技術分析", "en": "Wei Tang technical analysis" }, "url": "https://x.com/sorpaas/status/2086798076778267100", "type": "research" }, { "label": { "zh": "M13 Digital 金额摘要", "tw": "M13 Digital 金額摘要", "en": "M13 Digital amount summary" }, "url": "https://x.com/m13_digital/status/2086575401371844957", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-224", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-222", "status": "verified", "incidentDate": "2026-08-09", "datePrecision": "day", "title": { "zh": "USM / FUM defund 定价逻辑被闪电贷与拆单利用", "tw": "USM / FUM defund 定價邏輯被閃電貸與拆單利用", "en": "USM / FUM defund pricing logic exploited through flash loans and split calls" }, "summary": { "zh": "USM / FUM 在 Ethereum 上的 defund 定价路径被闪电贷和约 64 次拆单调用利用，公开估计约 70.83 ETH，披露时美元估值约 136,000 USD。", "tw": "USM / FUM 在 Ethereum 上的 defund 定價路徑被閃電貸和約 64 次拆單調用利用，公開估計約 70.83 ETH，披露時美元估值約 136,000 USD。", "en": "USM / FUM on Ethereum was exploited through flash loans and about 64 split defund calls, with an estimate of 70.83 ETH and a disclosed USD value of about $136,000." }, "details": { "zh": "## 事件背景\nUSM / FUM 的 defund 赎回路径使用当前价格与估算最终价格的算术平均。该计算在拆分赎回时不保持一致，状态收缩和整数舍入共同放大了累计输出。\n\n## 事件经过\n1. 攻击者借入闪电贷 ETH，通过 fund 调整 USM 内部状态。\n2. 攻击合约把赎回拆成约 64 次 defund 调用。\n3. 每次调用重新计算价格，重复利用状态收缩和舍入差异。\n4. 主攻击交易成功，安全机构估计提取约 70.83 ETH。\n\n## 资金流向\n攻击执行主体和攻击合约 → USM / FUM 受影响合约 → 收益接收地址；尚未发现公开的跨链、混币器或交易所后续路径。\n\n## 金额口径\n70.83 ETH 与约 136,000 USD 是同一事件的资产数量和美元估值，不重复相加；闪电贷名义本金不计为损失。\n\n## 证据边界\nCertiK、SlowMist 和 Ethereum 浏览器共同支持主交易、合约角色与技术机制。部分执行地址的实体身份和协议组件角色仍待项目方复盘。\n\n## 处置状态\n截至报告截止时点，未见 USM / FUM 官方暂停、修复、返还或审计公告；主攻击交易保持成功状态。", "tw": "## 事件背景\nUSM / FUM 的 defund 贖回路徑使用當前價格與估算最終價格的算術平均。該計算在拆分贖回時不保持一致，狀態收縮和整數舍入共同放大了累計輸出。\n\n## 事件經過\n1. 攻擊者借入閃電貸 ETH，通過 fund 調整 USM 內部狀態。\n2. 攻擊合約把贖回拆成約 64 次 defund 調用。\n3. 每次調用重新計算價格，重複利用狀態收縮和舍入差異。\n4. 主攻擊交易成功，安全機構估計提取約 70.83 ETH。\n\n## 資金流向\n攻擊執行主體和攻擊合約 → USM / FUM 受影響合約 → 收益接收地址；尚未發現公開的跨鏈、混幣器或交易所後續路徑。\n\n## 金額口徑\n70.83 ETH 與約 136,000 USD 是同一事件的資產數量和美元估值，不重複相加；閃電貸名義本金不計為損失。\n\n## 證據邊界\nCertiK、SlowMist 和 Ethereum 瀏覽器共同支持主交易、合約角色與技術機制。部分執行地址的實體身份和協議組件角色仍待項目方復盤。\n\n## 處置狀態\n截至報告截止時點，未見 USM / FUM 官方暫停、修復、返還或審計公告；主攻擊交易保持成功狀態。", "en": "## Incident overview\nUSM / FUM used an arithmetic average of the current price and an estimated final price in its defund path. The calculation was not split-invariant, and state contraction plus integer rounding amplified the cumulative output.\n\n## Incident sequence\n1. The attacker borrowed ETH through a flash loan and changed internal USM state through fund.\n2. The attacker contract split the redemption into about 64 defund calls.\n3. Each call recalculated the price and reused state contraction and rounding differences.\n4. The main attack transaction succeeded, and security teams estimated an extraction of about 70.83 ETH.\n\n## Fund flow\nAttack executor and contract → affected USM / FUM contract → profit receiving addresses; no public cross-chain, mixer, or exchange route was found.\n\n## Amount basis\n70.83 ETH and about $136,000 are the asset and USD valuation of the same event and are not added together; flash-loan principal is not treated as loss.\n\n## Evidence boundary\nCertiK, SlowMist, and the Ethereum explorer corroborate the main transaction, contract roles, and mechanism. Entity identity for some execution addresses and exact protocol-component roles remain open.\n\n## Current status\nBy the report cutoff, no USM / FUM pause, patch, return, or audit notice was found; the main attack transaction remains successful." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 136000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 70.83 ETH，披露时估值约 136,000 USD；两者是同一事件的不同金额口径。", "tw": "約 70.83 ETH，披露時估值約 136,000 USD；兩者是同一事件的不同金額口徑。", "en": "About 70.83 ETH, valued at approximately $136,000 at disclosure; these are two views of the same event." }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0xb92b2E47680c89DA8f951B8963ef469f461a50Fc", "entity": { "zh": "USM 攻击执行地址", "tw": "USM 攻擊執行地址", "en": "USM attack executor address" }, "role": "attack-executor", "category": "stolen_funds", "confidence": 0.82, "sourceUrl": "https://x.com/SlowMist_Team/status/2086644725143183639", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "SlowMist 将该地址列入攻击执行路径；浏览器显示的代码状态与来源称呼存在差异，保留角色边界。", "tw": "SlowMist 將該地址列入攻擊執行路徑；瀏覽器顯示的代碼狀態與來源稱呼存在差異，保留角色邊界。", "en": "SlowMist placed this address in the attack execution path; explorer code status differs from the source wording, so the role is kept bounded." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x5a5e29ba89663a3558273354E990426F3cAc7de7", "entity": { "zh": "USM 拆单攻击合约", "tw": "USM 拆單攻擊合約", "en": "USM split-call attack contract" }, "role": "attack-contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/SlowMist_Team/status/2086644725143183639", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "公开分析把该合约列为连续 defund 调用的执行组件。", "tw": "公開分析把該合約列為連續 defund 調用的執行組件。", "en": "Public analysis identifies this contract as the execution component for the repeated defund calls." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x2a7a9B0361207cA9ab9F8d707806A988e3F41675", "entity": { "zh": "USM / FUM 受影响合约", "tw": "USM / FUM 受影響合約", "en": "Affected USM / FUM contract" }, "role": "affected-contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/SlowMist_Team/status/2086644725143183639", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "公开分析把该地址列为 USM / FUM 受影响系统合约，不是攻击者身份标签。", "tw": "公開分析把該地址列為 USM / FUM 受影響系統合約，不是攻擊者身份標籤。", "en": "Public analysis places this address in the affected USM / FUM system and does not label it as the attacker." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xe3c1849149f19F963EC890586923E69BBEdfbf99", "entity": { "zh": "USM 攻击收益接收地址", "tw": "USM 攻擊收益接收地址", "en": "USM attack-profit receiving address" }, "role": "profit-receiving", "category": "stolen_funds", "confidence": 0.82, "sourceUrl": "https://x.com/SlowMist_Team/status/2086644725143183639", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "公开分析把该地址与攻击收益接收路径关联；具体控制人未确认。", "tw": "公開分析把該地址與攻擊收益接收路徑關聯；具體控制人未確認。", "en": "Public analysis links this address to the attack-profit receiving route; controller identity is not confirmed." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x2a7Fff44C19f39468064ab5e5c304De01D591675", "entity": { "zh": "USM ETH 流出地址", "tw": "USM ETH 流出地址", "en": "USM ETH outflow address" }, "role": "eth-outflow", "category": "unknown", "confidence": 0.78, "sourceUrl": "https://skylens.certik.com/tx/eth/0xfae5e751b8ce01457cbb6b529839f24a0cff50faaabcbd0fd02ca0cf559b050e?events_id=39&active_tab=events", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Skylens 事件记录显示该地址参与约 70.83 ETH 的流出；协议组件角色待核。", "tw": "Skylens 事件記錄顯示該地址參與約 70.83 ETH 的流出；協議組件角色待核。", "en": "Skylens records this address in the outflow of about 70.83 ETH; its protocol-component role remains open." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xE3C6346b6F282029312d2CAf4677EF39BeaBBF99", "entity": { "zh": "USM ETH 接收地址", "tw": "USM ETH 接收地址", "en": "USM ETH receiving address" }, "role": "eth-receiving", "category": "unknown", "confidence": 0.78, "sourceUrl": "https://skylens.certik.com/tx/eth/0xfae5e751b8ce01457cbb6b529839f24a0cff50faaabcbd0fd02ca0cf559b050e?events_id=39&active_tab=events", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Skylens 事件记录显示该地址接收约 70.83 ETH；最终控制归属待核。", "tw": "Skylens 事件記錄顯示該地址接收約 70.83 ETH；最終控制歸屬待核。", "en": "Skylens records this address receiving about 70.83 ETH; final control attribution remains open." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "CertiK 技术告警", "tw": "CertiK 技術告警", "en": "CertiK technical alert" }, "url": "https://x.com/CertiKAlert/status/2086641169078055208", "type": "research" }, { "label": { "zh": "SlowMist 根因与地址分析", "tw": "SlowMist 根因與地址分析", "en": "SlowMist root-cause and address analysis" }, "url": "https://x.com/SlowMist_Team/status/2086644725143183639", "type": "research" }, { "label": { "zh": "Ethereum 主攻击交易", "tw": "Ethereum 主攻擊交易", "en": "Ethereum main attack transaction" }, "url": "https://eth.blockscout.com/tx/0xfae5e751b8ce01457cbb6b529839f24a0cff50faaabcbd0fd02ca0cf559b050e", "type": "research" }, { "label": { "zh": "USM / FUM 官方账号", "tw": "USM / FUM 官方賬號", "en": "USM / FUM official account" }, "url": "https://x.com/usmfum", "type": "official" }, { "label": { "zh": "CertiK Skylens 资金变化", "tw": "CertiK Skylens 資金變化", "en": "CertiK Skylens balance changes" }, "url": "https://skylens.certik.com/tx/eth/0xfae5e751b8ce01457cbb6b529839f24a0cff50faaabcbd0fd02ca0cf559b050e?events_id=39&active_tab=events", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-222", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-221", "status": "verified", "incidentDate": "2026-08-09", "datePrecision": "day", "title": { "zh": "Coinsbuy 关联热钱包跨 Ethereum 与 TRON 被抽走约 7,900,000 USD", "tw": "Coinsbuy 關聯熱錢包跨 Ethereum 與 TRON 被抽走約 7,900,000 USD", "en": "Coinsbuy-linked hot wallets drained across Ethereum and TRON for about $7.9 million" }, "summary": { "zh": "Coinsbuy 关联热钱包在 Ethereum 与 TRON 出现集中异常流出，公开估值约 7,900,000 USD。部分资金经过 ChangeNOW、FixedFloat 和 BingX，具体根因与最终归集路径仍未完整公开。", "tw": "Coinsbuy 關聯熱錢包在 Ethereum 與 TRON 出現集中異常流出，公開估值約 7,900,000 USD。部分資金經過 ChangeNOW、FixedFloat 和 BingX，具體根因與最終歸集路徑仍未完整公開。", "en": "Coinsbuy-linked hot wallets suffered concentrated outflows on Ethereum and TRON with a public estimate of about $7.9 million. Some funds moved through ChangeNOW, FixedFloat, and BingX; the root cause and final aggregation route remain incomplete." }, "details": { "zh": "## 事件背景\nCoinsbuy 关联的 Ethereum 与 TRON 热钱包在 2026 年 8 月 9 日晚间出现集中异常流出。多家安全与情报来源交叉确认三条资金路径地址，但项目方尚未公开技术复盘。\n\n## 事件经过\n1. 北京时间 8 月 9 日约 21:00，相关热钱包开始出现资产外流。\n2. 资金被归集至两个 Ethereum 地址和一个 TRON 地址。\n3. 部分资金经 ChangeNOW、FixedFloat、BingX 等服务兑换，部分换成 XMR。\n4. ChangeNOW 据报冻结六位数美元级资金，但精确数额没有公开。\n\n## 资金流向\nCoinsbuy 关联热钱包 → Ethereum / TRON 归集地址 → 兑换和交易服务；部分资产继续兑换为 XMR。具体充值地址、订单和最终隐私币出口尚未核实。\n\n## 金额口径\n公开来源给出约或超过 7,900,000 USD 的多链钱包流出口径；该估值不是单笔交易金额。ChangeNOW 的六位数美元级冻结说法没有精确数额，未计入已追回金额。\n\n## 证据边界\n三条地址、跨链流出和服务路线有多源支持；“私钥泄露”或“管理员权限失陷”仍是模式推断，不能替代项目方根因确认。资金进入某服务也不等于该服务参与攻击。\n\n## 处置状态\n部分资金据报被 ChangeNOW 冻结，其余路径经多个兑换服务和 XMR 分散。未找到 Coinsbuy 官方事故复盘、全额赔付或完整密钥轮换公告。", "tw": "## 事件背景\nCoinsbuy 關聯的 Ethereum 與 TRON 熱錢包在 2026 年 8 月 9 日晚間出現集中異常流出。多家安全與情報來源交叉確認三條資金路徑地址，但項目方尚未公開技術復盤。\n\n## 事件經過\n1. 北京時間 8 月 9 日約 21:00，相關熱錢包開始出現資產外流。\n2. 資金被歸集至兩個 Ethereum 地址和一個 TRON 地址。\n3. 部分資金經 ChangeNOW、FixedFloat、BingX 等服務兌換，部分換成 XMR。\n4. ChangeNOW 據報凍結六位數美元級資金，但精確數額沒有公開。\n\n## 資金流向\nCoinsbuy 關聯熱錢包 → Ethereum / TRON 歸集地址 → 兌換和交易服務；部分資產繼續兌換為 XMR。具體充值地址、訂單和最終隱私幣出口尚未核實。\n\n## 金額口徑\n公開來源給出約或超過 7,900,000 USD 的多鏈錢包流出口徑；該估值不是單筆交易金額。ChangeNOW 的六位數美元級凍結說法沒有精確數額，未計入已追回金額。\n\n## 證據邊界\n三條地址、跨鏈流出和服務路線有多源支持；“私鑰洩露”或“管理員權限失陷”仍是模式推斷，不能替代項目方根因確認。資金進入某服務也不等於該服務參與攻擊。\n\n## 處置狀態\n部分資金據報被 ChangeNOW 凍結，其餘路徑經多個兌換服務和 XMR 分散。未找到 Coinsbuy 官方事故復盤、全額賠付或完整密鑰輪換公告。", "en": "## Incident overview\nCoinsbuy-linked hot wallets showed concentrated outflows on Ethereum and TRON on the night of August 9, 2026. Multiple security and intelligence sources corroborated three route addresses, while the project has not published a technical postmortem.\n\n## Incident sequence\n1. Outflows began at about 21:00 Beijing time on August 9.\n2. Funds were aggregated into two Ethereum addresses and one TRON address.\n3. Some funds moved through ChangeNOW, FixedFloat, and BingX and part was exchanged for XMR.\n4. ChangeNOW was reported to have frozen a six-figure USD amount, but the exact figure was not disclosed.\n\n## Fund flow\nCoinsbuy-linked hot wallets → Ethereum / TRON aggregation addresses → exchange and conversion services; part of the assets continued into XMR. Deposit addresses, order details, and the final privacy-coin route remain unverified.\n\n## Amount basis\nPublic sources estimate about or more than $7.9 million in multi-chain wallet outflows; this is not a single-transaction amount. The reported six-figure ChangeNOW freeze has no exact value and is not counted as recovered.\n\n## Evidence boundary\nThe three addresses, cross-chain outflows, and service routes have multi-source support. Private-key compromise or administrator compromise remains a pattern-based hypothesis rather than a confirmed root cause. A service appearing in the route does not establish participation.\n\n## Current status\nPart of the funds was reportedly frozen by ChangeNOW, while other paths dispersed through conversion services and XMR. No Coinsbuy technical postmortem, full compensation, or complete key-rotation notice was found." }, "category": "access-control", "severity": "high", "ecosystems": [ "Ethereum", "TRON" ], "chains": [ "Ethereum", "TRON" ], "lossUsd": 7900000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开估值约 7,900,000 USD；具体净损失和已冻结数额仍未完整公开。", "tw": "公開估值約 7,900,000 USD；具體淨損失和已凍結數額仍未完整公開。", "en": "Public estimates put the outflow at about $7.9 million; the exact net loss and frozen amount remain undisclosed." }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0x4d1bEF2Fe998B3E3C4029EF9EA6A0534d95661d3", "entity": { "zh": "Coinsbuy Ethereum 归集地址", "tw": "Coinsbuy Ethereum 歸集地址", "en": "Coinsbuy Ethereum aggregation address" }, "role": "attack-related-receiving", "category": "stolen_funds", "confidence": 0.88, "sourceUrl": "https://x.com/DarkWebInformer/status/2086566165665522120", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "公开资金路径把该地址列为 Coinsbuy 相关资产的接收和归集节点；归属仍是来源归因。", "tw": "公開資金路徑把該地址列為 Coinsbuy 相關資產的接收和歸集節點；歸屬仍是來源歸因。", "en": "The public fund route lists this address as a receiving and aggregation node for Coinsbuy-linked assets; attribution remains source-based." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x66790b545d13069499749940619c44ba7cd34b17", "entity": { "zh": "Coinsbuy Ethereum 二级归集地址", "tw": "Coinsbuy Ethereum 二級歸集地址", "en": "Coinsbuy secondary Ethereum aggregation address" }, "role": "aggregation", "category": "stolen_funds", "confidence": 0.86, "sourceUrl": "https://x.com/DarkWebInformer/status/2086566165665522120", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "公开资金路径把该地址列为后续归集与中转节点；没有据此确认控制人身份。", "tw": "公開資金路徑把該地址列為後續歸集與中轉節點；沒有據此確認控制人身份。", "en": "The public route lists this address as a later aggregation and relay node; controller identity is not established." }, "reviewRequired": true }, { "chain": "TRON", "address": "TVpX9xCzrj6KHeNhhDJoqjzEqFMxdgubGR", "entity": { "zh": "Coinsbuy TRON 归集地址", "tw": "Coinsbuy TRON 歸集地址", "en": "Coinsbuy TRON aggregation address" }, "role": "attack-related-receiving", "category": "stolen_funds", "confidence": 0.88, "sourceUrl": "https://x.com/DarkWebInformer/status/2086566165665522120", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "公开资金路径把该地址列为 Coinsbuy 相关资产的 TRON 接收节点；归属仍是来源归因。", "tw": "公開資金路徑把該地址列為 Coinsbuy 相關資產的 TRON 接收節點；歸屬仍是來源歸因。", "en": "The public fund route lists this address as a TRON receiving node for Coinsbuy-linked assets; attribution remains source-based." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "DarkWebInformer 地址与首批路径", "tw": "DarkWebInformer 地址與首批路徑", "en": "DarkWebInformer addresses and initial route" }, "url": "https://x.com/DarkWebInformer/status/2086566165665522120", "type": "research" }, { "label": { "zh": "PeckShield 资金路径", "tw": "PeckShield 資金路徑", "en": "PeckShield fund route" }, "url": "https://x.com/PeckShieldAlert/status/2086607420785402044", "type": "research" }, { "label": { "zh": "GoPlus 事件分析", "tw": "GoPlus 事件分析", "en": "GoPlus incident analysis" }, "url": "https://x.com/GoPlusSecurity/status/2086669119391428649", "type": "research" }, { "label": { "zh": "Coinsbuy 官方 X", "tw": "Coinsbuy 官方 X", "en": "Coinsbuy official X account" }, "url": "https://x.com/coinsbuycom", "type": "official" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-221", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-223", "status": "verified", "incidentDate": "2026-08-08", "datePrecision": "day", "title": { "zh": "Trezor / Ledger 赞助搜索广告钓鱼活动持续更新", "tw": "Trezor / Ledger 贊助搜索廣告釣魚活動持續更新", "en": "Ongoing sponsored-search phishing activity impersonating Trezor and Ledger" }, "summary": { "zh": "同一钓鱼活动在 Trezor 与 Ledger 品牌搜索结果中投放赞助广告，诱导用户进入仿冒页面并执行高风险钱包操作。跨窗口累计损失被估计超过 3,000,000 USD，严格窗口增量无法单独核定。", "tw": "同一釣魚活動在 Trezor 與 Ledger 品牌搜索結果中投放贊助廣告，誘導用戶進入仿冒頁面並執行高風險錢包操作。跨窗口累計損失被估計超過 3,000,000 USD，嚴格窗口增量無法單獨核定。", "en": "The same phishing activity placed sponsored ads in Trezor and Ledger searches and directed users to imitation pages for high-risk wallet actions. Cross-window losses were estimated above $3 million, while the strict-window increment cannot be isolated." }, "details": { "zh": "## 事件背景\n攻击者利用 Google 赞助搜索广告冒充 Trezor 与 Ledger，把仿冒结果推到搜索顶部，诱导用户输入助记词、签名或连接钱包。\n\n## 事件经过\n1. Trezor 相关首报发生在严格窗口开始前。\n2. 8 月 9 日，研究者披露同一攻击者还投放 Ledger 仿冒广告。\n3. 广告截图所示页面后来被移除。\n4. 研究者称多个相邻活动累计窃取超过 3,000,000 USD。\n\n## 资金流向\n公开来源没有提供受害钱包、恶意收款地址、Permit 或 Approve 交易，也没有给出可核的跨链和交易所路径；不能从广告截图反推链上地址。\n\n## 金额口径\n超过 3,000,000 USD 是跨窗口累计估值，不能分配为 8 月 8 日 15:00 之后的新增损失；严格窗口的受害人数和金额未公开。\n\n## 证据边界\n研究者确认了品牌冒充、赞助广告和相邻活动关系，但没有完整恶意域名、受害清单、收款地址或交易标识符。\n\n## 处置状态\n已知截图对应的广告据称被移除，但没有证据表明整个活动、基础设施或资金路径已经终止。", "tw": "## 事件背景\n攻擊者利用 Google 贊助搜索廣告冒充 Trezor 與 Ledger，把仿冒結果推到搜索頂部，誘導用戶輸入助記詞、簽名或連接錢包。\n\n## 事件經過\n1. Trezor 相關首報發生在嚴格窗口開始前。\n2. 8 月 9 日，研究者披露同一攻擊者還投放 Ledger 仿冒廣告。\n3. 廣告截圖所示頁面後來被移除。\n4. 研究者稱多個相鄰活動累計竊取超過 3,000,000 USD。\n\n## 資金流向\n公開來源沒有提供受害錢包、惡意收款地址、Permit 或 Approve 交易，也沒有給出可核的跨鏈和交易所路徑；不能從廣告截圖反推鏈上地址。\n\n## 金額口徑\n超過 3,000,000 USD 是跨窗口累計估值，不能分配為 8 月 8 日 15:00 之後的新增損失；嚴格窗口的受害人數和金額未公開。\n\n## 證據邊界\n研究者確認了品牌冒充、贊助廣告和相鄰活動關係，但沒有完整惡意域名、受害清單、收款地址或交易標識符。\n\n## 處置狀態\n已知截圖對應的廣告據稱被移除，但沒有證據表明整個活動、基礎設施或資金路徑已經終止。", "en": "## Incident overview\nThe attacker used Google sponsored search ads to impersonate Trezor and Ledger, placing imitation results at the top of search pages and soliciting seed phrases, signatures, or wallet connections.\n\n## Incident sequence\n1. The first Trezor disclosure preceded the strict reporting window.\n2. On August 9, researchers reported that the same actor was also running Ledger impersonation ads.\n3. The ad shown in the screenshots was later removed.\n4. Researchers estimated more than $3 million across several adjacent campaigns.\n\n## Fund flow\nPublic sources did not provide victim wallets, malicious receiving addresses, Permit or Approve transactions, or a verifiable cross-chain and exchange route; chain addresses cannot be inferred from an ad screenshot.\n\n## Amount basis\nMore than $3 million is a cross-window cumulative estimate and cannot be assigned to new loss after 15:00 Beijing time on August 8. Strict-window victim counts and loss were not disclosed.\n\n## Evidence boundary\nResearchers corroborated brand impersonation, sponsored advertising, and the adjacent campaign relationship, but did not publish a complete malicious domain, victim list, receiving address, or transaction identifier.\n\n## Current status\nThe ad shown in the available screenshot was reportedly removed, but there is no evidence that the broader campaign, infrastructure, or fund route has ended." }, "category": "phishing-approval", "severity": "medium", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "跨窗口累计估值超过 3,000,000 USD；严格窗口新增损失无法单独核定。", "tw": "跨窗口累計估值超過 3,000,000 USD；嚴格窗口新增損失無法單獨核定。", "en": "Cross-window losses were estimated above $3 million; strict-window incremental loss cannot be isolated." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "CoinDesk Trezor 赞助广告警报", "tw": "CoinDesk Trezor 贊助廣告警報", "en": "CoinDesk Trezor sponsored-ad alert" }, "url": "https://x.com/CoinDesk/status/2085760459773280311", "type": "research" }, { "label": { "zh": "Specter Ledger 活动更新", "tw": "Specter Ledger 活動更新", "en": "Specter Ledger activity update" }, "url": "https://x.com/SpecterAnalyst/status/2086193371740053692", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-223", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-214", "status": "verified", "incidentDate": "2026-08-08", "datePrecision": "day", "title": { "zh": "BTCPay Server 漏洞导致 Lightning 凭据泄露与钱包被盗", "tw": "BTCPay Server 漏洞導致 Lightning 憑據洩露與錢包被盜", "en": "BTCPay Server flaw exposed Lightning credentials and enabled wallet theft" }, "summary": { "zh": "BTCPay Server / LND 节点受到服务器漏洞或凭据泄露影响，Foundation、Citadel21 等运营方报告 Lightning 资金被抽走。公开报道尚未给出统一的受害范围和总损失。", "tw": "BTCPay Server / LND 節點受到服務器漏洞或憑據洩露影響，Foundation、Citadel21 等運營方報告 Lightning 資金被抽走。公開報道尚未給出統一的受害範圍和總損失。", "en": "BTCPay Server / LND nodes were affected by a server flaw or credential exposure, and operators including Foundation and Citadel21 reported Lightning funds being drained. Public reporting has not established a unified victim set or total loss." }, "details": { "zh": "## 事件背景\n公开报告指向 BTCPay Server 实例和 LND macaroon 凭据风险。macaroon 可作为 Lightning 节点的授权凭据，权限过大时可能允许远程控制支付和钱包操作。\n\n## 事件经过\n1. 攻击者扫描或利用暴露的 BTCPay Server 实例。\n2. 攻击者读取或导出 LND macaroon 凭据。\n3. 攻击者使用节点授权远程访问 Lightning 服务。\n4. 部分运营方报告资金被抽走，社区要求升级并轮换凭据。\n\n## 资金流向\n受影响 Lightning 节点或链上结算钱包 → 攻击者控制目标。公开报道没有统一的完整受害地址表和总损失。\n\n## 金额口径\n截至报告截止时间，公开来源只确认多个节点受影响，没有统一可核验的 USD 总额；不把单个运营方损失外推到全网。\n\n## 证据边界\n多家媒体和受影响实体的描述一致支持凭据泄露风险，但本轮材料未取得完整日志、版本矩阵和逐笔交易清单。\n\n## 处置状态\n运营方被要求紧急升级、轮换 macaroon 和密钥、审计节点日志；受影响范围和损失仍待项目方逐一确认。", "tw": "## 事件背景\n公開報告指向 BTCPay Server 實例和 LND macaroon 憑據風險。macaroon 可作為 Lightning 節點的授權憑據，權限過大時可能允許遠程控制支付和錢包操作。\n\n## 事件經過\n1. 攻擊者掃描或利用暴露的 BTCPay Server 實例。\n2. 攻擊者讀取或導出 LND macaroon 憑據。\n3. 攻擊者使用節點授權遠程訪問 Lightning 服務。\n4. 部分運營方報告資金被抽走，社區要求升級並輪換憑據。\n\n## 資金流向\n受影響 Lightning 節點或鏈上結算錢包 → 攻擊者控制目標。公開報道沒有統一的完整受害地址表和總損失。\n\n## 金額口徑\n截至報告截止時間，公開來源只確認多個節點受影響，沒有統一可核驗的 USD 總額；不把單個運營方損失外推到全網。\n\n## 證據邊界\n多家媒體和受影響實體的描述一致支持憑據洩露風險，但本輪材料未取得完整日誌、版本矩陣和逐筆交易清單。\n\n## 處置狀態\n運營方被要求緊急升級、輪換 macaroon 和密鑰、審計節點日誌；受影響範圍和損失仍待項目方逐一確認。", "en": "## Incident overview\nPublic reporting points to exposed BTCPay Server instances and LND macaroon credentials. A macaroon can authorize Lightning-node operations, and excessive permissions may enable remote payment or wallet control.\n\n## Incident sequence\n1. Attackers scanned or exploited exposed BTCPay Server instances.\n2. They read or exported LND macaroon credentials.\n3. The credentials enabled remote access to Lightning services.\n4. Some operators reported drained funds, and the community urged upgrades and credential rotation.\n\n## Fund flow\nAffected Lightning nodes or on-chain settlement wallets → attacker-controlled destinations. Public reporting does not provide a unified complete victim-address list or total loss.\n\n## Amount basis\nBy the report cutoff, public sources confirmed multiple affected nodes but no unified verifiable USD total. A single operator’s loss is not extrapolated to the entire ecosystem.\n\n## Evidence boundary\nMultiple media reports and affected entities consistently support the credential-exposure risk, but the report did not obtain complete logs, a version matrix, or a transaction-by-transaction list.\n\n## Current status\nOperators were urged to upgrade, rotate macaroons and keys, and audit node logs; the affected scope and loss remain subject to project-level confirmation." }, "category": "supply-chain", "severity": "high", "ecosystems": [ "Bitcoin" ], "chains": [ "Bitcoin" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "多个 Lightning 节点被报告资金被抽走；统一损失金额尚未核实。", "tw": "多個 Lightning 節點被報告資金被抽走；統一損失金額尚未核實。", "en": "Multiple Lightning nodes were reported as drained; a unified loss amount has not been verified." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "BTCPay 漏洞与受害实体线索", "tw": "BTCPay 漏洞與受害實體線索", "en": "BTCPay flaw and affected-entity leads" }, "url": "https://x.com/NewsTongueX/status/2085996822581977325", "type": "research" }, { "label": { "zh": "CoinDesk 报道索引", "tw": "CoinDesk 報道索引", "en": "CoinDesk report index" }, "url": "https://news.google.com/rss/articles/CBMixwFBVV95cUxOTndPYm1kZGdueVZKYmc0TUJ0R2ljTmF6QnotUTUyeUhQcmY4Qng5MU5jdXVhanYzSV9EeENQeUlKeWx6TjRVcEt4bk5jZFBWa09odzZ1ZV9nc2xkUnpZLXA0VnpoYnZLQjVaT2VUeF8wS1pJRWlaRlNXSHlOQ0lWVlk3VTBXLWx5Wk02WWpwZjUxRUJKMklpNmhFWE1FaFU5bjJjaENOTzhLSEx6UGpVMVIwN0xqaGduZUhtd2x6UnFBX29fNU5B?oc=5", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-214", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-213", "status": "verified", "incidentDate": "2026-08-06", "datePrecision": "day", "title": { "zh": "Base 钓鱼授权盗取约 500,000 USDC", "tw": "Base 釣魚授權盜取約 500,000 USDC", "en": "Base phishing authorization theft of approximately 500,000 USDC" }, "summary": { "zh": "Base 上个人钱包遭钓鱼或恶意授权后转出约 500,000 USDC。攻击者随后在 Uniswap V4 低流动性池换成 WETH，最终约获得 67 WETH；大部分价值被 MEV 截取，不构成受害者返还。", "tw": "Base 上個人錢包遭釣魚或惡意授權後轉出約 500,000 USDC。攻擊者隨後在 Uniswap V4 低流動性池換成 WETH，最終約獲得 67 WETH；大部分價值被 MEV 截取，不構成受害者返還。", "en": "A personal wallet on Base lost approximately 500,000 USDC after phishing or malicious authorization. The attacker then swapped through a low-liquidity Uniswap V4 pool and ended with about 67 WETH; most value was captured by MEV and was not returned to the victim." }, "details": { "zh": "## 事件背景\n受害钱包在 Base 上遭遇钓鱼或恶意授权，攻击者随后取得 USDC 转移权限。公开来源没有给出可核验的完整受害地址和攻击地址。\n\n## 事件经过\n1. 受害者签署钓鱼或恶意授权。\n2. 攻击者从受害钱包转出约 500,000 USDC。\n3. 攻击者尝试在 Uniswap V4 低流动性池换成 WETH。\n4. 缺少滑点保护导致 MEV 机器人夹击，攻击者最终约获得 67 WETH。\n\n## 资金流向\n受害钱包 → 攻击者路径 → Uniswap V4 低流动性池 → WETH。MEV 机器人截取的价值没有证据显示返还受害者。\n\n## 金额口径\n本站以受害者名义转出约 500,000 USDC 作为损失口径。约 67 WETH（约 129,000 USD）是攻击者最终取得的资产，不把 MEV 截取价值从受害者损失中扣除。\n\n## 证据边界\nPeckShield 与 GoPlus 对事件经过和金额口径给出一致描述，但来源正文只公开了截断地址，不能补全或猜测地址。\n\n## 处置状态\n未见冻结、追回或受害者返还公告；交易已完成，后续资金路线仍待核验。", "tw": "## 事件背景\n受害錢包在 Base 上遭遇釣魚或惡意授權，攻擊者隨後取得 USDC 轉移權限。公開來源沒有給出可核驗的完整受害地址和攻擊地址。\n\n## 事件經過\n1. 受害者簽署釣魚或惡意授權。\n2. 攻擊者從受害錢包轉出約 500,000 USDC。\n3. 攻擊者嘗試在 Uniswap V4 低流動性池換成 WETH。\n4. 缺少滑點保護導致 MEV 機器人夾擊，攻擊者最終約獲得 67 WETH。\n\n## 資金流向\n受害錢包 → 攻擊者路徑 → Uniswap V4 低流動性池 → WETH。MEV 機器人截取的價值沒有證據顯示返還受害者。\n\n## 金額口徑\n本站以受害者名義轉出約 500,000 USDC 作為損失口徑。約 67 WETH（約 129,000 USD）是攻擊者最終取得的資產，不把 MEV 截取價值從受害者損失中扣除。\n\n## 證據邊界\nPeckShield 與 GoPlus 對事件經過和金額口徑給出一致描述，但來源正文只公開了截斷地址，不能補全或猜測地址。\n\n## 處置狀態\n未見凍結、追回或受害者返還公告；交易已完成，後續資金路線仍待核驗。", "en": "## Incident overview\nA victim wallet on Base was exposed to phishing or a malicious authorization, allowing the attacker to transfer USDC. The public sources did not provide complete verifiable victim and attacker addresses.\n\n## Incident sequence\n1. The victim signed a phishing or malicious authorization.\n2. The attacker transferred approximately 500,000 USDC from the victim wallet.\n3. The attacker attempted to swap into WETH through a low-liquidity Uniswap V4 pool.\n4. Missing slippage protection allowed MEV bots to sandwich the swap, leaving the attacker with about 67 WETH.\n\n## Fund flow\nVictim wallet → attacker path → low-liquidity Uniswap V4 pool → WETH. There is no evidence that the value captured by MEV bots was returned to the victim.\n\n## Amount basis\nThis record uses the victim’s nominal outflow of approximately 500,000 USDC as the loss basis. The attacker’s final 67 WETH, about $129,000, is not subtracted from the victim loss because the remainder was captured by MEV.\n\n## Evidence boundary\nPeckShield and GoPlus describe the event and amount consistently, but the source posts expose only truncated addresses, which are not completed by inference.\n\n## Current status\nNo freeze, recovery, or victim-return announcement was found; the transaction completed and the downstream route remains under review." }, "category": "phishing-approval", "severity": "high", "ecosystems": [ "Base" ], "chains": [ "Base" ], "lossUsd": 500000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "受害者名义转出约 500,000 USDC；攻击者最终约取得 67 WETH，未见返还。", "tw": "受害者名義轉出約 500,000 USDC；攻擊者最終約取得 67 WETH，未見返還。", "en": "The victim’s nominal outflow was approximately 500,000 USDC; the attacker ended with about 67 WETH and no return was reported." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "PeckShield 告警", "tw": "PeckShield 告警", "en": "PeckShield alert" }, "url": "https://x.com/PeckShieldAlert/status/2085334419938890135", "type": "research" }, { "label": { "zh": "GoPlus 复核", "tw": "GoPlus 複核", "en": "GoPlus review" }, "url": "https://x.com/GoPlusSecurity/status/2085712566077321527", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-213", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-215", "status": "verified", "incidentDate": "2026-08-05", "datePrecision": "day", "title": { "zh": "ZEUS Bitcoin Lightning 基础设施遭入侵（客户资金零损失）", "tw": "ZEUS Bitcoin Lightning 基礎設施遭入侵（客戶資金零損失）", "en": "ZEUS Bitcoin Lightning infrastructure compromise with no customer-fund loss" }, "summary": { "zh": "SlowMist 记录 ZEUS Bitcoin Lightning 钱包及 LSP 基础设施遭入侵。事件得到缓解，客户资金没有损失或风险，相关服务曾短暂停机。", "tw": "SlowMist 記錄 ZEUS Bitcoin Lightning 錢包及 LSP 基礎設施遭入侵。事件得到緩解，客戶資金沒有損失或風險，相關服務曾短暫停機。", "en": "SlowMist recorded a compromise of ZEUS Bitcoin Lightning wallet and LSP infrastructure. The incident was mitigated, customer funds were not lost or at risk, and services were temporarily offline." }, "details": { "zh": "## 事件背景\nZEUS 的 Bitcoin Lightning 钱包和 LSP 基础设施遭遇入侵。公开记录将其归类为基础设施 compromise，而不是客户资金被盗。\n\n## 事件经过\n1. ZEUS 发现基础设施遭到未授权访问。\n2. 团队采取隔离和缓解措施，相关服务短暂停机。\n3. 公开说明确认客户资金没有损失或风险。\n4. 事件信息由 SlowMist Hacked Zone 记录。\n\n## 资金流向\n未确认客户资金从 Lightning 钱包流出；公开材料没有给出攻击者地址或交易哈希。\n\n## 金额口径\nSlowMist 记录的损失为 0 USD。基础设施中断和运营影响不转化为客户资金损失。\n\n## 证据边界\nSlowMist 记录支持基础设施入侵、缓解和零客户损失结论；未公开的内部日志和攻击者身份不作补全。\n\n## 处置状态\n事件已得到缓解，服务短暂停机后恢复；客户资金安全结论以项目后续公告为准。", "tw": "## 事件背景\nZEUS 的 Bitcoin Lightning 錢包和 LSP 基礎設施遭遇入侵。公開記錄將其歸類為基礎設施 compromise，而不是客戶資金被盜。\n\n## 事件經過\n1. ZEUS 發現基礎設施遭到未授權訪問。\n2. 團隊採取隔離和緩解措施，相關服務短暫停機。\n3. 公開說明確認客戶資金沒有損失或風險。\n4. 事件信息由 SlowMist Hacked Zone 記錄。\n\n## 資金流向\n未確認客戶資金從 Lightning 錢包流出；公開材料沒有給出攻擊者地址或交易哈希。\n\n## 金額口徑\nSlowMist 記錄的損失為 0 USD。基礎設施中斷和運營影響不轉化為客戶資金損失。\n\n## 證據邊界\nSlowMist 記錄支持基礎設施入侵、緩解和零客戶損失結論；未公開的內部日誌和攻擊者身份不作補全。\n\n## 處置狀態\n事件已得到緩解，服務短暫停機後恢復；客戶資金安全結論以項目後續公告為準。", "en": "## Incident overview\nZEUS Bitcoin Lightning wallet and LSP infrastructure was compromised. The public record describes an infrastructure compromise rather than a customer-fund theft.\n\n## Incident sequence\n1. ZEUS detected unauthorized access to infrastructure.\n2. The team isolated and mitigated the issue, with services temporarily offline.\n3. The public notice confirmed that customer funds were not lost or at risk.\n4. SlowMist recorded the event in its Hacked Zone.\n\n## Fund flow\nNo customer-fund outflow from Lightning wallets was confirmed; the public material did not provide an attacker address or transaction hash.\n\n## Amount basis\nSlowMist records a loss of $0. Infrastructure downtime and operational impact are not converted into customer-fund loss.\n\n## Evidence boundary\nThe SlowMist record supports the compromise, mitigation, and zero-customer-loss conclusion; undisclosed internal logs and attacker identity are not completed by inference.\n\n## Current status\nThe incident was mitigated and services were temporarily offline before recovery; the customer-fund safety conclusion remains tied to the project’s follow-up notice." }, "category": "hack", "severity": "medium", "ecosystems": [ "Bitcoin" ], "chains": [ "Bitcoin" ], "lossUsd": 0, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "客户资金损失为 0 USD；基础设施入侵和短暂停机已缓解。", "tw": "客戶資金損失為 0 USD；基礎設施入侵和短暫停機已緩解。", "en": "Customer-fund loss was $0; the infrastructure compromise and temporary outage were mitigated." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "SlowMist Hacked Zone ZEUS 记录", "tw": "SlowMist Hacked Zone ZEUS 記錄", "en": "SlowMist Hacked Zone ZEUS record" }, "url": "https://hacked.slowmist.io/", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-215", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-212", "status": "verified", "incidentDate": "2026-08-04", "datePrecision": "day", "title": { "zh": "Keyv / Cacheable npm 供应链攻击", "tw": "Keyv / Cacheable npm 供應鏈攻擊", "en": "Keyv / Cacheable npm supply-chain compromise" }, "summary": { "zh": "Keyv / Cacheable 相关 npm 发布链被劫持，恶意版本可能窃取 CI/CD 和开发环境凭据并继续传播。多家安全团队交叉确认影响，但截至报告截止时间没有统一的直接链上损失金额。", "tw": "Keyv / Cacheable 相關 npm 發佈鏈被劫持，惡意版本可能竊取 CI/CD 和開發環境憑據並繼續傳播。多家安全團隊交叉確認影響，但截至報告截止時間沒有統一的直接鏈上損失金額。", "en": "The Keyv / Cacheable npm release chain was hijacked, allowing malicious versions to target CI/CD and developer credentials. Multiple security teams corroborated the compromise, but no unified direct on-chain loss amount was confirmed by the report cutoff." }, "details": { "zh": "## 事件背景\n攻击者控制或滥用 npm 包发布凭据，将恶意代码发布到 Keyv / Cacheable 相关版本。受影响范围涵盖下游依赖、构建环境和开发者凭据。\n\n## 事件经过\n1. 恶意版本进入 npm 公开发布链。\n2. 下游依赖在安装或构建时执行恶意逻辑。\n3. 攻击者尝试收集凭据并继续污染依赖或 CI 环境。\n4. Wiz、Microsoft、SlowMist 等团队发布 IOC、受影响版本和清理建议。\n\n## 资金流向\n这是链下供应链威胁；截至报告截止时间没有可归因的统一链上盗币地址或损失账本。受影响项目应轮换 npm、GitHub、云和钱包凭据。\n\n## 金额口径\nSlowMist 的受影响版本数量与其他研究的包数量统计口径不同。版本数量、下载量和真实资金损失不能直接相加，损失金额保持空白。\n\n## 证据边界\n多家安全团队确认恶意发布和传播风险；具体受感染项目、凭据泄露范围和链上后果需要各受影响方逐项核验。\n\n## 处置状态\n恶意版本已被识别并陆续撤下；下游项目仍需升级依赖、轮换凭据、清理缓存并审计构建日志。", "tw": "## 事件背景\n攻擊者控制或濫用 npm 包發佈憑據，將惡意代碼發佈到 Keyv / Cacheable 相關版本。受影響範圍涵蓋下游依賴、構建環境和開發者憑據。\n\n## 事件經過\n1. 惡意版本進入 npm 公開發布鏈。\n2. 下游依賴在安裝或構建時執行惡意邏輯。\n3. 攻擊者嘗試收集憑據並繼續汙染依賴或 CI 環境。\n4. Wiz、Microsoft、SlowMist 等團隊發佈 IOC、受影響版本和清理建議。\n\n## 資金流向\n這是鏈下供應鏈威脅；截至報告截止時間沒有可歸因的統一鏈上盜幣地址或損失賬本。受影響項目應輪換 npm、GitHub、雲和錢包憑據。\n\n## 金額口徑\nSlowMist 的受影響版本數量與其他研究的包數量統計口徑不同。版本數量、下載量和真實資金損失不能直接相加，損失金額保持空白。\n\n## 證據邊界\n多家安全團隊確認惡意發佈和傳播風險；具體受感染項目、憑據洩露範圍和鏈上後果需要各受影響方逐項核驗。\n\n## 處置狀態\n惡意版本已被識別並陸續撤下；下游項目仍需升級依賴、輪換憑據、清理緩存並審計構建日誌。", "en": "## Incident overview\nAn attacker controlled or abused npm publishing credentials and released malicious Keyv / Cacheable versions. The downstream exposure includes dependencies, build environments, and developer credentials.\n\n## Incident sequence\n1. Malicious versions entered the public npm release chain.\n2. Downstream dependencies executed the malicious logic during installation or build steps.\n3. The attacker attempted to collect credentials and continue contaminating dependencies or CI environments.\n4. Wiz, Microsoft, SlowMist, and other teams published indicators, affected versions, and cleanup guidance.\n\n## Fund flow\nThis is a software supply-chain threat. No unified attributable on-chain theft address or loss ledger was confirmed by the report cutoff. Affected projects should rotate npm, GitHub, cloud, and wallet credentials.\n\n## Amount basis\nSlowMist’s affected-version count and other researchers’ package-count metrics use different scopes. Version counts, download counts, and realized financial loss cannot be added, so the loss amount remains blank.\n\n## Evidence boundary\nMultiple security teams corroborated the malicious releases and propagation risk. The affected projects, credential exposure, and any on-chain consequence require case-by-case verification.\n\n## Current status\nThe malicious versions were identified and progressively removed; downstream projects still need to upgrade dependencies, rotate credentials, clear caches, and audit build logs." }, "category": "supply-chain", "severity": "high", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "未确认直接链上损失；受影响版本和下载量不等于已实现资金损失。", "tw": "未確認直接鏈上損失；受影響版本和下載量不等於已實現資金損失。", "en": "No direct on-chain loss was confirmed; affected-version and download metrics are not realized financial loss." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "SlowMist Web3 供应链告警", "tw": "SlowMist Web3 供應鏈告警", "en": "SlowMist Web3 supply-chain alert" }, "url": "https://x.com/SlowMist_Team/status/2084846329205764111", "type": "research" }, { "label": { "zh": "Wiz Keyv / Cacheable 分析", "tw": "Wiz Keyv / Cacheable 分析", "en": "Wiz Keyv / Cacheable analysis" }, "url": "https://www.wiz.io/blog/keyv-and-cacheable-npm-package-hijacked", "type": "research" }, { "label": { "zh": "Microsoft ChainDrop 分析", "tw": "Microsoft ChainDrop 分析", "en": "Microsoft ChainDrop analysis" }, "url": "https://www.microsoft.com/en-us/security/blog/", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-212", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-211", "status": "verified", "incidentDate": "2026-08-03", "datePrecision": "day", "title": { "zh": "RISEx RWA 策略未授权提款 673,011.56 USDC", "tw": "RISEx RWA 策略未授權提款 673,011.56 USDC", "en": "RISEx RWA strategy unauthorized withdrawal of 673,011.56 USDC" }, "summary": { "zh": "RISEx 相关 RWA 策略出现未授权提款，公开金额为 673,011.56 USDC。SlowMist 将事件日期记录为 8 月 3 日；项目方称随后修复并对 XLP 存款人全额赔偿，赔偿不等同于攻击者资金追回。", "tw": "RISEx 相關 RWA 策略出現未授權提款，公開金額為 673,011.56 USDC。SlowMist 將事件日期記錄為 8 月 3 日；項目方稱隨後修復並對 XLP 存款人全額賠償，賠償不等同於攻擊者資金追回。", "en": "An RISEx-linked RWA strategy suffered an unauthorized withdrawal of 673,011.56 USDC. SlowMist records the incident date as August 3; the project said it patched the issue and fully compensated XLP depositors, which is not the same as recovering attacker funds." }, "details": { "zh": "## 事件背景\nRISEx 相关 RWA 策略合约存在访问控制问题，允许未授权提款。公开材料未给出完整函数名、攻击者地址或跨链出口。\n\n## 事件经过\n1. 8 月 3 日 07:21 UTC 发生 673,011.56 USDC 未授权提款。\n2. 团队识别并修复访问控制问题。\n3. 后续重复尝试均回滚，未见 07:21 UTC 后成功提款。\n4. RISEx 使用费用收入全额覆盖 XLP 存款人损失。\n\n## 资金流向\nRWA 策略 → 未授权接收方。完整接收地址和交易哈希没有在本轮可核验公开材料中展开；项目费用赔偿不等同于攻击者资金追回。\n\n## 金额口径\nSlowMist 记录金额为 673,011.56 USDC，项目方确认全额赔偿 XLP 存款人。本站把 673,011.56 USD 作为攻击名义损失，追回字段保持为 0，以免把项目赔偿误写成链上追回。\n\n## 证据边界\n项目公开说明和 SlowMist 记录支持金额、日期、修复和赔偿事实。完整攻击路径、攻击者身份和链上归集地址仍未公开核验。\n\n## 处置状态\n漏洞已修复，项目方已宣布全额赔偿；未见冻结或攻击者资金追回公告。", "tw": "## 事件背景\nRISEx 相關 RWA 策略合約存在訪問控制問題，允許未授權提款。公開材料未給出完整函數名、攻擊者地址或跨鏈出口。\n\n## 事件經過\n1. 8 月 3 日 07:21 UTC 發生 673,011.56 USDC 未授權提款。\n2. 團隊識別並修復訪問控制問題。\n3. 後續重複嘗試均回滾，未見 07:21 UTC 後成功提款。\n4. RISEx 使用費用收入全額覆蓋 XLP 存款人損失。\n\n## 資金流向\nRWA 策略 → 未授權接收方。完整接收地址和交易哈希沒有在本輪可核驗公開材料中展開；項目費用賠償不等同於攻擊者資金追回。\n\n## 金額口徑\nSlowMist 記錄金額為 673,011.56 USDC，項目方確認全額賠償 XLP 存款人。本站把 673,011.56 USD 作為攻擊名義損失，追回字段保持為 0，以免把項目賠償誤寫成鏈上追回。\n\n## 證據邊界\n項目公開說明和 SlowMist 記錄支持金額、日期、修復和賠償事實。完整攻擊路徑、攻擊者身份和鏈上歸集地址仍未公開核驗。\n\n## 處置狀態\n漏洞已修復，項目方已宣佈全額賠償；未見凍結或攻擊者資金追回公告。", "en": "## Incident overview\nAn RISEx-linked RWA strategy had an access-control issue that allowed an unauthorized withdrawal. The public material did not disclose a complete function name, attacker address, or cross-chain exit.\n\n## Incident sequence\n1. An unauthorized withdrawal of 673,011.56 USDC occurred at 07:21 UTC on August 3.\n2. The team identified and patched the access-control issue.\n3. Later repeated attempts reverted, with no successful withdrawal observed after 07:21 UTC.\n4. RISEx used fee revenue to fully cover XLP depositor losses.\n\n## Fund flow\nRWA strategy → unauthorized recipient. The complete recipient address and transaction hash were not expanded in the verifiable material used here; project compensation is not the same as attacker-fund recovery.\n\n## Amount basis\nSlowMist records 673,011.56 USDC, and the project confirmed full compensation for XLP depositors. This record uses $673,011.56 as the nominal attack loss and keeps the recovery amount at zero so project compensation is not mislabeled as on-chain recovery.\n\n## Evidence boundary\nThe project statement and SlowMist record support the amount, date, patch, and compensation. The complete attack route, attacker identity, and aggregation addresses remain undisclosed.\n\n## Current status\nThe issue was patched and the project announced full compensation; no freeze or attacker-fund recovery announcement was found." }, "category": "access-control", "severity": "high", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": 673011.56, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "未授权提款 673,011.56 USDC；项目方已用费用收入全额赔偿，赔偿不计作链上追回。", "tw": "未授權提款 673,011.56 USDC；項目方已用費用收入全額賠償，賠償不計作鏈上追回。", "en": "An unauthorized withdrawal of 673,011.56 USDC; the project used fee revenue for full compensation, which is not counted as on-chain recovery." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "SlowMist Hacked Zone RISEx 记录", "tw": "SlowMist Hacked Zone RISEx 記錄", "en": "SlowMist Hacked Zone RISEx record" }, "url": "https://hacked.slowmist.io/", "type": "research" }, { "label": { "zh": "RISEx 官方说明引用", "tw": "RISEx 官方說明引用", "en": "RISEx official statement as cited publicly" }, "url": "https://x.com/miketwinks/status/2084651536135631270", "type": "research" }, { "label": { "zh": "DeFiLlama Hacks 记录", "tw": "DeFiLlama Hacks 記錄", "en": "DeFiLlama Hacks record" }, "url": "https://api.llama.fi/hacks", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-211", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-204", "status": "verified", "incidentDate": "2026-08-03", "datePrecision": "day", "title": { "zh": "KRON PEPE 池索引和记账遭干扰，官方确认无资金损失", "tw": "KRON PEPE 池索引和記賬遭干擾，官方確認無資金損失", "en": "KRON PEPE pool indexing and accounting were disrupted with no confirmed fund loss" }, "summary": { "zh": "KRON 官方称内部 Token 被重新导入后造成 PEPE 池索引和记账失配，交易约两小时不可用，LP 存取暂停更久；团队恢复备份并封堵路径，明确表示没有资金被盗、抽干或移动。", "tw": "KRON 官方稱內部 Token 被重新導入後造成 PEPE 池索引和記賬失配，交易約兩小時不可用，LP 存取暫停更久；團隊恢復備份並封堵路徑，明確表示沒有資金被盜、抽乾或移動。", "en": "KRON said that re-importing an internal token caused an indexing and accounting mismatch around the PEPE pool. Trading was unavailable for about two hours and LP access was paused longer; the team restored from backup, blocked the path, and said no funds were stolen, drained, or moved." }, "details": { "zh": "## 事件背景\nKRON 允许导入外部 Kaspa 代币。行为者重新导入 KRON 用于 PEPE 和 ANSEM 池记账的内部 Token，导致索引器无法正确定位 PEPE 池。\n\n## 事件经过\n1. 行为者针对内部池基础设施执行重新导入操作。\n2. PEPE 交换约两小时不可用，LP 存取暂停更久。\n3. 团队逆转导入，从备份恢复并逐字节核验链上状态。\n4. 团队阻止内部 Token 再次导入或围绕其建池，并加入实时监控。\n\n## 资金流向\n官方核验显示持有人余额未被触碰，没有可确认的资金流出或资产移动。\n\n## 金额口径\n官方明确表示没有资金被盗或抽干，因此公开损失记为 0 美元。服务中断时间不换算成资金损失。\n\n## 证据边界\nKRON 官方说明足以确认服务中断、记账机制和修复措施；没有公开完整地址或交易标识，也不能由“识别资金来源”推断攻击者身份。\n\n## 处置状态\nPEPE 池记账、交换和 LP 存取已恢复，内部 Token 导入路径已封堵，监控已加入。", "tw": "## 事件背景\nKRON 允許導入外部 Kaspa 代幣。行為者重新導入 KRON 用於 PEPE 和 ANSEM 池記賬的內部 Token，導致索引器無法正確定位 PEPE 池。\n\n## 事件經過\n1. 行為者針對內部池基礎設施執行重新導入操作。\n2. PEPE 交換約兩小時不可用，LP 存取暫停更久。\n3. 團隊逆轉導入，從備份恢復並逐字節核驗鏈上狀態。\n4. 團隊阻止內部 Token 再次導入或圍繞其建池，並加入實時監控。\n\n## 資金流向\n官方核驗顯示持有人餘額未被觸碰，沒有可確認的資金流出或資產移動。\n\n## 金額口徑\n官方明確表示沒有資金被盜或抽乾，因此公開損失記為 0 美元。服務中斷時間不換算成資金損失。\n\n## 證據邊界\nKRON 官方說明足以確認服務中斷、記賬機制和修復措施；沒有公開完整地址或交易標識，也不能由“識別資金來源”推斷攻擊者身份。\n\n## 處置狀態\nPEPE 池記賬、交換和 LP 存取已恢復，內部 Token 導入路徑已封堵，監控已加入。", "en": "## Incident overview\nKRON allows external Kaspa tokens to be imported. An actor re-imported an internal token used for accounting around the KRON PEPE and ANSEM pools, preventing the indexer from locating the PEPE pool correctly.\n\n## Incident sequence\n1. The actor targeted the internal pool infrastructure with a re-import operation.\n2. PEPE swaps were unavailable for about two hours and LP access was paused for longer.\n3. The team reversed the import, restored from backup, and checked the on-chain state byte by byte.\n4. The team blocked further imports or pool creation around the internal token and added live monitoring.\n\n## Fund flow\nThe official review said that holder balances were not touched and no fund outflow or asset movement was confirmed.\n\n## Amount basis\nThe official statement says that no funds were stolen or drained, so the public loss is recorded as $0. Service downtime is not converted into a financial loss.\n\n## Evidence boundary\nKRON’s official statement supports the outage, accounting mechanism, and remediation. No complete address or transaction identifier was published, and identifying a possible source of funds does not establish an attacker identity.\n\n## Current status\nPEPE accounting, swaps, and LP access were restored. The internal-token import path was blocked and monitoring was added." }, "category": "protocol-exploit", "severity": "low", "ecosystems": [ "Kaspa" ], "chains": [ "Kaspa" ], "lossUsd": 0, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "官方确认没有资金被盗、抽干或移动，公开损失为 0 美元。", "tw": "官方確認沒有資金被盜、抽乾或移動，公開損失為 0 美元。", "en": "The official statement confirmed that no funds were stolen, drained, or moved; public loss is $0." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "KRON 透明度报告", "tw": "KRON 透明度報告", "en": "KRON transparency report" }, "url": "https://x.com/KronTechnology/status/2084108487240339745", "type": "official" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-204", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-203", "status": "verified", "incidentDate": "2026-08-03", "datePrecision": "day", "title": { "zh": "MOKE：BSC 复杂交易触发约 90.77 万美元可疑攻击告警", "tw": "MOKE：BSC 複雜交易觸發約 90.77 萬美元可疑攻擊告警", "en": "MOKE: a complex BSC transaction triggered an estimated $907,700 attack alert" }, "summary": { "zh": "TenArmor 监测到一笔包含多资产和多协议调用的成功交易，估算涉资约 90.77 万美元。交易和代币可在 BNB Smart Chain 核验，但根因、受害合约边界和最终净损失仍待独立分析。", "tw": "TenArmor 監測到一筆包含多資產和多協議呼叫的成功交易，估算涉資約 90.77 萬美元。交易和代幣可在 BNB Smart Chain 核驗，但根因、受害合約邊界和最終淨損失仍待獨立分析。", "en": "TenArmor flagged a successful transaction with multiple assets and protocol calls and estimated approximately $907,700 at risk. The transaction and tokens are verifiable on BNB Smart Chain, but the root cause, affected-contract boundary, and final net loss require independent analysis." }, "details": { "zh": "## 事件背景\nMOKE 相关交易包含 MOKE、MOKE-AC、WBNB、BTCB、USDT 以及多个协议合约的大量调用和日志。公开告警没有给出完整函数级根因。\n\n## 事件经过\n1. 执行主体发起一笔复杂批处理交易。\n2. 交易调用多个池、代币和协议相关合约，产生铸造、转移、销毁和兑换日志。\n3. 交易成功上链，TenArmor 将其标为可疑攻击并估算约 90.77 万美元。\n4. 截止时没有项目方复盘或第二家机构的完整定因。\n\n## 资金流向\n公开交易确认多种资产在调用链中流转，但日志不足以把每个中间合约标为受害者或攻击者归集地址。后续净利润资产和资金终点仍待核验。\n\n## 金额口径\n约 90.77 万美元来自 TenArmor 单一监控估算，不是项目官方审计数字。交易内的代币面值和中间调用金额不另行相加。\n\n## 证据边界\nBNB Smart Chain RPC 和区块浏览器支持交易成功、执行主体和代币事实；复杂交易模式不能自动证明闪电贷、预言机操纵或重入等具体漏洞。\n\n## 处置状态\n当前未见冻结、追回或项目方修复确认。事件保留为已执行但根因待核的可疑攻击。", "tw": "## 事件背景\nMOKE 相關交易包含 MOKE、MOKE-AC、WBNB、BTCB、USDT 以及多個協議合約的大量呼叫和日誌。公開告警沒有給出完整函數級根因。\n\n## 事件經過\n1. 執行主體發起一筆複雜批處理交易。\n2. 交易呼叫多個池、代幣和協議相關合約，產生鑄造、轉移、銷燬和兌換日誌。\n3. 交易成功上鍊，TenArmor 將其標為可疑攻擊並估算約 90.77 萬美元。\n4. 截止時沒有專案方復盤或第二家機構的完整定因。\n\n## 資金流向\n公開交易確認多種資產在呼叫鏈中流轉，但日誌不足以把每個中間合約標為受害者或攻擊者歸集地址。後續淨利潤資產和資金終點仍待核驗。\n\n## 金額口徑\n約 90.77 萬美元來自 TenArmor 單一監控估算，不是專案官方審計數字。交易內的代幣面值和中間呼叫金額不另行相加。\n\n## 證據邊界\nBNB Smart Chain RPC 和區塊瀏覽器支持交易成功、執行主體和代幣事實；複雜交易模式不能自動證明閃電貸、預言機操縱或重入等具體漏洞。\n\n## 處置狀態\n當前未見凍結、追回或專案方修復確認。事件保留為已執行但根因待核的可疑攻擊。", "en": "## Incident overview\nThe MOKE transaction contains MOKE, MOKE-AC, WBNB, BTCB, USDT, and extensive calls and logs across several protocol contracts. The public alert did not provide a complete function-level root cause.\n\n## Incident sequence\n1. The executor initiated a complex batch transaction.\n2. The transaction called multiple pools, tokens, and protocol contracts, producing mint, transfer, burn, and swap logs.\n3. The transaction succeeded on-chain, and TenArmor labeled it a suspicious attack with an estimate of approximately $907,700.\n4. No project postmortem or complete independent attribution was found by the cutoff.\n\n## Fund flow\nThe public transaction confirms several assets moving through the call path, but the logs do not justify labeling every intermediate contract as a victim or attacker aggregation address. The final profit asset and destination remain under review.\n\n## Amount basis\nThe approximately $907,700 figure is a single-monitor estimate from TenArmor, not a project audit. Token face values and intermediate call amounts are not added separately.\n\n## Evidence boundary\nBNB Smart Chain RPC data and the block explorer support the successful transaction, executor, and token facts. A complex transaction pattern does not by itself prove a flash-loan, oracle-manipulation, or reentrancy vulnerability.\n\n## Current status\nNo freeze, recovery, or project remediation was confirmed. The event is retained as an executed suspicious attack with the root cause pending." }, "category": "protocol-exploit", "severity": "medium", "ecosystems": [ "BNB Chain" ], "chains": [ "BNB Chain" ], "lossUsd": 907700, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "TenArmor 估算涉资约 90.77 万美元；最终净损失仍待核验。", "tw": "TenArmor 估算涉資約 90.77 萬美元；最終淨損失仍待核驗。", "en": "TenArmor estimated approximately $907,700 at risk; the final net loss remains under review." }, "addressDisclosure": "published", "addresses": [ { "chain": "BNB Chain", "address": "0x0776048b1b58064fb31b6513721811e7b44d6bdbe7bf5833158b241ca6756a8f", "entity": { "zh": "MOKE 可疑攻击交易", "tw": "MOKE 可疑攻擊交易", "en": "MOKE suspicious attack transaction" }, "role": "attack-transaction", "category": "hack", "confidence": 0.9, "sourceUrl": "https://bscscan.com/tx/0x0776048b1b58064fb31b6513721811e7b44d6bdbe7bf5833158b241ca6756a8f", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "BscScan 显示交易成功；攻击标签来自 TenArmor，根因仍待核。", "tw": "BscScan 顯示交易成功；攻擊標籤來自 TenArmor，根因仍待核。", "en": "BscScan shows the transaction succeeded; the attack label comes from TenArmor and the root cause remains pending." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xe454a9bac1a44868e4a9cbe1a4b5ac231d0dcf8a", "entity": { "zh": "MOKE 交易执行主体", "tw": "MOKE 交易執行主體", "en": "MOKE transaction executor" }, "role": "execution-address", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://bscscan.com/address/0xe454a9bac1a44868e4a9cbe1a4b5ac231d0dcf8a", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址是交易 from 和 to；公开来源没有完成现实身份归因。", "tw": "該地址是交易 from 和 to；公開來源沒有完成現實身份歸因。", "en": "This address is the transaction from and to; public sources do not establish a real-world identity." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x1a35c16ce21903bc17fd020c4ed73fedc70c1b2a", "entity": { "zh": "MOKE 代币合约", "tw": "MOKE 代幣合約", "en": "MOKE token contract" }, "role": "token-contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://bscscan.com/token/0x1a35c16ce21903bc17fd020c4ed73fedc70c1b2a", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "交易日志中的 MOKE 资产合约，不是攻击者地址。", "tw": "交易日誌中的 MOKE 資產合約，不是攻擊者地址。", "en": "MOKE asset contract appearing in the transaction logs, not an attacker address." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x729bdaf6daa7464ab7432d4b2bc1d6f306c92282", "entity": { "zh": "MOKE-AC 项目相关代币合约", "tw": "MOKE-AC 專案相關代幣合約", "en": "MOKE-AC project-related token contract" }, "role": "related-token-contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://bscscan.com/token/0x729bdaf6daa7464ab7432d4b2bc1d6f306c92282", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "公开交易中的项目相关资产合约，不作为攻击者标签。", "tw": "公開交易中的專案相關資產合約，不作為攻擊者標籤。", "en": "Project-related asset contract in the public transaction, not labeled as an attacker." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "TenArmor 原始告警", "tw": "TenArmor 原始告警", "en": "TenArmor original alert" }, "url": "https://x.com/TenArmorAlert/status/2084102947500368164", "type": "research" }, { "label": { "zh": "BscScan 可疑攻击交易", "tw": "BscScan 可疑攻擊交易", "en": "BscScan suspicious attack transaction" }, "url": "https://bscscan.com/tx/0x0776048b1b58064fb31b6513721811e7b44d6bdbe7bf5833158b241ca6756a8f", "type": "explorer" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-203", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-210", "status": "verified", "incidentDate": "2026-08-02", "datePrecision": "day", "title": { "zh": "LOOPSDAO / LpdFi 现货预言机操纵", "tw": "LOOPSDAO / LpdFi 現貨預言機操縱", "en": "LOOPSDAO / LpdFi spot-oracle manipulation on BNB Chain" }, "summary": { "zh": "ExVul、Backward Labs 和链上研究记录了 LpdFi 在 BNB Chain 上的预言机操纵攻击。攻击者通过闪电贷和现货价格操纵移除 LP 并转出资产，公开估算损失约 696,952.81 USD。", "tw": "ExVul、Backward Labs 和鏈上研究記錄了 LpdFi 在 BNB Chain 上的預言機操縱攻擊。攻擊者通過閃電貸和現貨價格操縱移除 LP 並轉出資產，公開估算損失約 696,952.81 USD。", "en": "ExVul, Backward Labs, and on-chain researchers documented a LpdFi oracle-manipulation attack on BNB Chain. The attacker used flash-loan and spot-price manipulation to remove LP assets; public estimates put the loss at approximately $696,952.81." }, "details": { "zh": "## 事件背景\nLpdFi 的价格函数直接读取 PancakeSwap 的 LPD / USDC 现货储备，缺少 TWAP 或抗操纵保护。攻击者利用闪电贷、捐赠和同步操作改变储备比例，再通过利息领取逻辑移除 LP。\n\n## 事件经过\n1. 攻击者获得初始 BNB 和 Gas，并部署或控制执行地址。\n2. 攻击者借入 USDC，操纵 LPD / USDC 储备。\n3. 协议按被扭曲的现货价格计算膨胀利息。\n4. 攻击者调用领取逻辑，协议移除约 168 个 LP 并转出大部分 USDC。\n5. 资产经 Relay 换成 BNB，后续部分进入 Tornado Cash。\n\n## 资金流向\nBNB Chain 协议 LP → 攻击者地址 → 二级归集地址 → Relay / BNB → Tornado Cash。ChangeNOW 相关地址只作为路线线索，不能直接标为交易所归属。\n\n## 金额口径\n公开来源给出约 690,000 USD、696,000 USD 和 696,952.81 USD 等估值。本站采用 Backward Labs 的精确估算 696,952.81 USD，其他数字不重复相加。\n\n## 证据边界\n公开材料包含完整攻击交易、执行地址和合约调用记录。ChangeNOW 归因来自单一链上分析，Tornado Cash 后续存款的完整交易列表尚未在本轮材料中展开。\n\n## 处置状态\n截至报告截止时间，未见 LOOPSDAO 官方补偿、冻结或追回公告。事件保留为已执行攻击，后续金额和归集路径仍可更新。", "tw": "## 事件背景\nLpdFi 的價格函數直接讀取 PancakeSwap 的 LPD / USDC 現貨儲備，缺少 TWAP 或抗操縱保護。攻擊者利用閃電貸、捐贈和同步操作改變儲備比例，再通過利息領取邏輯移除 LP。\n\n## 事件經過\n1. 攻擊者獲得初始 BNB 和 Gas，並部署或控制執行地址。\n2. 攻擊者借入 USDC，操縱 LPD / USDC 儲備。\n3. 協議按被扭曲的現貨價格計算膨脹利息。\n4. 攻擊者調用領取邏輯，協議移除約 168 個 LP 並轉出大部分 USDC。\n5. 資產經 Relay 換成 BNB，後續部分進入 Tornado Cash。\n\n## 資金流向\nBNB Chain 協議 LP → 攻擊者地址 → 二級歸集地址 → Relay / BNB → Tornado Cash。ChangeNOW 相關地址只作為路線線索，不能直接標為交易所歸屬。\n\n## 金額口徑\n公開來源給出約 690,000 USD、696,000 USD 和 696,952.81 USD 等估值。本站採用 Backward Labs 的精確估算 696,952.81 USD，其他數字不重複相加。\n\n## 證據邊界\n公開材料包含完整攻擊交易、執行地址和合約調用記錄。ChangeNOW 歸因來自單一鏈上分析，Tornado Cash 後續存款的完整交易列表尚未在本輪材料中展開。\n\n## 處置狀態\n截至報告截止時間，未見 LOOPSDAO 官方補償、凍結或追回公告。事件保留為已執行攻擊，後續金額和歸集路徑仍可更新。", "en": "## Incident overview\nLpdFi read a PancakeSwap LPD / USDC spot reserve directly in its price function without TWAP or anti-manipulation protection. The attacker used flash loans, donations, and reserve synchronization before invoking the LP withdrawal logic.\n\n## Incident sequence\n1. The attacker obtained initial BNB and gas and deployed or controlled the executor.\n2. The attacker borrowed USDC and distorted the LPD / USDC reserve.\n3. The protocol calculated inflated interest from the distorted spot price.\n4. The attacker invoked the claim path, removed about 168 LP positions, and withdrew most of the USDC.\n5. The funds were converted to BNB through Relay, with part later sent to Tornado Cash.\n\n## Fund flow\nBNB Chain protocol LP → attacker address → secondary aggregation address → Relay / BNB → Tornado Cash. ChangeNOW-linked addresses are retained as route leads and are not treated as exchange attribution.\n\n## Amount basis\nPublic sources cite estimates around $690,000, $696,000, and $696,952.81. This record uses Backward Labs’ precise estimate of $696,952.81 and does not add the other figures.\n\n## Evidence boundary\nThe public material contains the main attack transaction, executor address, and contract-call evidence. The ChangeNOW attribution comes from a single on-chain analysis, and the complete Tornado Cash deposit list was not expanded in this report.\n\n## Current status\nNo LOOPSDAO compensation, freeze, or recovery announcement was found by the report cutoff. The event is retained as an executed attack subject to later route and amount updates." }, "category": "oracle-manipulation", "severity": "high", "ecosystems": [ "BNB Chain", "Ethereum" ], "chains": [ "BNB Chain", "Ethereum" ], "lossUsd": 696952.81, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开估算损失约 696,952.81 USD，主要涉及 LPD / USDC 流动性资产；未见冻结或追回。", "tw": "公開估算損失約 696,952.81 USD，主要涉及 LPD / USDC 流動性資產；未見凍結或追回。", "en": "Public estimates put the loss at approximately $696,952.81, mainly involving LPD / USDC liquidity assets; no freeze or recovery was reported." }, "addressDisclosure": "published", "addresses": [ { "chain": "BNB Chain", "address": "0x70bbe0aa3c7ef149ecb6128a06025885deaa8fef3f393a505d447d28ab3315d6", "entity": { "zh": "LOOPSDAO 攻击交易", "tw": "LOOPSDAO 攻擊交易", "en": "LOOPSDAO attack transaction" }, "role": "attack-transaction", "category": "unknown", "confidence": 0.96, "sourceUrl": "https://bscscan.com/tx/0x70bbe0aa3c7ef149ecb6128a06025885deaa8fef3f393a505d447d28ab3315d6", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "公开链上记录显示该交易执行了 LpdFi 相关攻击调用；交易角色不等同于实体身份认定。", "tw": "公開鏈上記錄顯示該交易執行了 LpdFi 相關攻擊調用；交易角色不等同於實體身份認定。", "en": "The public chain record shows the LpdFi-related attack calls; the transaction role does not establish a legal identity." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x5d289266d85ef671561ba3f253fb79327c193f33", "entity": { "zh": "LOOPSDAO 攻击者资金接收地址", "tw": "LOOPSDAO 攻擊者資金接收地址", "en": "LOOPSDAO attacker receiving address" }, "role": "attacker-receiving", "category": "stolen_funds", "confidence": 0.9, "sourceUrl": "https://bscscan.com/address/0x5d289266d85ef671561ba3f253fb79327c193f33", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Backward Labs 将该地址与攻击后的资产接收路径关联；归属是链上证据归因。", "tw": "Backward Labs 將該地址與攻擊後的資產接收路徑關聯；歸屬是鏈上證據歸因。", "en": "Backward Labs linked this address to the post-exploit asset-receiving path; attribution is based on public on-chain evidence." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xce6a6e4413d85a136bbac8aae6fb46eaa77f295e", "entity": { "zh": "LpdFi 受影响合约", "tw": "LpdFi 受影響合約", "en": "Affected LpdFi contract" }, "role": "affected-contract", "category": "dex", "confidence": 0.88, "sourceUrl": "https://bscscan.com/address/0xce6a6e4413d85a136bbac8aae6fb46eaa77f295e", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "公开攻击记录将该地址列为受影响流动性池或合约路径；不是攻击者身份标签。", "tw": "公開攻擊記錄將該地址列為受影響流動性池或合約路徑；不是攻擊者身份標籤。", "en": "Public attack records place this address in the affected liquidity-pool or contract path; it is not an attacker-identity label." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xa16f5ba49954c5ed6273cf8578586be4344f8968", "entity": { "zh": "LOOPSDAO 二级归集地址", "tw": "LOOPSDAO 二級歸集地址", "en": "LOOPSDAO secondary aggregation address" }, "role": "secondary-aggregation", "category": "stolen_funds", "confidence": 0.82, "sourceUrl": "https://bscscan.com/address/0xa16f5ba49954c5ed6273cf8578586be4344f8968", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Noxos 将该地址与攻击资产的后续归集路线关联；不代表已确认控制人。", "tw": "Noxos 將該地址與攻擊資產的後續歸集路線關聯；不代表已確認控制人。", "en": "Noxos linked this address to a later aggregation route for the attack proceeds; controller identity is not confirmed." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x6cb7f6c785eb3793d6084dc05a81e5fde9ca293f", "entity": { "zh": "LOOPSDAO 关联资金路线地址", "tw": "LOOPSDAO 關聯資金路線地址", "en": "LOOPSDAO-related fund-route address" }, "role": "related-fund-route", "category": "service", "confidence": 0.68, "sourceUrl": "https://etherscan.io/address/0x6cb7f6c785eb3793d6084dc05a81e5fde9ca293f", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "公开分析将该地址与 ChangeNOW 路线关联；仅作为线索保留。", "tw": "公開分析將該地址與 ChangeNOW 路線關聯；僅作為線索保留。", "en": "Public analysis linked this address to a ChangeNOW route; it is retained as a lead only." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xeba88149813bec1cccccfdb0dacefaaa5de94cb1", "entity": { "zh": "LOOPSDAO 兑换服务路线地址", "tw": "LOOPSDAO 兌換服務路線地址", "en": "LOOPSDAO exchange-service route address" }, "role": "related-service-route", "category": "service", "confidence": 0.62, "sourceUrl": "https://etherscan.io/address/0xeba88149813bec1cccccfdb0dacefaaa5de94cb1", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "公开分析将该地址列为兑换服务接收线索，尚无服务方官方归属确认。", "tw": "公開分析將該地址列為兌換服務接收線索，尚無服務方官方歸屬確認。", "en": "Public analysis listed this address as an exchange-service receiving lead; no official service attribution was found." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "ExVul 首报与攻击交易", "tw": "ExVul 首報與攻擊交易", "en": "ExVul initial report and attack transaction" }, "url": "https://x.com/exvulsec/status/2083953058355269865", "type": "research" }, { "label": { "zh": "Backward Labs 损失与组件说明", "tw": "Backward Labs 損失與組件說明", "en": "Backward Labs loss and component analysis" }, "url": "https://x.com/backwardlabs/status/2083956531205460376", "type": "research" }, { "label": { "zh": "Noxos 资金路线", "tw": "Noxos 資金路線", "en": "Noxos fund-route analysis" }, "url": "https://x.com/NoxosIntel/status/2085111967237148728", "type": "research" }, { "label": { "zh": "DeFiLlama Hacks 记录", "tw": "DeFiLlama Hacks 記錄", "en": "DeFiLlama Hacks record" }, "url": "https://api.llama.fi/hacks", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-210", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-205", "status": "verified", "incidentDate": "2026-08-02", "datePrecision": "day", "title": { "zh": "22 个 OKX Web3 扩展钱包被盗，疑似终端权限失陷", "tw": "22 個 OKX Web3 擴展錢包被盜，疑似終端權限失陷", "en": "Twenty-two OKX Web3 extension wallets were reportedly drained after a suspected endpoint compromise" }, "summary": { "zh": "一名用户称在下载多个来源不明 VPN 后，22 个 OKX Web3 扩展钱包资产被转出，约 1,000 USDT 报失并抢救约 300 USDT。公开证据支持个人钱包失陷线索，但尚无恶意样本、完整交易链或独立取证结论。", "tw": "一名用戶稱在下載多個來源不明 VPN 後，22 個 OKX Web3 擴展錢包資產被轉出，約 1,000 USDT 報失並搶救約 300 USDT。公開證據支持個人錢包失陷線索，但尚無惡意樣本、完整交易鏈或獨立取證結論。", "en": "A user reported that assets from 22 OKX Web3 extension wallets were moved after downloading several untrusted VPN tools, with about 1,000 USDT reported lost and about 300 USDT moved to safety. Public evidence supports a personal-wallet compromise lead, but no malware sample, complete transaction path, or independent forensic conclusion was available." }, "details": { "zh": "## 事件背景\n受害者称在 MacBook 上使用 OKX Web3 扩展钱包，并从 X 的陌生链接下载多个 VPN 工具。随后多个交互钱包资产被转出，恶意 VPN 只是可疑来源判断。\n\n## 事件经过\n1. 用户下载多个来源不明的 VPN 工具。\n2. 随后发现 22 个钱包的资产被转出。\n3. 用户称未手动发起转账，并澄清本人钱包地址与收款地址的区别。\n4. 约 300 USDT 被及时转移，约 1,000 USDT 仍报失。\n\n## 资金流向\n受害者称资金经 OKX DEX 合约从 Base 钱包转至地址 0x8cc99f50707c4b6aabdafdd075da50bac6747b73。完整交易哈希和后续归集未公开。\n\n## 金额口径\n约 1,000 USDT 是单一受害者自报损失，约 300 USDT 是抢救金额，不是安全机构审计数字，也不扩展为 22 个钱包的总损失。\n\n## 证据边界\n第一人称帖和收款地址支持事件线索；没有恶意 VPN 样本哈希、权限日志或完整多链交易，因此不把 VPN 根因写成已证实结论。\n\n## 处置状态\n部分资金被抢救，未见冻结、追回或平台统一处置确认。受害者继续核验终端和钱包权限。", "tw": "## 事件背景\n受害者稱在 MacBook 上使用 OKX Web3 擴展錢包，並從 X 的陌生鏈接下載多個 VPN 工具。隨後多個交互錢包資產被轉出，惡意 VPN 只是可疑來源判斷。\n\n## 事件經過\n1. 用戶下載多個來源不明的 VPN 工具。\n2. 隨後發現 22 個錢包的資產被轉出。\n3. 用戶稱未手動發起轉賬，並澄清本人錢包地址與收款地址的區別。\n4. 約 300 USDT 被及時轉移，約 1,000 USDT 仍報失。\n\n## 資金流向\n受害者稱資金經 OKX DEX 合約從 Base 錢包轉至地址 0x8cc99f50707c4b6aabdafdd075da50bac6747b73。完整交易哈希和後續歸集未公開。\n\n## 金額口徑\n約 1,000 USDT 是單一受害者自報損失，約 300 USDT 是搶救金額，不是安全機構審計數字，也不擴展為 22 個錢包的總損失。\n\n## 證據邊界\n第一人稱帖和收款地址支持事件線索；沒有惡意 VPN 樣本哈希、權限日誌或完整多鏈交易，因此不把 VPN 根因寫成已證實結論。\n\n## 處置狀態\n部分資金被搶救，未見凍結、追回或平臺統一處置確認。受害者繼續核驗終端和錢包權限。", "en": "## Incident overview\nThe victim said they used OKX Web3 extension wallets on a MacBook and downloaded several VPN tools from unfamiliar X links. Assets from multiple interacting wallets were then moved; the malicious-VPN theory remains a suspected source.\n\n## Incident sequence\n1. The user downloaded several VPN tools from untrusted sources.\n2. Assets from 22 wallets were later found to have moved.\n3. The user said the transfers were not initiated manually and clarified the difference between the victim wallet and the receiving address.\n4. About 300 USDT was moved to safety while approximately 1,000 USDT remained reported lost.\n\n## Fund flow\nThe victim said funds moved through an OKX DEX contract from Base wallets to 0x8cc99f50707c4b6aabdafdd075da50bac6747b73. Complete transaction hashes and later aggregation were not published.\n\n## Amount basis\nApproximately 1,000 USDT is a single-victim self-report, and about 300 USDT is the amount moved to safety. Neither figure is a security-firm audit or a total for all 22 wallets.\n\n## Evidence boundary\nThe first-person post and receiving address support the incident lead. No malicious-VPN hash, permission log, or complete multichain transaction path was available, so the VPN theory is not presented as proven.\n\n## Current status\nSome funds were moved to safety. No freeze, recovery, or unified platform response was confirmed, and endpoint and wallet permissions remained under review." }, "category": "wallet-vulnerability", "severity": "medium", "ecosystems": [ "Base", "ZK", "Linea" ], "chains": [ "Base", "ZK", "Linea" ], "lossUsd": 1000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "单一受害者自报约 1,000 USDT 被盗，约 300 USDT 被抢救。", "tw": "單一受害者自報約 1,000 USDT 被盜，約 300 USDT 被搶救。", "en": "A single victim reported approximately 1,000 USDT stolen and about 300 USDT moved to safety." }, "addressDisclosure": "published", "addresses": [ { "chain": "Base", "address": "0x8cc99f50707c4b6aabdafdd075da50bac6747b73", "entity": { "zh": "OKX Web3 钱包事件疑似收款地址", "tw": "OKX Web3 錢包事件疑似收款地址", "en": "Suspected receiving address in the OKX Web3 wallet incident" }, "role": "suspected-recipient", "category": "stolen_funds", "confidence": 0.7, "sourceUrl": "https://basescan.org/address/0x8cc99f50707c4b6aabdafdd075da50bac6747b73", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "受害者将该地址与转出资金关联，尚无独立安全机构标签。", "tw": "受害者將該地址與轉出資金關聯，尚無獨立安全機構標籤。", "en": "The victim linked this address to the moved funds; no independent security-firm label was available." }, "reviewRequired": true }, { "chain": "Base", "address": "0xEbB59Ac411F162d5A1665A6dCcE97D6E4c003b3A", "entity": { "zh": "OKX Web3 钱包受害者本人地址", "tw": "OKX Web3 錢包受害者本人地址", "en": "Victim-controlled wallet in the OKX Web3 incident" }, "role": "victim-wallet", "category": "unknown", "confidence": 0.82, "sourceUrl": "https://x.com/ningchen7591552/status/2083927024473940065", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "受害者公开澄清该地址属于本人，不是黑客地址。", "tw": "受害者公開澄清該地址屬於本人，不是黑客地址。", "en": "The victim publicly clarified that this address belonged to them and was not the attacker address." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "受害者原始 X 帖", "tw": "受害者原始 X 帖", "en": "Victim’s original X post" }, "url": "https://x.com/ningchen7591552/status/2083927024473940065", "type": "research" }, { "label": { "zh": "Base 收款地址浏览器记录", "tw": "Base 收款地址瀏覽器記錄", "en": "Base explorer record for the receiving address" }, "url": "https://basescan.org/address/0x8cc99f50707c4b6aabdafdd075da50bac6747b73", "type": "explorer" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-205", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-199", "status": "verified", "incidentDate": "2026-07-31", "datePrecision": "day", "title": { "zh": "Swan Treasury 链下签名密钥泄露", "tw": "Swan Treasury 鏈下簽名密鑰洩露", "en": "Swan Treasury off-chain signer key compromise" }, "summary": { "zh": "攻击者利用泄露的链下签名者密钥，把折扣参数设为 1，以约 19,700 USDT 买入约 687,000 STY 后抛售，净获约 625,000 USDT。Defimon 认为多次 ecrecover 均解析到同一硬编码签名者，支持密钥泄露结论。", "tw": "攻擊者利用洩露的鏈下簽名者密鑰，把折扣參數設為 1，以約 19,700 USDT 買入約 687,000 STY 後拋售，淨獲約 625,000 USDT。Defimon 認為多次 ecrecover 均解析到同一硬編碼簽名者，支持密鑰洩露結論。", "en": "The attacker used a compromised off-chain signer key to set the discount parameter to 1, bought roughly 687,000 STY for about 19,700 USDT, and sold the tokens for approximately 625,000 USDT in net proceeds. Defimon reported that repeated ecrecover calls resolved to the same hardcoded signer, supporting a key-compromise finding." }, "details": { "zh": "## 事件背景\nZhaiquanBuy 合约把一个链下签名者硬编码为 _signer，并依据签名中的折扣参数计算 STY 购买数量。攻击者能够为自己的地址生成可通过校验的签名，说明签名密钥本身失陷。\n\n## 事件经过\n1. 攻击者通过 PancakeSwap 闪电贷取得约 19,700 USDT。\n2. 攻击者使用有效伪造签名并把折扣设为 1，使购买量按 100 倍比例放大。\n3. 攻击者以约 19,700 USDT 取得约 687,000 STY。\n4. 关联合约上的 claim 和 transfer 签名也被伪造。\n5. 攻击者向 STY/USDT 池抛售代币并获得约 625,000 USDT 净收益。\n\n## 资金流向\nPancakeSwap 闪电贷提供 USDT，资金进入 ZhaiquanBuy 折扣购买路径并换得 STY，随后 STY 被卖入 STY/USDT 池，收益留在攻击者控制路径。公开主证据没有完整确认后续跨链出口。\n\n## 金额口径\n公开损失采用 Defimon 估算的约 625,000 美元净收益。约 19,700 USDT 是攻击投入，约 687,000 STY 是获得并抛售的代币数量，均不另行相加。\n\n## 证据边界\nDefimon 支持签名密钥泄露、交易机制、地址角色和金额。公开帖子只展示截断签名者地址，因此不将该截断值扩展为完整地址标签。\n\n## 处置状态\n攻击交易执行成功。现有公开资料没有确认密钥轮换、资金返还、冻结、赔付或控制权恢复。", "tw": "## 事件背景\nZhaiquanBuy 合約把一個鏈下簽名者硬編碼為 _signer，並依據簽名中的折扣參數計算 STY 購買數量。攻擊者能夠為自己的地址生成可通過校驗的簽名，說明簽名密鑰本身失陷。\n\n## 事件經過\n1. 攻擊者通過 PancakeSwap 閃電貸取得約 19,700 USDT。\n2. 攻擊者使用有效偽造簽名並把折扣設為 1，使購買量按 100 倍比例放大。\n3. 攻擊者以約 19,700 USDT 取得約 687,000 STY。\n4. 關聯合約上的 claim 和 transfer 簽名也被偽造。\n5. 攻擊者向 STY/USDT 池拋售代幣並獲得約 625,000 USDT 淨收益。\n\n## 資金流向\nPancakeSwap 閃電貸提供 USDT，資金進入 ZhaiquanBuy 折扣購買路徑並換得 STY，隨後 STY 被賣入 STY/USDT 池，收益留在攻擊者控制路徑。公開主證據沒有完整確認後續跨鏈出口。\n\n## 金額口徑\n公開損失採用 Defimon 估算的約 625,000 美元淨收益。約 19,700 USDT 是攻擊投入，約 687,000 STY 是獲得並拋售的代幣數量，均不另行相加。\n\n## 證據邊界\nDefimon 支持簽名密鑰洩露、交易機制、地址角色和金額。公開帖子只展示截斷簽名者地址，因此不將該截斷值擴展為完整地址標籤。\n\n## 處置狀態\n攻擊交易執行成功。現有公開資料沒有確認密鑰輪換、資金返還、凍結、賠付或控制權恢復。", "en": "## Incident overview\nZhaiquanBuy hardcoded an off-chain signer as _signer and calculated STY purchase amounts from a signed discount parameter. The attacker produced signatures that validated for the attacker’s own address, supporting compromise of the signer key itself.\n\n## Incident sequence\n1. The attacker obtained approximately 19,700 USDT through a PancakeSwap flash loan.\n2. The attacker used valid forged signatures with the discount set to 1, multiplying the purchase quantity by 100.\n3. Approximately 687,000 STY was acquired for about 19,700 USDT.\n4. Signatures for claim and transfer on related contracts were also forged.\n5. The attacker sold STY into the STY/USDT pool and retained approximately 625,000 USDT in net proceeds.\n\n## Fund flow\nA PancakeSwap flash loan supplied USDT, which entered the ZhaiquanBuy discounted-purchase path and acquired STY. The STY was then sold into the STY/USDT pool, leaving proceeds in the attacker-controlled route. The primary public evidence did not fully establish a later cross-chain destination.\n\n## Amount basis\nReported loss uses Defimon’s estimate of approximately $625,000 in net proceeds. The roughly 19,700 USDT input and approximately 687,000 STY acquired and sold are mechanism figures and are not added separately.\n\n## Evidence boundary\nDefimon supports the signer-key compromise, transaction mechanism, address roles, and amount. The public post showed only a truncated signer address, so that value is not expanded into a complete address label.\n\n## Current status\nThe attack transaction succeeded. Public evidence did not confirm key rotation, return of funds, freezing, compensation, or restoration of control." }, "category": "key-compromise", "severity": "medium", "ecosystems": [ "BNB Chain" ], "chains": [ "BNB Chain" ], "lossUsd": 625000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "攻击者抛售约 687,000 STY 后净获约 625,000 USDT。", "tw": "攻擊者拋售約 687,000 STY 後淨獲約 625,000 USDT。", "en": "The attacker obtained approximately 625,000 USDT in net proceeds after selling about 687,000 STY." }, "addressDisclosure": "published", "addresses": [ { "chain": "BNB Chain", "address": "0x840ff67cdd5bc3cf51ebf758c35feaac92cdada4", "entity": { "zh": "Swan Treasury 攻击执行地址", "tw": "Swan Treasury 攻擊執行地址", "en": "Swan Treasury attack executor" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/DefimonAlerts/status/2083039796784410802", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Defimon 将该地址标记为本次攻击执行主体。", "tw": "Defimon 將該地址標記為本次攻擊執行主體。", "en": "Defimon identified this address as the executor of the attack." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xcbafd579210f2bee8e618c2166a87d927dfaadfb", "entity": { "zh": "Swan Treasury 攻击调用合约", "tw": "Swan Treasury 攻擊呼叫合約", "en": "Swan Treasury attack-call contract" }, "role": "attacker-contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/DefimonAlerts/status/2083039796784410802", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "公开攻击交易直接调用该合约；标签限于本次执行路径。", "tw": "公開攻擊交易直接呼叫該合約；標籤限於本次執行路徑。", "en": "The public attack transaction called this contract directly; the label is limited to this execution path." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x27af47fa5681e4c4ef5ffdcff47eb0dd3bac6a8c", "entity": { "zh": "Swan Treasury 受影响合约", "tw": "Swan Treasury 受影響合約", "en": "Affected Swan Treasury contract" }, "role": "contract", "category": "unknown", "confidence": 0.92, "sourceUrl": "https://x.com/DefimonAlerts/status/2083039796784410802", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Defimon 将该地址标记为受影响合约；它不是攻击者地址。", "tw": "Defimon 將該地址標記為受影響合約；它不是攻擊者地址。", "en": "Defimon identified this address as an affected contract; it is not labeled as an attacker address." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "Defimon Alerts 攻击分析", "tw": "Defimon Alerts 攻擊分析", "en": "Defimon Alerts exploit analysis" }, "url": "https://x.com/DefimonAlerts/status/2083039796784410802", "type": "research" }, { "label": { "zh": "BscScan 攻击交易", "tw": "BscScan 攻擊交易", "en": "BscScan attack transaction" }, "url": "https://bscscan.com/tx/0xc8c3325ba2c942a674b26de2063d278c144e92dbc91497ca0c766c915d96cbd4", "type": "explorer" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-199", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-208", "status": "verified", "incidentDate": "2026-07-30", "datePrecision": "day", "title": { "zh": "Base 未验证合约任意低级调用盗取 16.623 WETH", "tw": "Base 未驗證合約任意低級呼叫盜取 16.623 WETH", "en": "Base unverified contract exploit drained 16.623 WETH through an unrestricted low-level call" }, "summary": { "zh": "攻击者利用 Base 上未验证合约缺失访问控制的低级 CALL，滥用既有 WETH 授权从受害地址转出 16.623029776956898128 WETH。攻击发生于 7 月 30 日，8 月 1 日由漫雾披露，属于窗口内旧案技术披露。", "tw": "攻擊者利用 Base 上未驗證合約缺失訪問控制的低級 CALL，濫用既有 WETH 授權從受害地址轉出 16.623029776956898128 WETH。攻擊發生於 7 月 30 日，8 月 1 日由漫霧披露，屬於窗口內舊案技術披露。", "en": "An attacker used an unrestricted low-level CALL in an unverified Base contract to abuse an existing WETH approval and transfer 16.623029776956898128 WETH from a victim. The exploit occurred on July 30 and was disclosed by SlowMist on August 1, making it a prior-case technical disclosure during the window." }, "details": { "zh": "## 事件背景\n受害者此前向易受攻击合约授予 WETH 额度。该合约的选择器暴露无限制低级 CALL，缺少所有者检查、目标和 calldata 约束。\n\n## 事件经过\n1. 攻击者部署辅助合约并调用缺失访问控制的入口。\n2. 受害合约使用既有授权执行 transferFrom。\n3. 16.623029776956898128 WETH 被转出，交易成功上链。\n4. 8 月 1 日漫雾披露技术路径，随后研究者重建受害合约和攻击辅助合约。\n\n## 资金流向\n受害地址 0x386218744a2053d949a1cafae0b7b49a35e03f53 → 易受攻击合约 0xa31722ca2a32695280d0e7e325b3dd6d699fc170 → 攻击辅助合约 0x797c889d8df4498640f018d7e5d5f0df5bea6dc8 → 攻击者地址 0xbdce6bdd52baceadd1fc91bf01f3bc6ab24df17a。\n\n## 金额口径\n链上 Transfer 原始值为 16.623029776956898128 WETH。公开资料未形成独立美元估值口径，因此只记录原始资产数量。\n\n## 证据边界\nBase 交易和 Transfer 日志支持金额、调用路径和地址角色；公开资料没有确认合约属于某个已命名项目，也没有把后续去向扩展为其他损失。\n\n## 处置状态\n交易已成功完成盗取。窗口内没有确认冻结、追回或受害者官方赔付。", "tw": "## 事件背景\n受害者此前向易受攻擊合約授予 WETH 額度。該合約的選擇器暴露無限制低級 CALL，缺少所有者檢查、目標和 calldata 約束。\n\n## 事件經過\n1. 攻擊者部署輔助合約並呼叫缺失訪問控制的入口。\n2. 受害合約使用既有授權執行 transferFrom。\n3. 16.623029776956898128 WETH 被轉出，交易成功上鍊。\n4. 8 月 1 日漫霧披露技術路徑，隨後研究者重建受害合約和攻擊輔助合約。\n\n## 資金流向\n受害地址 0x386218744a2053d949a1cafae0b7b49a35e03f53 → 易受攻擊合約 0xa31722ca2a32695280d0e7e325b3dd6d699fc170 → 攻擊輔助合約 0x797c889d8df4498640f018d7e5d5f0df5bea6dc8 → 攻擊者地址 0xbdce6bdd52baceadd1fc91bf01f3bc6ab24df17a。\n\n## 金額口徑\n鏈上 Transfer 原始值為 16.623029776956898128 WETH。公開資料未形成獨立美元估值口徑，因此只記錄原始資產數量。\n\n## 證據邊界\nBase 交易和 Transfer 日誌支持金額、呼叫路徑和地址角色；公開資料沒有確認合約屬於某個已命名專案，也沒有把後續去向擴展為其他損失。\n\n## 處置狀態\n交易已成功完成盜取。窗口內沒有確認凍結、追回或受害者官方賠付。", "en": "## Incident overview\nThe victim had previously approved WETH to a vulnerable contract. Its selector exposed an unrestricted low-level CALL without owner checks or target and calldata constraints.\n\n## Incident sequence\n1. The attacker deployed a helper contract and called the access-control-free entry point.\n2. The victim contract used the existing approval to execute transferFrom.\n3. 16.623029776956898128 WETH was transferred and the transaction succeeded on-chain.\n4. SlowMist disclosed the technical path on August 1, after which researchers reconstructed the victim and helper contracts.\n\n## Fund flow\nVictim address 0x386218744a2053d949a1cafae0b7b49a35e03f53 → vulnerable contract 0xa31722ca2a32695280d0e7e325b3dd6d699fc170 → helper contract 0x797c889d8df4498640f018d7e5d5f0df5bea6dc8 → attacker address 0xbdce6bdd52baceadd1fc91bf01f3bc6ab24df17a.\n\n## Amount basis\nThe on-chain Transfer value was 16.623029776956898128 WETH. Public sources did not establish a separate USD valuation, so the original asset quantity is recorded without conversion.\n\n## Evidence boundary\nThe Base transaction and Transfer logs support the amount, call path, and address roles. Public evidence did not identify a named project behind the contract or extend later movement into additional loss.\n\n## Current status\nThe transaction completed the theft. No freeze, recovery, or victim compensation was confirmed during the window." }, "category": "protocol-exploit", "severity": "medium", "ecosystems": [ "Base" ], "chains": [ "Base" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "链上转出 16.623029776956898128 WETH，公开资料未形成独立美元估值口径。", "tw": "鏈上轉出 16.623029776956898128 WETH，公開資料未形成獨立美元估值口徑。", "en": "The on-chain transfer removed 16.623029776956898128 WETH; public sources did not establish a separate USD valuation." }, "addressDisclosure": "published", "addresses": [ { "chain": "Base", "address": "0xe831f3991132cbaffbb4a3738da7d1e254a6c02f0adce605a333229a61e27ad7", "entity": { "zh": "Base WETH 盗取交易", "tw": "Base WETH 盜取交易", "en": "Base WETH theft transaction" }, "role": "attack-transaction", "category": "hack", "confidence": 0.9, "sourceUrl": "https://basescan.org/tx/0xe831f3991132cbaffbb4a3738da7d1e254a6c02f0adce605a333229a61e27ad7", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "BaseScan 显示交易成功并包含 WETH Transfer 日志。", "tw": "BaseScan 顯示交易成功並包含 WETH Transfer 日誌。", "en": "BaseScan shows a successful transaction with the WETH Transfer log." }, "reviewRequired": true }, { "chain": "Base", "address": "0xbdce6bdd52baceadd1fc91bf01f3bc6ab24df17a", "entity": { "zh": "Base WETH 攻击者最终接收地址", "tw": "Base WETH 攻擊者最終接收地址", "en": "Final receiving address in the Base WETH exploit" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://basescan.org/address/0xbdce6bdd52baceadd1fc91bf01f3bc6ab24df17a", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "公开交易路径将该地址标为最终接收方。", "tw": "公開交易路徑將該地址標為最終接收方。", "en": "The public transaction path identifies this address as the final recipient." }, "reviewRequired": true }, { "chain": "Base", "address": "0x386218744a2053d949a1cafae0b7b49a35e03f53", "entity": { "zh": "Base WETH 受害地址", "tw": "Base WETH 受害地址", "en": "Victim address in the Base WETH exploit" }, "role": "victim", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://basescan.org/address/0x386218744a2053d949a1cafae0b7b49a35e03f53", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址是被滥用 WETH 授权的受害方。", "tw": "該地址是被濫用 WETH 授權的受害方。", "en": "This address was the victim whose WETH approval was abused." }, "reviewRequired": true }, { "chain": "Base", "address": "0xa31722ca2a32695280d0e7e325b3dd6d699fc170", "entity": { "zh": "Base 易受攻击合约", "tw": "Base 易受攻擊合約", "en": "Vulnerable Base contract" }, "role": "vulnerable-contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://basescan.org/address/0xa31722ca2a32695280d0e7e325b3dd6d699fc170", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该合约暴露缺失访问控制的低级 CALL，不是攻击者地址。", "tw": "該合約暴露缺失訪問控制的低級 CALL，不是攻擊者地址。", "en": "This contract exposed an access-control-free low-level CALL; it is not an attacker address." }, "reviewRequired": true }, { "chain": "Base", "address": "0x797c889d8df4498640f018d7e5d5f0df5bea6dc8", "entity": { "zh": "Base WETH 攻击辅助合约", "tw": "Base WETH 攻擊輔助合約", "en": "Helper contract in the Base WETH exploit" }, "role": "attacker-contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://basescan.org/address/0x797c889d8df4498640f018d7e5d5f0df5bea6dc8", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该合约在攻击交易中负责调用和资金中转。", "tw": "該合約在攻擊交易中負責呼叫和資金中轉。", "en": "This contract handled the call and fund movement in the exploit transaction." }, "reviewRequired": true }, { "chain": "Base", "address": "0x4200000000000000000000000000000000000006", "entity": { "zh": "Base WETH 官方代币合约", "tw": "Base WETH 官方代幣合約", "en": "Base canonical WETH contract" }, "role": "token-contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://basescan.org/token/0x4200000000000000000000000000000000000006", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该地址是 Base 官方 WETH 合约，不是攻击者地址。", "tw": "該地址是 Base 官方 WETH 合約，不是攻擊者地址。", "en": "This address is the canonical Base WETH contract, not an attacker address." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "漫雾技术告警", "tw": "漫霧技術告警", "en": "SlowMist technical alert" }, "url": "https://x.com/SlowMist_Team/status/2083509411243299252", "type": "research" }, { "label": { "zh": "BaseScan 攻击交易", "tw": "BaseScan 攻擊交易", "en": "BaseScan exploit transaction" }, "url": "https://basescan.org/tx/0xe831f3991132cbaffbb4a3738da7d1e254a6c02f0adce605a333229a61e27ad7", "type": "explorer" }, { "label": { "zh": "受害合约重建分析", "tw": "受害合約重建分析", "en": "Victim-contract reconstruction" }, "url": "https://x.com/256cisco/status/2083646637184811488", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-208", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-198", "status": "verified", "incidentDate": "2026-07-30", "datePrecision": "day", "title": { "zh": "Set Protocol ExchangeIssuance 状态膨胀攻击", "tw": "Set Protocol ExchangeIssuance 狀態膨脹攻擊", "en": "Set Protocol ExchangeIssuance state-inflation exploit" }, "summary": { "zh": "攻击者通过恶意 SetToken、预发行钩子和虚假估值器，在报价后把组件单位放大约 93.66 倍，使 ExchangeIssuance 过量转出真实资产。漫雾估算损失约 9,600 美元。", "tw": "攻擊者通過惡意 SetToken、預發行鉤子和虛假估值器，在報價後把組件單位放大約 93.66 倍，使 ExchangeIssuance 過量轉出真實資產。漫霧估算損失約 9,600 美元。", "en": "An attacker used a malicious SetToken, pre-issue hook, and fake valuer to inflate component units by approximately 93.66 times after quotation, causing ExchangeIssuance to transfer excess real assets. SlowMist estimated the loss at about $9,600." }, "details": { "zh": "## 事件背景\nIndex Coop 的 ExchangeIssuance.issueSetForExactToken 在报价时读取任意 SetToken 的组件与单位，但没有锁定中间状态或在执行前重新校验。攻击者控制的管理器可在预发行钩子期间改变 positionMultiplier。\n\n## 事件经过\n1. 攻击者部署恶意 SetToken、管理器、预发行钩子和估值器。\n2. 攻击者先用 0.05 WETH 发行 BHSET。\n3. 预发行钩子通过 NAV issue/redeem 与虚假估值把组件单位放大约 93.66 倍。\n4. BasicIssuanceModule.issue 按变化后的真实单位执行 transferFrom，导致 ExchangeIssuance 资产被过量转出。\n\n## 资金流向\n攻击执行地址通过恶意估值器、钩子和 SetToken 组合触发发行路径，真实资产从 ExchangeIssuance 被过量转出。公开资料没有确认后续跨链、混币器或交易所出口。\n\n## 金额口径\n漫雾估算损失约 9,600 美元。0.05 WETH 是初始发行投入，约 93.66 倍是组件单位膨胀比例，均不作为额外损失相加。\n\n## 证据边界\n根因、地址角色、单位膨胀比例和损失来自漫雾分析；Ethereum 交易用于确认执行路径。项目公开渠道尚未发布完整处置说明。\n\n## 处置状态\n攻击交易执行成功。现有公开资料没有确认资产返还、冻结、赔付或控制权恢复。", "tw": "## 事件背景\nIndex Coop 的 ExchangeIssuance.issueSetForExactToken 在報價時讀取任意 SetToken 的組件與單位，但沒有鎖定中間狀態或在執行前重新校驗。攻擊者控制的管理器可在預發行鉤子期間改變 positionMultiplier。\n\n## 事件經過\n1. 攻擊者部署惡意 SetToken、管理器、預發行鉤子和估值器。\n2. 攻擊者先用 0.05 WETH 發行 BHSET。\n3. 預發行鉤子通過 NAV issue/redeem 與虛假估值把組件單位放大約 93.66 倍。\n4. BasicIssuanceModule.issue 按變化後的真實單位執行 transferFrom，導致 ExchangeIssuance 資產被過量轉出。\n\n## 資金流向\n攻擊執行地址通過惡意估值器、鉤子和 SetToken 組合觸發發行路徑，真實資產從 ExchangeIssuance 被過量轉出。公開資料沒有確認後續跨鏈、混幣器或交易所出口。\n\n## 金額口徑\n漫霧估算損失約 9,600 美元。0.05 WETH 是初始發行投入，約 93.66 倍是組件單位膨脹比例，均不作為額外損失相加。\n\n## 證據邊界\n根因、地址角色、單位膨脹比例和損失來自漫霧分析；Ethereum 交易用於確認執行路徑。專案公開渠道尚未發布完整處置說明。\n\n## 處置狀態\n攻擊交易執行成功。現有公開資料沒有確認資產返還、凍結、賠付或控制權恢復。", "en": "## Incident overview\nIndex Coop’s ExchangeIssuance.issueSetForExactToken read components and units from an arbitrary SetToken for quotation without locking the intermediate state or revalidating it before execution. An attacker-controlled manager could change positionMultiplier during a pre-issue hook.\n\n## Incident sequence\n1. The attacker deployed a malicious SetToken, manager, pre-issue hook, and valuer.\n2. The attacker first issued BHSET with 0.05 WETH.\n3. The pre-issue hook used NAV issue/redeem and a fake valuation to inflate component units by approximately 93.66 times.\n4. BasicIssuanceModule.issue executed transferFrom with the changed real units, causing ExchangeIssuance to transfer excess assets.\n\n## Fund flow\nThe executing address triggered the issuance path through the malicious valuer, hook, and SetToken combination, drawing excess real assets from ExchangeIssuance. No verified onward bridge, mixer, or exchange route was published.\n\n## Amount basis\nSlowMist estimated the loss at approximately $9,600. The initial 0.05 WETH issuance and the approximately 93.66-times unit inflation are mechanism figures and are not added as separate losses.\n\n## Evidence boundary\nSlowMist supports the root cause, address roles, unit-inflation ratio, and loss estimate; the Ethereum transaction confirms the execution path. The project had not published a complete response.\n\n## Current status\nThe attack transaction succeeded. Public evidence did not confirm asset return, freezing, compensation, or restoration of control." }, "category": "protocol-exploit", "severity": "low", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 9600, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "ExchangeIssuance 真实资产约损失 9,600 美元。", "tw": "ExchangeIssuance 真實資產約損失 9,600 美元。", "en": "ExchangeIssuance lost approximately $9,600 in real assets." }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0x0736930ae35eafefa789f11edf41d7b799e7c99d", "entity": { "zh": "Set Protocol 攻击执行地址", "tw": "Set Protocol 攻擊執行地址", "en": "Set Protocol attack executor" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/SlowMist_Team/status/2082767887245410320", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "漫雾将该地址标记为本次攻击者。", "tw": "漫霧將該地址標記為本次攻擊者。", "en": "SlowMist identified this address as the attacker in this incident." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xc8c85a3b4d03fb3451e7248ff94f780c92f884fd", "entity": { "zh": "受影响 ExchangeIssuance 合约", "tw": "受影響 ExchangeIssuance 合約", "en": "Affected ExchangeIssuance contract" }, "role": "contract", "category": "unknown", "confidence": 0.95, "sourceUrl": "https://x.com/SlowMist_Team/status/2082767887245410320", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "漫雾将该合约标记为本次事件的受影响 ExchangeIssuance；它不是攻击者地址。", "tw": "漫霧將該合約標記為本次事件的受影響 ExchangeIssuance；它不是攻擊者地址。", "en": "SlowMist identified this contract as the affected ExchangeIssuance; it is not labeled as an attacker address." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xf7c2d0a2bf81bf803ed6e1d97c89fe3b30b06948", "entity": { "zh": "恶意 SetToken 合约", "tw": "惡意 SetToken 合約", "en": "Malicious SetToken contract" }, "role": "attacker-contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/SlowMist_Team/status/2082767887245410320", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "漫雾将该地址标记为攻击者部署的恶意 SetToken。", "tw": "漫霧將該地址標記為攻擊者部署的惡意 SetToken。", "en": "SlowMist identified this address as the malicious SetToken deployed for the attack." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x8f449d85f728c1dd6596880ba28a0b80b6a26c58", "entity": { "zh": "恶意管理器与预发行钩子", "tw": "惡意管理器與預發行鉤子", "en": "Malicious manager and pre-issue hook" }, "role": "attacker-contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/SlowMist_Team/status/2082767887245410320", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "漫雾将该地址标记为恶意管理器和预发行钩子。", "tw": "漫霧將該地址標記為惡意管理器和預發行鉤子。", "en": "SlowMist identified this address as the malicious manager and pre-issue hook." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x388a3da33825e1f44ac71b8fd543523cdf994802", "entity": { "zh": "恶意估值器合约", "tw": "惡意估值器合約", "en": "Malicious valuer contract" }, "role": "attacker-contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/SlowMist_Team/status/2082767887245410320", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "漫雾将该地址标记为用于放大组件单位的恶意估值器。", "tw": "漫霧將該地址標記為用於放大組件單位的惡意估值器。", "en": "SlowMist identified this address as the malicious valuer used to inflate component units." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "漫雾完整攻击分析", "tw": "漫霧完整攻擊分析", "en": "SlowMist full exploit analysis" }, "url": "https://x.com/SlowMist_Team/status/2082767887245410320", "type": "research" }, { "label": { "zh": "Etherscan 攻击交易", "tw": "Etherscan 攻擊交易", "en": "Etherscan attack transaction" }, "url": "https://etherscan.io/tx/0x7f45428df558fba1d19ab115effef8ecd1e6e05b491f02202b0815e47b8d658b", "type": "explorer" }, { "label": { "zh": "DeFiLlama Hacks 事件数据库", "tw": "DeFiLlama Hacks 事件數據庫", "en": "DeFiLlama Hacks database" }, "url": "https://defillama.com/hacks", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-198", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-197", "status": "verified", "incidentDate": "2026-07-30", "datePrecision": "day", "title": { "zh": "COLDCARD 弱熵缺陷关联多波次 BTC 批量盗转", "tw": "COLDCARD 弱熵缺陷關聯多波次 BTC 批量盜轉", "en": "COLDCARD weak-entropy flaw linked to multistage BTC theft" }, "summary": { "zh": "Coinkite 确认旧版 COLDCARD 固件的种子生成存在弱熵缺陷。前三波已确认约 1,367.05 BTC；SlowMist 于 2026-08-12 披露多波累计至少 1,719 BTC、约 $111M、超过 5,200 个地址。8 月 3 日第四波初报 388.92748828 BTC 仍在核验，不与累计口径重复相加。", "tw": "Coinkite 確認舊版 COLDCARD 固件的種子生成存在弱熵缺陷。前三波已確認約 1,367.05 BTC；SlowMist 於 2026-08-12 披露多波累計至少 1,719 BTC、約 $111M、超過 5,200 個地址。8 月 3 日第四波初報 388.92748828 BTC 仍在核驗，不與累計口徑重複相加。", "en": "Coinkite confirmed a weak-entropy flaw in seed generation on older COLDCARD firmware. The first three waves confirmed approximately 1,367.05 BTC; on August 12, 2026, SlowMist disclosed a cross-wave cumulative total of at least 1,719 BTC, about $111M, across more than 5,200 addresses. The initial 388.92748828 BTC fourth-wave figure from August 3 remains under review and is not added again." }, "details": { "zh": "## 事件背景\nCoinkite 说明部分旧版 COLDCARD 固件的随机数整合存在缺陷，导致种子有效熵低于预期。攻击者可以离线重建弱种子并清空受影响的单签钱包。\n\n## 事件经过\n1. 7 月 30 日起，第一至第三波攻击清空大量受影响 Bitcoin 钱包，已确认合计约 1,367.05 BTC。\n2. 8 月 3 日约 06:21 至 08:51 出现第四波，初报涉及 218 笔交易、462 个受害地址和 216 个新目标地址。\n3. 第四波仍在实时修正，不能把初报金额与前三波确认金额直接相加。\n4. Coinkite 停止受影响库存发货并要求用户重新生成非受影响种子。\n\n## 资金流向\n早期主归集地址累计收到约 594.47725695 BTC，随后向下游地址转出。个别受害资金经 THORChain 跨至 Ethereum 并进入 Duel；公开资料未确认全部后续出口。\n\n## 金额口径\n前三波确认规模约为 1,367.05 BTC。SlowMist Hacked Zone 将该规模四舍五入为约 8,900 万美元，报告中的估值约为 8,860 万美元；官网采用约 8,900 万美元作为已确认累计损失。第四波的 388.92748828 BTC 仍是初报，不另行计入。\n\n## 证据边界\nCoinkite 官方确认固件缺陷和迁移要求；Galaxy Research、Lookonchain 及其他链上研究支持波次和归集规模。第四波地址清单和其中部分归因仍在修正，混合输入交易的全部输出不能计作单一事件损失。\n\n## 处置状态\n官方已发布修复固件和迁移流程。现有公开资料没有确认资金返还、冻结或司法扣押；第四波仍处于调查和地址核验阶段。\n\n## 2026-08-12 披露更新\nSlowMist 在此次检索窗口内披露 COLDCARD 弱随机数攻击链的技术复盘，给出至少 1,719 BTC、约 $111M 和超过 5,200 个地址的跨期多波累计口径。该披露更新了事件记录的累计金额基准，但没有证明全部动作发生在 2026 年 8 月 11 日至 12 日窗口内。\n\n## 更新后的证据边界\nSlowMist 尚未提供超过 5,200 个地址的完整清单、逐笔交易总账或可复算的原始动作时间。1,719 BTC 是披露方汇总口径，不把地址数量写成受害人数，也不把技术披露日写成攻击发生日。\n\n## 2026-08-19 调查更新\nWuBlockchain 和 Bitcoin Magazine 在窗口内披露 COLDCARD Wave 1 调查线索：旧案约 1,082.65 BTC 的链上行为据称与付费区块链数据服务账户及内部日志有关，调查人员认为 FBI 可能已经知道第一波攻击者身份。该信息不是官方起诉、扣押或身份确认。\n\n## 更新后的证据边界\n公开资料未提供新的完整地址、交易集合、FBI/DOJ 起诉书或扣押公告。美元换算存在公开纠错信号，事件记录继续只保留 1,082.65 BTC，不把调查披露日写成新的盗窃日期。\n\n## 2026-08-19 调查更新\nWuBlockchain 和 Bitcoin Magazine 在窗口内披露 COLDCARD Wave 1 调查线索：旧案约 1,082.65 BTC 的链上行为据称与付费区块链数据服务账户及内部日志有关，调查人员认为 FBI 可能已经知道第一波攻击者身份。该信息不是官方起诉、扣押或身份确认。\n\n## 更新后的证据边界\n公开资料未提供新的完整地址、交易集合、FBI/DOJ 起诉书或扣押公告。美元换算存在公开纠错信号，事件记录继续只保留 1,082.65 BTC，不把调查披露日写成新的盗窃日期。\n\n## 2026-08-19 调查更新\nWuBlockchain 和 Bitcoin Magazine 在窗口内披露 COLDCARD Wave 1 调查线索：旧案约 1,082.65 BTC 的链上行为据称与付费区块链数据服务账户及内部日志有关，调查人员认为 FBI 可能已经知道第一波攻击者身份。该信息不是官方起诉、扣押或身份确认。\n\n## 更新后的证据边界\n公开资料未提供新的完整地址、交易集合、FBI/DOJ 起诉书或扣押公告。美元换算存在公开纠错信号，事件记录继续只保留 1,082.65 BTC，不把调查披露日写成新的盗窃日期。\n\n## 2026 年 9 月资金异动\n2026 年 9 月 1 日至 3 日，Wave 3 相关地址首次大规模移动资金。约 20.45 BTC 经 THORChain 尝试跨链，其中约 20.15 BTC 对应资产进入 Ethereum 主接收地址。该活动是旧案资金异动，不构成新增损失。\n\n## 更新后的证据边界\nBitquery 公开 CSV 提供日期、区块和跨链记录，但部分来源地址仍是 reported 标签。34 笔交换与汇总转账属于同一批资金，不重复相加；公开证据没有确认最终进入可冻结交易所。", "tw": "## 事件背景\nCoinkite 說明部分舊版 COLDCARD 固件的隨機數整合存在缺陷，導致種子有效熵低於預期。攻擊者可以離線重建弱種子並清空受影響的單籤錢包。\n\n## 事件經過\n1. 7 月 30 日起，第一至第三波攻擊清空大量受影響 Bitcoin 錢包，已確認合計約 1,367.05 BTC。\n2. 8 月 3 日約 06:21 至 08:51 出現第四波，初報涉及 218 筆交易、462 個受害地址和 216 個新目標地址。\n3. 第四波仍在實時修正，不能把初報金額與前三波確認金額直接相加。\n4. Coinkite 停止受影響庫存發貨並要求用戶重新生成非受影響種子。\n\n## 資金流向\n早期主歸集地址累計收到約 594.47725695 BTC，隨後向下遊地址轉出。個別受害資金經 THORChain 跨至 Ethereum 並進入 Duel；公開資料未確認全部後續出口。\n\n## 金額口徑\n前三波確認規模約為 1,367.05 BTC。SlowMist Hacked Zone 將該規模四捨五入為約 8,900 萬美元，報告中的估值約為 8,860 萬美元；官網採用約 8,900 萬美元作為已確認累計損失。第四波的 388.92748828 BTC 仍是初報，不另行計入。\n\n## 證據邊界\nCoinkite 官方確認固件缺陷和遷移要求；Galaxy Research、Lookonchain 及其他鏈上研究支持波次和歸集規模。第四波地址清單和其中部分歸因仍在修正，混合輸入交易的全部輸出不能計作單一事件損失。\n\n## 處置狀態\n官方已發布修復固件和遷移流程。現有公開資料沒有確認資金返還、凍結或司法扣押；第四波仍處於調查和地址核驗階段。\n\n## 2026-08-12 披露更新\nSlowMist 在此次檢索窗口內披露 COLDCARD 弱隨機數攻擊鏈的技術復盤，給出至少 1,719 BTC、約 $111M 和超過 5,200 個地址的跨期多波累計口徑。該披露更新了事件記錄的累計金額基準，但沒有證明全部動作發生在 2026 年 8 月 11 日至 12 日窗口內。\n\n## 更新後的證據邊界\nSlowMist 尚未提供超過 5,200 個地址的完整清單、逐筆交易總賬或可復算的原始動作時間。1,719 BTC 是披露方彙總口徑，不把地址數量寫成受害人數，也不把技術披露日寫成攻擊發生日。\n\n## 2026-08-19 調查更新\nWuBlockchain 和 Bitcoin Magazine 在窗口內披露 COLDCARD Wave 1 調查線索：舊案約 1,082.65 BTC 的鏈上行為據稱與付費區塊鏈數據服務賬戶及內部日誌有關，調查人員認為 FBI 可能已經知道第一波攻擊者身份。該信息不是官方起訴、扣押或身份確認。\n\n## 更新後的證據邊界\n公開資料未提供新的完整地址、交易集合、FBI/DOJ 起訴書或扣押公告。美元換算存在公開糾錯信號，事件記錄繼續只保留 1,082.65 BTC，不把調查披露日寫成新的盜竊日期。\n\n## 2026-08-19 調查更新\nWuBlockchain 和 Bitcoin Magazine 在窗口內披露 COLDCARD Wave 1 調查線索：舊案約 1,082.65 BTC 的鏈上行為據稱與付費區塊鏈數據服務賬戶及內部日誌有關，調查人員認為 FBI 可能已經知道第一波攻擊者身份。該信息不是官方起訴、扣押或身份確認。\n\n## 更新後的證據邊界\n公開資料未提供新的完整地址、交易集合、FBI/DOJ 起訴書或扣押公告。美元換算存在公開糾錯信號，事件記錄繼續只保留 1,082.65 BTC，不把調查披露日寫成新的盜竊日期。\n\n## 2026-08-19 調查更新\nWuBlockchain 和 Bitcoin Magazine 在窗口內披露 COLDCARD Wave 1 調查線索：舊案約 1,082.65 BTC 的鏈上行為據稱與付費區塊鏈數據服務賬戶及內部日誌有關，調查人員認為 FBI 可能已經知道第一波攻擊者身份。該信息不是官方起訴、扣押或身份確認。\n\n## 更新後的證據邊界\n公開資料未提供新的完整地址、交易集合、FBI/DOJ 起訴書或扣押公告。美元換算存在公開糾錯信號，事件記錄繼續只保留 1,082.65 BTC，不把調查披露日寫成新的盜竊日期。\n\n## 2026 年 9 月資金異動\n2026 年 9 月 1 日至 3 日，Wave 3 相關地址首次大規模移動資金。約 20.45 BTC 經 THORChain 嘗試跨鏈，其中約 20.15 BTC 對應資產進入 Ethereum 主接收地址。該活動是舊案資金異動，不構成新增損失。\n\n## 更新後的證據邊界\nBitquery 公開 CSV 提供日期、區塊和跨鏈記錄，但部分來源地址仍是 reported 標籤。34 筆交換與彙總轉賬屬於同一批資金，不重複相加；公開證據沒有確認最終進入可凍結交易所。", "en": "## Incident overview\nCoinkite said that a random-number integration flaw in some older COLDCARD firmware produced seeds with less entropy than intended. An attacker could reconstruct weak seeds offline and sweep affected single-signature wallets.\n\n## Incident sequence\n1. From July 30, the first three waves swept many affected Bitcoin wallets, with approximately 1,367.05 BTC confirmed in aggregate.\n2. A fourth wave appeared from about 06:21 to 08:51 on August 3, with an initial report covering 218 transactions, 462 victim addresses, and 216 new target addresses.\n3. The fourth-wave figures were still being corrected and are not added directly to the confirmed first-three-wave amount.\n4. Coinkite stopped shipping affected inventory and told users to generate new seeds outside the affected releases.\n\n## Fund flow\nAn early aggregation address received approximately 594.47725695 BTC before funds moved to downstream addresses. Some victim funds crossed through THORChain to Ethereum and entered Duel; public evidence does not establish the complete onward route.\n\n## Amount basis\nThe first three waves total approximately 1,367.05 BTC. SlowMist Hacked Zone rounds that confirmed scale to about $89 million, while the report gives an estimate near $88.6 million; the website uses approximately $89 million for the confirmed cumulative loss. The 388.92748828 BTC fourth-wave figure remains an initial report and is not added.\n\n## Evidence boundary\nCoinkite officially confirmed the firmware flaw and migration requirement. Galaxy Research, Lookonchain, and other on-chain researchers support the wave and aggregation estimates. The fourth-wave address list and some attributions remain under correction, and a mixed-input transaction cannot be assigned entirely to this incident.\n\n## Current status\nCoinkite released corrected firmware and migration guidance. Public evidence did not confirm return of funds, freezing, or judicial seizure; the fourth wave remained under investigation and address review.\n\n## August 12 disclosure update\nDuring this report window, SlowMist published a technical reconstruction of the COLDCARD weak-randomness attack chain and gave a cross-period, multi-wave cumulative basis of at least 1,719 BTC, about $111M, across more than 5,200 addresses. This updates the cumulative amount basis in the public dossier but does not prove that all actions occurred inside the August 11–12 window.\n\n## Updated evidence boundary\nSlowMist did not publish a complete list of the more than 5,200 addresses, a transaction-level ledger, or recoverable timestamps for the original actions. The 1,719 BTC figure is the discloser's aggregate basis; the address count is not treated as a victim count, and the disclosure date is not treated as the attack date.\n\n## August 19 investigation update\nWuBlockchain and Bitcoin Magazine reported a COLDCARD Wave 1 investigative lead: the old-case activity involving about 1,082.65 BTC was reportedly linked to a paid blockchain-data-service account and internal logs, and investigators may have given the FBI the first-wave attacker identity. This is not an official indictment, seizure, or identity confirmation.\n\n## Updated evidence boundary\nNo new complete addresses, transaction set, FBI/DOJ indictment, or seizure notice was public. The USD conversion has a public correction signal, so the record keeps 1,082.65 BTC only and does not treat the disclosure date as a new theft date.\n\n## August 19 investigation update\nWuBlockchain and Bitcoin Magazine reported a COLDCARD Wave 1 investigative lead: the old-case activity involving about 1,082.65 BTC was reportedly linked to a paid blockchain-data-service account and internal logs, and investigators may have given the FBI the first-wave attacker identity. This is not an official indictment, seizure, or identity confirmation.\n\n## Updated evidence boundary\nNo new complete addresses, transaction set, FBI/DOJ indictment, or seizure notice was public. The USD conversion has a public correction signal, so the record keeps 1,082.65 BTC only and does not treat the disclosure date as a new theft date.\n\n## August 19 investigation update\nWuBlockchain and Bitcoin Magazine reported a COLDCARD Wave 1 investigative lead: the old-case activity involving about 1,082.65 BTC was reportedly linked to a paid blockchain-data-service account and internal logs, and investigators may have given the FBI the first-wave attacker identity. This is not an official indictment, seizure, or identity confirmation.\n\n## Updated evidence boundary\nNo new complete addresses, transaction set, FBI/DOJ indictment, or seizure notice was public. The USD conversion has a public correction signal, so the record keeps 1,082.65 BTC only and does not treat the disclosure date as a new theft date.\n\n## September 2026 fund movement\nFrom September 1 through 3, wallets linked to Wave 3 moved a substantial amount for the first time. About 20.45 BTC was routed through THORChain swap attempts, with assets corresponding to about 20.15 BTC reaching the main Ethereum receiver. This was post-incident movement, not a new loss.\n\n## Updated evidence boundary\nThe public Bitquery CSV provides dates, blocks, and cross-chain records, while some source wallets remain reported labels. The 34 swaps and aggregate transfers represent the same funds and are not additive. No public evidence confirmed a final deposit at a freeze-capable exchange." }, "category": "wallet-vulnerability", "severity": "critical", "ecosystems": [ "Bitcoin" ], "chains": [ "Bitcoin" ], "lossUsd": 111000000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "SlowMist 于 2026-08-12 披露至少 1,719 BTC，约 $111M；这是跨期多波累计口径。旧记录约 $89M 只对应前三波确认规模，第四波初报不另行计入。", "tw": "SlowMist 於 2026-08-12 披露至少 1,719 BTC，約 $111M；這是跨期多波累計口徑。舊記錄約 $89M 只對應前三波確認規模，第四波初報不另行計入。", "en": "SlowMist disclosed at least 1,719 BTC, about $111M, on August 12, 2026; this is a cross-period cumulative figure. The earlier approximately $89M basis covered only the first three confirmed waves, and the initial fourth-wave figure is not added." }, "addressDisclosure": "published", "addresses": [ { "chain": "Bitcoin", "address": "bc1qnk4zh9qcnap2mycp56qjrgza3cc8ylrh8fecp0", "entity": { "zh": "COLDCARD 批量盗转公开归集地址", "tw": "COLDCARD 批量盜轉公開歸集地址", "en": "Public aggregation address in the COLDCARD mass theft" }, "role": "attacker", "category": "stolen_funds", "confidence": 0.88, "sourceUrl": "https://x.com/lookonchain/status/2083074854190985535", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Lookonchain 将约 500 个钱包转出的 594.48 BTC 与该地址关联；标签限于本次公开聚类。", "tw": "Lookonchain 將約 500 個錢包轉出的 594.48 BTC 與該地址關聯；標籤限於本次公開聚類。", "en": "Lookonchain linked 594.48 BTC from approximately 500 wallets to this address; the label is limited to this public cluster." }, "reviewRequired": true }, { "chain": "Bitcoin", "address": "bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r", "entity": { "zh": "COLDCARD 批量盗转下游归集地址", "tw": "COLDCARD 批量盜轉下游歸集地址", "en": "Downstream aggregation address in the COLDCARD mass theft" }, "role": "downstream-aggregation", "category": "stolen_funds", "confidence": 0.86, "sourceUrl": "https://mempool.space/address/bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "公开研究将该地址标为早期归集地址的下游持有方；标签不扩展为已确认攻击者身份。", "tw": "公開研究將該地址標為早期歸集地址的下游持有方；標籤不擴展為已確認攻擊者身份。", "en": "Public research identifies this address as a downstream holder of the early aggregation path; the label does not establish the controller as an attacker." }, "reviewRequired": true }, { "chain": "Bitcoin", "address": "1N8knQCfjqUeJQwjkZZavbboXXL6WVqfDo", "entity": { "zh": "COLDCARD 第四波关联暂存地址", "tw": "COLDCARD 第四波關聯暫存地址", "en": "Temporary holding address linked to the COLDCARD fourth wave" }, "role": "temporary-holding", "category": "stolen_funds", "confidence": 0.78, "sourceUrl": "https://mempool.space/address/1N8knQCfjqUeJQwjkZZavbboXXL6WVqfDo", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "单一研究者将该地址与第四波输入关联；已核金额仅指其对混合交易的贡献。", "tw": "單一研究者將該地址與第四波輸入關聯；已核金額僅指其對混合交易的貢獻。", "en": "One researcher linked this address to fourth-wave inputs; the confirmed amount is limited to its contribution to a mixed transaction." }, "reviewRequired": true }, { "chain": "Bitcoin", "address": "23a84f33fe49943e34f58bcecc945f719208f10c2a65f1ea12944ec103bc709c", "entity": { "zh": "COLDCARD 第四波关联归集交易", "tw": "COLDCARD 第四波關聯歸集交易", "en": "Aggregation transaction linked to the COLDCARD fourth wave" }, "role": "aggregation-transaction", "category": "unknown", "confidence": 0.82, "sourceUrl": "https://mempool.space/tx/23a84f33fe49943e34f58bcecc945f719208f10c2a65f1ea12944ec103bc709c", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "该交易含 34 个输入和 2 个输出；其中只有一个输入被研究者与第四波关联。", "tw": "該交易含 34 個輸入和 2 個輸出；其中只有一個輸入被研究者與第四波關聯。", "en": "The transaction has 34 inputs and 2 outputs; only one input was linked to the fourth wave by public research." }, "reviewRequired": true }, { "chain": "Bitcoin", "address": "bc1qdj58duywm3ng0twrxk5kykup9q6jmmj72n60ms", "entity": { "zh": "COLDCARD 关联交易疑似 Coinbase 目的地", "tw": "COLDCARD 關聯交易疑似 Coinbase 目的地", "en": "Suspected Coinbase destination in a COLDCARD-linked transaction" }, "role": "attributed-destination", "category": "unknown", "confidence": 0.62, "sourceUrl": "https://x.com/noackdom/status/2084138299690566092", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "单一研究者将该地址归因为 Coinbase 目的地，尚无 Coinbase 官方冻结或身份确认。", "tw": "單一研究者將該地址歸因為 Coinbase 目的地，尚無 Coinbase 官方凍結或身份確認。", "en": "One researcher attributed this address to a Coinbase destination; Coinbase has not publicly confirmed the identity or a freeze." }, "reviewRequired": true }, { "chain": "Bitcoin", "address": "334iKwmhLKzJFoijrcQwcBFfFth7QjJ6gB", "entity": { "zh": "COLDCARD Wave 3 攻击者停放地址", "tw": "COLDCARD Wave 3 攻擊者停放地址", "en": "COLDCARD Wave 3 attacker holding address" }, "role": "attacker-holding", "category": "stolen_funds", "confidence": 0.84, "sourceUrl": "https://bitquery.io/coldcard-hack/", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "COLDCARD Wave 3 攻击者停放地址", "tw": "COLDCARD Wave 3 攻擊者停放地址", "en": "COLDCARD Wave 3 attacker holding address" }, "reviewRequired": true }, { "chain": "Bitcoin", "address": "3Qm8C2ns2XpzLq36xGbTYAAVNfd924RtV9", "entity": { "zh": "COLDCARD Wave 3 中转地址", "tw": "COLDCARD Wave 3 中轉地址", "en": "COLDCARD Wave 3 transit address" }, "role": "transit", "category": "stolen_funds", "confidence": 0.78, "sourceUrl": "https://bitquery.io/coldcard-hack/", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "COLDCARD Wave 3 中转地址", "tw": "COLDCARD Wave 3 中轉地址", "en": "COLDCARD Wave 3 transit address" }, "reviewRequired": true }, { "chain": "Bitcoin", "address": "bc1qn3uy9j26m79vghed2uddr89l344xa5efnn4d0rxhz4q3xxlyxryqq595ld", "entity": { "zh": "COLDCARD Wave 3 来源地址", "tw": "COLDCARD Wave 3 來源地址", "en": "COLDCARD Wave 3 source address" }, "role": "attacker-source", "category": "stolen_funds", "confidence": 0.8, "sourceUrl": "https://bitquery.io/coldcard-hack/", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "COLDCARD Wave 3 来源地址", "tw": "COLDCARD Wave 3 來源地址", "en": "COLDCARD Wave 3 source address" }, "reviewRequired": true }, { "chain": "Bitcoin", "address": "bc1qt8rrtnxlszm7rcdjpeepzk076jd5hevakqerzjyxpk8u3p6dfh2q92ua36", "entity": { "zh": "COLDCARD Wave 3 攻击者停放地址", "tw": "COLDCARD Wave 3 攻擊者停放地址", "en": "COLDCARD Wave 3 attacker holding address" }, "role": "attacker-holding", "category": "stolen_funds", "confidence": 0.85, "sourceUrl": "https://bitquery.io/coldcard-hack/", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "COLDCARD Wave 3 攻击者停放地址", "tw": "COLDCARD Wave 3 攻擊者停放地址", "en": "COLDCARD Wave 3 attacker holding address" }, "reviewRequired": true }, { "chain": "Bitcoin", "address": "bc1q4tsjmdrdr7welf49uhywxgvuxrnqxu7cs6rfr3yv34zume2tw6msrtwzdc", "entity": { "zh": "COLDCARD THORChain 前中转地址", "tw": "COLDCARD THORChain 前中轉地址", "en": "COLDCARD pre-THORChain transit address" }, "role": "bridge-transit", "category": "stolen_funds", "confidence": 0.82, "sourceUrl": "https://bitquery.io/coldcard-hack/", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "COLDCARD THORChain 前中转地址", "tw": "COLDCARD THORChain 前中轉地址", "en": "COLDCARD pre-THORChain transit address" }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x160a7A4c067B084F03400c6980Ac29F73F6782f6", "entity": { "zh": "COLDCARD 跨链后主接收地址", "tw": "COLDCARD 跨鏈後主接收地址", "en": "COLDCARD main post-bridge receiver" }, "role": "stolen-funds-destination", "category": "stolen_funds", "confidence": 0.88, "sourceUrl": "https://bitquery.io/coldcard-hack/", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "COLDCARD 跨链后主接收地址", "tw": "COLDCARD 跨鏈後主接收地址", "en": "COLDCARD main post-bridge receiver" }, "reviewRequired": true } ], "references": [ { "label": { "zh": "Coinkite 种子生成安全警告", "tw": "Coinkite 種子生成安全警告", "en": "Coinkite seed-generation security warning" }, "url": "https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/", "type": "official" }, { "label": { "zh": "Coinkite 熵技术说明", "tw": "Coinkite 熵技術說明", "en": "Coinkite entropy technical backgrounder" }, "url": "https://blog.coinkite.com/entropy-technical-backgrounder/", "type": "official" }, { "label": { "zh": "Lookonchain 链上归集分析", "tw": "Lookonchain 鏈上歸集分析", "en": "Lookonchain on-chain aggregation analysis" }, "url": "https://x.com/lookonchain/status/2083074854190985535", "type": "research" }, { "label": { "zh": "Chainalysis 受害者分析", "tw": "Chainalysis 受害者分析", "en": "Chainalysis victim analysis" }, "url": "https://x.com/chainalysis/status/2083270377065558343", "type": "research" }, { "label": { "zh": "Mempool.Space 归集地址", "tw": "Mempool.Space 歸集地址", "en": "Mempool.Space aggregation address" }, "url": "https://mempool.space/address/bc1qnk4zh9qcnap2mycp56qjrgza3cc8ylrh8fecp0", "type": "explorer" }, { "label": { "zh": "代表性首批入账交易", "tw": "代表性首批入賬交易", "en": "Representative first-batch transaction" }, "url": "https://mempool.space/tx/1ab4369f4a204db6cac58657e2d965b424c811c431c4eb986661b8f3d8e9a8f6", "type": "explorer" }, { "label": { "zh": "代表性主要批次交易", "tw": "代表性主要批次交易", "en": "Representative main-batch transaction" }, "url": "https://mempool.space/tx/69e67b8b9749caccc70cbb82c051b9d333bd454f7ba54a35ddab9c16aee008fe", "type": "explorer" }, { "label": { "zh": "Coldcard 第四波实时研究", "tw": "Coldcard 第四波實時研究", "en": "Coldcard fourth-wave live research" }, "url": "https://x.com/intangiblecoins/status/2084079706320646300", "type": "research" }, { "label": { "zh": "Coldcard 第四波交易更正", "tw": "Coldcard 第四波交易更正", "en": "Coldcard fourth-wave transaction correction" }, "url": "https://x.com/intangiblecoins/status/2084091366720655844", "type": "research" }, { "label": { "zh": "Coldcard 官方更新", "tw": "Coldcard 官方更新", "en": "Coldcard official update" }, "url": "https://x.com/COLDCARDwallet/status/2084051697148498394", "type": "official" }, { "label": { "zh": "Coldcard 关联归集交易", "tw": "Coldcard 關聯歸集交易", "en": "Coldcard-linked aggregation transaction" }, "url": "https://mempool.space/tx/23a84f33fe49943e34f58bcecc945f719208f10c2a65f1ea12944ec103bc709c", "type": "explorer" }, { "label": { "zh": "SlowMist Hacked Zone 记录", "tw": "SlowMist Hacked Zone 記錄", "en": "SlowMist Hacked Zone record" }, "url": "https://hacked.slowmist.io/", "type": "research" }, { "label": { "zh": "SlowMist COLDCARD 弱随机数技术披露", "tw": "SlowMist COLDCARD 弱隨機數技術披露", "en": "SlowMist COLDCARD weak-randomness technical disclosure" }, "url": "https://x.com/SlowMist_Team/status/2087438490518892592", "type": "research" }, { "label": { "zh": "COLDCARD 官方安全更新", "tw": "COLDCARD 官方安全更新", "en": "COLDCARD official security update" }, "url": "https://x.com/COLDCARDwallet/status/2083081854597374168", "type": "official" }, { "label": { "zh": "Coinkite 熵技术背景", "tw": "Coinkite 熵技術背景", "en": "Coinkite entropy technical background" }, "url": "https://blog.coinkite.com/entropy-technical-backgrounder", "type": "official" }, { "label": { "zh": "WuBlockchain COLDCARD 调查更新", "tw": "WuBlockchain COLDCARD 調查更新", "en": "WuBlockchain COLDCARD investigation update" }, "url": "https://x.com/WuBlockchain/status/2089931912823636285", "type": "research" }, { "label": { "zh": "WuBlockchain 来源链接帖", "tw": "WuBlockchain 來源鏈接帖", "en": "WuBlockchain source-link post" }, "url": "https://x.com/WuBlockchain/status/2089932241204048025", "type": "research" }, { "label": { "zh": "Bitcoin Magazine Wave 1 调查", "tw": "Bitcoin Magazine Wave 1 調查", "en": "Bitcoin Magazine Wave 1 investigation" }, "url": "https://bitcoinmagazine.com/technical/hunting-down-the-coldcard-hacker-wave-1-thief-may-be-known-to-fbi", "type": "research" }, { "label": { "zh": "COLDCARD Wave 3 资金异动披露", "tw": "COLDCARD Wave 3 資金異動披露", "en": "COLDCARD Wave 3 fund-movement disclosure" }, "url": "https://x.com/intangiblecoins/status/2095297452681158840", "type": "research" }, { "label": { "zh": "Bitquery COLDCARD 追踪", "tw": "Bitquery COLDCARD 追蹤", "en": "Bitquery COLDCARD tracking" }, "url": "https://bitquery.io/coldcard-hack/", "type": "research" }, { "label": { "zh": "Bitquery COLDCARD 移动 CSV", "tw": "Bitquery COLDCARD 移動 CSV", "en": "Bitquery COLDCARD movements CSV" }, "url": "https://bitquery.io/coldcard-hack/downloads/coldcard-movements.csv", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-197", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-194", "status": "verified", "incidentDate": "2026-07-29", "datePrecision": "day", "title": { "zh": "Relay AI 会议工具求职恶意软件活动", "tw": "Relay AI 會議工具求職惡意軟體活動", "en": "Relay AI meeting-tool recruitment malware campaign" }, "summary": { "zh": "SlowMist MistEye 披露一项针对 Web3 从业者的求职诈骗活动。攻击者冒充招聘人员，引导目标在 macOS 或 Windows 上安装伪装成 Relay AI 会议工具的恶意软件，以窃取终端凭据。", "tw": "SlowMist MistEye 披露一項針對 Web3 從業者的求職詐騙活動。攻擊者冒充招聘人員，引導目標在 macOS 或 Windows 上安裝偽裝成 Relay AI 會議工具的惡意軟體，以竊取終端憑據。", "en": "SlowMist MistEye disclosed a recruitment-scam campaign targeting Web3 professionals. Attackers impersonated recruiters and induced targets to install malware disguised as the Relay AI meeting tool on macOS or Windows in order to steal endpoint credentials." }, "details": { "zh": "## 事件背景\n2026 年 7 月 29 日，SlowMist MistEye 发布针对 Web3 从业者的活跃求职恶意软件预警。该活动利用招聘沟通建立信任并推动安装伪装软件。\n\n## 事件经过\n攻击者冒充招聘人员，向目标提供伪装为 Relay AI 会议工具的安装包。恶意软件面向 macOS 与 Windows，目标是终端凭据和与数字资产相关的敏感信息。\n\n## 资金流向\n公开预警没有披露具体受害钱包、链上转移地址或交易，因此没有可核链上资金路径。\n\n## 金额口径\n没有统一受害人数或损失金额，因此损失金额保持未知。该记录代表已确认的恶意软件分发活动，不把未知金额写成 0。\n\n## 证据边界\nSlowMist 官方预警支持招聘诱导、伪装产品、目标平台和凭据窃取目的。公开资料不足以确认具体恶意样本哈希、攻击者身份或受害规模。\n\n## 处置状态\n活动仍处于预警和防范阶段。用户应从已验证渠道下载会议软件并隔离面试设备；没有公开冻结或追回金额。", "tw": "## 事件背景\n2026 年 7 月 29 日，SlowMist MistEye 釋出針對 Web3 從業者的活躍求職惡意軟體預警。該活動利用招聘溝通建立信任並推動安裝偽裝軟體。\n\n## 事件經過\n攻擊者冒充招聘人員，向目標提供偽裝為 Relay AI 會議工具的安裝包。惡意軟體面向 macOS 與 Windows，目標是終端憑據和與數字資產相關的敏感資訊。\n\n## 資金流向\n公開預警沒有披露具體受害錢包、鏈上轉移地址或交易，因此沒有可核鏈上資金路徑。\n\n## 金額口徑\n沒有統一受害人數或損失金額，因此損失金額保持未知。該記錄代表已確認的惡意軟體分發活動，不把未知金額寫成 0。\n\n## 證據邊界\nSlowMist 官方預警支援招聘誘導、偽裝產品、目標平臺和憑據竊取目的。公開資料不足以確認具體惡意樣本雜湊、攻擊者身份或受害規模。\n\n## 處置狀態\n活動仍處於預警和防範階段。使用者應從已驗證渠道下載會議軟體並隔離面試裝置；沒有公開凍結或追回金額。", "en": "## Incident overview\nOn July 29, 2026, SlowMist MistEye published an alert about an active recruitment-malware campaign targeting Web3 professionals. The campaign used recruitment conversations to build trust and induce installation of disguised software.\n\n## Incident sequence\nAttackers impersonated recruiters and supplied installers presented as the Relay AI meeting tool. The malware targeted macOS and Windows endpoints and sought credentials and other digital-asset-related sensitive information.\n\n## Fund flow\nThe public alert does not disclose a specific victim wallet, on-chain transfer address, or transaction, so there is no verifiable fund path.\n\n## Amount basis\nNo unified victim count or loss amount is disclosed, so the loss amount remains unknown. The record represents a confirmed malicious-distribution campaign and does not convert an unknown amount into zero.\n\n## Evidence boundary\nSlowMist’s official alert supports the recruitment lure, disguised product, target platforms, and credential-theft purpose. Public material does not establish a complete sample-hash set, attacker identity, or victim scale.\n\n## Current status\nThe campaign remains in an alert and prevention phase. Users should download meeting software only from verified channels and isolate interview devices. No public frozen or recovered amount exists." }, "category": "supply-chain", "severity": "high", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开预警未披露统一受害人数或损失金额。", "tw": "公開預警未披露統一受害人數或損失金額。", "en": "The public alert does not disclose a unified victim count or loss amount." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "SlowMist 求职恶意软件预警", "tw": "SlowMist 求職惡意軟體預警", "en": "SlowMist recruitment-malware alert" }, "url": "https://x.com/SlowMist_Team/status/2082357983250637073", "type": "official" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-194", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-193", "status": "verified", "incidentDate": "2026-07-29", "datePrecision": "day", "title": { "zh": "LULA recycle() 储备操纵攻击", "tw": "LULA recycle() 儲備操縱攻擊", "en": "LULA recycle() reserve-manipulation exploit" }, "summary": { "zh": "LULA Rental 合约的特权 recycle() 可直接从 PancakeSwap V2 池转出 LULA 并调用 sync()。攻击者结合闪电贷、奖励领取和储备更新，最终获得 578,295.907588061 USDT。", "tw": "LULA Rental 合約的特權 recycle() 可直接從 PancakeSwap V2 池轉出 LULA 並呼叫 sync()。攻擊者結合閃電貸、獎勵領取和儲備更新，最終獲得 578,295.907588061 USDT。", "en": "The privileged recycle() function in the LULA Rental contract could move LULA directly from a PancakeSwap V2 pool and call sync(). The attacker combined flash liquidity, reward claims, and reserve updates to obtain 578,295.907588061 USDT." }, "details": { "zh": "## 事件背景\n2026 年 7 月 29 日，BNB Chain 上的 LULA 体系遭储备操纵攻击。安全机构将根因指向 Rental 合约中的特权 recycle() 与池储备同步组合。\n\n## 事件经过\n攻击者先构建大规模临时流动性并购买 LULA，随后反复执行 claimReward()、recycle() 与 sync()。池中 LULA 储备接近归零，而 USDT 储备被保留在高位，攻击者再以少量 LULA 抽取 USDT。\n\n## 资金流向\n核心交易最终从攻击合约向攻击执行地址转出 578,295.907588061 USDT。攻击者、攻击合约、代币合约、交易池和团队指定返还地址均有公开记录。\n\n## 金额口径\n公开损失采用核心交易最终转给攻击者的 578,295.907588061 USDT。约 2.37 亿美元是闪电贷和临时流动性规模，不能计为损失。\n\n## 证据边界\nBlockSec、CertiK、BscScan 和团队链上消息支持攻击机制、地址、交易与金额。团队提出的返还条件只是谈判方案，不等于已经返还。\n\n## 处置状态\n团队通过链上消息提出 36 小时内返还至少 25% 的条件。截至报告截止，没有公开返还、冻结或司法扣押证据，冻结与追回金额均为 0。", "tw": "## 事件背景\n2026 年 7 月 29 日，BNB Chain 上的 LULA 體系遭儲備操縱攻擊。安全機構將根因指向 Rental 合約中的特權 recycle() 與池儲備同步組合。\n\n## 事件經過\n攻擊者先構建大規模臨時流動性並購買 LULA，隨後反覆執行 claimReward()、recycle() 與 sync()。池中 LULA 儲備接近歸零，而 USDT 儲備被保留在高位，攻擊者再以少量 LULA 抽取 USDT。\n\n## 資金流向\n核心交易最終從攻擊合約向攻擊執行地址轉出 578,295.907588061 USDT。攻擊者、攻擊合約、代幣合約、交易池和團隊指定返還地址均有公開記錄。\n\n## 金額口徑\n公開損失採用核心交易最終轉給攻擊者的 578,295.907588061 USDT。約 2.37 億美元是閃電貸和臨時流動性規模，不能計為損失。\n\n## 證據邊界\nBlockSec、CertiK、BscScan 和團隊鏈上消息支援攻擊機制、地址、交易與金額。團隊提出的返還條件只是談判方案，不等於已經返還。\n\n## 處置狀態\n團隊通過鏈上消息提出 36 小時內返還至少 25% 的條件。截至報告截止，沒有公開返還、凍結或司法扣押證據，凍結與追回金額均為 0。", "en": "## Incident overview\nOn July 29, 2026, the LULA system on BNB Chain was exploited through reserve manipulation. Security firms traced the mechanism to the privileged recycle() function in the Rental contract combined with pool reserve synchronization.\n\n## Incident sequence\nThe attacker assembled substantial temporary liquidity and bought LULA, then repeatedly called claimReward(), recycle(), and sync(). LULA reserves in the pool approached zero while USDT reserves remained high, allowing the attacker to remove USDT with a small amount of LULA.\n\n## Fund flow\nThe core transaction ultimately transferred 578,295.907588061 USDT from the attack contract to the executing address. Public sources identify the attacker, attack contract, token contract, pool, and team-designated return address.\n\n## Amount basis\nReported loss uses the 578,295.907588061 USDT transferred to the attacker in the core transaction. Approximately $237 million was flash liquidity and temporary capital, not loss.\n\n## Evidence boundary\nBlockSec, CertiK, BscScan, and the team’s on-chain message support the mechanism, addresses, transactions, and amount. The team’s return condition was a negotiation proposal, not completed repayment.\n\n## Current status\nThe team offered a 36-hour condition to return at least 25%. At the report cutoff, no public evidence confirmed return, freezing, or judicial seizure, so frozen and recovered amounts remain 0." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "BNB Chain" ], "chains": [ "BNB Chain" ], "lossUsd": 578295.907588061, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "核心交易最终向攻击者转出 578,295.907588061 USDT；闪电贷规模不计为损失。", "tw": "核心交易最終向攻擊者轉出 578,295.907588061 USDT；閃電貸規模不計為損失。", "en": "The core transaction transferred 578,295.907588061 USDT to the attacker; flash-liquidity scale is not counted as loss." }, "addressDisclosure": "published", "addresses": [ { "chain": "BNB Chain", "address": "0x2677806d48325Ced7533C54B86eD5e99b129a4ED", "entity": { "zh": "LULA 攻击执行地址", "tw": "LULA 攻擊執行地址", "en": "LULA attack executor" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://bscscan.com/tx/0xa219ab9d57e520e5235b15a8801f4ebac8cc45551be0430ce4e49caea0411d7c", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "BscScan 和安全机构将该地址识别为 LULA 攻击执行地址。", "tw": "BscScan 和安全機構將該地址識別為 LULA 攻擊執行地址。", "en": "BscScan and security firms identify this address as the LULA attack executor." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x5E506Ba06Fa6C61d1069B0E68d7013DE35AFA816", "entity": { "zh": "LULA 攻击合约", "tw": "LULA 攻擊合約", "en": "LULA attack contract" }, "role": "attacker-contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://bscscan.com/tx/0xa219ab9d57e520e5235b15a8801f4ebac8cc45551be0430ce4e49caea0411d7c", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "核心交易显示该合约执行储备操纵并向攻击地址转出 USDT。", "tw": "核心交易顯示該合約執行儲備操縱並向攻擊地址轉出 USDT。", "en": "The core transaction shows this contract executing the reserve manipulation and transferring USDT to the attacker." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xf5d7029eb6751d170dcf0bb1c87af6f93d5a2e9a", "entity": { "zh": "LULA 代币合约", "tw": "LULA 代幣合約", "en": "LULA token contract" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/Phalcon_xyz/status/2082298859481608516", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "BlockSec 分析将该地址列为 LULA 代币合约。", "tw": "BlockSec 分析將該地址列為 LULA 代幣合約。", "en": "BlockSec analysis identifies this address as the LULA token contract." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xf0b36389a12a28be1280c0ec2a4bbc76889d6a96", "entity": { "zh": "PancakeSwap V2 BSC-USD/LULA 受影响池", "tw": "PancakeSwap V2 BSC-USD/LULA 受影響池", "en": "Affected PancakeSwap V2 BSC-USD/LULA pool" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/CertiKAlert/status/2082309959484911845", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "CertiK 分析将该池列为储备被操纵的交易对。", "tw": "CertiK 分析將該池列為儲備被操縱的交易對。", "en": "CertiK analysis identifies this pair as the pool whose reserves were manipulated." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x5e16609D18bF366b5502b088E0253dE45fc1CD96", "entity": { "zh": "LULA 团队指定返还地址", "tw": "LULA 團隊指定返還地址", "en": "LULA team-designated return address" }, "role": "recovery", "category": "unknown", "confidence": 0.95, "sourceUrl": "https://bscscan.com/tx/0x392fc1d6cb1b3c832983c7eabb94a96b895c2f1c16c472a15930d4d7c4efc52d", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "团队链上谈判消息将该地址指定为返还地址；没有证据显示资金已经转入。", "tw": "團隊鏈上談判消息將該地址指定為返還地址；沒有證據顯示資金已經轉入。", "en": "The team’s on-chain negotiation message designates this as the return address; no evidence shows that funds were transferred to it." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "BlockSec Phalcon 分析", "tw": "BlockSec Phalcon 分析", "en": "BlockSec Phalcon analysis" }, "url": "https://x.com/Phalcon_xyz/status/2082298859481608516", "type": "research" }, { "label": { "zh": "CertiK 分析", "tw": "CertiK 分析", "en": "CertiK analysis" }, "url": "https://x.com/CertiKAlert/status/2082309959484911845", "type": "research" }, { "label": { "zh": "团队链上谈判消息", "tw": "團隊鏈上談判消息", "en": "Team on-chain negotiation message" }, "url": "https://x.com/DefimonAlerts/status/2082315406627213456", "type": "research" }, { "label": { "zh": "BscScan 核心攻击交易", "tw": "BscScan 核心攻擊交易", "en": "BscScan core attack transaction" }, "url": "https://bscscan.com/tx/0xa219ab9d57e520e5235b15a8801f4ebac8cc45551be0430ce4e49caea0411d7c", "type": "explorer" }, { "label": { "zh": "BscScan 谈判消息交易", "tw": "BscScan 談判消息交易", "en": "BscScan negotiation-message transaction" }, "url": "https://bscscan.com/tx/0x392fc1d6cb1b3c832983c7eabb94a96b895c2f1c16c472a15930d4d7c4efc52d", "type": "explorer" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-193", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-191", "status": "verified", "incidentDate": "2026-07-28", "datePrecision": "day", "title": { "zh": "TheIndexFi 前成员委托权限未撤销事件", "tw": "TheIndexFi 前成員委託權限未撤銷事件", "en": "TheIndexFi former-member delegated-access incident" }, "summary": { "zh": "TheIndexFi 的 X 账号发布异常钱包连接内容。项目方确认并非外部黑客接管，而是一名前成员仍保留委托访问权限；团队删除内容并撤销访问。没有确认受害交易或损失。", "tw": "TheIndexFi 的 X 賬號釋出異常錢包連線內容。專案方確認並非外部駭客接管，而是一名前成員仍保留委託訪問權限；團隊刪除內容並撤銷訪問。沒有確認受害交易或損失。", "en": "TheIndexFi’s X account published abnormal wallet-connection content. The project said this was not an external takeover: a former member still retained delegated access. The team removed the content and revoked access. No victim transaction or loss has been confirmed." }, "details": { "zh": "## 事件背景\n2026 年 7 月 28 日，TheIndexFi 的官方 X 账号发布要求用户连接钱包的异常内容，引发社区安全警告。\n\n## 事件经过\n异常帖子随后被删除。项目方说明，一名早期成员的委托权限未及时撤销，仍可访问账号；团队确认后彻底撤销该成员权限。\n\n## 资金流向\n公开材料没有披露恶意域名、合约、受害地址或资产转移交易，因此没有可核资金路径。\n\n## 金额口径\n没有确认损失，公开损失记为 0。零损失表示已执行的账号权限事件未发现资产损失，不代表该内容没有安全风险。\n\n## 证据边界\n项目方说明支持前成员委托权限未撤销和异常内容已删除。现有证据不支持写成外部黑客接管，也不支持推断受害人数。\n\n## 处置状态\n异常内容已删除，相关委托权限已撤销。未发现公开受害交易，冻结与追回金额均为 0。", "tw": "## 事件背景\n2026 年 7 月 28 日，TheIndexFi 的官方 X 賬號釋出要求使用者連線錢包的異常內容，引發社群安全警告。\n\n## 事件經過\n異常帖子隨後被刪除。專案方說明，一名早期成員的委託權限未及時撤銷，仍可訪問賬號；團隊確認後徹底撤銷該成員權限。\n\n## 資金流向\n公開材料沒有披露惡意域名、合約、受害地址或資產轉移交易，因此沒有可核資金路徑。\n\n## 金額口徑\n沒有確認損失，公開損失記為 0。零損失表示已執行的賬號權限事件未發現資產損失，不代表該內容沒有安全風險。\n\n## 證據邊界\n專案方說明支援前成員委託權限未撤銷和異常內容已刪除。現有證據不支援寫成外部駭客接管，也不支援推斷受害人數。\n\n## 處置狀態\n異常內容已刪除，相關委託權限已撤銷。未發現公開受害交易，凍結與追回金額均為 0。", "en": "## Incident overview\nOn July 28, 2026, TheIndexFi’s official X account published abnormal content asking users to connect a wallet, prompting community security warnings.\n\n## Incident sequence\nThe post was deleted. The project explained that an early member’s delegated access had not been revoked and still allowed account access. The team then removed that access completely.\n\n## Fund flow\nPublic material does not disclose a malicious domain, contract, victim address, or asset-transfer transaction, so there is no verifiable fund path.\n\n## Amount basis\nNo loss is confirmed and reported loss is 0. A zero-loss value means that this executed access incident has no identified asset loss, not that the content posed no security risk.\n\n## Evidence boundary\nThe project statement supports the retained delegated access and removal of the abnormal content. Evidence does not support describing the event as an external hacker takeover or inferring a victim count.\n\n## Current status\nThe abnormal content was deleted and delegated access was revoked. No public victim transaction has been found, and frozen and recovered amounts remain 0." }, "category": "access-control", "severity": "medium", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": 0, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "没有确认受害交易或资产损失。", "tw": "沒有確認受害交易或資產損失。", "en": "No victim transaction or asset loss has been confirmed." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "TheIndexFi 异常原帖", "tw": "TheIndexFi 異常原帖", "en": "TheIndexFi abnormal post" }, "url": "https://x.com/TheIndexFi/status/2081980589272437079", "type": "research" }, { "label": { "zh": "TheIndexFi 官方权限说明", "tw": "TheIndexFi 官方權限說明", "en": "TheIndexFi official access explanation" }, "url": "https://x.com/TheIndexFi/status/2081994758021689694", "type": "official" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-191", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-190", "status": "verified", "incidentDate": "2026-07-28", "datePrecision": "day", "title": { "zh": "CryptoDAO Global / PRO 访问控制漏洞", "tw": "CryptoDAO Global / PRO 訪問控制漏洞", "en": "CryptoDAO Global / PRO access-control exploit" }, "summary": { "zh": "CryptoDAO Global 的 PRO 合约旧实现中，exec() 缺少调用者检查。攻击者通过合约反复调用该函数并操纵 PRO/USDT 价格，获得约 52,000 美元利润；代理随后升级到增加调用者检查的新实现。", "tw": "CryptoDAO Global 的 PRO 合約舊實現中，exec() 缺少呼叫者檢查。攻擊者通過合約反覆呼叫該函式並操縱 PRO/USDT 價格，獲得約 52,000 美元利潤；代理隨後升級到增加呼叫者檢查的新實現。", "en": "In CryptoDAO Global’s previous PRO implementation, exec() lacked a caller check. The attacker repeatedly invoked the function through an attack contract and distorted the PRO/USDT price, earning approximately $52,000. The proxy was later upgraded to an implementation with caller validation." }, "details": { "zh": "## 事件背景\n2026 年 7 月 28 日，BNB Chain 上的 CryptoDAO Global / PRO 合约遭访问控制利用。GoPlus 发布了攻击合约、执行地址、代理实现和升级交易。\n\n## 事件经过\n旧实现的 exec() 可由任意外部合约调用。攻击者反复执行每次将 50 PRO 兑换为 USDT 的路径，扭曲 PRO/USDT 交易对价格，随后卖出自有 PRO 获利。\n\n## 资金流向\n被利用合约损失 167,200 PRO，这些 PRO 按合约预设接收路径转移。攻击者实现的利润约为 52,000 美元；预设接收者地址不等同于攻击者。\n\n## 金额口径\n公开损失采用攻击者约 52,000 美元利润口径。167,200 PRO 是受影响代币数量，不作为另一笔美元损失相加；其他地址资产余额也不计为盗取金额。\n\n## 证据边界\nGoPlus 分析和 BscScan 交易支持缺少调用者检查、重复调用、价格变化、攻击地址与修复升级。项目方尚未发布完整技术复盘。\n\n## 处置状态\n代理合约已升级到增加调用者检查的新实现。没有公开证据确认攻击收益已返还、冻结或被司法扣押。", "tw": "## 事件背景\n2026 年 7 月 28 日，BNB Chain 上的 CryptoDAO Global / PRO 合約遭訪問控制利用。GoPlus 釋出了攻擊合約、執行地址、代理實現和升級交易。\n\n## 事件經過\n舊實現的 exec() 可由任意外部合約呼叫。攻擊者反覆執行每次將 50 PRO 兌換為 USDT 的路徑，扭曲 PRO/USDT 交易對價格，隨後賣出自有 PRO 獲利。\n\n## 資金流向\n被利用合約損失 167,200 PRO，這些 PRO 按合約預設接收路徑轉移。攻擊者實現的利潤約為 52,000 美元；預設接收者地址不等同於攻擊者。\n\n## 金額口徑\n公開損失採用攻擊者約 52,000 美元利潤口徑。167,200 PRO 是受影響代幣數量，不作為另一筆美元損失相加；其他地址資產餘額也不計為盜取金額。\n\n## 證據邊界\nGoPlus 分析和 BscScan 交易支援缺少呼叫者檢查、重複呼叫、價格變化、攻擊地址與修復升級。專案方尚未釋出完整技術復盤。\n\n## 處置狀態\n代理合約已升級到增加呼叫者檢查的新實現。沒有公開證據確認攻擊收益已返還、凍結或被司法扣押。", "en": "## Incident overview\nOn July 28, 2026, the CryptoDAO Global / PRO contracts on BNB Chain were exploited through missing access control. GoPlus published the attack contract, executing address, proxy implementations, and upgrade transaction.\n\n## Incident sequence\nThe previous implementation allowed any external contract to call exec(). The attacker repeatedly invoked a path that swapped 50 PRO for USDT, distorted the PRO/USDT pair price, and then sold the attacker’s own PRO for profit.\n\n## Fund flow\nThe exploited contract lost 167,200 PRO, which moved through receiver paths configured by the contract. Attacker profit was approximately $52,000. Configured receiver addresses are not treated as attacker addresses.\n\n## Amount basis\nReported loss uses the approximately $52,000 attacker-profit basis. The 167,200 PRO quantity is not added as a second USD loss, and balances observed at other addresses are not counted as stolen value.\n\n## Evidence boundary\nGoPlus analysis and BscScan transactions support the missing caller check, repeated calls, price movement, attack addresses, and remediation upgrade. A complete project postmortem has not been published.\n\n## Current status\nThe proxy was upgraded to an implementation with a caller check. No public evidence confirms return, freezing, or judicial seizure of the attack profit." }, "category": "access-control", "severity": "high", "ecosystems": [ "BNB Chain" ], "chains": [ "BNB Chain" ], "lossUsd": 52000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "攻击者利润约 52,000 美元；被利用合约损失 167,200 PRO，不重复换算相加。", "tw": "攻擊者利潤約 52,000 美元；被利用合約損失 167,200 PRO，不重複換算相加。", "en": "Attacker profit was approximately $52,000. The exploited contract lost 167,200 PRO, which is not converted and added again." }, "addressDisclosure": "published", "addresses": [ { "chain": "BNB Chain", "address": "0x427671b2C8e91034A91FE698F9B7259b2345F45D", "entity": { "zh": "CryptoDAO 攻击执行地址", "tw": "CryptoDAO 攻擊執行地址", "en": "CryptoDAO attack executor" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/GoPlusSecurity/status/2082353018901852609", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "GoPlus 将该地址列为攻击执行地址。", "tw": "GoPlus 將該地址列為攻擊執行地址。", "en": "GoPlus identified this address as the attack executor." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xf00bC28D22d71Be74Bc8aB0d11Fe77F6D77850ac", "entity": { "zh": "CryptoDAO 攻击合约", "tw": "CryptoDAO 攻擊合約", "en": "CryptoDAO attack contract" }, "role": "attacker-contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/GoPlusSecurity/status/2082353018901852609", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "GoPlus 将该合约识别为重复调用 exec() 的攻击合约。", "tw": "GoPlus 將該合約識別為重複呼叫 exec() 的攻擊合約。", "en": "GoPlus identified this contract as the attack contract that repeatedly called exec()." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xc44f2acCAc20598A3F2b4D489A970Fcf52a04A3C", "entity": { "zh": "受影响 PRO 代理合约", "tw": "受影響 PRO 代理合約", "en": "Affected PRO proxy contract" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/GoPlusSecurity/status/2082353018901852609", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "GoPlus 将该地址列为受影响并完成升级的 PRO 代理合约。", "tw": "GoPlus 將該地址列為受影響並完成升級的 PRO 代理合約。", "en": "GoPlus identified this as the affected PRO proxy that was subsequently upgraded." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x7fBA63d0c45f265c1bEa3Ed2e49f0691A9d9AA87", "entity": { "zh": "缺少调用者检查的旧实现合约", "tw": "缺少呼叫者檢查的舊實現合約", "en": "Previous implementation without caller validation" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/GoPlusSecurity/status/2082353016527822926", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "GoPlus 分析显示该旧实现的 exec() 缺少调用者检查。", "tw": "GoPlus 分析顯示該舊實現的 exec() 缺少呼叫者檢查。", "en": "GoPlus analysis shows that exec() in this previous implementation lacked caller validation." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xF9129AB3CBFccDfE7F39Ab0B2be79EEBA6420059", "entity": { "zh": "增加调用者检查的新实现合约", "tw": "增加呼叫者檢查的新實現合約", "en": "New implementation with caller validation" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/GoPlusSecurity/status/2082353016527822926", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "GoPlus 分析显示该新实现增加了调用者地址检查。", "tw": "GoPlus 分析顯示該新實現增加了呼叫者地址檢查。", "en": "GoPlus analysis shows that this new implementation added caller-address validation." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "GoPlus 攻击分析", "tw": "GoPlus 攻擊分析", "en": "GoPlus attack analysis" }, "url": "https://x.com/GoPlusSecurity/status/2082353004980707444", "type": "research" }, { "label": { "zh": "GoPlus 机制说明", "tw": "GoPlus 機制說明", "en": "GoPlus mechanism explanation" }, "url": "https://x.com/GoPlusSecurity/status/2082353009661718702", "type": "research" }, { "label": { "zh": "GoPlus 修复交易", "tw": "GoPlus 修復交易", "en": "GoPlus remediation transaction" }, "url": "https://x.com/GoPlusSecurity/status/2082353013080105313", "type": "research" }, { "label": { "zh": "GoPlus 新旧实现对比", "tw": "GoPlus 新舊實現對比", "en": "GoPlus implementation comparison" }, "url": "https://x.com/GoPlusSecurity/status/2082353016527822926", "type": "research" }, { "label": { "zh": "GoPlus 地址与交易", "tw": "GoPlus 地址與交易", "en": "GoPlus addresses and transactions" }, "url": "https://x.com/GoPlusSecurity/status/2082353018901852609", "type": "research" }, { "label": { "zh": "BscScan 代表攻击交易", "tw": "BscScan 代表攻擊交易", "en": "BscScan representative attack transaction" }, "url": "https://bscscan.com/tx/0xaaea183bdb5d7e4fd3c8da1d5bfe7edcb2e1db2458cef9a3adac54db6a7793d1", "type": "explorer" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-190", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-196", "status": "verified", "incidentDate": "2026-07-26", "datePrecision": "day", "title": { "zh": "ChainConnect 跨链桥遭未授权访问", "tw": "ChainConnect 跨鏈橋遭未授權訪問", "en": "ChainConnect bridge suffered unauthorized access" }, "summary": { "zh": "漫雾记录显示，ChainConnect 跨链桥在 Ethereum、BNB Chain、Avalanche 和 Polygon 上的合约通过 23 笔交易被转走约 65 万美元资产。Venom Foundation 随后确认桥平台发生安全事件并暂停全部桥操作。", "tw": "漫霧記錄顯示，ChainConnect 跨鏈橋在 Ethereum、BNB Chain、Avalanche 和 Polygon 上的合約通過 23 筆交易被轉走約 65 萬美元資產。Venom Foundation 隨後確認橋平臺發生安全事件並暫停全部橋操作。", "en": "SlowMist recorded approximately $650,000 drained from ChainConnect bridge contracts across Ethereum, BNB Chain, Avalanche, and Polygon in 23 transactions. Venom Foundation later confirmed a bridge security incident and the suspension of all bridge operations." }, "details": { "zh": "## 事件背景\nChainConnect 是 Venom 生态中的独立跨链桥产品。漫雾 Hacked Zone 将事件日期记为 2026 年 7 月 26 日，并把攻击方式归为未授权访问；Venom Foundation 于 7 月 28 日确认桥平台发生安全事件。\n\n## 事件经过\n1. 攻击活动影响 Ethereum、BNB Chain、Avalanche 和 Polygon 上的桥合约。\n2. 漫雾记录显示，资产通过 23 笔交易从桥合约转出。\n3. ChainConnect 暂停全部桥操作并展开调查。\n4. Venom Foundation 表示 Venom Network 本身及直接存放在该网络上的资产未发现受影响。\n\n## 资金流向\n可核资料确认资产从多链桥合约被转出，但没有公开完整的攻击地址、逐笔交易清单和后续跨链出口，因此当前不对具体接收方或资金终点作归因。\n\n## 金额口径\n公开损失采用漫雾记录的约 65 万美元。该数字描述跨四条链的桥合约损失，不与桥暂停期间的流动性、风险敞口或 Venom Network 上未受影响资产相加。\n\n## 证据边界\nVenom Foundation 的公告确认事件范围与暂停措施，但没有公开根因、攻击地址和损失金额；未授权访问、23 笔交易及约 65 万美元来自漫雾记录。\n\n## 处置状态\nChainConnect Bridge 已暂停并调查。现有公开资料没有确认资金返还、发行方冻结、司法扣押或控制权恢复。", "tw": "## 事件背景\nChainConnect 是 Venom 生態中的獨立跨鏈橋產品。漫霧 Hacked Zone 將事件日期記為 2026 年 7 月 26 日，並把攻擊方式歸為未授權訪問；Venom Foundation 於 7 月 28 日確認橋平臺發生安全事件。\n\n## 事件經過\n1. 攻擊活動影響 Ethereum、BNB Chain、Avalanche 和 Polygon 上的橋合約。\n2. 漫霧記錄顯示，資產通過 23 筆交易從橋合約轉出。\n3. ChainConnect 暫停全部橋操作並展開調查。\n4. Venom Foundation 表示 Venom Network 本身及直接存放在該網絡上的資產未發現受影響。\n\n## 資金流向\n可核資料確認資產從多鏈橋合約被轉出，但沒有公開完整的攻擊地址、逐筆交易清單和後續跨鏈出口，因此當前不對具體接收方或資金終點作歸因。\n\n## 金額口徑\n公開損失採用漫霧記錄的約 65 萬美元。該數字描述跨四條鏈的橋合約損失，不與橋暫停期間的流動性、風險敞口或 Venom Network 上未受影響資產相加。\n\n## 證據邊界\nVenom Foundation 的公告確認事件範圍與暫停措施，但沒有公開根因、攻擊地址和損失金額；未授權訪問、23 筆交易及約 65 萬美元來自漫霧記錄。\n\n## 處置狀態\nChainConnect Bridge 已暫停並調查。現有公開資料沒有確認資金返還、發行方凍結、司法扣押或控制權恢復。", "en": "## Incident overview\nChainConnect is an independent bridge product in the Venom ecosystem. SlowMist Hacked Zone dates the incident to July 26, 2026 and classifies the method as unauthorized access; Venom Foundation confirmed a bridge-platform security incident on July 28.\n\n## Incident sequence\n1. The activity affected bridge contracts on Ethereum, BNB Chain, Avalanche, and Polygon.\n2. SlowMist recorded assets drained from the contracts in 23 transactions.\n3. ChainConnect suspended all bridge operations and began an investigation.\n4. Venom Foundation stated that the Venom Network itself and assets held directly on it showed no identified impact.\n\n## Fund flow\nAvailable evidence supports assets leaving multichain bridge contracts, but no complete attacker-address list, transaction ledger, or onward route was published. No specific recipient or final destination is attributed.\n\n## Amount basis\nReported loss uses SlowMist’s estimate of approximately $650,000 across bridge contracts on four chains. Paused liquidity, potential exposure, and unaffected assets on Venom Network are not added to that amount.\n\n## Evidence boundary\nVenom Foundation confirmed the incident scope and suspension but did not publish a root cause, attacker addresses, or loss amount. The unauthorized-access classification, 23 transactions, and approximately $650,000 loss come from SlowMist.\n\n## Current status\nChainConnect Bridge remained paused for investigation. Public evidence did not confirm return of funds, issuer freezing, judicial seizure, or restoration of control." }, "category": "access-control", "severity": "medium", "ecosystems": [ "Ethereum", "BNB Chain", "Avalanche", "Polygon" ], "chains": [ "Ethereum", "BNB Chain", "Avalanche", "Polygon" ], "lossUsd": 650000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "跨四条链的 ChainConnect 桥合约约损失 65 万美元。", "tw": "跨四條鏈的 ChainConnect 橋合約約損失 65 萬美元。", "en": "Approximately $650,000 was lost from ChainConnect bridge contracts across four chains." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "漫雾 Hacked Zone 事件记录", "tw": "漫霧 Hacked Zone 事件記錄", "en": "SlowMist Hacked Zone incident record" }, "url": "https://hacked.slowmist.io/", "type": "research" }, { "label": { "zh": "Venom Foundation 事件确认", "tw": "Venom Foundation 事件確認", "en": "Venom Foundation incident confirmation" }, "url": "https://x.com/VenomFoundation/status/2082101022928040063", "type": "official" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-196", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-114", "status": "verified", "incidentDate": "2026-07-26", "datePrecision": "day", "title": { "zh": "恶意 multicall 隐藏无限授权并转走 alphaUSDCDeltaV2", "tw": "惡意 multicall 隱藏無限授權並轉走 alphaUSDCDeltaV2", "en": "Malicious multicall concealed an unlimited approval and drained alphaUSDCDeltaV2" }, "summary": { "zh": "受害者签署表面为 multicall 的交易后，内部调用向攻击地址授予无限 approve。约 36 秒后，攻击者通过 transferFrom 转走 332,787 枚 alphaUSDCDeltaV2，估值约 340,463 美元。", "tw": "受害者簽署表面為 multicall 的交易後，內部呼叫向攻擊地址授予無限 approve。約 36 秒後，攻擊者通過 transferFrom 轉走 332,787 枚 alphaUSDCDeltaV2，估值約 340,463 美元。", "en": "After the victim signed a transaction presented as multicall, an inner call granted an attacker unlimited approval. About 36 seconds later, the attacker used transferFrom to remove 332,787 alphaUSDCDeltaV2, valued at approximately $340,463." }, "details": { "zh": "## 事件背景\n2026 年 7 月 26 日，Scam Sniffer 披露一笔把无限代币授权隐藏在 multicall 内部调用中的钓鱼交易。受害者没有向攻击者发起普通转账，损失来自先授权、后由攻击者拉取资产。\n\n## 事件经过\n1. 受害者签署顶层显示为 multicall 的交易。\n2. 内部调用包含对 alphaUSDCDeltaV2 合约的无限 approve。\n3. 约 36 秒后，攻击者调用 transferFrom。\n4. 332,787 枚 alphaUSDCDeltaV2 从受害者地址转出。\n\n## 资金流向\n资产从受害者地址 0x3E1B8F98Ed69C6A97A8540E1D7AeD33FdF4509aA 被攻击地址通过授权拉取。GoPlus 后续披露两个关联执行地址，可作为钓鱼与转移角色标签。\n\n## 金额口径\n代币数量为 332,787 枚 alphaUSDCDeltaV2；公开报警按当时资产价格估值约 340,463 美元。公开损失采用美元估值，不把代币数量作为另一笔损失相加。\n\n## 证据边界\nScam Sniffer 支持恶意签名、36 秒时间线和损失数量，GoPlus 支持关联地址。公开材料没有确认钓鱼入口、攻击者真实身份、冻结或追回结果。\n\n## 处置状态\n资产已通过 transferFrom 转走。没有公开证据确认资产返还或控制权恢复，冻结和追回金额均为零。", "tw": "## 事件背景\n2026 年 7 月 26 日，Scam Sniffer 披露一筆把無限代幣授權隱藏在 multicall 內部呼叫中的釣魚交易。受害者沒有向攻擊者發起普通轉賬，損失來自先授權、後由攻擊者拉取資產。\n\n## 事件經過\n1. 受害者簽署頂層顯示為 multicall 的交易。\n2. 內部呼叫包含對 alphaUSDCDeltaV2 合約的無限 approve。\n3. 約 36 秒後，攻擊者呼叫 transferFrom。\n4. 332,787 枚 alphaUSDCDeltaV2 從受害者地址轉出。\n\n## 資金流向\n資產從受害者地址 0x3E1B8F98Ed69C6A97A8540E1D7AeD33FdF4509aA 被攻擊地址通過授權拉取。GoPlus 後續披露兩個關聯執行地址，可作為釣魚與轉移角色標籤。\n\n## 金額口徑\n代幣數量為 332,787 枚 alphaUSDCDeltaV2；公開報警按當時資產價格估值約 340,463 美元。公開損失採用美元估值，不把代幣數量作為另一筆損失相加。\n\n## 證據邊界\nScam Sniffer 支援惡意簽名、36 秒時間線和損失數量，GoPlus 支援關聯地址。公開材料沒有確認釣魚入口、攻擊者真實身份、凍結或追回結果。\n\n## 處置狀態\n資產已通過 transferFrom 轉走。沒有公開證據確認資產返還或控制權恢復，凍結和追回金額均為零。", "en": "## Incident overview\nOn July 26, 2026, Scam Sniffer disclosed a phishing transaction that concealed an unlimited token approval inside multicall. The victim did not initiate an ordinary transfer to the attacker; the loss resulted from approval followed by attacker-initiated asset pulling.\n\n## Incident sequence\n1. The victim signed a transaction whose top-level function appeared as multicall.\n2. An inner call granted unlimited approval over alphaUSDCDeltaV2.\n3. About 36 seconds later, the attacker invoked transferFrom.\n4. A total of 332,787 alphaUSDCDeltaV2 left the victim address.\n\n## Fund flow\nAssets were pulled from victim address 0x3E1B8F98Ed69C6A97A8540E1D7AeD33FdF4509aA through the malicious approval. GoPlus later disclosed two associated execution addresses, which are labeled only for their phishing and transfer roles.\n\n## Amount basis\nThe token quantity was 332,787 alphaUSDCDeltaV2, valued by the public alert at approximately $340,463 at the time. The public loss uses the dollar valuation and does not add the token quantity as a separate loss.\n\n## Evidence boundary\nScam Sniffer supports the malicious signature, approximately 36-second sequence, and loss quantity; GoPlus supports associated addresses. Public material does not confirm the phishing entry point, attacker identity, freeze, or recovery.\n\n## Current status\nThe assets were removed through transferFrom. No public evidence confirms asset return or restoration of control, so frozen and recovered amounts remain zero." }, "category": "phishing-approval", "severity": "high", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 340463, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "332,787 枚 alphaUSDCDeltaV2 被转走，按公开报警估值约 340,463 美元。", "tw": "332,787 枚 alphaUSDCDeltaV2 被轉走，按公開報警估值約 340,463 美元。", "en": "A total of 332,787 alphaUSDCDeltaV2 was removed, valued by the public alert at approximately $340,463." }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0x3E1B8F98Ed69C6A97A8540E1D7AeD33FdF4509aA", "entity": { "zh": "恶意 multicall 授权事件受害地址", "tw": "惡意 multicall 授權事件受害地址", "en": "Victim address in the malicious multicall approval incident" }, "role": "victim", "category": "unknown", "confidence": 0.95, "sourceUrl": "https://x.com/realScamSniffer/status/2080559865895022730", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Scam Sniffer 将该地址标记为 332,787 枚 alphaUSDCDeltaV2 被转走的受害地址；不扩大为其他事件归因。", "tw": "Scam Sniffer 將該地址標記為 332,787 枚 alphaUSDCDeltaV2 被轉走的受害地址；不擴大為其他事件歸因。", "en": "Scam Sniffer identified the address as the victim from which 332,787 alphaUSDCDeltaV2 was removed; the label is not extended to other incidents." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xbC2EdA71a62C0C8142E5138b1c17c879f7c04F0D", "entity": { "zh": "恶意授权执行与资产转移地址", "tw": "惡意授權執行與資產轉移地址", "en": "Malicious approval execution and asset-transfer address" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/GoPlusSecurity/status/2081079161989595628", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "GoPlus 将该地址与恶意授权后的资产转移关联；标签限于本次公开事件。", "tw": "GoPlus 將該地址與惡意授權後的資產轉移關聯；標籤限於本次公開事件。", "en": "GoPlus linked the address to asset transfer following the malicious approval; the label is limited to this public incident." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x64B478b0A819fbD0ef05B4ef118Df78941D6D018", "entity": { "zh": "恶意授权事件关联攻击地址", "tw": "惡意授權事件關聯攻擊地址", "en": "Associated attacker address in the malicious approval incident" }, "role": "attacker", "category": "hack", "confidence": 0.85, "sourceUrl": "https://x.com/GoPlusSecurity/status/2081079161989595628", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "GoPlus 将该地址列为恶意 multicall 授权事件的关联地址；标签不扩展至未公开行为。", "tw": "GoPlus 將該地址列為惡意 multicall 授權事件的關聯地址；標籤不擴充套件至未公開行為。", "en": "GoPlus listed the address as associated with the malicious multicall approval incident; the label does not extend to undisclosed activity." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xeDBc178d79DC6Fa9A16b8B93FF02a31846098B72", "entity": { "zh": "恶意授权事件关联攻击地址 3", "tw": "惡意授權事件關聯攻擊地址 3", "en": "Associated attacker address 3 in the malicious approval incident" }, "role": "attacker", "category": "hack", "confidence": 0.85, "sourceUrl": "https://x.com/GoPlusSecurity/status/2081079161989595628", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "GoPlus 将该地址列为本次恶意授权与资产转移事件的关联地址。", "tw": "GoPlus 將該地址列為本次惡意授權與資產轉移事件的關聯地址。", "en": "GoPlus listed the address as associated with this malicious approval and asset-transfer incident." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x26115fA4FdB32d0221f2A14848d90379F7033269", "entity": { "zh": "恶意授权事件关联攻击地址 4", "tw": "惡意授權事件關聯攻擊地址 4", "en": "Associated attacker address 4 in the malicious approval incident" }, "role": "attacker", "category": "hack", "confidence": 0.85, "sourceUrl": "https://x.com/GoPlusSecurity/status/2081079161989595628", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "GoPlus 将该地址列为本次恶意授权与资产转移事件的关联地址。", "tw": "GoPlus 將該地址列為本次惡意授權與資產轉移事件的關聯地址。", "en": "GoPlus listed the address as associated with this malicious approval and asset-transfer incident." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "Scam Sniffer 主报警", "tw": "Scam Sniffer 主報警", "en": "Scam Sniffer primary alert" }, "url": "https://x.com/realScamSniffer/status/2080559865895022730", "type": "research" }, { "label": { "zh": "Scam Sniffer 时间线", "tw": "Scam Sniffer 時間線", "en": "Scam Sniffer timeline" }, "url": "https://x.com/realScamSniffer/status/2080559881128747506", "type": "research" }, { "label": { "zh": "GoPlus 关联地址报警", "tw": "GoPlus 關聯地址報警", "en": "GoPlus associated-address alert" }, "url": "https://x.com/GoPlusSecurity/status/2081079161989595628", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-114", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-111", "status": "verified", "incidentDate": "2026-07-26", "datePrecision": "day", "title": { "zh": "Garden Finance HTLC 与 solver 基础设施遭利用", "tw": "Garden Finance HTLC 與 solver 基礎設施遭利用", "en": "Garden Finance HTLC and solver infrastructure exploitation" }, "summary": { "zh": "Garden Finance 的独立 solver 链下数据库遭入侵并被写入欺诈记录，导致 Ethereum、Base、Arbitrum 与 BNB Chain 的 HTLC 流程错误释放约 45 万 USDT。项目方称核心协议和智能合约未被攻破，并暂时下线应用。", "tw": "Garden Finance 的獨立 solver 鏈下資料庫遭入侵並被寫入欺詐記錄，導致 Ethereum、Base、Arbitrum 與 BNB Chain 的 HTLC 流程錯誤釋放約 45 萬 USDT。專案方稱核心協議和智慧合約未被攻破，並暫時下線應用。", "en": "An independent Garden Finance solver’s off-chain database was compromised and populated with fraudulent records, causing HTLC flows on Ethereum, Base, Arbitrum, and BNB Chain to release approximately 450,000 USDT improperly. The project said its core protocol and smart contracts were not compromised and took the application offline." }, "details": { "zh": "## 事件背景\n2026 年 7 月 26 日晚，Blockaid 发现 Garden Finance 相关 HTLC 流程在四条 EVM 链出现异常资金释放。Garden 随后确认异常活动并暂时下线应用。\n\n## 事件经过\n同一攻击地址在 Ethereum、Base、Arbitrum 与 BNB Chain 上接收资金。Garden 表示独立 solver 的链下数据库遭入侵并被插入欺诈记录，错误记录触发了不当资金释放；核心协议和智能合约未被攻破。\n\n## 资金流向\n四条链合计约 45 万 USDT 被转往公开攻击地址。Ethereum 示例交易显示 HTLC 相关合约向该地址转出 124,785.18075 USDT。\n\n## 金额口径\n公开损失采用 Blockaid 报告的约 450,000 USDT 四链流出总额。预警时攻击地址的跨链余额是时点快照，不作为另一笔损失或追回金额。\n\n## 证据边界\nBlockaid 支持攻击地址、示例交易、涉及链和金额；Garden 官方支持链下 solver 数据库失陷、应用下线以及核心合约未被攻破。逐链最终损失尚未公开。\n\n## 处置状态\nGarden 暂时下线应用并开展调查。没有公开证据确认资金已冻结、返还或恢复控制，因此冻结与追回金额均为 0。", "tw": "## 事件背景\n2026 年 7 月 26 日晚，Blockaid 發現 Garden Finance 相關 HTLC 流程在四條 EVM 鏈出現異常資金釋放。Garden 隨後確認異常活動並暫時下線應用。\n\n## 事件經過\n同一攻擊地址在 Ethereum、Base、Arbitrum 與 BNB Chain 上接收資金。Garden 表示獨立 solver 的鏈下資料庫遭入侵並被插入欺詐記錄，錯誤記錄觸發了不當資金釋放；核心協議和智慧合約未被攻破。\n\n## 資金流向\n四條鏈合計約 45 萬 USDT 被轉往公開攻擊地址。Ethereum 示例交易顯示 HTLC 相關合約向該地址轉出 124,785.18075 USDT。\n\n## 金額口徑\n公開損失採用 Blockaid 報告的約 450,000 USDT 四鏈流出總額。預警時攻擊地址的跨鏈餘額是時點快照，不作為另一筆損失或追回金額。\n\n## 證據邊界\nBlockaid 支援攻擊地址、示例交易、涉及鏈和金額；Garden 官方支援鏈下 solver 資料庫失陷、應用下線以及核心合約未被攻破。逐鏈最終損失尚未公開。\n\n## 處置狀態\nGarden 暫時下線應用並開展調查。沒有公開證據確認資金已凍結、返還或恢復控制，因此凍結與追回金額均為 0。", "en": "## Incident overview\nLate on July 26, 2026, Blockaid detected abnormal releases through Garden Finance-related HTLC flows across four EVM chains. Garden confirmed the activity and temporarily took its application offline.\n\n## Incident sequence\nOne attack address received funds on Ethereum, Base, Arbitrum, and BNB Chain. Garden said an independent solver’s off-chain database was compromised and populated with fraudulent records that triggered improper releases. Its core protocol and smart contracts were not compromised.\n\n## Fund flow\nApproximately 450,000 USDT was transferred across the four chains. An Ethereum example transaction shows an HTLC-related contract sending 124,785.18075 USDT to the attack address.\n\n## Amount basis\nReported loss uses Blockaid’s approximately 450,000 USDT four-chain outflow total. The cross-chain balance visible when the alert was issued is a point-in-time snapshot, not an additional loss or recovery amount.\n\n## Evidence boundary\nBlockaid supports the attack address, example transaction, involved chains, and amount. Garden supports the off-chain solver database compromise, application shutdown, and absence of a core-contract compromise. Final chain-by-chain losses remain unpublished.\n\n## Current status\nGarden took the application offline and began an investigation. No public evidence confirms freezing, return, or restoration of control, so frozen and recovered amounts remain 0." }, "category": "access-control", "severity": "high", "ecosystems": [ "Ethereum", "Base", "Arbitrum", "BNB Chain" ], "chains": [ "Ethereum", "Base", "Arbitrum", "BNB Chain" ], "lossUsd": 450000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 450,000 USDT 在四条链上发生可见流出；最终资金归属仍待正式复盘。", "tw": "約 450,000 USDT 在四條鏈上發生可見流出；最終資金歸屬仍待正式復盤。", "en": "Approximately 450,000 USDT visibly left across four chains; the ultimate ownership of the affected funds awaits a formal postmortem." }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0x25b224c05f6cc5e132165c1621de1a4c3b316999", "entity": { "zh": "Garden Finance 事件攻击资金归集地址", "tw": "Garden Finance 事件攻擊資金歸集地址", "en": "Garden Finance incident attacker consolidation address" }, "role": "attacker", "category": "hack", "confidence": 0.95, "sourceUrl": "https://x.com/blockaid_/status/2081409474393194827", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Blockaid 将该地址与四链约 45 万 USDT 流出及 Garden HTLC 利用关联；标签仅限公开事件角色。", "tw": "Blockaid 將該地址與四鏈約 45 萬 USDT 流出及 Garden HTLC 利用關聯；標籤僅限公開事件角色。", "en": "Blockaid linked the address to approximately 450,000 USDT in four-chain outflow and the Garden HTLC exploitation; the label is limited to that public incident role." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xCF5E5e28848cFe779f7Fb711C57857Cb3b144A19", "entity": { "zh": "Garden Finance 受影响 HTLC 相关合约", "tw": "Garden Finance 受影響 HTLC 相關合約", "en": "Affected Garden Finance HTLC-related contract" }, "role": "contract", "category": "unknown", "confidence": 0.95, "sourceUrl": "https://etherscan.io/tx/0x9d7a961aa340156b7342839e9f6448a26dea9acd38dc7b2638966eb19e29d395", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Ethereum 示例交易显示该合约向公开攻击地址转出 124,785.18075 USDT。", "tw": "Ethereum 示例交易顯示該合約向公開攻擊地址轉出 124,785.18075 USDT。", "en": "The Ethereum example transaction shows this contract transferring 124,785.18075 USDT to the public attack address." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "Blockaid 主报警", "tw": "Blockaid 主報警", "en": "Blockaid primary alert" }, "url": "https://x.com/blockaid_/status/2081409252489298100", "type": "research" }, { "label": { "zh": "Blockaid 地址与示例交易", "tw": "Blockaid 地址與示例交易", "en": "Blockaid address and example transaction" }, "url": "https://x.com/blockaid_/status/2081409474393194827", "type": "research" }, { "label": { "zh": "Garden 官方异常活动公告", "tw": "Garden 官方異常活動公告", "en": "Garden abnormal-activity notice" }, "url": "https://x.com/gardenfi/status/2081441973651804359", "type": "official" }, { "label": { "zh": "Etherscan 攻击地址", "tw": "Etherscan 攻擊地址", "en": "Etherscan attacker address" }, "url": "https://etherscan.io/address/0x25b224c05f6cc5e132165c1621de1a4c3b316999", "type": "research" }, { "label": { "zh": "Etherscan 示例攻击交易", "tw": "Etherscan 示例攻擊交易", "en": "Etherscan example exploit transaction" }, "url": "https://etherscan.io/tx/0x9d7a961aa340156b7342839e9f6448a26dea9acd38dc7b2638966eb19e29d395", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-111", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-110", "status": "verified", "incidentDate": "2026-07-26", "datePrecision": "day", "title": { "zh": "WEMIX$ 合约权限失陷与未经授权铸造", "tw": "WEMIX$ 合約許可權失陷與未經授權鑄造", "en": "WEMIX$ contract authority compromise and unauthorized minting" }, "summary": { "zh": "WEMIX 官方确认 WEMIX$ 相关合约所有权失陷，攻击者未经授权铸造约 522.55 万枚 WEMIX$，并兑换为 30,736 WEMIX 与 724,198.27 USDC.e。公开损失采用约 73 万美元实际变现口径，不把异常铸造面值重复计入。", "tw": "WEMIX 官方確認 WEMIX$ 相關合約所有權失陷，攻擊者未經授權鑄造約 522.55 萬枚 WEMIX$，並兌換為 30,736 WEMIX 與 724,198.27 USDC.e。公開損失採用約 73 萬美元實際變現口徑，不把異常鑄造面值重複計入。", "en": "WEMIX confirmed that ownership of a WEMIX$-related contract was compromised. The attacker minted approximately 5.2255 million WEMIX$ without authorization and swapped it into 30,736 WEMIX and 724,198.27 USDC.e. Reported loss uses an approximately $730,000 realized-value basis and does not add nominal minted value." }, "details": { "zh": "## 事件背景\n2026 年 7 月 26 日，WEMIX 确认 WEMIX$ 相关合约所有权失陷并发生未经授权铸造。官方启动紧急处置、服务限制、调查和链上追踪，但尚未公布所有权失陷的最终技术入口。\n\n## 事件经过\n攻击者取得合约所有权或管理员能力，铸造约 522.55 万枚 WEMIX$，随后兑换为 WEMIX 与 USDC.e。USDC.e 经桥接转往 Ethereum 和 BNB Chain，部分资产继续兑换为 ETH、USDT 等并拆分转移。\n\n## 资金流向\n已确认的兑换资产包括 30,736 WEMIX 与 724,198.27 USDC.e。公开资料描述了跨链和后续兑换路径，但没有给出完整攻击地址及逐笔交易清单，因此不补写未披露的钱包。\n\n## 金额口径\n约 522.55 万枚 WEMIX$ 是异常铸造数量，不是可直接相加的现金损失。公开损失采用 GoPlus 依据实际兑换及转移资产给出的约 73 万美元估值。\n\n## 证据边界\n官方公告支持合约所有权失陷、未经授权铸造、服务暂停和追踪协作。具体是密钥泄露、权限配置错误还是其他入口仍待正式技术复盘；部分交易所完成地址限制，但金额未披露。\n\n## 处置状态\nWEMIX 暂停相关桥接、流动性池、模块和部分生态功能，并联系交易所、稳定币发行方及安全机构协作。没有公开证据确认资金已经返还，冻结与追回金额仍记为 0。", "tw": "## 事件背景\n2026 年 7 月 26 日，WEMIX 確認 WEMIX$ 相關合約所有權失陷並發生未經授權鑄造。官方啟動緊急處置、服務限制、調查和鏈上追蹤，但尚未公佈所有權失陷的最終技術入口。\n\n## 事件經過\n攻擊者取得合約所有權或管理員能力，鑄造約 522.55 萬枚 WEMIX$，隨後兌換為 WEMIX 與 USDC.e。USDC.e 經橋接轉往 Ethereum 和 BNB Chain，部分資產繼續兌換為 ETH、USDT 等並拆分轉移。\n\n## 資金流向\n已確認的兌換資產包括 30,736 WEMIX 與 724,198.27 USDC.e。公開資料描述了跨鏈和後續兌換路徑，但沒有給出完整攻擊地址及逐筆交易清單，因此不補寫未披露的錢包。\n\n## 金額口徑\n約 522.55 萬枚 WEMIX$ 是異常鑄造數量，不是可直接相加的現金損失。公開損失採用 GoPlus 依據實際兌換及轉移資產給出的約 73 萬美元估值。\n\n## 證據邊界\n官方公告支援合約所有權失陷、未經授權鑄造、服務暫停和追蹤協作。具體是金鑰洩露、權限配置錯誤還是其他入口仍待正式技術復盤；部分交易所完成地址限制，但金額未披露。\n\n## 處置狀態\nWEMIX 暫停相關橋接、流動性池、模組和部分生態功能，並聯絡交易所、穩定幣發行方及安全機構協作。沒有公開證據確認資金已經返還，凍結與追回金額仍記為 0。", "en": "## Incident overview\nOn July 26, 2026, WEMIX confirmed that ownership of a WEMIX$-related contract had been compromised and used for unauthorized minting. Emergency restrictions, investigation, and on-chain tracing began, but the final technical entry point has not been published.\n\n## Incident sequence\nThe attacker obtained contract-owner or administrator capability, minted about 5.2255 million WEMIX$, and swapped it into WEMIX and USDC.e. USDC.e was bridged toward Ethereum and BNB Chain, with part of the flow converted into ETH, USDT, and other assets.\n\n## Fund flow\nConfirmed swapped assets include 30,736 WEMIX and 724,198.27 USDC.e. Public material describes bridging and later swaps but does not disclose a complete attacker-address or transaction ledger, so no missing wallets are reconstructed.\n\n## Amount basis\nThe 5.2255 million WEMIX$ figure is unauthorized minted quantity, not an additional cash loss. Reported loss uses the approximately $730,000 estimate that GoPlus derived from realized swaps and transferred assets.\n\n## Evidence boundary\nOfficial material supports the ownership compromise, unauthorized minting, service restrictions, and tracing response. Whether the entry point was key leakage, permission configuration, or another mechanism remains unresolved. Some exchanges restricted related addresses, but no amount was disclosed.\n\n## Current status\nWEMIX paused relevant bridges, liquidity pools, modules, and ecosystem functions and contacted exchanges, stablecoin issuers, and security firms. No public evidence confirms asset return, so frozen and recovered amounts remain 0." }, "category": "access-control", "severity": "critical", "ecosystems": [ "WEMIX", "Ethereum", "BNB Chain" ], "chains": [ "WEMIX", "Ethereum", "BNB Chain" ], "lossUsd": 730000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "实际兑换资产为 724,198.27 USDC.e 与 30,736 WEMIX；公开损失采用约 73 万美元估值，异常铸造数量不重复计算。", "tw": "實際兌換資產為 724,198.27 USDC.e 與 30,736 WEMIX；公開損失採用約 73 萬美元估值，異常鑄造數量不重複計算。", "en": "Realized swaps comprised 724,198.27 USDC.e and 30,736 WEMIX. Reported loss uses an approximately $730,000 valuation and does not double-count unauthorized minted quantity." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "WEMIX 首次安全提示", "tw": "WEMIX 首次安全提示", "en": "Initial WEMIX security notice" }, "url": "https://x.com/WemixNetwork/status/2081391838200766549", "type": "official" }, { "label": { "zh": "WEMIX PLAY 临时维护公告", "tw": "WEMIX PLAY 臨時維護公告", "en": "WEMIX PLAY temporary maintenance notice" }, "url": "https://x.com/WemixNetwork/status/2081433362242384119", "type": "official" }, { "label": { "zh": "WEMIX 官方处置更新", "tw": "WEMIX 官方處置更新", "en": "WEMIX response update" }, "url": "https://x.com/WemixNetwork/status/2081472302655668507", "type": "official" }, { "label": { "zh": "WEMIX 安全事件调查公告", "tw": "WEMIX 安全事件調查公告", "en": "WEMIX security incident investigation notice" }, "url": "https://www.wemix.com/news/regarding-the-wemix-security-issue-and-ongoing-investigation-1001f385826a", "type": "official" }, { "label": { "zh": "BSCN 金额口径整理", "tw": "BSCN 金額口徑整理", "en": "BSCN amount-basis report" }, "url": "https://x.com/BSCNews/status/2081590405523476898", "type": "research" }, { "label": { "zh": "WEMIX 官方完整公告", "tw": "WEMIX 官方完整公告", "en": "WEMIX official incident update" }, "url": "https://wemix.com/news/update-on-the-wemix-security-issue-and-response-measures-06359e6f2a8e", "type": "official" }, { "label": { "zh": "GoPlus 安全分析", "tw": "GoPlus 安全分析", "en": "GoPlus security analysis" }, "url": "https://x.com/GoPlusSecurity/status/2081623583030399353", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-110", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-189", "status": "verified", "incidentDate": "2026-07-25", "datePrecision": "day", "title": { "zh": "Projekt 奖励分配逻辑漏洞", "tw": "Projekt 獎勵分配邏輯漏洞", "en": "Projekt reward-allocation logic exploit" }, "summary": { "zh": "Projekt 的 GREEN/GOLD 奖励金库通过可公开调用的 trackPurchase() 按代币余额变化分配奖励，却未验证真实 ETH 支出。攻击者利用闪电贷与 skim() 制造虚假购买记录，并通过 massWithdraw() 提取约 301.7 ETH，估值约 56 万美元。", "tw": "Projekt 的 GREEN/GOLD 獎勵金庫通過可公開呼叫的 trackPurchase() 按代幣餘額變化分配獎勵，卻未驗證真實 ETH 支出。攻擊者利用閃電貸與 skim() 製造虛假購買記錄，並通過 massWithdraw() 提取約 301.7 ETH，估值約 56 萬美元。", "en": "Projekt’s GREEN/GOLD reward vault used permissionless trackPurchase() to allocate rewards from token-balance changes without verifying real ETH expenditure. The attacker used flash liquidity and skim() to create fake purchase records, then withdrew approximately 301.7 ETH, valued near $560,000, through massWithdraw()." }, "details": { "zh": "## 事件背景\n2026 年 7 月 25 日，Ethereum 上的 Projekt GREEN/GOLD 奖励金库因购买追踪逻辑缺陷遭利用。公开分析将损失估计为约 56 万美元。\n\n## 事件经过\n攻击者从 Morpho 闪电贷约 14,000 WETH，将资金推入多个 Uniswap V2 代币池，再通过 skim() 把代币转回攻击合约。trackPurchase() 只读取余额变化计算奖励，没有验证实际支付的 ETH。\n\n## 资金流向\n虚假购买记录产生大量奖励分配，攻击者随后调用 massWithdraw() 从奖励池提取约 301.7 ETH。闪电贷在同一交易中归还，不属于损失金额。\n\n## 金额口径\n公开损失采用约 301.7 ETH、估值约 560,000 美元。约 14,000 WETH 是临时闪电贷规模，不能与损失相加。\n\n## 证据边界\nDefimon 的技术分析支持函数路径、闪电贷规模、奖励膨胀机制和损失。受影响金库合约未完成独立验证，公开材料也未披露项目方最终复盘。\n\n## 处置状态\n公开来源没有确认资金返还、冻结或补偿结果。奖励逻辑是否已修复及金库后续状态仍待项目方说明。", "tw": "## 事件背景\n2026 年 7 月 25 日，Ethereum 上的 Projekt GREEN/GOLD 獎勵金庫因購買追蹤邏輯缺陷遭利用。公開分析將損失估計為約 56 萬美元。\n\n## 事件經過\n攻擊者從 Morpho 閃電貸約 14,000 WETH，將資金推入多個 Uniswap V2 代幣池，再通過 skim() 把代幣轉回攻擊合約。trackPurchase() 只讀取餘額變化計算獎勵，沒有驗證實際支付的 ETH。\n\n## 資金流向\n虛假購買記錄產生大量獎勵分配，攻擊者隨後呼叫 massWithdraw() 從獎勵池提取約 301.7 ETH。閃電貸在同一交易中歸還，不屬於損失金額。\n\n## 金額口徑\n公開損失採用約 301.7 ETH、估值約 560,000 美元。約 14,000 WETH 是臨時閃電貸規模，不能與損失相加。\n\n## 證據邊界\nDefimon 的技術分析支援函式路徑、閃電貸規模、獎勵膨脹機制和損失。受影響金庫合約未完成獨立驗證，公開材料也未披露專案方最終復盤。\n\n## 處置狀態\n公開來源沒有確認資金返還、凍結或補償結果。獎勵邏輯是否已修復及金庫後續狀態仍待專案方說明。", "en": "## Incident overview\nOn July 25, 2026, the Projekt GREEN/GOLD reward vault on Ethereum was exploited through a purchase-tracking logic defect. Public analysis estimates loss at approximately $560,000.\n\n## Incident sequence\nThe attacker flash-borrowed approximately 14,000 WETH from Morpho, pushed liquidity into multiple Uniswap V2 token pairs, and used skim() to return tokens to the attack contract. trackPurchase() sized rewards from balance changes without verifying real ETH expenditure.\n\n## Fund flow\nFake purchase records generated inflated reward allocations. The attacker then called massWithdraw() and removed approximately 301.7 ETH from the reward pool. The flash loan was repaid in the same transaction and is not loss.\n\n## Amount basis\nReported loss uses approximately 301.7 ETH, valued near $560,000. The approximately 14,000 WETH flash loan was temporary liquidity and is not added to loss.\n\n## Evidence boundary\nDefimon’s technical analysis supports the function path, flash-loan scale, allocation inflation, and loss. The affected vault was unverified, and no final project postmortem has been published in the cited material.\n\n## Current status\nPublic sources do not confirm return, freezing, or compensation. Remediation of the reward logic and the vault’s subsequent status remain undisclosed." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 560000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 301.7 ETH 从奖励池被提取，公开估值约 560,000 美元。", "tw": "約 301.7 ETH 從獎勵池被提取，公開估值約 560,000 美元。", "en": "Approximately 301.7 ETH was removed from the reward pool, publicly valued near $560,000." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "Defimon 技术分析", "tw": "Defimon 技術分析", "en": "Defimon technical analysis" }, "url": "https://x.com/DefimonAlerts/status/2081781283584106959", "type": "research" }, { "label": { "zh": "SlowMist Hacked Zone 记录", "tw": "SlowMist Hacked Zone 記錄", "en": "SlowMist Hacked Zone record" }, "url": "https://hacked.slowmist.io/", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-189", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-188", "status": "verified", "incidentDate": "2026-07-25", "datePrecision": "day", "title": { "zh": "Bankrbot X 账号与项目钱包失陷", "tw": "Bankrbot X 賬號與專案錢包失陷", "en": "Bankrbot X account and project wallet compromise" }, "summary": { "zh": "Bankrbot 的 X 账号在启用设备通行密钥的情况下仍被接管并发布假空投链接；同期，一个未启用多重验证的项目钱包被清空约 15 亿枚 BNKR。SlowMist Hacked Zone 记录损失约 479,885 美元。", "tw": "Bankrbot 的 X 賬號在啟用裝置通行金鑰的情況下仍被接管並釋出假空投連結；同期，一個未啟用多重驗證的專案錢包被清空約 15 億枚 BNKR。SlowMist Hacked Zone 記錄損失約 479,885 美元。", "en": "Bankrbot’s X account was taken over despite an on-device passkey and used to publish fake airdrop links. In the same incident window, a project wallet without multifactor authentication was drained of approximately 1.5 billion BNKR. SlowMist Hacked Zone records a loss of about $479,885." }, "details": { "zh": "## 事件背景\n2026 年 7 月 25 日，Bankrbot 团队成员公开表示项目 X 账号失陷并发布假空投链接，团队无法正常登录该账号。\n\n## 事件经过\n账号在启用设备通行密钥的情况下仍被接管。SlowMist Hacked Zone 同时记录一个未启用多重验证的 Bankr 项目钱包被清空约 15 亿枚 BNKR，代币随后被抛售。\n\n## 资金流向\n公开资料确认项目钱包资产流出和代币抛售，但没有在当前来源中披露完整攻击钱包、转移交易或最终资金归集地址。\n\n## 金额口径\n代币数量约为 15 亿枚 BNKR；公开损失采用 SlowMist Hacked Zone 的 479,885 美元记录，不把代币数量再次换算相加。\n\n## 证据边界\n团队成员的公开帖子直接支持 X 账号接管和假空投内容；钱包损失与金额来自 SlowMist Hacked Zone。账号与钱包是否共享同一底层入口尚未得到完整技术说明。\n\n## 处置状态\n团队请求 X 协助移除假链接并调查通行密钥环境下的账号接管。没有公开证据确认资产返还、冻结或恢复控制。", "tw": "## 事件背景\n2026 年 7 月 25 日，Bankrbot 團隊成員公開表示專案 X 賬號失陷並釋出假空投連結，團隊無法正常登入該賬號。\n\n## 事件經過\n賬號在啟用裝置通行金鑰的情況下仍被接管。SlowMist Hacked Zone 同時記錄一個未啟用多重驗證的 Bankr 專案錢包被清空約 15 億枚 BNKR，代幣隨後被拋售。\n\n## 資金流向\n公開資料確認專案錢包資產流出和代幣拋售，但沒有在目前來源中披露完整攻擊錢包、轉移交易或最終資金歸集地址。\n\n## 金額口徑\n代幣數量約為 15 億枚 BNKR；公開損失採用 SlowMist Hacked Zone 的 479,885 美元記錄，不把代幣數量再次換算相加。\n\n## 證據邊界\n團隊成員的公開帖子直接支援 X 賬號接管和假空投內容；錢包損失與金額來自 SlowMist Hacked Zone。賬號與錢包是否共享同一底層入口尚未得到完整技術說明。\n\n## 處置狀態\n團隊請求 X 協助移除假連結並調查通行金鑰環境下的賬號接管。沒有公開證據確認資產返還、凍結或恢復控制。", "en": "## Incident overview\nOn July 25, 2026, a Bankrbot team member publicly reported that the project’s X account had been compromised, was posting fake airdrop links, and was no longer accessible to the team.\n\n## Incident sequence\nThe account was taken over despite an on-device passkey. SlowMist Hacked Zone also records that a Bankr project wallet without multifactor authentication was drained of approximately 1.5 billion BNKR and that the tokens were sold.\n\n## Fund flow\nPublic material confirms the project-wallet outflow and token sale but does not provide a complete attack-wallet, transaction, or final-consolidation ledger in the currently cited sources.\n\n## Amount basis\nToken quantity was approximately 1.5 billion BNKR. Reported loss uses the $479,885 SlowMist Hacked Zone record and does not add a separate conversion of the token quantity.\n\n## Evidence boundary\nThe team member’s post directly supports the X account takeover and fake airdrop content. The wallet loss and amount are supported by SlowMist Hacked Zone. Whether the account and wallet shared one underlying entry point is not established.\n\n## Current status\nThe team asked X to remove the fake links and investigate how takeover occurred with a passkey. No public evidence confirms asset return, freezing, or restored wallet control." }, "category": "account-takeover", "severity": "high", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": 479885, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 15 亿枚 BNKR 被转出并抛售，公开损失记录为 479,885 美元。", "tw": "約 15 億枚 BNKR 被轉出並拋售，公開損失記錄為 479,885 美元。", "en": "Approximately 1.5 billion BNKR was removed and sold; reported loss is $479,885." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "Bankrbot 团队账号失陷公告", "tw": "Bankrbot 團隊賬號失陷公告", "en": "Bankrbot team account-compromise notice" }, "url": "https://x.com/0xdeployer/status/2081155362968015159", "type": "official" }, { "label": { "zh": "SlowMist Hacked Zone 记录", "tw": "SlowMist Hacked Zone 記錄", "en": "SlowMist Hacked Zone record" }, "url": "https://hacked.slowmist.io/", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-188", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-112", "status": "verified", "incidentDate": "2026-07-25", "datePrecision": "day", "title": { "zh": "Triple-A 多链热钱包异常流出", "tw": "Triple-A 多鏈熱錢包異常流出", "en": "Triple-A multi-chain hot-wallet outflow" }, "summary": { "zh": "Triple-A 官方确认公司热钱包在多链遭未授权访问，最终损失约 1,180 万美元，客户与商户资金未受影响。资金被兑换、桥接并集中至 Ethereum，服务完成安全检查后恢复。", "tw": "Triple-A 官方確認公司熱錢包在多鏈遭未授權訪問，最終損失約 1,180 萬美元，客戶與商戶資金未受影響。資金被兌換、橋接並集中至 Ethereum，服務完成安全檢查後恢復。", "en": "Triple-A confirmed unauthorized access to company hot wallets across multiple chains and a final loss of approximately $11.8 million. Client and merchant funds were unaffected. Assets were swapped, bridged, and consolidated on Ethereum, and services resumed after security checks." }, "details": { "zh": "## 事件背景\n攻击从 2026 年 7 月 24 日 19:31 UTC 开始并持续约 22 小时。按北京时间计算，主要活动发生在 7 月 25 日。Triple-A 后续确认公司自有热钱包遭未授权访问。\n\n## 事件经过\nTRON、Ethereum、Arbitrum、Polygon、Solana 等链上的公司钱包被清扫，后续披露还涉及 TON 与 Bitcoin。不同链资产被交换或桥接为 Ethereum 资产并集中归集。\n\n## 资金流向\nBlockSec Phalcon 追踪到资金归集至 Ethereum 地址 0x01f83b5d4fb30e8aa3dac1681b4048d9135253b1，该地址当时持有约 5,287.63 ETH，公开观察显示随后没有明显移动。\n\n## 金额口径\n初始链上追踪约为 970 万美元，后续官方与媒体披露将最终损失更新为约 1,180 万美元。该金额是公司自有资产损失，不与归集地址的 ETH 余额重复相加。\n\n## 证据边界\n公开来源支持多链热钱包失陷、资金归集、最终损失和客户资金未受影响。具体凭据、密钥或系统入口尚未公布，因此分类保持为权限失陷而不是已证实的私钥泄露。\n\n## 处置状态\nTriple-A 暂停服务并完成安全检查，随后恢复运营，并与安全机构、链上调查机构及新加坡警方合作。没有公开冻结或返还金额，冻结与追回金额均为 0。", "tw": "## 事件背景\n攻擊從 2026 年 7 月 24 日 19:31 UTC 開始並持續約 22 小時。按北京時間計算，主要活動發生在 7 月 25 日。Triple-A 後續確認公司自有熱錢包遭未授權訪問。\n\n## 事件經過\nTRON、Ethereum、Arbitrum、Polygon、Solana 等鏈上的公司錢包被清掃，後續披露還涉及 TON 與 Bitcoin。不同鏈資產被交換或橋接為 Ethereum 資產並集中歸集。\n\n## 資金流向\nBlockSec Phalcon 追蹤到資金歸集至 Ethereum 地址 0x01f83b5d4fb30e8aa3dac1681b4048d9135253b1，該地址當時持有約 5,287.63 ETH，公開觀察顯示隨後沒有明顯移動。\n\n## 金額口徑\n初始鏈上追蹤約為 970 萬美元，後續官方與媒體披露將最終損失更新為約 1,180 萬美元。該金額是公司自有資產損失，不與歸集地址的 ETH 餘額重複相加。\n\n## 證據邊界\n公開來源支援多鏈熱錢包失陷、資金歸集、最終損失和客戶資金未受影響。具體憑據、金鑰或系統入口尚未公佈，因此分類保持為權限失陷而不是已證實的私鑰洩露。\n\n## 處置狀態\nTriple-A 暫停服務並完成安全檢查，隨後恢復運營，並與安全機構、鏈上調查機構及新加坡警方合作。沒有公開凍結或返還金額，凍結與追回金額均為 0。", "en": "## Incident overview\nThe activity began on July 24, 2026 at 19:31 UTC and continued for approximately 22 hours, placing most of the event on July 25 in Beijing time. Triple-A later confirmed unauthorized access to company-owned hot wallets.\n\n## Incident sequence\nCompany wallets on TRON, Ethereum, Arbitrum, Polygon, and Solana were swept, with later reporting also referring to TON and Bitcoin. Assets from multiple chains were swapped or bridged into Ethereum assets and consolidated.\n\n## Fund flow\nBlockSec Phalcon traced consolidation to Ethereum address 0x01f83b5d4fb30e8aa3dac1681b4048d9135253b1, which held approximately 5,287.63 ETH at the observed time and showed no material subsequent movement in the cited update.\n\n## Amount basis\nInitial on-chain tracking identified approximately $9.7 million, while later official and media reporting updated final loss to about $11.8 million. This is company-asset loss and is not added again to the ETH balance at the consolidation address.\n\n## Evidence boundary\nPublic sources support the multi-chain hot-wallet compromise, consolidation path, final loss, and absence of client-fund impact. The credential, key, or system entry point has not been published, so the record remains access-control compromise rather than confirmed key leakage.\n\n## Current status\nTriple-A paused services for security checks and later restored operations while working with security firms, on-chain investigators, and Singapore police. No public frozen or returned amount has been disclosed, so frozen and recovered values remain 0." }, "category": "access-control", "severity": "critical", "ecosystems": [ "TRON", "Ethereum", "Polygon", "Arbitrum" ], "chains": [ "TRON", "Ethereum", "Polygon", "Arbitrum" ], "lossUsd": 11800000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "最终公开损失约 1,180 万美元，客户和商户资金未受影响；约 5,287.63 ETH 是归集余额，不重复计算。", "tw": "最終公開損失約 1,180 萬美元，客戶和商戶資金未受影響；約 5,287.63 ETH 是歸集餘額，不重複計算。", "en": "Final reported loss is approximately $11.8 million, with client and merchant funds unaffected. Approximately 5,287.63 ETH is a consolidation balance and is not counted again." }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0x01f83b5d4fb30e8aa3dac1681b4048d9135253b1", "entity": { "zh": "Triple-A 攻击资金归集地址", "tw": "Triple-A 攻擊資金歸集地址", "en": "Triple-A attack-fund consolidation address" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/Phalcon_xyz/status/2082026002247512067", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "BlockSec Phalcon 将该地址识别为多链攻击收益在 Ethereum 的归集地址。", "tw": "BlockSec Phalcon 將該地址識別為多鏈攻擊收益在 Ethereum 的歸集地址。", "en": "BlockSec Phalcon identified this address as the Ethereum consolidation point for the multi-chain attack proceeds." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "PeckShieldAlert 多链异常流出报警", "tw": "PeckShieldAlert 多鏈異常流出報警", "en": "PeckShieldAlert multi-chain outflow alert" }, "url": "https://x.com/PeckShieldAlert/status/2080833993633866106", "type": "research" }, { "label": { "zh": "Triple-A 官方说明", "tw": "Triple-A 官方說明", "en": "Triple-A official statement" }, "url": "https://x.com/TripleAHQ/status/2081622020932948328", "type": "official" }, { "label": { "zh": "BlockSec Phalcon 多链追踪", "tw": "BlockSec Phalcon 多鏈追蹤", "en": "BlockSec Phalcon multi-chain tracing" }, "url": "https://x.com/Phalcon_xyz/status/2082025998774657089", "type": "research" }, { "label": { "zh": "BlockSec Phalcon 归集地址", "tw": "BlockSec Phalcon 歸集地址", "en": "BlockSec Phalcon consolidation address" }, "url": "https://x.com/Phalcon_xyz/status/2082026002247512067", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-112", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-186", "status": "verified", "incidentDate": "2026-07-24", "datePrecision": "day", "title": { "zh": "Solido Cash 预言机错配导致异常铸币", "tw": "Solido Cash 預言機錯配導致異常鑄幣", "en": "Solido Cash oracle misassignment and excess minting" }, "summary": { "zh": "Solido Cash 的 SOLID 抵押品价格源失效后错误回退到接近 1 美元的 CASH 价格，使低价 SOLID 被高估。攻击者据此铸造 809,051.55 CASH，并换得约 293,705,544.97 SUPRA。", "tw": "Solido Cash 的 SOLID 抵押品價格源失效後錯誤回退到接近 1 美元的 CASH 價格，使低價 SOLID 被高估。攻擊者據此鑄造 809,051.55 CASH，並換得約 293,705,544.97 SUPRA。", "en": "After the SOLID collateral feed failed, Solido Cash incorrectly fell back to a CASH price near $1 and severely overvalued low-priced SOLID. The attacker minted 809,051.55 CASH and obtained approximately 293,705,544.97 SUPRA." }, "details": { "zh": "## 事件背景\n2026 年 7 月 24 日，Supra 上的 Solido Cash 因 SOLID 抵押品预言机错配遭利用。项目方随后发布法证报告并暂停相关功能。\n\n## 事件经过\nSOLID 的价格源失效后，系统使用接近 1 美元的 CASH 价格作为错误回退。攻击者低价取得 SOLID、存入 CDP、按虚高抵押价值铸造 CASH，再将 CASH 卖入流动性池换取 SUPRA。\n\n## 资金流向\n攻击分两个阶段执行。约 220,000,000 SUPRA 进入疑似 Gate.io 存款地址，26,926,777 SUPRA 进入另一疑似托管路径，46,778,767.97 SUPRA 留在链上。\n\n## 金额口径\n未经授权铸造量为 809,051.55 CASH，攻击者净得约 293,705,544.97 SUPRA。美元价值受 SUPRA 价格与流动性影响较大，公开损失采用 SlowMist Hacked Zone 的 73,400 美元记录，同时保留完整代币数量。\n\n## 证据边界\nSolido 法证材料支持预言机错配、两阶段攻击和 SUPRA 数量。交易所地址归属仍为疑似，不能写成平台已确认；不同美元估值不相加。\n\n## 处置状态\n项目暂停相关功能并表示将公布修复与恢复计划。没有公开证据确认攻击资产已经返还、冻结或恢复控制。", "tw": "## 事件背景\n2026 年 7 月 24 日，Supra 上的 Solido Cash 因 SOLID 抵押品預言機錯配遭利用。專案方隨後釋出法證報告並暫停相關功能。\n\n## 事件經過\nSOLID 的價格源失效後，系統使用接近 1 美元的 CASH 價格作為錯誤回退。攻擊者低價取得 SOLID、存入 CDP、按虛高抵押價值鑄造 CASH，再將 CASH 賣入流動性池換取 SUPRA。\n\n## 資金流向\n攻擊分兩個階段執行。約 220,000,000 SUPRA 進入疑似 Gate.io 存款地址，26,926,777 SUPRA 進入另一疑似託管路徑，46,778,767.97 SUPRA 留在鏈上。\n\n## 金額口徑\n未經授權鑄造量為 809,051.55 CASH，攻擊者淨得約 293,705,544.97 SUPRA。美元價值受 SUPRA 價格與流動性影響較大，公開損失採用 SlowMist Hacked Zone 的 73,400 美元記錄，同時保留完整代幣數量。\n\n## 證據邊界\nSolido 法證材料支援預言機錯配、兩階段攻擊和 SUPRA 數量。交易所地址歸屬仍為疑似，不能寫成平臺已確認；不同美元估值不相加。\n\n## 處置狀態\n專案暫停相關功能並表示將公佈修復與恢復計劃。沒有公開證據確認攻擊資產已經返還、凍結或恢復控制。", "en": "## Incident overview\nOn July 24, 2026, Solido Cash on Supra was exploited through an oracle misassignment affecting SOLID collateral. The project later published a forensic report and paused affected functions.\n\n## Incident sequence\nAfter the SOLID price feed failed, the system incorrectly fell back to a CASH price near $1. The attacker acquired cheap SOLID, deposited it into the CDP, minted CASH against the inflated collateral value, and sold CASH into liquidity pools for SUPRA.\n\n## Fund flow\nThe attack ran in two phases. Approximately 220,000,000 SUPRA entered a suspected Gate.io deposit address, 26,926,777 SUPRA entered another suspected custody path, and 46,778,767.97 SUPRA remained on-chain.\n\n## Amount basis\nUnauthorized minting totaled 809,051.55 CASH, and the attacker obtained approximately 293,705,544.97 SUPRA. USD value varies substantially with SUPRA price and liquidity. Reported loss uses the $73,400 SlowMist Hacked Zone record while preserving the full token quantity.\n\n## Evidence boundary\nSolido’s forensic material supports the oracle misassignment, two-stage attack, and SUPRA quantity. Exchange attribution remains suspected rather than platform-confirmed, and different USD estimates are not added together.\n\n## Current status\nThe project paused affected functions and said it would publish remediation and recovery plans. No public evidence confirms return, freezing, or restoration of control over the attack proceeds." }, "category": "oracle-manipulation", "severity": "high", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": 73400, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "攻击者净得约 293,705,544.97 SUPRA；公开美元损失采用 73,400 美元记录。", "tw": "攻擊者淨得約 293,705,544.97 SUPRA；公開美元損失採用 73,400 美元記錄。", "en": "The attacker obtained approximately 293,705,544.97 SUPRA; reported USD loss uses the $73,400 record." }, "addressDisclosure": "published", "addresses": [ { "chain": "Other", "address": "0x473da897ccc9e1932a3756d1811d08e83b7ba0387cd42c5f9f89c64ccb1fd14b", "entity": { "zh": "Supra 上的 Solido Cash 第一阶段攻击主体", "tw": "Supra 上的 Solido Cash 第一階段攻擊主體", "en": "Solido Cash wave-A attack actor on Supra" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://app.solido.money/reports/solido-cash-incident-july-2026.pdf", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Solido 法证报告将该 Supra 账户列为第一阶段攻击执行主体。", "tw": "Solido 法證報告將該 Supra 賬戶列為第一階段攻擊執行主體。", "en": "Solido’s forensic report identifies this Supra account as the wave-A attack actor." }, "reviewRequired": true }, { "chain": "Other", "address": "0x2d76190e8179a5423582ef7097e8c2839344ffc64b8943d6936368525adfb089", "entity": { "zh": "疑似 Gate.io 存款地址", "tw": "疑似 Gate.io 存款地址", "en": "Suspected Gate.io deposit address" }, "role": "exchange", "category": "unknown", "confidence": 0.65, "sourceUrl": "https://app.solido.money/reports/solido-cash-incident-july-2026.pdf", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "法证报告将该地址描述为疑似 Gate.io 存款路径，平台归属仍需确认。", "tw": "法證報告將該地址描述為疑似 Gate.io 存款路徑，平臺歸屬仍需確認。", "en": "The forensic report describes this as a suspected Gate.io deposit path; platform attribution remains unconfirmed." }, "reviewRequired": true }, { "chain": "Other", "address": "0xaef2f958c03bad82824841c71cbae2c2160e7d8babeaf6c0b39bd864637df4dd", "entity": { "zh": "疑似交易所托管路径地址", "tw": "疑似交易所託管路徑地址", "en": "Suspected exchange-custody path address" }, "role": "exchange", "category": "unknown", "confidence": 0.6, "sourceUrl": "https://app.solido.money/reports/solido-cash-incident-july-2026.pdf", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "法证报告将该地址列为疑似交易所客户存款或托管路径，具体归属未确认。", "tw": "法證報告將該地址列為疑似交易所客戶存款或託管路徑，具體歸屬未確認。", "en": "The forensic report lists this as a suspected exchange customer-deposit or custody path; attribution is not confirmed." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "Solido 法证报告公告", "tw": "Solido 法證報告公告", "en": "Solido forensic-report announcement" }, "url": "https://x.com/SolidoMoney/status/2081323242854469730", "type": "official" }, { "label": { "zh": "Solido 影响范围更新", "tw": "Solido 影響範圍更新", "en": "Solido impact update" }, "url": "https://x.com/SolidoMoney/status/2081648032584716767", "type": "official" }, { "label": { "zh": "Solido Cash 法证报告", "tw": "Solido Cash 法證報告", "en": "Solido Cash forensic report" }, "url": "https://app.solido.money/reports/solido-cash-incident-july-2026.pdf", "type": "official" }, { "label": { "zh": "SlowMist Hacked Zone 记录", "tw": "SlowMist Hacked Zone 記錄", "en": "SlowMist Hacked Zone record" }, "url": "https://hacked.slowmist.io/", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-186", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-113", "status": "verified", "incidentDate": "2026-07-24", "datePrecision": "day", "title": { "zh": "Lien Finance 多重集完整性校验漏洞", "tw": "Lien Finance 多重集完整性校驗漏洞", "en": "Lien Finance multiset-integrity validation exploit" }, "summary": { "zh": "Lien Finance 的 exchangeEquivalentBonds 仅比较异常项总数，没有逐一验证 bondID 的出现次数。攻击者重复输出 bondID 后铸造担保不足的 BondToken，并通过预授权端点兑换走 542,144.63 USDC。", "tw": "Lien Finance 的 exchangeEquivalentBonds 僅比較異常項總數，沒有逐一驗證 bondID 的出現次數。攻擊者重複輸出 bondID 後鑄造擔保不足的 BondToken，並通過預授權端點兌換走 542,144.63 USDC。", "en": "Lien Finance’s exchangeEquivalentBonds compared only aggregate anomaly counts and did not verify each bondID multiplicity. The attacker duplicated a bondID in the output, minted undercollateralized BondToken, and redeemed 542,144.63 USDC through preapproved endpoints." }, "details": { "zh": "## 事件背景\n2026 年 7 月 24 日，SlowMist 披露 Lien Finance 的 BondMakerCollateralizedEth.exchangeEquivalentBonds 存在多重集完整性校验缺陷。漏洞把业务逻辑错误放大为可直接兑换 USDC 的提款路径。\n\n## 事件经过\n1. 函数只统计输入和输出中的异常项总数。\n2. 合约没有逐一比较每个 bondID 在两组中的出现次数。\n3. 攻击者在输出组重复同一异常 bondID，绕过集合等价性假设。\n4. 攻击者铸造担保不足的 BondToken。\n5. 三个预授权端点随后把这些代币兑换为协议或受害方持有的 USDC。\n\n## 资金流向\n公开分析说明资金经由预授权兑换端点从协议或受害方资产池流出，但来源没有披露可完整核验的攻击者地址和交易清单，因此地址字段保持未公开。\n\n## 金额口径\n公开损失采用 SlowMist 披露的 542,144.63 USDC。没有第二种独立资产口径需要叠加，也没有公开证据支持更高的损失估计。\n\n## 证据边界\n公开研究支持受影响函数、逐 bondID 校验缺失、重复输出及预授权兑换路径。现有来源没有提供完整地址、冻结结果、返还交易或项目赔付方案。\n\n## 处置状态\n根因已被公开说明。追回、冻结和赔付均未得到公开确认，因此冻结和追回金额保持为零。", "tw": "## 事件背景\n2026 年 7 月 24 日，SlowMist 披露 Lien Finance 的 BondMakerCollateralizedEth.exchangeEquivalentBonds 存在多重集完整性校驗缺陷。漏洞把業務邏輯錯誤放大為可直接兌換 USDC 的提款路徑。\n\n## 事件經過\n1. 函式只統計輸入和輸出中的異常項總數。\n2. 合約沒有逐一比較每個 bondID 在兩組中的出現次數。\n3. 攻擊者在輸出組重複同一異常 bondID，繞過集合等價性假設。\n4. 攻擊者鑄造擔保不足的 BondToken。\n5. 三個預授權端點隨後把這些代幣兌換為協議或受害方持有的 USDC。\n\n## 資金流向\n公開分析說明資金經由預授權兌換端點從協議或受害方資產池流出，但來源沒有披露可完整核驗的攻擊者地址和交易清單，因此地址欄位保持未公開。\n\n## 金額口徑\n公開損失採用 SlowMist 披露的 542,144.63 USDC。沒有第二種獨立資產口徑需要疊加，也沒有公開證據支援更高的損失估計。\n\n## 證據邊界\n公開研究支援受影響函式、逐 bondID 校驗缺失、重複輸出及預授權兌換路徑。現有來源沒有提供完整地址、凍結結果、返還交易或專案賠付方案。\n\n## 處置狀態\n根因已被公開說明。追回、凍結和賠付均未得到公開確認，因此凍結和追回金額保持為零。", "en": "## Incident overview\nOn July 24, 2026, SlowMist disclosed a multiset-integrity validation defect in Lien Finance’s BondMakerCollateralizedEth.exchangeEquivalentBonds. The business-logic flaw was amplified into a direct USDC redemption path.\n\n## Incident sequence\n1. The function counted only the aggregate number of anomalous entries in the input and output.\n2. It did not compare the multiplicity of every bondID across both groups.\n3. The attacker duplicated one anomalous bondID in the output and bypassed the assumed set equivalence.\n4. The attacker minted undercollateralized BondToken.\n5. Three preapproved endpoints then redeemed those tokens for USDC held by the protocol or affected party.\n\n## Fund flow\nPublic analysis describes value leaving through preapproved redemption endpoints, but the source does not publish a complete attacker-address and transaction list. Address disclosure therefore remains unavailable.\n\n## Amount basis\nThe reported loss uses SlowMist’s 542,144.63 USDC figure. No separate independent asset measure is added, and no public evidence supports a higher loss estimate.\n\n## Evidence boundary\nPublic research supports the affected function, missing per-bondID multiplicity check, duplicated output, and preapproved redemption path. The available source does not provide complete addresses, freeze results, return transactions, or a project compensation plan.\n\n## Current status\nThe root cause has been publicly described. No recovery, freeze, or compensation has been confirmed, so frozen and recovered amounts remain zero." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 542144.63, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "542,144.63 USDC 经预授权兑换端点流出。", "tw": "542,144.63 USDC 經預授權兌換端點流出。", "en": "542,144.63 USDC left through preapproved redemption endpoints." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "SlowMist TI 报警与根因分析", "tw": "SlowMist TI 報警與根因分析", "en": "SlowMist TI alert and root-cause analysis" }, "url": "https://x.com/SlowMist_Team/status/2080555677811171459", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-113", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-058", "status": "verified", "incidentDate": "2026-07-24", "datePrecision": "day", "title": { "zh": "Evan Jawad 自述 PC 与账户失陷并损失加密资产及 NFT", "tw": "Evan Jawad 自述 PC 與帳戶失陷並損失加密資產及 NFT", "en": "Evan Jawad reports PC and account compromise with cryptocurrency and NFT losses" }, "summary": { "zh": "Evan Jawad 称未知文件导致 PC、多个账户和 X 被接管，钱包中超过 600 美元的资产及 NFT 被转走，总损失超过 1,000 美元。该记录是第一方陈述，未公开地址、TxID、样本或独立取证。", "tw": "Evan Jawad 稱未知文件導致 PC、多個帳戶和 X 被接管，錢包中超過 600 美元的資產及 NFT 被轉走，總損失超過 1,000 美元。該記錄是第一方陳述，未公開地址、TxID、樣本或獨立取證。", "en": "Evan Jawad said an unknown file led to compromise of his PC, multiple accounts, and X account, followed by the transfer of more than $600 in wallet assets and NFTs, for a total loss exceeding $1,000. This is a first-party report without public addresses, transaction IDs, sample, or independent forensics." }, "details": { "zh": "## 事件背景\n当事人称起因是一个自认为安全的文件，随后 PC、多个账户及 X 被未授权控制。公开材料没有提供文件样本、哈希、恶意软件家族、钱包地址、TxID 或取证报告，因此不能确定是 infostealer、RAT、剪贴板劫持、恶意签名还是其他入口。\n\n## 事件经过\n1. 当事人运行或打开未知文件。\n2. PC 与多个账户被未授权访问，X 账户一度被接管。\n3. 当事人在恢复 X 账户时发现钱包资产和 NFT 已被转走。\n4. 2026 年 7 月 24 日 13:00:33，当事人公开损失并提醒不要运行未知测试应用或验证文件。\n\n## 资金流向\n公开资料未披露完整钱包地址、接收地址或 TxID，现阶段无法确认具体链、地址或攻击者归因。\n\n## 金额口径\n当事人称钱包中超过 600 美元的资产被转走，另有 NFT 被盗，总损失超过 1,000 美元。公开记录以 1,000 美元作为公开下限记录，不对 NFT 另行估值，避免重复或虚增。\n\n## 证据边界\n第一方陈述支持发生了公开报案式自述，但缺少链上标识、恶意样本和独立取证。具体链、恶意软件类型、攻击者地址、NFT 估值及资金最终去向均待核。\n\n## 处置状态\nX 账户已恢复；被盗资产和 NFT 未确认追回。当事人未披露发行方冻结、交易所拦截、警方文件或资金返还，现有资料未确认资产已返还受害者或恢复控制权。", "tw": "## 事件背景\n當事人稱起因是一個自認為安全的文件，隨後 PC、多個帳戶及 X 被未授權控制。公開材料沒有提供文件樣本、哈希、惡意軟件家族、錢包地址、TxID 或取證報告，因此不能確定是 infostealer、RAT、剪貼板劫持、惡意簽名還是其他入口。\n\n## 事件經過\n1. 當事人運行或打開未知文件。\n2. PC 與多個帳戶被未授權訪問，X 帳戶一度被接管。\n3. 當事人在恢復 X 帳戶時發現錢包資產和 NFT 已被轉走。\n4. 2026 年 7 月 24 日 13:00:33，當事人公開損失並提醒不要運行未知測試應用或驗證文件。\n\n## 資金流向\n公開資料未披露完整錢包地址、接收地址或 TxID，現階段無法確認具體鏈、地址或攻擊者歸因。\n\n## 金額口徑\n當事人稱錢包中超過 600 美元的資產被轉走，另有 NFT 被盜，總損失超過 1,000 美元。公開記錄以 1,000 美元作為公開下限記錄，不對 NFT 另行估值，避免重複或虛增。\n\n## 證據邊界\n第一方陳述支持發生了公開報案式自述，但缺少鏈上標識、惡意樣本和獨立取證。具體鏈、惡意軟件類型、攻擊者地址、NFT 估值及資金最終去向均待核。\n\n## 處置狀態\nX 帳戶已恢復；被盜資產和 NFT 未確認追回。當事人未披露發行方凍結、交易所攔截、警方文件或資金返還，現有資料未確認資產已返還受害者或恢復控制權。", "en": "## Incident overview\nThe victim said the incident began with a file he believed was safe, after which his PC, multiple accounts, and X account were accessed without authorization. No file sample, hash, malware family, wallet address, transaction ID, or forensic report was published, so the entry vector cannot be classified as an infostealer, RAT, clipboard hijacker, malicious signature, or another specific mechanism.\n\n## Incident sequence\n1. The victim ran or opened an unknown file.\n2. His PC and multiple accounts were accessed without authorization, and his X account was temporarily taken over.\n3. While restoring the X account, he found that wallet assets and NFTs had been transferred away.\n4. At 13:00:33 on July 24, 2026, he publicly described the loss and warned users not to run unknown test applications or verification files.\n\n## Fund flow\nNo complete wallet, recipient address, or transaction ID was published. The chain, addresses, and attacker attribution remain unconfirmed.\n\n## Amount basis\nThe victim reported more than $600 in transferred wallet assets plus stolen NFTs, placing the total loss above $1,000. A conservative $1,000 lower bound is used, and the NFTs are not valued separately to avoid duplication or inflation.\n\n## Evidence boundary\nThe first-party statement supports a public victim report but lacks chain identifiers, a malicious sample, and independent forensics. The specific chain, malware type, attacker addresses, NFT value, and final destination of funds remain unverified.\n\n## Current status\nThe X account was restored, but the stolen assets and NFTs were not confirmed as recovered. No issuer freeze, exchange interception, police document, or asset return was disclosed. No asset return or restoration of control is confirmed." }, "category": "account-takeover", "severity": "medium", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": 1000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "第一方称钱包资产和 NFT 总损失超过 1,000 美元；公开记录按公开下限记录 1,000 美元，不另行估算 NFT。", "tw": "第一方稱錢包資產和 NFT 總損失超過 1,000 美元；公開記錄按公開下限記錄 1,000 美元，不另行估算 NFT。", "en": "The first party reported total cryptocurrency and NFT losses exceeding $1,000; public sources report the public $1,000 lower bound without assigning a separate NFT estimate." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "Evan Jawad 第一方陈述", "tw": "Evan Jawad 第一方陳述", "en": "Evan Jawad first-party statement" }, "url": "https://x.com/evanjawadx/status/2080518476469551290", "type": "official" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-058", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-056", "status": "verified", "incidentDate": "2026-07-24", "datePrecision": "day", "title": { "zh": "Robinhood CEO Vlad Tenev 的 X 账户被接管并推广假 VLAD 代币", "tw": "Robinhood CEO Vlad Tenev 的 X 帳戶被接管並推廣假 VLAD 代幣", "en": "Robinhood CEO Vlad Tenev’s X account was taken over to promote a fake VLAD token" }, "summary": { "zh": "Robinhood 官方确认 Vlad Tenev 的 X 账户遭入侵并推广假 VLAD 代币，账户随后恢复。GoPlus 将地址 0xd70627fd9ee5b70906620a6f2001ba74457b438d 与假币部署及约 120 万至 130 万美元攻击者获利估计关联；该利润不是已确认受害者净损失。", "tw": "Robinhood 官方確認 Vlad Tenev 的 X 賬戶遭入侵併推廣假 VLAD 代幣，賬戶隨後恢復。GoPlus 將地址 0xd70627fd9ee5b70906620a6f2001ba74457b438d 與假幣部署及約 120 萬至 130 萬美元攻擊者獲利估計關聯；該利潤不是已確認受害者淨損失。", "en": "Robinhood confirmed that Vlad Tenev’s X account was compromised and used to promote a fake VLAD token before access was restored. GoPlus associated address 0xd70627fd9ee5b70906620a6f2001ba74457b438d with the token deployment and an estimated $1.2 million to $1.3 million in attacker profit; that profit is not confirmed victim net loss." }, "details": { "zh": "## 事件背景\nVlad Tenev 的 X 账户被未授权控制，攻击者借助名人账户信誉，把 VLAD 描述为 Robinhood 官方代币或吉祥物并诱导交易。公开证据没有说明入侵入口，不能确定为 SIM 换卡、钓鱼、会话窃取、设备失陷或平台侧问题。\n\n## 事件经过\n1. 假 VLAD 代币及主要流动性池在 2026 年 7 月 24 日创建。\n2. 被接管的 @vladtenev 账户发布虚假推广内容。\n3. Robinhood Comms 确认账户遭入侵并删除恶意帖子。\n4. Vlad Tenev 恢复账户后明确 Robinhood 没有发行任何 coin 或 token。\n5. GoPlus 后续披露与假币部署及获利路径关联的地址。\n\n## 资金流向\n假 VLAD Token 合约和两个流动性池是恶意推广与交易基础设施。GoPlus 将 0xd70627fd9ee5b70906620a6f2001ba74457b438d 与假币创建及攻击者获利路径关联；其余 Token 合约和 DEX 池不标成攻击者钱包。\n\n## 金额口径\n公开报警估计攻击者获利约 120 万至 130 万美元，假币交易量约 2,200 万美元。交易量、攻击者利润与受害者净损失是不同口径；没有足够公开资料确认受害者净损失，因此公开损失保持未披露。\n\n## 地址与交易\n1. 0x92D176ccBeEffeCd8089e841D09ea17b6C22D969 — 假 VLAD 代币合约。\n2. 0xac870e97FC1FE981F4D887e5f453203745A15EF4 — VLAD/WETH 流动性池。\n3. 0xd556163Edd5d44797bfC767FD85Ac17819C5310d — VLAD/USDG 流动性池。\n4. 0xd70627fd9ee5b70906620a6f2001ba74457b438d — GoPlus 关联的假币部署与获利地址。\n\n## 证据边界\n官方材料支持账户接管、恶意推广、帖子删除、账户恢复和 Robinhood 未发币。Dexscreener 支持 Token 与池存在，GoPlus 支持新增地址和利润估计。现有公开资料不足以把攻击者利润直接写成受害者净损失。\n\n## 处置状态\n账户已恢复，恶意帖已删除，Vlad 已公开否认 Robinhood 发币。假代币和池仍可被链上数据服务检索；未公开受害者净损失、入侵入口或赔偿方案。", "tw": "## 事件背景\nVlad Tenev 的 X 賬戶被未授權控制，攻擊者藉助名人賬戶信譽，把 VLAD 描述為 Robinhood 官方代幣或吉祥物並誘導交易。公開證據沒有說明入侵入口，不能確定為 SIM 換卡、釣魚、會話竊取、裝置失陷或平臺側問題。\n\n## 事件經過\n1. 假 VLAD 代幣及主要流動性池在 2026 年 7 月 24 日建立。\n2. 被接管的 @vladtenev 賬戶釋出虛假推廣內容。\n3. Robinhood Comms 確認賬戶遭入侵併刪除惡意帖子。\n4. Vlad Tenev 恢復賬戶後明確 Robinhood 沒有發行任何 coin 或 token。\n5. GoPlus 後續披露與假幣部署及獲利路徑關聯的地址。\n\n## 資金流向\n假 VLAD Token 合約和兩個流動性池是惡意推廣與交易基礎設施。GoPlus 將 0xd70627fd9ee5b70906620a6f2001ba74457b438d 與假幣建立及攻擊者獲利路徑關聯；其餘 Token 合約和 DEX 池不標成攻擊者錢包。\n\n## 金額口徑\n公開報警估計攻擊者獲利約 120 萬至 130 萬美元，假幣交易量約 2,200 萬美元。交易量、攻擊者利潤與受害者淨損失是不同口徑；沒有足夠公開資料確認受害者淨損失，因此公開損失保持未披露。\n\n## 地址與交易\n1. 0x92D176ccBeEffeCd8089e841D09ea17b6C22D969 — 假 VLAD 代幣合約。\n2. 0xac870e97FC1FE981F4D887e5f453203745A15EF4 — VLAD/WETH 流動性池。\n3. 0xd556163Edd5d44797bfC767FD85Ac17819C5310d — VLAD/USDG 流動性池。\n4. 0xd70627fd9ee5b70906620a6f2001ba74457b438d — GoPlus 關聯的假幣部署與獲利地址。\n\n## 證據邊界\n官方材料支援賬戶接管、惡意推廣、帖子刪除、賬戶恢復和 Robinhood 未發幣。Dexscreener 支援 Token 與池存在，GoPlus 支援新增地址和利潤估計。現有公開資料不足以把攻擊者利潤直接寫成受害者淨損失。\n\n## 處置狀態\n賬戶已恢復，惡意帖已刪除，Vlad 已公開否認 Robinhood 發幣。假代幣和池仍可被鏈上資料服務檢索；未公開受害者淨損失、入侵入口或賠償方案。", "en": "## Incident overview\nVlad Tenev’s X account was accessed without authorization. The attacker used the credibility of a prominent account to describe VLAD as an official Robinhood token or mascot and encourage trading. Public evidence does not disclose the intrusion vector, so SIM swapping, phishing, session theft, endpoint compromise, or a platform-side failure cannot be asserted.\n\n## Incident sequence\n1. The fake VLAD token and principal liquidity pools were created on July 24, 2026.\n2. The compromised @vladtenev account posted false promotional content.\n3. Robinhood Comms confirmed the compromise and removed the malicious post.\n4. After restoring access, Vlad Tenev stated that Robinhood had issued no coin or token.\n5. GoPlus later disclosed an address associated with deployment and the profit path.\n\n## Fund flow\nThe fake VLAD token contract and two liquidity pools are malicious-promotion and trading infrastructure. GoPlus associated 0xd70627fd9ee5b70906620a6f2001ba74457b438d with token creation and the attacker profit path. The other token contract and DEX pools are not labeled as attacker wallets.\n\n## Amount basis\nPublic alerts estimated attacker profit at approximately $1.2 million to $1.3 million and fake-token trading volume near $22 million. Trading volume, attacker profit, and victim net loss are different measures. Public material does not establish victim net loss, so the reported loss remains undisclosed.\n\n## Addresses and transactions\n1. 0x92D176ccBeEffeCd8089e841D09ea17b6C22D969 — fake VLAD token contract.\n2. 0xac870e97FC1FE981F4D887e5f453203745A15EF4 — VLAD/WETH liquidity pool.\n3. 0xd556163Edd5d44797bfC767FD85Ac17819C5310d — VLAD/USDG liquidity pool.\n4. 0xd70627fd9ee5b70906620a6f2001ba74457b438d — address associated by GoPlus with token deployment and profit.\n\n## Evidence boundary\nOfficial material supports the account takeover, malicious promotion, post removal, access restoration, and Robinhood’s denial of a token launch. Dexscreener supports the token and pools, while GoPlus supports the added address and profit estimate. Public material is insufficient to treat attacker profit as victim net loss.\n\n## Current status\nThe account was restored, the malicious post was deleted, and Vlad publicly denied that Robinhood had issued a token. The fake token and pools remain discoverable through chain-data services; victim net loss, intrusion vector, and compensation were not published." }, "category": "account-takeover", "severity": "high", "ecosystems": [ "Robinhood Chain" ], "chains": [ "Robinhood Chain" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "受害者净损失未公开；约 120 万至 130 万美元为公开报警中的攻击者获利估计，约 2,200 万美元为交易量，均不记作确认损失。", "tw": "受害者淨損失未公開；約 120 萬至 130 萬美元為公開報警中的攻擊者獲利估計，約 2,200 萬美元為交易量，均不記作確認損失。", "en": "Victim net loss was not published. Approximately $1.2 million to $1.3 million is an alert-based attacker-profit estimate and about $22 million is trading volume; neither is recorded as confirmed loss." }, "addressDisclosure": "published", "addresses": [ { "chain": "Robinhood Chain", "address": "0x92D176ccBeEffeCd8089e841D09ea17b6C22D969", "entity": { "zh": "[链：Robinhood Chain] [假 VLAD 代币合约] [恶意推广载体] [非攻击者钱包]", "tw": "[鏈：Robinhood Chain] [假 VLAD 代幣合約] [惡意推廣載體] [非攻擊者錢包]", "en": "[chain: Robinhood Chain] [fake VLAD token contract] [malicious-promotion vehicle] [not an attacker wallet]" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://dexscreener.com/robinhood/0xac870e97fc1fe981f4d887e5f453203745a15ef4", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Robinhood Chain] [假 VLAD 代币合约] [恶意推广载体] [非攻击者钱包]。该标签仅说明所引公开证据支持的地址角色，不扩大为案件、所有人或资金性质归因。", "tw": "[鏈：Robinhood Chain] [假 VLAD 代幣合約] [惡意推廣載體] [非攻擊者錢包]。該標籤僅說明所引公開證據支持的地址角色，不擴大為案件、所有人或資金性質歸因。", "en": "[chain: Robinhood Chain] [fake VLAD token contract] [malicious-promotion vehicle] [not an attacker wallet]. The label is limited to the cited public evidence and does not establish broader case, ownership, or fund-source attribution." }, "reviewRequired": true }, { "chain": "Robinhood Chain", "address": "0xac870e97FC1FE981F4D887e5f453203745A15EF4", "entity": { "zh": "[链：Robinhood Chain] [VLAD/WETH 流动性池] [DEX 基础设施] [非攻击者钱包]", "tw": "[鏈：Robinhood Chain] [VLAD/WETH 流動性池] [DEX 基礎設施] [非攻擊者錢包]", "en": "[chain: Robinhood Chain] [VLAD/WETH liquidity pool] [DEX infrastructure] [not an attacker wallet]" }, "role": "other", "category": "dex", "confidence": 0.95, "sourceUrl": "https://dexscreener.com/robinhood/0xac870e97fc1fe981f4d887e5f453203745a15ef4", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Robinhood Chain] [VLAD/WETH 流动性池] [DEX 基础设施] [非攻击者钱包]。该标签仅说明所引公开证据支持的地址角色，不扩大为案件、所有人或资金性质归因。", "tw": "[鏈：Robinhood Chain] [VLAD/WETH 流動性池] [DEX 基礎設施] [非攻擊者錢包]。該標籤僅說明所引公開證據支持的地址角色，不擴大為案件、所有人或資金性質歸因。", "en": "[chain: Robinhood Chain] [VLAD/WETH liquidity pool] [DEX infrastructure] [not an attacker wallet]. The label is limited to the cited public evidence and does not establish broader case, ownership, or fund-source attribution." }, "reviewRequired": true }, { "chain": "Robinhood Chain", "address": "0xd556163Edd5d44797bfC767FD85Ac17819C5310d", "entity": { "zh": "[链：Robinhood Chain] [VLAD/USDG 流动性池] [DEX 基础设施] [非攻击者钱包]", "tw": "[鏈：Robinhood Chain] [VLAD/USDG 流動性池] [DEX 基礎設施] [非攻擊者錢包]", "en": "[chain: Robinhood Chain] [VLAD/USDG liquidity pool] [DEX infrastructure] [not an attacker wallet]" }, "role": "other", "category": "dex", "confidence": 0.9, "sourceUrl": "https://dexscreener.com/robinhood/0xd556163edd5d44797bfc767fd85ac17819c5310d", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Robinhood Chain] [VLAD/USDG 流动性池] [DEX 基础设施] [非攻击者钱包]。该标签仅说明所引公开证据支持的地址角色，不扩大为案件、所有人或资金性质归因。", "tw": "[鏈：Robinhood Chain] [VLAD/USDG 流動性池] [DEX 基礎設施] [非攻擊者錢包]。該標籤僅說明所引公開證據支持的地址角色，不擴大為案件、所有人或資金性質歸因。", "en": "[chain: Robinhood Chain] [VLAD/USDG liquidity pool] [DEX infrastructure] [not an attacker wallet]. The label is limited to the cited public evidence and does not establish broader case, ownership, or fund-source attribution." }, "reviewRequired": true }, { "chain": "Robinhood Chain", "address": "0xd70627fd9ee5b70906620a6f2001ba74457b438d", "entity": { "zh": "假 VLAD 代币部署与攻击者获利关联地址", "tw": "假 VLAD 代幣部署與攻擊者獲利關聯地址", "en": "Address associated with fake VLAD deployment and attacker profit" }, "role": "attacker", "category": "scam", "confidence": 0.85, "sourceUrl": "https://x.com/GoPlusSecurity/status/2080552676866379944", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "GoPlus 将该地址与假 VLAD 代币创建和约 120 万至 130 万美元获利估计关联；不据此推定受害者净损失。", "tw": "GoPlus 將該地址與假 VLAD 代幣建立和約 120 萬至 130 萬美元獲利估計關聯；不據此推定受害者淨損失。", "en": "GoPlus associated the address with fake VLAD token creation and an estimated $1.2 million to $1.3 million in profit; this does not establish victim net loss." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "Robinhood Comms 官方确认", "tw": "Robinhood Comms 官方確認", "en": "Robinhood Comms confirmation" }, "url": "https://x.com/RobinhoodComms/status/2080353603160584640", "type": "official" }, { "label": { "zh": "Vlad Tenev 恢复账户并否认发币", "tw": "Vlad Tenev 恢復帳戶並否認發幣", "en": "Vlad Tenev confirms restoration and denies issuing a token" }, "url": "https://x.com/vladtenev/status/2080483725209649349", "type": "official" }, { "label": { "zh": "Dexscreener：VLAD/WETH", "tw": "Dexscreener：VLAD/WETH", "en": "Dexscreener: VLAD/WETH" }, "url": "https://dexscreener.com/robinhood/0xac870e97fc1fe981f4d887e5f453203745a15ef4", "type": "research" }, { "label": { "zh": "GoPlus 假 VLAD 链上报警", "tw": "GoPlus 假 VLAD 鏈上報警", "en": "GoPlus fake VLAD on-chain alert" }, "url": "https://x.com/GoPlusSecurity/status/2080552676866379944", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-056", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-187", "status": "verified", "incidentDate": "2026-07-23", "datePrecision": "day", "title": { "zh": "Verus–Ethereum Bridge 第二次同类漏洞攻击", "tw": "Verus–Ethereum Bridge 第二次同類漏洞攻擊", "en": "Second Verus–Ethereum Bridge exploit of the same flaw" }, "summary": { "zh": "攻击者利用 Verus 与 Ethereum 对重复 proofRoots 的处理差异，让恶意 state-root 覆盖真实根，再以仅 0.01 VRSC 的出口请求构造膨胀导入证明，从桥储备提取约 744 万美元资产。", "tw": "攻擊者利用 Verus 與 Ethereum 對重複 proofRoots 的處理差異，讓惡意 state-root 覆蓋真實根，再以僅 0.01 VRSC 的出口請求構造膨脹導入證明，從橋儲備提取約 744 萬美元資產。", "en": "The attacker exploited different handling of duplicate proofRoots on Verus and Ethereum, allowing a malicious state root to overwrite the genuine root. A fabricated import proof based on a 0.01 VRSC export then released approximately $7.44 million from bridge reserves." }, "details": { "zh": "## 事件背景\n2026 年 7 月 23 日，攻击者利用 Verus 与 Ethereum 对 notarization 数据的不同解释，再次攻击 Verus–Ethereum Bridge。Verus 侧把 proofRoots 放入映射时忽略重复项，而 Ethereum 合约按顺序处理并让后出现的同一 system ID 覆盖先前 stateRoot。\n\n## 事件经过\n1. 攻击者提交包含正常根和多个恶意重复 state-root 的 notarization。\n2. 11 个合法 notary daemon 对原始 notarization 字节签名。\n3. 攻击者把证据转发至 Ethereum，两次调用 setLatestData，使后出现的恶意根覆盖真实根。\n4. 攻击者在 Verus 上发起仅 0.01 VRSC 的真实出口请求，并构造与恶意根匹配的伪造导入证明。\n5. Ethereum 桥接受该证明并释放约 744 万美元资产。\n\n## 资金流向\n桥储备中的 ETH、tBTC、稳定币和 MKR 被提取后，经 Relay 兑换为 2,778.8662 ETH，并进入 Tornado Cash。该路径属于 7 月 23 日的第二次独立攻击，不与 5 月的第一次事件合并。\n\n## 金额口径\nCertiK 完整分析将损失记为约 744 万美元。该数值替代早期约 754 万美元的汇总估算，只计本次攻击释放的桥储备，不与 0.01 VRSC 出口请求、兑换后的 ETH 数量或 5 月事件相加。\n\n## 证据边界\nCertiK 提供双链交易时间线、关键地址、重复根覆盖机制和资金流分析；链上浏览器支持相关交易。notary 的签名行为说明其签署原始序列化数据，不等同于其知情批准恶意提款。\n\n## 处置状态\n桥功能曾被暂停调查。公开资料没有确认本次资金已经返还受害方、被冻结、被司法扣押或恢复控制。", "tw": "## 事件背景\n2026 年 7 月 23 日，攻擊者利用 Verus 與 Ethereum 對 notarization 數據的不同解釋，再次攻擊 Verus–Ethereum Bridge。Verus 側把 proofRoots 放入映射時忽略重複項，而 Ethereum 合約按順序處理並讓後出現的同一 system ID 覆蓋先前 stateRoot。\n\n## 事件經過\n1. 攻擊者提交包含正常根和多個惡意重複 state-root 的 notarization。\n2. 11 個合法 notary daemon 對原始 notarization 字節簽名。\n3. 攻擊者把證據轉發至 Ethereum，兩次呼叫 setLatestData，使後出現的惡意根覆蓋真實根。\n4. 攻擊者在 Verus 上發起僅 0.01 VRSC 的真實出口請求，並構造與惡意根匹配的偽造導入證明。\n5. Ethereum 橋接受該證明並釋放約 744 萬美元資產。\n\n## 資金流向\n橋儲備中的 ETH、tBTC、穩定幣和 MKR 被提取後，經 Relay 兌換為 2,778.8662 ETH，並進入 Tornado Cash。該路徑屬於 7 月 23 日的第二次獨立攻擊，不與 5 月的第一次事件合併。\n\n## 金額口徑\nCertiK 完整分析將損失記為約 744 萬美元。該數值替代早期約 754 萬美元的彙總估算，只計本次攻擊釋放的橋儲備，不與 0.01 VRSC 出口請求、兌換後的 ETH 數量或 5 月事件相加。\n\n## 證據邊界\nCertiK 提供雙鏈交易時間線、關鍵地址、重複根覆蓋機制和資金流分析；鏈上瀏覽器支持相關交易。notary 的簽名行為說明其簽署原始序列化數據，不等同於其知情批准惡意提款。\n\n## 處置狀態\n橋功能曾被暫停調查。公開資料沒有確認本次資金已經返還受害方、被凍結、被司法扣押或恢復控制。", "en": "## Incident overview\nOn July 23, 2026, an attacker exploited differing interpretations of notarization data between Verus and Ethereum to attack Verus–Ethereum Bridge again. Verus ignored duplicate proofRoots when building a map, while the Ethereum contract processed them sequentially and allowed later entries for the same system ID to overwrite stateRoot.\n\n## Incident sequence\n1. The attacker submitted notarizations containing a genuine root and several malicious duplicate state roots.\n2. Eleven legitimate notary daemons signed the raw notarization bytes.\n3. The attacker relayed the evidence to Ethereum and called setLatestData twice, allowing later malicious roots to overwrite the genuine root.\n4. The attacker initiated a genuine export request for only 0.01 VRSC on Verus and constructed a fabricated import proof matching the malicious root.\n5. The Ethereum bridge accepted the proof and released approximately $7.44 million in assets.\n\n## Fund flow\nETH, tBTC, stablecoins, and MKR were removed from bridge reserves, exchanged through Relay for 2,778.8662 ETH, and deposited into Tornado Cash. This path belongs to the independent July 23 repeat attack and is not combined with the May event.\n\n## Amount basis\nCertiK’s complete analysis records approximately $7.44 million in loss. This replaces the earlier aggregate estimate of about $7.54 million and counts only bridge reserves released in this attack; the 0.01 VRSC export, exchanged ETH quantity, and May event are not added.\n\n## Evidence boundary\nCertiK provides the two-chain transaction timeline, key addresses, duplicate-root overwrite mechanism, and fund-flow analysis, while chain explorers support the transactions. The notaries signed raw serialized data; that does not establish knowing approval of the malicious withdrawal.\n\n## Current status\nBridge functions were paused for investigation. Public evidence did not confirm return of the funds, freezing, judicial seizure, or restoration of control." }, "category": "bridge-exploit", "severity": "critical", "ecosystems": [ "Ethereum", "Other" ], "chains": [ "Ethereum", "Other" ], "lossUsd": 7440000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "第二次攻击从桥储备提取约 744 万美元的 ETH、tBTC、稳定币和 MKR。", "tw": "第二次攻擊從橋儲備提取約 744 萬美元的 ETH、tBTC、穩定幣和 MKR。", "en": "The second attack removed approximately $7.44 million in ETH, tBTC, stablecoins, and MKR from bridge reserves." }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0xbda71b58cec0b1c20a8f87ccd52fa0679747855c", "entity": { "zh": "[链：Ethereum] [攻击执行 EOA] [恶意 StateRoot 设置调用者] [资产抽取调用者]", "tw": "[鏈：Ethereum] [攻擊執行 EOA] [惡意 StateRoot 設置呼叫者] [資產抽取呼叫者]", "en": "[chain: Ethereum] [attack-execution EOA] [malicious StateRoot setter] [asset-extraction caller]" }, "role": "attacker", "category": "hack", "confidence": 0.95, "sourceUrl": "https://etherscan.io/address/0xbda71b58cec0b1c20a8f87ccd52fa0679747855c", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [攻击执行 EOA] [恶意 StateRoot 设置调用者] [资产抽取调用者]。该标签仅说明所引公开证据支持的地址角色，不扩大为案件、所有人或资金性质归因。", "tw": "[鏈：Ethereum] [攻擊執行 EOA] [惡意 StateRoot 設置呼叫者] [資產抽取呼叫者]。該標籤僅說明所引公開證據支持的地址角色，不擴大為案件、所有人或資金性質歸因。", "en": "[chain: Ethereum] [attack-execution EOA] [malicious StateRoot setter] [asset-extraction caller]. The label is limited to the cited public evidence and does not establish broader case, ownership, or fund-source attribution." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x71518580f36feceffe0721f06ba4703218cd7f63", "entity": { "zh": "[链：Ethereum] [受影响 Verus 桥合约] [跨链桥合约] [非攻击者]", "tw": "[鏈：Ethereum] [受影響 Verus 橋合約] [跨鏈橋合約] [非攻擊者]", "en": "[chain: Ethereum] [affected Verus bridge contract] [cross-chain bridge contract] [not an attacker]" }, "role": "contract", "category": "unknown", "confidence": 0.98, "sourceUrl": "https://etherscan.io/address/0x71518580f36feceffe0721f06ba4703218cd7f63", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [受影响 Verus 桥合约] [跨链桥合约] [非攻击者]。该标签仅说明所引公开证据支持的地址角色，不扩大为案件、所有人或资金性质归因。", "tw": "[鏈：Ethereum] [受影響 Verus 橋合約] [跨鏈橋合約] [非攻擊者]。該標籤僅說明所引公開證據支持的地址角色，不擴大為案件、所有人或資金性質歸因。", "en": "[chain: Ethereum] [affected Verus bridge contract] [cross-chain bridge contract] [not an attacker]. The label is limited to the cited public evidence and does not establish broader case, ownership, or fund-source attribution." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xCFd0A20703cD11E0b9f665e1C3F1Ef989C142D54", "entity": { "zh": "[链：Ethereum] [被盗资产接收] [资金归集] [攻击者控制地址]", "tw": "[鏈：Ethereum] [被盜資產接收] [資金歸集] [攻擊者控制地址]", "en": "[chain: Ethereum] [stolen-asset recipient] [fund consolidation] [attacker-controlled address]" }, "role": "attacker", "category": "hack", "confidence": 0.98, "sourceUrl": "https://etherscan.io/address/0xCFd0A20703cD11E0b9f665e1C3F1Ef989C142D54", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [被盗资产接收] [资金归集] [攻击者控制地址]。该标签仅说明所引公开证据支持的地址角色，不扩大为案件、所有人或资金性质归因。", "tw": "[鏈：Ethereum] [被盜資產接收] [資金歸集] [攻擊者控制地址]。該標籤僅說明所引公開證據支持的地址角色，不擴大為案件、所有人或資金性質歸因。", "en": "[chain: Ethereum] [stolen-asset recipient] [fund consolidation] [attacker-controlled address]. The label is limited to the cited public evidence and does not establish broader case, ownership, or fund-source attribution." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xd90e2f925da726b50c4ed8d0fb90ad053324f31b", "entity": { "zh": "[链：Ethereum] [Tornado Cash Router] [混币器基础设施] [非攻击者]", "tw": "[鏈：Ethereum] [Tornado Cash Router] [混幣器基礎設施] [非攻擊者]", "en": "[chain: Ethereum] [Tornado Cash Router] [mixer infrastructure] [not an attacker]" }, "role": "mixer", "category": "mixer", "confidence": 0.99, "sourceUrl": "https://etherscan.io/address/0xd90e2f925da726b50c4ed8d0fb90ad053324f31b", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [Tornado Cash Router] [混币器基础设施] [非攻击者]。该标签仅说明所引公开证据支持的地址角色，不扩大为案件、所有人或资金性质归因。", "tw": "[鏈：Ethereum] [Tornado Cash Router] [混幣器基礎設施] [非攻擊者]。該標籤僅說明所引公開證據支持的地址角色，不擴大為案件、所有人或資金性質歸因。", "en": "[chain: Ethereum] [Tornado Cash Router] [mixer infrastructure] [not an attacker]. The label is limited to the cited public evidence and does not establish broader case, ownership, or fund-source attribution." }, "reviewRequired": true }, { "chain": "Other", "address": "RXo2PqXjgRVJ8w8QVDErVqVLavz4TToyuu", "entity": { "zh": "Verus 源链攻击者地址", "tw": "Verus 源鏈攻擊者地址", "en": "Attacker address on the Verus source chain" }, "role": "attacker", "category": "hack", "confidence": 0.95, "sourceUrl": "https://www.certik.com/blog/verus-incident-analysis", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "CertiK 将该地址列为 Verus 侧攻击者地址。", "tw": "CertiK 將該地址列為 Verus 側攻擊者地址。", "en": "CertiK identified this address as the attacker address on Verus." }, "reviewRequired": true }, { "chain": "Other", "address": "i3f7tSctFkiPpiedY8QR5Tep9p4qDVebDx", "entity": { "zh": "Verus Bridge.vETH 基础设施地址", "tw": "Verus Bridge.vETH 基礎設施地址", "en": "Verus Bridge.vETH infrastructure address" }, "role": "bridge", "category": "bridge", "confidence": 0.95, "sourceUrl": "https://www.certik.com/blog/verus-incident-analysis", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "CertiK 将该地址列为 Verus 上的 Bridge.vETH；它不是攻击者地址。", "tw": "CertiK 將該地址列為 Verus 上的 Bridge.vETH；它不是攻擊者地址。", "en": "CertiK identified this as Bridge.vETH on Verus; it is not an attacker address." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x54e03a1682fd0bb065b669f6296f97028dcfd4ce", "entity": { "zh": "VerusProof 验证合约", "tw": "VerusProof 驗證合約", "en": "VerusProof verification contract" }, "role": "contract", "category": "bridge", "confidence": 0.95, "sourceUrl": "https://www.certik.com/blog/verus-incident-analysis", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "CertiK 将该合约列为 Ethereum 侧的 VerusProof 验证路径；它不是攻击者地址。", "tw": "CertiK 將該合約列為 Ethereum 側的 VerusProof 驗證路徑；它不是攻擊者地址。", "en": "CertiK identified this contract as the Ethereum-side VerusProof verification path; it is not an attacker address." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "BlockSec Phalcon 根因修正", "tw": "BlockSec Phalcon 根因修正", "en": "BlockSec Phalcon root-cause update" }, "url": "https://x.com/Phalcon_xyz/status/2080341851517980811", "type": "research" }, { "label": { "zh": "BlockSec 初始攻击分析", "tw": "BlockSec 初始攻擊分析", "en": "BlockSec initial attack analysis" }, "url": "https://x.com/Phalcon_xyz/status/2080157648096559110", "type": "research" }, { "label": { "zh": "CertiK 分析补充", "tw": "CertiK 分析補充", "en": "CertiK supplementary analysis" }, "url": "https://x.com/CertiKAlert/status/2080322690096013677", "type": "research" }, { "label": { "zh": "Blockaid 初报", "tw": "Blockaid 初報", "en": "Blockaid initial alert" }, "url": "https://x.com/blockaid_/status/2080143099561496896", "type": "research" }, { "label": { "zh": "SlowMist 机制分析", "tw": "SlowMist 機制分析", "en": "SlowMist mechanism analysis" }, "url": "https://x.com/SlowMist_Team/status/2080192064478724299", "type": "research" }, { "label": { "zh": "Lookonchain 资金路径", "tw": "Lookonchain 資金路徑", "en": "Lookonchain fund-flow review" }, "url": "https://x.com/lookonchain/status/2080160229287920109", "type": "research" }, { "label": { "zh": "Etherscan：第一次 StateRoot 设置交易", "tw": "Etherscan：第一次 StateRoot 設置交易", "en": "Etherscan: first StateRoot-setting transaction" }, "url": "https://etherscan.io/tx/0x8f21bd8f0fce72ac959caa93a9923d85f902dfc6eddac2785ac5bc49c3b28d8f", "type": "research" }, { "label": { "zh": "Etherscan：第二次 setLatestData 交易", "tw": "Etherscan：第二次 setLatestData 交易", "en": "Etherscan: second setLatestData transaction" }, "url": "https://etherscan.io/tx/0x51b1c8341da4092b7d1e0e4865f7b318de4e96245358b05b2bff2df50adaf0c9", "type": "research" }, { "label": { "zh": "Etherscan：攻击与资产抽取交易", "tw": "Etherscan：攻擊與資產抽取交易", "en": "Etherscan: attack and asset-extraction transaction" }, "url": "https://etherscan.io/tx/0xa1f1e65c1cea4dba4ae439cd4dcdba6cc2dbda0ed1228e61f29ae9c9324eb099", "type": "research" }, { "label": { "zh": "Etherscan：攻击资金接收地址", "tw": "Etherscan：攻擊資金接收地址", "en": "Etherscan: stolen-asset recipient" }, "url": "https://etherscan.io/address/0xCFd0A20703cD11E0b9f665e1C3F1Ef989C142D54", "type": "research" }, { "label": { "zh": "SlowMist Hacked Zone 记录", "tw": "SlowMist Hacked Zone 記錄", "en": "SlowMist Hacked Zone record" }, "url": "https://hacked.slowmist.io/", "type": "research" }, { "label": { "zh": "CertiK 完整技术分析", "tw": "CertiK 完整技術分析", "en": "CertiK complete technical analysis" }, "url": "https://www.certik.com/blog/verus-incident-analysis", "type": "research" }, { "label": { "zh": "Verus 第一笔恶意 notarization", "tw": "Verus 第一筆惡意 notarization", "en": "First malicious Verus notarization" }, "url": "https://scan.verus.cx/vrsc/tx/0c24765b6d4daa745e38b09f46382d1a457966e1c128265b87dc2b5a3fd16280", "type": "explorer" }, { "label": { "zh": "Verus 第二笔恶意 notarization", "tw": "Verus 第二筆惡意 notarization", "en": "Second malicious Verus notarization" }, "url": "https://scan.verus.cx/vrsc/tx/f5f0d9056163edaa8497857226dd0905e10f044063ba77cedc3fc7589d3bf10c", "type": "explorer" }, { "label": { "zh": "Verus 第三笔恶意 notarization", "tw": "Verus 第三筆惡意 notarization", "en": "Third malicious Verus notarization" }, "url": "https://scan.verus.cx/vrsc/tx/0c5843f87f3ef1c9ea31ec4b6c601101eec8592ec476a03a53dd6e400df05c6e", "type": "explorer" }, { "label": { "zh": "Verus 最小出口请求", "tw": "Verus 最小出口請求", "en": "Minimal Verus export request" }, "url": "https://scan.verus.cx/vrsc/tx/5b5043febfd7f7c089e976d11d0f87a904881266bb96dd118b3d69b0e02aab52", "type": "explorer" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-187", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-051", "status": "verified", "incidentDate": "2026-07-23", "datePrecision": "day", "title": { "zh": "B² Network 质押合约升级权限遭未授权访问", "tw": "B² Network 質押合約升級權限遭未授權訪問", "en": "Unauthorized access to B² Network staking-contract upgrade authority" }, "summary": { "zh": "质押服务已暂停；官方称问题已控制、预计无进一步影响，并承诺全额补偿。没有公开证据证明被转出的 BNB/ETH 已全部冻结、返还或追回；“将补偿”与“补偿已完成”必须区分。", "tw": "質押服務已暫停；官方稱問題已控制、預計無進一步影響，並承諾全額補償。沒有公開證據證明被轉出的 BNB/ETH 已全部凍結、返還或追回；“將補償”與“補償已完成”必須區分。", "en": "B² Network confirmed unauthorized access to its staking-contract upgrade authority. Approximately 8.591 million B2 was withdrawn; nominal value was about $3.86 million and realized proceeds were about 5,409 BNB, or $3.01 million." }, "details": { "zh": "## 事件背景\nB² 官方确认质押合约的升级权限发生未授权访问。公开信息尚未说明升级管理员私钥、治理多签、部署账户或后台凭据究竟如何被控制，因此根因只能定为“升级权限失守”，不能进一步虚构具体泄露方式。\n\n## 事件经过\n1. 攻击执行地址先从质押合约提取极小数量 B2，用于试探路径。\n2. 随后连续调用同一质押合约，把约 859.1 万 B2 导入主归集地址。\n3. 归集地址把 B2 通过流动性池兑换成 WBNB/BNB。\n4. 约 5,253 WBNB 在一笔主要转移中进入第二下游地址，整体实现约 5,409 BNB。\n5. 资金继续跨至 Ethereum，并进入 NEAR Intents/HOT Protocol 相关路径。\n6. B² 暂停质押服务并承诺受影响用户将获得全额补偿；截止报告未看到公开链上补偿完成证明。\n\n## 资金流向\nB² 质押合约 0xf0c1…3b94 → 攻击执行地址 0x35fe…287d → 主归集 0xEc44…f433 → B2/WBNB 池 → 下游 0xf977…bf6d → Ethereum/NEAR Intents/HOT Protocol。跨链后的最终受益人归因尚待完整 Trace。\n\n## 金额口径\n约 859.1 万 B2 按事发价格名义约 386 万美元；实际兑换所得约 5,409 BNB、约 301 万美元。两者不能相加。\n\n## 证据边界\n名义 386 万美元来自 B2 市场价格，实际兑现约 301 万美元；两者不是两笔损失。NEAR Intents/HOT Protocol 是资金路径，不自动等于这些协议参与攻击或控制攻击者资金。\n\n## 处置状态\n质押服务已暂停；官方称问题已控制、预计无进一步影响，并承诺全额补偿。没有公开证据证明被转出的 BNB/ETH 已全部冻结、返还或追回；“将补偿”与“补偿已完成”必须区分。", "tw": "## 事件背景\nB² 官方確認質押合約的升級權限發生未授權訪問。公開信息尚未說明升級管理員私鑰、治理多籤、部署賬戶或後臺憑據究竟如何被控制，因此根因只能定為“升級權限失守”，不能進一步虛構具體洩露方式。\n\n## 事件經過\n1. 攻擊執行地址先從質押合約提取極小數量 B2，用於試探路徑。\n2. 隨後連續調用同一質押合約，把約 859.1 萬 B2 導入主歸集地址。\n3. 歸集地址把 B2 通過流動性池兌換成 WBNB/BNB。\n4. 約 5,253 WBNB 在一筆主要轉移中進入第二下游地址，整體實現約 5,409 BNB。\n5. 資金繼續跨至 Ethereum，並進入 NEAR Intents/HOT Protocol 相關路徑。\n6. B² 暫停質押服務並承諾受影響用戶將獲得全額補償；截止報告未看到公開鏈上補償完成證明。\n\n## 資金流向\nB² 質押合約 0xf0c1…3b94 → 攻擊執行地址 0x35fe…287d → 主歸集 0xEc44…f433 → B2/WBNB 池 → 下游 0xf977…bf6d → Ethereum/NEAR Intents/HOT Protocol。跨鏈後的最終受益人歸因尚待完整 Trace。\n\n## 金額口徑\n約 859.1 萬 B2 按事發價格名義約 386 萬美元；實際兌換所得約 5,409 BNB、約 301 萬美元。兩者不能相加。\n\n## 證據邊界\n名義 386 萬美元來自 B2 市場價格，實際兌現約 301 萬美元；兩者不是兩筆損失。NEAR Intents/HOT Protocol 是資金路徑，不自動等於這些協議參與攻擊或控制攻擊者資金。\n\n## 處置狀態\n質押服務已暫停；官方稱問題已控制、預計無進一步影響，並承諾全額補償。沒有公開證據證明被轉出的 BNB/ETH 已全部凍結、返還或追回；“將補償”與“補償已完成”必須區分。", "en": "## Incident overview\nB² Network confirmed unauthorized access to the upgrade authority of its staking contract. Public information does not establish whether the administrator key, governance multisig, deployment account, or backend credential was compromised, so the root cause is limited to a loss of upgrade-control authority.\n\n## Incident sequence\n1. The executor first withdrew a very small amount of B2 from the staking contract to test the path.\n2. It then made successive withdrawals totaling approximately 8.591 million B2 into a main consolidation address.\n3. The B2 was swapped through liquidity pools into WBNB/BNB.\n4. Approximately 5,253 WBNB moved in one principal transfer to a downstream address; total realized proceeds were reported at approximately 5,409 BNB.\n5. Funds continued to Ethereum and then through routes involving NEAR Intents and HOT Protocol.\n6. B² paused staking and promised full compensation, but the report found no public on-chain proof that compensation had been completed.\n\n## Fund flow\nB² staking contract 0xf0c1…3b94 → attack executor 0x35fe…287d → main consolidation 0xEc44…f433 → B2/WBNB pool → downstream 0xf977…bf6d → Ethereum / NEAR Intents / HOT Protocol. Final beneficiary attribution after bridging remains incomplete.\n\n## Amount basis\nApproximately 8.591 million B2 had a nominal incident-time value of about $3.86 million. Realized sale proceeds were approximately 5,409 BNB, or about $3.01 million. These are two measurements of the same loss and must not be added together.\n\n## Evidence boundary\nB² confirmed unauthorized access to upgrade authority but did not disclose the exact credential or governance component that failed. NEAR Intents and HOT Protocol are fund-flow infrastructure and are not thereby implicated in the attack.\n\n## Current status\nStaking is paused. B² said the issue was contained and promised full compensation, but the transferred BNB/ETH had not been publicly shown as fully frozen, returned, recovered, or compensated by the cutoff." }, "category": "access-control", "severity": "high", "ecosystems": [ "BNB Chain", "Ethereum" ], "chains": [ "BNB Chain", "Ethereum" ], "lossUsd": 3860000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 859.1 万 B2 按事发价格名义约 386 万美元；实际兑换所得约 5,409 BNB、约 301 万美元。两者不能相加。", "tw": "約 859.1 萬 B2 按事發價格名義約 386 萬美元；實際兌換所得約 5,409 BNB、約 301 萬美元。兩者不能相加。", "en": "Approximately 8.591 million B2 (nominally about $3.86 million); realized proceeds approximately 5,409 BNB (about $3.01 million)." }, "addressDisclosure": "published", "addresses": [ { "chain": "BNB Chain", "address": "0xf0c1fd96e25b71a7114dacea11b55204be483b94", "entity": { "zh": "[链：BNB Chain] [受影响合约] [质押合约] [非黑客]", "tw": "[鏈：BNB Chain] [受影響合約] [質押合約] [非黑客]", "en": "[chain: BNB Chain] [affected contract] [staking contract] [not an attacker]" }, "role": "contract", "category": "unknown", "confidence": 0.95, "sourceUrl": "https://bscscan.com/address/0xf0c1fd96e25b71a7114dacea11b55204be483b94", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [受影响合约] [质押合约] [非黑客]。标签仅限所引公开证据，不扩大为未获支持的实体归因。", "tw": "[鏈：BNB Chain] [受影響合約] [質押合約] [非黑客]。標籤僅限所引公開證據，不擴大為未獲支持的實體歸因。", "en": "The role is limited to the cited public evidence and does not imply any broader unsupported attribution." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x35fe57b69964227e67795288746508a7f89b287d", "entity": { "zh": "[链：BNB Chain] [攻击执行主体] [角色待核] [合约权限滥用]", "tw": "[鏈：BNB Chain] [攻擊執行主體] [角色待核] [合約權限濫用]", "en": "[chain: BNB Chain] [attack executor] [role pending verification] [contract privilege abuse]" }, "role": "attacker", "category": "hack", "confidence": 0.75, "sourceUrl": "https://bscscan.com/address/0x35fe57b69964227e67795288746508a7f89b287d", "evidenceStatus": "community_reported", "evidenceSummary": { "zh": "[链：BNB Chain] [攻击执行主体] [角色待核] [合约权限滥用]。标签仅限所引公开证据，不扩大为未获支持的实体归因。", "tw": "[鏈：BNB Chain] [攻擊執行主體] [角色待核] [合約權限濫用]。標籤僅限所引公開證據，不擴大為未獲支持的實體歸因。", "en": "The role is limited to the cited public evidence and does not imply any broader unsupported attribution." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xEc443f7D79835B464FBEAC798d3f92B62d6Ff433", "entity": { "zh": "[链：BNB Chain] [被盗资产接收] [资金归集] [BscScan 攻击者标签]", "tw": "[鏈：BNB Chain] [被盜資產接收] [資金歸集] [BscScan 攻擊者標籤]", "en": "[chain: BNB Chain] [stolen-asset recipient] [fund consolidation] [BscScan attacker label]" }, "role": "attacker", "category": "hack", "confidence": 0.95, "sourceUrl": "https://bscscan.com/address/0xEc443f7D79835B464FBEAC798d3f92B62d6Ff433", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [被盗资产接收] [资金归集] [BscScan 攻击者标签]。标签仅限所引公开证据，不扩大为未获支持的实体归因。", "tw": "[鏈：BNB Chain] [被盜資產接收] [資金歸集] [BscScan 攻擊者標籤]。標籤僅限所引公開證據，不擴大為未獲支持的實體歸因。", "en": "The role is limited to the cited public evidence and does not imply any broader unsupported attribution." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xf977427ec8e583c55d413061fc205bcd57e8bf6d", "entity": { "zh": "[链：BNB Chain] [二级归集] [WBNB 接收] [角色待核]", "tw": "[鏈：BNB Chain] [二級歸集] [WBNB 接收] [角色待核]", "en": "[chain: BNB Chain] [secondary consolidation] [WBNB recipient] [role pending verification]" }, "role": "other", "category": "hack", "confidence": 0.7, "sourceUrl": "https://bscscan.com/address/0xf977427ec8e583c55d413061fc205bcd57e8bf6d", "evidenceStatus": "community_reported", "evidenceSummary": { "zh": "[链：BNB Chain] [二级归集] [WBNB 接收] [角色待核]。标签仅限所引公开证据，不扩大为未获支持的实体归因。", "tw": "[鏈：BNB Chain] [二級歸集] [WBNB 接收] [角色待核]。標籤僅限所引公開證據，不擴大為未獲支持的實體歸因。", "en": "The role is limited to the cited public evidence and does not imply any broader unsupported attribution." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "B² 官方通报", "tw": "B² 官方通報", "en": "x.com source" }, "url": "https://x.com/BSquaredNetwork/status/2080077286238454109", "type": "official" }, { "label": { "zh": "PeckShield 金额与路径", "tw": "PeckShield 金額與路徑", "en": "x.com source" }, "url": "https://x.com/PeckShieldAlert/status/2080095004484395028", "type": "research" }, { "label": { "zh": "BscScan 主归集地址", "tw": "BscScan 主歸集地址", "en": "bscscan.com source" }, "url": "https://bscscan.com/address/0xEc443f7D79835B464FBEAC798d3f92B62d6Ff433", "type": "research" }, { "label": { "zh": "BscScan 试探提款 Tx", "tw": "BscScan 試探提款 Tx", "en": "bscscan.com source" }, "url": "https://bscscan.com/tx/0x93a3a3f4f6894f5240140d51bf846b25015a5684dec5d540b0c7ac7d81e181ab", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-051", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-050", "status": "verified", "incidentDate": "2026-07-23", "datePrecision": "day", "title": { "zh": "AFX Trade 托管桥遭攻击", "tw": "AFX Trade 託管橋遭攻擊", "en": "AFX Trade custodial bridge exploited for approximately 24.15 million USDC" }, "summary": { "zh": "AFX 托管桥约 2,415 万 USDC 被提取并兑换为约 12,467.44 ETH。2026 年 7 月 25 日，监测显示攻击者通过 THORChain 将 655.4 ETH 换成 18.86 BTC，约 11,812 ETH 仍在相关地址；没有确认冻结、返还或追回。", "tw": "AFX 託管橋約 2,415 萬 USDC 被提取並兌換為約 12,467.44 ETH。2026 年 7 月 25 日，監測顯示攻擊者通過 THORChain 將 655.4 ETH 換成 18.86 BTC，約 11,812 ETH 仍在相關地址；沒有確認凍結、返還或追回。", "en": "Approximately 24.15 million USDC left the AFX custodial bridge and was converted into about 12,467.44 ETH. On July 25, 2026, monitoring showed 655.4 ETH converted through THORChain into 18.86 BTC, while about 11,812 ETH remained at related addresses; no freeze, return, or recovery was confirmed." }, "details": { "zh": "## 事件背景\nAFX 称受影响组件是其运营的托管桥，不是 Arbitrum 官方桥。CertiK 分析显示恶意提款包含 5 个验证者签名，对应 10,000 点总权重中的约 7,142 点并超过三分之二门槛。签名权或后端权限被控制是当前主要判断，但精确入侵路径仍未最终公开。\n\n## 事件经过\n1. 攻击方向 Arbitrum 桥合约提交达到门槛的提款提案。\n2. 数分钟后执行提款，约 2,415 万 USDC 离开桥储备。\n3. 资金跨至 Ethereum 并兑换为约 12,467.44 ETH。\n4. AFX 暂停托管桥并提出返还 70%、保留 30%赏金的白帽条件。\n5. 2026 年 7 月 25 日，攻击者开始通过 THORChain 把部分 ETH 换成 BTC。\n\n## 资金流向\nArbitrum 桥合约 → 跨链提款 → Ethereum 兑换与归集地址 0x627654B2782bfC57580ecD11d40869b350B6ebAC。窗口内已有 655.4 ETH 经 THORChain 换成 18.86 BTC，约 11,812 ETH 仍在相关 Ethereum 地址。THORChain 是跨链兑换路径，不代表 BTC 侧已被冻结。\n\n## 金额口径\n链上提取约 2,415 万 USDC，并兑换为约 12,467.44 ETH。655.4 ETH 与 18.86 BTC 是同一批被盗资产的后续转换，不新增损失。30%赏金是项目提出的条件，不是已经支付或追回的金额。\n\n## 证据边界\n官方通报与链上交易支持桥被利用、金额、服务暂停和白帽方案；CertiK 支持验证权重路径。后续监测支持 THORChain 转换，但没有公开完整 BTC 接收端映射，也没有证据确认 5 个签名权如何失陷。\n\n## 处置状态\n托管桥保持暂停或受限。没有公开证据确认资金已冻结、攻击者已接受白帽条件或资产已经返还，因此冻结和追回金额均为零。", "tw": "## 事件背景\nAFX 稱受影響元件是其運營的託管橋，不是 Arbitrum 官方橋。CertiK 分析顯示惡意提款包含 5 個驗證者簽名，對應 10,000 點總權重中的約 7,142 點並超過三分之二門檻。簽名權或後端許可權被控制是當前主要判斷，但精確入侵路徑仍未最終公開。\n\n## 事件經過\n1. 攻擊方向 Arbitrum 橋合約提交達到門檻的提款提案。\n2. 數分鐘後執行提款，約 2,415 萬 USDC 離開橋儲備。\n3. 資金跨至 Ethereum 並兌換為約 12,467.44 ETH。\n4. AFX 暫停託管橋並提出返還 70%、保留 30%賞金的白帽條件。\n5. 2026 年 7 月 25 日，攻擊者開始通過 THORChain 把部分 ETH 換成 BTC。\n\n## 資金流向\nArbitrum 橋合約 → 跨鏈提款 → Ethereum 兌換與歸集地址 0x627654B2782bfC57580ecD11d40869b350B6ebAC。視窗內已有 655.4 ETH 經 THORChain 換成 18.86 BTC，約 11,812 ETH 仍在相關 Ethereum 地址。THORChain 是跨鏈兌換路徑，不代表 BTC 側已被凍結。\n\n## 金額口徑\n鏈上提取約 2,415 萬 USDC，並兌換為約 12,467.44 ETH。655.4 ETH 與 18.86 BTC 是同一批被盜資產的後續轉換，不新增損失。30%賞金是專案提出的條件，不是已經支付或追回的金額。\n\n## 證據邊界\n官方通報與鏈上交易支援橋被利用、金額、服務暫停和白帽方案；CertiK 支援驗證權重路徑。後續監測支援 THORChain 轉換，但沒有公開完整 BTC 接收端對映，也沒有證據確認 5 個簽名權如何失陷。\n\n## 處置狀態\n託管橋保持暫停或受限。沒有公開證據確認資金已凍結、攻擊者已接受白帽條件或資產已經返還，因此凍結和追回金額均為零。", "en": "## Incident overview\nAFX said the affected component was its operated custodial bridge, not the official Arbitrum bridge. CertiK analysis found five validator signatures representing approximately 7,142 of 10,000 total weight, above the two-thirds threshold. Control of signing or backend authority is the leading assessment, but the exact intrusion path remains unpublished.\n\n## Incident sequence\n1. The attacker submitted a withdrawal proposal to the Arbitrum bridge contract with sufficient validator weight.\n2. The withdrawal was executed minutes later and approximately 24.15 million USDC left bridge reserves.\n3. Funds crossed to Ethereum and were converted into about 12,467.44 ETH.\n4. AFX paused the custodial bridge and offered a white-hat condition under which 70% would be returned and 30% retained as a bounty.\n5. On July 25, 2026, the attacker began converting part of the ETH into BTC through THORChain.\n\n## Fund flow\nArbitrum bridge contract → cross-chain withdrawal → Ethereum conversion and consolidation address 0x627654B2782bfC57580ecD11d40869b350B6ebAC. During the reporting window, 655.4 ETH was converted through THORChain into 18.86 BTC and approximately 11,812 ETH remained at related Ethereum addresses. THORChain is a cross-chain conversion path and does not establish a BTC-side freeze.\n\n## Amount basis\nApproximately 24.15 million USDC was withdrawn and converted into about 12,467.44 ETH. The 655.4 ETH and 18.86 BTC figures describe later conversion of the same stolen assets and do not add loss. The proposed 30% bounty is a condition, not a paid or recovered amount.\n\n## Evidence boundary\nOfficial notices and transactions support the bridge exploitation, amount, service pause, and white-hat proposal. CertiK supports the validator-weight path. Later monitoring supports the THORChain conversion, but no complete BTC recipient mapping or final explanation of the five compromised signing authorities has been published.\n\n## Current status\nThe custodial bridge remains paused or restricted. No public evidence confirms a freeze, acceptance of the white-hat terms, or asset return, so frozen and recovered amounts remain zero." }, "category": "bridge-exploit", "severity": "critical", "ecosystems": [ "Arbitrum", "Ethereum" ], "chains": [ "Arbitrum", "Ethereum" ], "lossUsd": 24150000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "链上提取约 2,415 万 USDC；不同监控四舍五入口径约 2,400 万–2,415 万美元。攻击者兑换后收到约 12,467.44 ETH。", "tw": "鏈上提取約 2,415 萬 USDC；不同監控四捨五入口徑約 2,400 萬–2,415 萬美元。攻擊者兌換後收到約 12,467.44 ETH。", "en": "Approximately 24.15 million USDC withdrawn; approximately 12,467.44 ETH received after conversion." }, "addressDisclosure": "published", "addresses": [ { "chain": "Arbitrum", "address": "0xcb3b9a3e5668afe84dc7a864b36b845dce062e67", "entity": { "zh": "[链：Arbitrum] [受影响合约] [跨链桥入口] [非黑客]", "tw": "[鏈：Arbitrum] [受影響合約] [跨鏈橋入口] [非黑客]", "en": "[chain: Arbitrum] [affected contract] [bridge entry] [not an attacker]" }, "role": "contract", "category": "unknown", "confidence": 0.95, "sourceUrl": "https://arbiscan.io/address/0xcb3b9a3e5668afe84dc7a864b36b845dce062e67", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Arbitrum] [受影响合约] [跨链桥入口] [非黑客]。标签仅限所引公开证据，不扩大为未获支持的实体归因。", "tw": "[鏈：Arbitrum] [受影響合約] [跨鏈橋入口] [非黑客]。標籤僅限所引公開證據，不擴大為未獲支持的實體歸因。", "en": "The role is limited to the cited public evidence and does not imply any broader unsupported attribution." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x627654b2782bfc57580ecd11d40869b350b6ebac", "entity": { "zh": "[链：Ethereum] [被盗资产接收] [资金归集] [攻击者控制地址]", "tw": "[鏈：Ethereum] [被盜資產接收] [資金歸集] [攻擊者控制地址]", "en": "[chain: Ethereum] [stolen-asset recipient] [fund consolidation] [attacker-controlled address]" }, "role": "attacker", "category": "hack", "confidence": 0.95, "sourceUrl": "https://etherscan.io/address/0x627654b2782bfc57580ecd11d40869b350b6ebac", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [被盗资产接收] [资金归集] [攻击者控制地址]。标签仅限所引公开证据，不扩大为未获支持的实体归因。", "tw": "[鏈：Ethereum] [被盜資產接收] [資金歸集] [攻擊者控制地址]。標籤僅限所引公開證據，不擴大為未獲支持的實體歸因。", "en": "The role is limited to the cited public evidence and does not imply any broader unsupported attribution." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x222Bd8dbc0d71972f880DAb5D69cdCFD903D9f1B", "entity": { "zh": "[链：Ethereum] [官方白帽返还地址] [非黑客] [返还未确认]", "tw": "[鏈：Ethereum] [官方白帽返還地址] [非黑客] [返還未確認]", "en": "[chain: Ethereum] [official white-hat return address] [not an attacker] [return not confirmed]" }, "role": "recovery", "category": "unknown", "confidence": 0.95, "sourceUrl": "https://x.com/AFX_XYZ/status/2080136046982135958", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [官方白帽返还地址] [非黑客] [返还未确认]。标签仅限所引公开证据，不扩大为未获支持的实体归因。", "tw": "[鏈：Ethereum] [官方白帽返還地址] [非黑客] [返還未確認]。標籤僅限所引公開證據，不擴大為未獲支持的實體歸因。", "en": "The role is limited to the cited public evidence and does not imply any broader unsupported attribution." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "AFX 官方通报", "tw": "AFX 官方通報", "en": "x.com source" }, "url": "https://x.com/AFX_XYZ/status/2080126901205770734", "type": "official" }, { "label": { "zh": "AFX 白帽方案", "tw": "AFX 白帽方案", "en": "x.com source" }, "url": "https://x.com/AFX_XYZ/status/2080136046982135958", "type": "research" }, { "label": { "zh": "CertiK 分析", "tw": "CertiK 分析", "en": "x.com source" }, "url": "https://x.com/CertiKAlert/status/2080103798736073119", "type": "research" }, { "label": { "zh": "Arbiscan 提案 Tx", "tw": "Arbiscan 提案 Tx", "en": "arbiscan.io source" }, "url": "https://arbiscan.io/tx/0x217c45c1272550e0439e53243f2987b7fb3f58b1d33c222597bbb71851b93f74", "type": "research" }, { "label": { "zh": "Arbiscan 提款 Tx", "tw": "Arbiscan 提款 Tx", "en": "arbiscan.io source" }, "url": "https://arbiscan.io/tx/0x50d0b3ec6c3f5fce0f10abf81540bbb508f421494aa2b3480c4a264b0436547b", "type": "research" }, { "label": { "zh": "AFX 攻击者 THORChain 资金移动监测", "tw": "AFX 攻擊者 THORChain 資金移動監測", "en": "Monitoring of AFX attacker THORChain movement" }, "url": "https://x.com/hupzy_agent/status/2080943367652032703", "type": "research" }, { "label": { "zh": "AFX 资金移动补充报道", "tw": "AFX 資金移動補充報道", "en": "Supplementary AFX fund-movement report" }, "url": "https://x.com/bpaynews/status/2080943624645169630", "type": "research" }, { "label": { "zh": "Arkham：AFX 攻击者资金地址", "tw": "Arkham：AFX 攻擊者資金地址", "en": "Arkham: AFX attacker fund address" }, "url": "https://intel.arkm.com/explorer/address/0x627654B2782bfC57580ecD11d40869b350B6ebAC", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-050", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-044", "status": "verified", "incidentDate": "2026-07-22", "datePrecision": "day", "title": { "zh": "183 天前恶意 Permit 未撤销导致再次盗走 75,780 USDC", "tw": "183 天前惡意 Permit 未撤銷導致再次盜走 75,780 USDC", "en": "Repeat theft through a 183-day-old malicious Permit" }, "summary": { "zh": "本次约 75,780 USDC 已被转走。公开信息没有确认追回、冻结、交易所拦截或受害者完成全部授权撤销；后续资金路径仍待追踪。", "tw": "本次約 75,780 USDC 已被轉走。公開信息沒有確認追回、凍結、交易所攔截或受害者完成全部授權撤銷；後續資金路徑仍待追蹤。", "en": "An unrevoked Permit was reused to steal 75,780 USDC; the two known thefts total about 77,405 USDC." }, "details": { "zh": "## 事件背景\n受害者约 183 天前签署了恶意 Permit，首次被转走约 1,625 USDC 后没有撤销授权。Permit/allowance 继续有效，攻击者不需要受害者再次签名；当受害钱包重新出现 USDC 时，钓鱼基础设施可以再次调用授权路径转走资金。\n\n该事件说明，第一次小额盗币后如果只更换前端或停止交互、却没有链上撤销 Permit/allowance，恶意 Spender 仍保留长期提款权限。\n\n## 事件经过\n1. 约 183 天前，受害者签署恶意 Permit，首次损失约 1,625 USDC。\n2. 受害者事后没有撤销相关授权。\n3. 2026-07-22 08:10:23，恶意地址再次通过已存在的授权路径执行 Ethereum 交易。\n4. 本次约 75,780 USDC 被转走；两次公开金额合计约 77,405 USDC。\n5. GoPlus 公开受害者地址、三个钓鱼地址和完整交易。\n6. RPC 显示交易 From 为恶意 Spender，交易 To 为 GoPlus 列出的第二个钓鱼地址；具体内部 USDC 接收和后续归集仍应以完整 Trace 为准。\n\n## 资金流向\n受害者 USDC 通过未撤销的 Permit/allowance 被恶意 Spender 调用。当前确认的是受害者、恶意 Spender、两个关联钓鱼地址及交易；后续是否进入混币器、跨链桥、交易所充值或 OTC 未有充分公开证据。\n\n## 金额口径\n183 天前首次约 1,625 USDC；本次约 75,780 USDC；两次合计约 77,405 USDC\n\n## 证据边界\nGoPlus 将三个地址统称钓鱼地址，但没有在原帖中逐一拆分“最终收款、归集、控制器”角色。除交易 From/To 可由 RPC 确认外，其余两个地址只保留[钓鱼地址] [关联路径]，最终归集身份尚未确认。\n\n## 处置状态\n本次约 75,780 USDC 已被转走。公开信息没有确认追回、冻结、交易所拦截或受害者完成全部授权撤销；后续资金路径仍待追踪。", "tw": "## 事件背景\n受害者約 183 天前簽署了惡意 Permit，首次被轉走約 1,625 USDC 後沒有撤銷授權。Permit/allowance 繼續有效，攻擊者不需要受害者再次簽名；當受害錢包重新出現 USDC 時，釣魚基礎設施可以再次調用授權路徑轉走資金。\n\n該事件說明，第一次小額盜幣後如果只更換前端或停止交互、卻沒有鏈上撤銷 Permit/allowance，惡意 Spender 仍保留長期提款權限。\n\n## 事件經過\n1. 約 183 天前，受害者簽署惡意 Permit，首次損失約 1,625 USDC。\n2. 受害者事後沒有撤銷相關授權。\n3. 2026-07-22 08:10:23，惡意地址再次通過已存在的授權路徑執行 Ethereum 交易。\n4. 本次約 75,780 USDC 被轉走；兩次公開金額合計約 77,405 USDC。\n5. GoPlus 公開受害者地址、三個釣魚地址和完整交易。\n6. RPC 顯示交易 From 為惡意 Spender，交易 To 為 GoPlus 列出的第二個釣魚地址；具體內部 USDC 接收和後續歸集仍應以完整 Trace 為準。\n\n## 資金流向\n受害者 USDC 通過未撤銷的 Permit/allowance 被惡意 Spender 調用。當前確認的是受害者、惡意 Spender、兩個關聯釣魚地址及交易；後續是否進入混幣器、跨鏈橋、交易所充值或 OTC 未有充分公開證據。\n\n## 金額口徑\n183 天前首次約 1,625 USDC；本次約 75,780 USDC；兩次合計約 77,405 USDC\n\n## 證據邊界\nGoPlus 將三個地址統稱釣魚地址，但沒有在原帖中逐一拆分“最終收款、歸集、控制器”角色。除交易 From/To 可由 RPC 確認外，其餘兩個地址只保留[釣魚地址] [關聯路徑]，最終歸集身份尚未確認。\n\n## 處置狀態\n本次約 75,780 USDC 已被轉走。公開信息沒有確認追回、凍結、交易所攔截或受害者完成全部授權撤銷；後續資金路徑仍待追蹤。", "en": "## Incident background\nThe victim signed a malicious Permit about 183 days before this incident. Approximately 1,625 USDC was taken in the first theft, but the authorization was not revoked. Because the Permit remained valid on-chain, the attacker did not need another signature: when USDC returned to the wallet, the malicious spender could use the existing allowance again.\n\nThe case illustrates why stopping interaction with a phishing site is not enough. A Permit or allowance remains usable until it is revoked or exhausted, even if the victim changes applications or no longer visits the malicious front end.\n\n## Incident sequence\n1. About 183 days earlier, the victim signed a malicious Permit and lost approximately 1,625 USDC.\n2. The authorization remained active.\n3. At 08:10:23 on July 22, 2026, the malicious spender used the existing authorization in a new Ethereum transaction.\n4. Approximately 75,780 USDC was transferred in the second theft, bringing the two publicly reported transfers to about 77,405 USDC.\n5. GoPlus published the victim address, three phishing-related addresses, and the transaction.\n6. RPC data identifies the transaction sender as the malicious spender and the transaction recipient as the second phishing-related address listed by GoPlus. The internal USDC recipient and later consolidation path require transaction-trace evidence.\n\n## Fund flow\nThe malicious spender invoked the victim's unrevoked Permit or allowance to transfer USDC. Public evidence identifies the victim, the spender, two associated phishing addresses, and the transaction, but does not establish a later mixer, bridge, exchange-deposit, or OTC route.\n\n## Amount basis\nThe second theft is recorded at $75,780. Together with the earlier transfer of approximately 1,625 USDC, the two disclosed thefts total about 77,405 USDC.\n\n## Evidence boundary\nGoPlus grouped three addresses under a phishing label without assigning a separate final-recipient, consolidator, or controller role to each one. RPC data supports the transaction sender and recipient, while the roles of the other associated addresses and the final consolidation address remain unconfirmed.\n\n## Current status\nNo public evidence confirms a freeze, exchange interception, asset return, or complete revocation of the victim's remaining authorizations. The downstream fund path remains unconfirmed." }, "category": "phishing-approval", "severity": "high", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 75780, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "183 天前首次约 1,625 USDC；本次约 75,780 USDC；两次合计约 77,405 USDC", "tw": "183 天前首次約 1,625 USDC；本次約 75,780 USDC；兩次合計約 77,405 USDC", "en": "Reported loss: $75,780" }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0x13eF2275bE2aB18E18884065ea856cA8CCc6DbcF", "entity": { "zh": "[链：Ethereum] [受害地址] [恶意 Permit 受害者]", "tw": "[鏈：Ethereum] [受害地址] [惡意 Permit 受害者]", "en": "victim address documented by a public source" }, "role": "victim", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/GoPlusSecurity/status/2079748522245824796", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [受害地址] [恶意 Permit 受害者]", "tw": "[鏈：Ethereum] [受害地址] [惡意 Permit 受害者]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xAfb2423F447D3e16931164C9970B9741aAb1723E", "entity": { "zh": "[链：Ethereum] [钓鱼地址] [恶意 Spender] [交易 From] [授权盗币执行]", "tw": "[鏈：Ethereum] [釣魚地址] [惡意 Spender] [交易 From] [授權盜幣執行]", "en": "attacker address documented by a public source" }, "role": "attacker", "category": "scam", "confidence": 0.9, "sourceUrl": "https://x.com/GoPlusSecurity/status/2079748522245824796", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [钓鱼地址] [恶意 Spender] [交易 From] [授权盗币执行]", "tw": "[鏈：Ethereum] [釣魚地址] [惡意 Spender] [交易 From] [授權盜幣執行]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x187DCEDda3dAcFa1F3Bcd5468dE789F3c03F2490", "entity": { "zh": "[链：Ethereum] [钓鱼地址] [交易 To] [具体收款角色待核]", "tw": "[鏈：Ethereum] [釣魚地址] [交易 To] [具體收款角色待核]", "en": "attacker address documented by a public source" }, "role": "attacker", "category": "scam", "confidence": 0.65, "sourceUrl": "https://x.com/GoPlusSecurity/status/2079748522245824796", "evidenceStatus": "community_reported", "evidenceSummary": { "zh": "[链：Ethereum] [钓鱼地址] [交易 To] [具体收款角色待核]", "tw": "[鏈：Ethereum] [釣魚地址] [交易 To] [具體收款角色待核]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xAc09bBC4167D69543189b494c27c841F1c5dCdB7", "entity": { "zh": "[链：Ethereum] [钓鱼地址] [关联路径] [具体角色待核]", "tw": "[鏈：Ethereum] [釣魚地址] [關聯路徑] [具體角色待核]", "en": "attacker address documented by a public source" }, "role": "attacker", "category": "scam", "confidence": 0.65, "sourceUrl": "https://x.com/GoPlusSecurity/status/2079748522245824796", "evidenceStatus": "community_reported", "evidenceSummary": { "zh": "[链：Ethereum] [钓鱼地址] [关联路径] [具体角色待核]", "tw": "[鏈：Ethereum] [釣魚地址] [關聯路徑] [具體角色待核]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "GoPlus Security 完整原帖", "tw": "GoPlus Security 完整原帖", "en": "x.com source" }, "url": "https://x.com/GoPlusSecurity/status/2079748522245824796", "type": "research" }, { "label": { "zh": "Etherscan 盗币交易", "tw": "Etherscan 盜幣交易", "en": "etherscan.io source" }, "url": "https://etherscan.io/tx/0x35285c5b0b5a2a228b8d17aa69488a5ba6dc87b73264a3bc6f3e93759c6df09f", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-044", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-043", "status": "verified", "incidentDate": "2026-07-22", "datePrecision": "day", "title": { "zh": "42DAO / Balance Coin（BLC）预言机低价与即时清算攻击", "tw": "42DAO / Balance Coin（BLC）預言機低價與即時清算攻擊", "en": "42DAO / Balance Coin oracle liquidation attack" }, "summary": { "zh": "确认发生约 91.2 万—91.5 万美元攻击，BLC 一度暴跌约 99%。截至窗口结束，没有公开证据证明资金已冻结、追回或退还，也没有在已搜索到的项目官方 X 内容中取得正式处置公告。", "tw": "確認發生約 91.2 萬—91.5 萬美元攻擊，BLC 一度暴跌約 99%。截至窗口結束，沒有公開證據證明資金已凍結、追回或退還，也沒有在已搜索到的項目官方 X 內容中取得正式處置公告。", "en": "An abnormally low BTCB oracle price triggered immediate liquidations, causing an estimated $912,000-$915,000 loss." }, "details": { "zh": "## 事件背景\n42DAO 采用 Maker 风格抵押债与清算架构：Median Oracle 提供 BTCB 价格，Spotter 通过 poke 把价格写入系统，Dog 再通过 bark 对被判定为资不抵债的仓位执行清算。\n\n本次攻击的关键不是普通市场下跌，而是异常低 BTCB 价格被写入系统后立即生效。SlowMist 指出 Spotter 缺少三类保护：\n\n1. 与前值之间的价格偏差检查；\n2. 最大回撤或单次变化上限；\n3. 最低价格保护。\n\n同时，Dog 模块使用更新后的价格立即清算，没有清算延迟或二次预言机验证，导致多个 BTCB 抵押仓位在异常低价下被瞬时清算，攻击者捕获价差和抵押价值。\n\n## 事件经过\n1. 2026-07-22 05:00:01，成功攻击关联交易在 BNB Chain 区块 111351152 执行；交易 From 和 To 均为同一自调用主体。\n2. 攻击路径把异常低 BTCB 预言机价格经 Spotter poke 写入 Vat。\n3. Dog 使用该价格执行 bark，多个 BTCB 仓位被立即判定可清算。\n4. SlowMist 明确标记攻击者、受害者、Spotter 和 Dog 合约；PeckShield 报告 BLC 价格下跌约 99%。\n5. 07:00:00 另有一笔由 SlowMist 标记攻击者发起的自调用关联交易，但 RPC 回执状态为 0，属于回滚或失败交易，并非成功的资金提取 Tx。\n6. 安全机构估算损失约 91.2 万—91.5 万美元。\n7. 截至 7 月 23 日 19:00，未在 42DAO 官方 X 搜索中取得项目方处置、暂停、追回或赔付公告。\n\n## 资金流向\n已确认攻击通过错误低价和即时清算从 BTCB 抵押仓位捕获价值。SlowMist 原帖给出攻击者和受害者地址，但没有在一条公开路径中完整披露后续兑换、跨链、混币器或交易所充值地址；这些下游路径保持[待核]，未作超出公开证据的推断。\n\n## 金额口径\nSlowMist 约 912,000 美元；PeckShield 约 915,000 美元；两者为不同安全机构估值口径\n\n## 证据边界\n攻击存在、根因、金额区间、主攻击者、受害者、Spotter、Dog 和成功关联 Tx 均已确认。未取得项目官方事后说明；后续归集、跨链、冻结、追回和赔付状态未确认。自调用地址与 SlowMist 明确标记的主攻击者不是同一证据角色，现已分别标注。\n\n## 处置状态\n确认发生约 91.2 万—91.5 万美元攻击，BLC 一度暴跌约 99%。截至窗口结束，没有公开证据证明资金已冻结、追回或退还，也没有在已搜索到的项目官方 X 内容中取得正式处置公告。", "tw": "## 事件背景\n42DAO 採用 Maker 風格抵押債與清算架構：Median Oracle 提供 BTCB 價格，Spotter 通過 poke 把價格寫入系統，Dog 再通過 bark 對被判定為資不抵債的倉位執行清算。\n\n本次攻擊的關鍵不是普通市場下跌，而是異常低 BTCB 價格被寫入系統後立即生效。SlowMist 指出 Spotter 缺少三類保護：\n\n1. 與前值之間的價格偏差檢查；\n2. 最大回撤或單次變化上限；\n3. 最低價格保護。\n\n同時，Dog 模塊使用更新後的價格立即清算，沒有清算延遲或二次預言機驗證，導致多個 BTCB 抵押倉位在異常低價下被瞬時清算，攻擊者捕獲價差和抵押價值。\n\n## 事件經過\n1. 2026-07-22 05:00:01，成功攻擊關聯交易在 BNB Chain 區塊 111351152 執行；交易 From 和 To 均為同一自調用主體。\n2. 攻擊路徑把異常低 BTCB 預言機價格經 Spotter poke 寫入 Vat。\n3. Dog 使用該價格執行 bark，多個 BTCB 倉位被立即判定可清算。\n4. SlowMist 明確標記攻擊者、受害者、Spotter 和 Dog 合約；PeckShield 報告 BLC 價格下跌約 99%。\n5. 07:00:00 另有一筆由 SlowMist 標記攻擊者發起的自調用關聯交易，但 RPC 回執狀態為 0，屬於回滾或失敗交易，並非成功的資金提取 Tx。\n6. 安全機構估算損失約 91.2 萬—91.5 萬美元。\n7. 截至 7 月 23 日 19:00，未在 42DAO 官方 X 搜索中取得項目方處置、暫停、追回或賠付公告。\n\n## 資金流向\n已確認攻擊通過錯誤低價和即時清算從 BTCB 抵押倉位捕獲價值。SlowMist 原帖給出攻擊者和受害者地址，但沒有在一條公開路徑中完整披露後續兌換、跨鏈、混幣器或交易所充值地址；這些下游路徑保持[待核]，未作超出公開證據的推斷。\n\n## 金額口徑\nSlowMist 約 912,000 美元；PeckShield 約 915,000 美元；兩者為不同安全機構估值口徑\n\n## 證據邊界\n攻擊存在、根因、金額區間、主攻擊者、受害者、Spotter、Dog 和成功關聯 Tx 均已確認。未取得項目官方事後說明；後續歸集、跨鏈、凍結、追回和賠付狀態未確認。自調用地址與 SlowMist 明確標記的主攻擊者不是同一證據角色，現已分別標註。\n\n## 處置狀態\n確認發生約 91.2 萬—91.5 萬美元攻擊，BLC 一度暴跌約 99%。截至窗口結束，沒有公開證據證明資金已凍結、追回或退還，也沒有在已搜索到的項目官方 X 內容中取得正式處置公告。", "en": "## Incident background\n42DAO uses a Maker-style collateralized-debt and liquidation design. Median Oracle supplies the BTCB price, Spotter writes it into the system through poke, and Dog uses bark to liquidate positions considered undercollateralized.\n\nThe attack relied on an abnormally low BTCB price taking effect immediately, rather than on a broad market decline. SlowMist identified three missing safeguards in Spotter:\n\n1. A limit on deviation from the previous price;\n2. A cap on the size of a single downward price change;\n3. A minimum-price safeguard.\n\nDog then liquidated positions immediately from the updated value, without a delay or secondary-oracle check. Multiple BTCB-backed positions were therefore liquidated at an artificial price, allowing the attacker to capture collateral value and liquidation spreads.\n\n## Incident sequence\n1. At 05:00:01 on July 22, 2026, the successful attack transaction executed in BNB Chain block 111351152. The transaction used a self-call pattern.\n2. The attack path submitted an abnormally low BTCB oracle value through Spotter poke and wrote it into Vat.\n3. Dog used that value through bark, immediately marking multiple BTCB positions for liquidation.\n4. SlowMist identified the attacker, victim, Spotter, and Dog contracts; PeckShield reported that BLC fell by approximately 99%.\n5. A second self-call transaction appeared at 07:00:00, but its receipt status was 0. It reverted and is not treated as a successful withdrawal.\n6. Security researchers estimated losses at approximately $912,000 to $915,000.\n7. No project suspension, remediation, return, or compensation announcement was found in the project's public X posts by 19:00.\n\n## Fund flow\nThe attacker captured value from BTCB-backed positions through the false low price and immediate liquidations. SlowMist published the principal attacker and victim addresses, but public sources did not establish a complete downstream route through exchanges, bridges, mixers, or deposit addresses.\n\n## Amount basis\nThe incident is recorded at $915,000, the upper end of the publicly reported $912,000 to $915,000 range.\n\n## Evidence boundary\nPublic evidence supports the attack, root cause, amount range, principal attacker and victim, Spotter and Dog contracts, and the successful transaction. The reverted self-call is kept separate from the successful attack, and downstream consolidation, cross-chain movement, freezing, and compensation remain unconfirmed.\n\n## Current status\nAn oracle-driven liquidation attack of approximately $912,000 to $915,000 was confirmed, and BLC briefly fell by about 99%. No public evidence showed funds frozen, returned, or reimbursed by the end of the reporting window." }, "category": "oracle-manipulation", "severity": "critical", "ecosystems": [ "BNB Chain" ], "chains": [ "BNB Chain" ], "lossUsd": 915000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "SlowMist 约 912,000 美元；PeckShield 约 915,000 美元；两者为不同安全机构估值口径", "tw": "SlowMist 約 912,000 美元；PeckShield 約 915,000 美元；兩者為不同安全機構估值口徑", "en": "Reported loss: $915,000" }, "addressDisclosure": "published", "addresses": [ { "chain": "BNB Chain", "address": "0x9d8dd9f2d734675e2bfcc142d1c7a45609ca213c", "entity": { "zh": "[链：BNB Chain] [黑客地址] [SlowMist 明确标记攻击者] [后续资金路径待核]", "tw": "[鏈：BNB Chain] [黑客地址] [SlowMist 明確標記攻擊者] [後續資金路徑待核]", "en": "attacker address documented by a public source" }, "role": "attacker", "category": "hack", "confidence": 0.65, "sourceUrl": "https://x.com/SlowMist_Team/status/2079759793192132810", "evidenceStatus": "community_reported", "evidenceSummary": { "zh": "[链：BNB Chain] [黑客地址] [SlowMist 明确标记攻击者] [后续资金路径待核]", "tw": "[鏈：BNB Chain] [黑客地址] [SlowMist 明確標記攻擊者] [後續資金路徑待核]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x973a722fd8bcd4b81f4c5c1ac687073e44aa9a0c", "entity": { "zh": "[链：BNB Chain] [受害地址] [SlowMist 明确标记受害者]", "tw": "[鏈：BNB Chain] [受害地址] [SlowMist 明確標記受害者]", "en": "victim address documented by a public source" }, "role": "victim", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/SlowMist_Team/status/2079759793192132810", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [受害地址] [SlowMist 明确标记受害者]", "tw": "[鏈：BNB Chain] [受害地址] [SlowMist 明確標記受害者]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x7b2e2dE172fd24c9158f6ECB77c05943CE47399D", "entity": { "zh": "[链：BNB Chain] [攻击执行地址] [成功 Tx 自调用主体] [与主攻击者关系待核]", "tw": "[鏈：BNB Chain] [攻擊執行地址] [成功 Tx 自調用主體] [與主攻擊者關係待核]", "en": "attacker address documented by a public source" }, "role": "attacker", "category": "hack", "confidence": 0.65, "sourceUrl": "https://x.com/SlowMist_Team/status/2079759793192132810", "evidenceStatus": "community_reported", "evidenceSummary": { "zh": "[链：BNB Chain] [攻击执行地址] [成功 Tx 自调用主体] [与主攻击者关系待核]", "tw": "[鏈：BNB Chain] [攻擊執行地址] [成功 Tx 自調用主體] [與主攻擊者關係待核]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x849dc2416cbe54995a1d725afe526c0e38829228", "entity": { "zh": "[链：BNB Chain] [受影响合约] [Spotter] [预言机价格写入] [非黑客]", "tw": "[鏈：BNB Chain] [受影響合約] [Spotter] [預言機價格寫入] [非黑客]", "en": "contract address documented by a public source" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/SlowMist_Team/status/2079759793192132810", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [受影响合约] [Spotter] [预言机价格写入] [非黑客]", "tw": "[鏈：BNB Chain] [受影響合約] [Spotter] [預言機價格寫入] [非黑客]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x00101ae4467d72e83ef68df447c41de0c71f634e", "entity": { "zh": "[链：BNB Chain] [受影响合约] [Dog] [即时清算] [非黑客]", "tw": "[鏈：BNB Chain] [受影響合約] [Dog] [即時清算] [非黑客]", "en": "contract address documented by a public source" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/SlowMist_Team/status/2079759793192132810", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [受影响合约] [Dog] [即时清算] [非黑客]", "tw": "[鏈：BNB Chain] [受影響合約] [Dog] [即時清算] [非黑客]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x5343b4586a3f2a3365df92ee705c3bf446c54668", "entity": { "zh": "[链：BNB Chain] [BLC 代币合约] [市场暴跌关联] [非黑客]", "tw": "[鏈：BNB Chain] [BLC 代幣合約] [市場暴跌關聯] [非黑客]", "en": "contract address documented by a public source" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/SlowMist_Team/status/2079759793192132810", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [BLC 代币合约] [市场暴跌关联] [非黑客]", "tw": "[鏈：BNB Chain] [BLC 代幣合約] [市場暴跌關聯] [非黑客]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x7130d2a12b9bcbfae4f2634d864a1ee1ce3ead9c", "entity": { "zh": "[链：BNB Chain] [BTCB 代币合约] [抵押资产] [非黑客]", "tw": "[鏈：BNB Chain] [BTCB 代幣合約] [抵押資產] [非黑客]", "en": "contract address documented by a public source" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/SlowMist_Team/status/2079759793192132810", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [BTCB 代币合约] [抵押资产] [非黑客]", "tw": "[鏈：BNB Chain] [BTCB 代幣合約] [抵押資產] [非黑客]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "SlowMist 根因、攻击者、受害者与合约", "tw": "SlowMist 根因、攻擊者、受害者與合約", "en": "x.com source" }, "url": "https://x.com/SlowMist_Team/status/2079759793192132810", "type": "research" }, { "label": { "zh": "PeckShield 损失与 BLC 跌幅", "tw": "PeckShield 損失與 BLC 跌幅", "en": "x.com source" }, "url": "https://x.com/PeckShieldAlert/status/2079751809183433197", "type": "research" }, { "label": { "zh": "BscScan 成功攻击关联交易", "tw": "BscScan 成功攻擊關聯交易", "en": "bscscan.com source" }, "url": "https://bscscan.com/tx/0xe7abe6416e386332b41d63cf5f16903251dc178942cd79bf080fe61058587628", "type": "research" }, { "label": { "zh": "BscScan 回滚关联交易", "tw": "BscScan 回滾關聯交易", "en": "bscscan.com source" }, "url": "https://bscscan.com/tx/0x3b26b3cb6b820a15b7216f07e6951de59990671f513bca62b40759c80ec42652", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-043", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-185", "status": "verified", "incidentDate": "2026-07-21", "datePrecision": "day", "title": { "zh": "FlashTrade 临时实例未经授权提款", "tw": "FlashTrade 臨時實例未經授權提款", "en": "FlashTrade ephemeral-instance unauthorized withdrawal" }, "summary": { "zh": "FlashTrade 官方确认临时实例发生 98,000 美元未经授权提款。新上线的提款批处理与监控系统迅速发现并限制影响；团队表示将全额承担该金额，用户资金不受影响。", "tw": "FlashTrade 官方確認臨時實例發生 98,000 美元未經授權提款。新上線的提款批處理與監控系統迅速發現並限制影響；團隊表示將全額承擔該金額，使用者資金不受影響。", "en": "FlashTrade confirmed an unauthorized $98,000 withdrawal from an ephemeral instance. Newly deployed withdrawal batching and monitoring detected and contained the event quickly. The team said it would cover the amount in full and that user funds were unaffected." }, "details": { "zh": "## 事件背景\n2026 年 7 月 21 日，Solana 永续协议 FlashTrade 发现其临时实例出现 98,000 美元未经授权提款，并暂停交易、充值和提款以调查。\n\n## 事件经过\n提款批处理与监控系统触发告警并限制影响。团队暂停相关功能进行资金对账，随后恢复交易，充值和提款继续暂停约 24 小时等待修复。\n\n## 资金流向\n公开公告确认 98,000 美元从临时实例未经授权转出，但没有披露攻击地址、交易哈希或后续资金路径。\n\n## 金额口径\n公开损失采用项目方确认的 98,000 美元。团队承诺全额承担该金额属于补偿安排，不等同于攻击资产已经返还，因此追回金额为 0。\n\n## 证据边界\n官方公告支持事件、金额、服务暂停和用户资金未受影响。根因等待 MagicBlock 风险披露和修复补丁，不能提前归因为密钥或合约漏洞。\n\n## 处置状态\n交易已恢复，充值和提款在对账及补丁期间继续暂停。团队承担损失，未见攻击资产返还或冻结证据。", "tw": "## 事件背景\n2026 年 7 月 21 日，Solana 永續協議 FlashTrade 發現其臨時實例出現 98,000 美元未經授權提款，並暫停交易、充值和提款以調查。\n\n## 事件經過\n提款批處理與監控系統觸發警報並限制影響。團隊暫停相關功能進行資金對賬，隨後恢復交易，充值和提款繼續暫停約 24 小時等待修復。\n\n## 資金流向\n公開公告確認 98,000 美元從臨時實例未經授權轉出，但沒有披露攻擊地址、交易雜湊或後續資金路徑。\n\n## 金額口徑\n公開損失採用專案方確認的 98,000 美元。團隊承諾全額承擔該金額屬於補償安排，不等同於攻擊資產已經返還，因此追回金額為 0。\n\n## 證據邊界\n官方公告支援事件、金額、服務暫停和使用者資金未受影響。根因等待 MagicBlock 風險披露和修復補丁，不能提前歸因為金鑰或合約漏洞。\n\n## 處置狀態\n交易已恢復，充值和提款在對賬及補丁期間繼續暫停。團隊承擔損失，未見攻擊資產返還或凍結證據。", "en": "## Incident overview\nOn July 21, 2026, Solana perpetuals protocol FlashTrade detected an unauthorized $98,000 withdrawal from its ephemeral instance and paused trading, deposits, and withdrawals for investigation.\n\n## Incident sequence\nWithdrawal batching and monitoring generated an alert and contained the impact. The team paused affected functions for reconciliation, later restored trading, and kept deposits and withdrawals paused for approximately 24 hours pending remediation.\n\n## Fund flow\nThe official announcement confirms the unauthorized $98,000 outflow but does not disclose an attacker address, transaction hash, or downstream fund path.\n\n## Amount basis\nReported loss uses the project-confirmed $98,000 amount. The team’s commitment to cover the amount is compensation, not return of the attack proceeds, so recovered value remains 0.\n\n## Evidence boundary\nThe official announcement supports the event, amount, service pause, and absence of user-fund impact. Root cause awaited MagicBlock’s risk disclosure and patch, so no key or contract failure is asserted.\n\n## Current status\nTrading resumed while deposits and withdrawals remained paused for reconciliation and patching. The team absorbed the loss; no public evidence confirms freezing or return of the attack proceeds." }, "category": "access-control", "severity": "medium", "ecosystems": [ "Solana" ], "chains": [ "Solana" ], "lossUsd": 98000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "临时实例未经授权转出 98,000 美元，团队承担损失，用户资金不受影响。", "tw": "臨時實例未經授權轉出 98,000 美元，團隊承擔損失，使用者資金不受影響。", "en": "An unauthorized $98,000 left the ephemeral instance. The team absorbed the loss and user funds were unaffected." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "FlashTrade 初始公告", "tw": "FlashTrade 初始公告", "en": "FlashTrade initial announcement" }, "url": "https://x.com/FlashTrade/status/2079649461064908805", "type": "official" }, { "label": { "zh": "FlashTrade 恢复与对账更新", "tw": "FlashTrade 恢復與對賬更新", "en": "FlashTrade restoration and reconciliation update" }, "url": "https://x.com/FlashTrade/status/2079727481574334544", "type": "official" }, { "label": { "zh": "SlowMist Hacked Zone 记录", "tw": "SlowMist Hacked Zone 記錄", "en": "SlowMist Hacked Zone record" }, "url": "https://hacked.slowmist.io/", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-185", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-041", "status": "verified", "incidentDate": "2026-07-21", "datePrecision": "day", "title": { "zh": "Wanchain Cardano—BNB Chain 桥 NIGHT 事件", "tw": "Wanchain Cardano—BNB Chain 橋 NIGHT 事件", "en": "Wanchain Cardano-BNB Chain NIGHT bridge incident" }, "summary": { "zh": "影响局限于 Wanchain 第三方桥，不是 Midnight 主链本身被攻破。多家交易所对相关账户或资产采取限制，但未公开完整冻结充值地址。", "tw": "影響侷限於 Wanchain 第三方橋，不是 Midnight 主鏈本身被攻破。多家交易所對相關賬戶或資產採取限制，但未公開完整凍結充值地址。", "en": "About 515 million NIGHT tokens were exposed; realized swaps and the reported nominal $9-13 million exposure are recorded separately." }, "details": { "zh": "## 事件背景\n问题出在 Wanchain 第三方桥的 Cardano 侧 TreasuryCheck 验证器，而不是 Midnight/Cardano 核心共识：\n\n1. 签名消息由 14 个可变长度字段通过原始字节拼接（AppendByteString fold）生成；\n2. 没有固定字段长度前缀或分隔符 → 编码非单射（non-injective）；\n3. 不同字段边界/取值组合可以哈希出相同的待签消息，从而复用一笔本只授权约 3,110 NIGHT 的合法 BSC 侧签名；\n4. 在 Cardano 端用同一签名构造恶意 redeemer，单笔提出约 203,001,692 NIGHT，放大约 65,000 倍；\n5. 多批次累计抽走桥金库约 5.15 亿 NIGHT（桥储备从约 5.27 亿降至约 0.12 亿量级的公开叙述）。\n\n因此：Midnight 主网可仍安全，但 BSC 上 wrapped NIGHT 可能严重欠抵押；媒体按币价估的「千万美元」是名义敞口，不等于攻击者已全部套现。\n\n## 事件经过\n1. 7 月 21 日 13:47（北京时间）BlockSec Phalcon 等率先报警。\n2. 约 13:51 Wanchain 官方确认 Cardano–BNB 桥安全事件。\n3. CertiK 等随后给出地址与金额分析（约 14:58）。\n4. 攻击者复用小额合法签名，在 Cardano 端超额提取 NIGHT 至黑客地址。\n5. 部分 NIGHT 兑换 ADA（公开一笔约 2.03 亿 NIGHT → 约 283 万 ADA）；NIGHT 价格大幅下跌。\n6. 桥被下线；Midnight Foundation 强调主网/验证者未受影响；部分交易所限制关联账户。\n\n## 资金流向\n2. 约 13:51 Wanchain 官方确认 Cardano–BNB 桥安全事件。\n5. 部分 NIGHT 兑换 ADA（公开一笔约 2.03 亿 NIGHT → 约 283 万 ADA）；NIGHT 价格大幅下跌。\n6. 桥被下线；Midnight Foundation 强调主网/验证者未受影响；部分交易所限制关联账户。\n\n## 金额口径\n累计约 5.15 亿枚 NIGHT；其中一笔 203,001,692 NIGHT 换成 2,831,361 ADA；名义市值媒体有约 900 万—1300 万美元差；已实现兑换与名义敞口必须分开写\n\n## 证据边界\n现有公开资料已确认事件基本事实；完整地址角色、技术根因或后续处置仍有未公开部分。\n\n## 处置状态\n影响局限于 Wanchain 第三方桥，不是 Midnight 主链本身被攻破。多家交易所对相关账户或资产采取限制，但未公开完整冻结充值地址。", "tw": "## 事件背景\n問題出在 Wanchain 第三方橋的 Cardano 側 TreasuryCheck 驗證器，而不是 Midnight/Cardano 核心共識：\n\n1. 簽名消息由 14 個可變長度字段通過原始字節拼接（AppendByteString fold）生成；\n2. 沒有固定字段長度前綴或分隔符 → 編碼非單射（non-injective）；\n3. 不同字段邊界/取值組合可以哈希出相同的待籤消息，從而複用一筆本只授權約 3,110 NIGHT 的合法 BSC 側簽名；\n4. 在 Cardano 端用同一簽名構造惡意 redeemer，單筆提出約 203,001,692 NIGHT，放大約 65,000 倍；\n5. 多批次累計抽走橋金庫約 5.15 億 NIGHT（橋儲備從約 5.27 億降至約 0.12 億量級的公開敘述）。\n\n因此：Midnight 主網可仍安全，但 BSC 上 wrapped NIGHT 可能嚴重欠抵押；媒體按幣價估的「千萬美元」是名義敞口，不等於攻擊者已全部套現。\n\n## 事件經過\n1. 7 月 21 日 13:47（北京時間）BlockSec Phalcon 等率先報警。\n2. 約 13:51 Wanchain 官方確認 Cardano–BNB 橋安全事件。\n3. CertiK 等隨後給出地址與金額分析（約 14:58）。\n4. 攻擊者複用小額合法簽名，在 Cardano 端超額提取 NIGHT 至黑客地址。\n5. 部分 NIGHT 兌換 ADA（公開一筆約 2.03 億 NIGHT → 約 283 萬 ADA）；NIGHT 價格大幅下跌。\n6. 橋被下線；Midnight Foundation 強調主網/驗證者未受影響；部分交易所限制關聯賬戶。\n\n## 資金流向\n2. 約 13:51 Wanchain 官方確認 Cardano–BNB 橋安全事件。\n5. 部分 NIGHT 兌換 ADA（公開一筆約 2.03 億 NIGHT → 約 283 萬 ADA）；NIGHT 價格大幅下跌。\n6. 橋被下線；Midnight Foundation 強調主網/驗證者未受影響；部分交易所限制關聯賬戶。\n\n## 金額口徑\n累計約 5.15 億枚 NIGHT；其中一筆 203,001,692 NIGHT 換成 2,831,361 ADA；名義市值媒體有約 900 萬—1300 萬美元差；已實現兌換與名義敞口必須分開寫\n\n## 證據邊界\n現有公開資料已確認事件基本事實；完整地址角色、技術根因或後續處置仍有未公開部分。\n\n## 處置狀態\n影響侷限於 Wanchain 第三方橋，不是 Midnight 主鏈本身被攻破。多家交易所對相關賬戶或資產採取限制，但未公開完整凍結充值地址。", "en": "## Incident background\nThe vulnerability affected the TreasuryCheck validator used by Wanchain's third-party Cardano-BNB Chain bridge, not the Midnight or Cardano consensus layer.\n\n1. Fourteen variable-length fields were concatenated as raw bytes to form the signed message.\n2. The encoding had no fixed field lengths or delimiters, so it was not injective.\n3. Different field boundaries and values could produce the same signed byte string. A valid BNB Chain-side signature authorizing about 3,110 NIGHT could therefore be reused.\n4. The attacker supplied the same signature in a malicious Cardano-side redeemer and withdrew approximately 203,001,692 NIGHT in one operation, an amplification of roughly 65,000 times.\n5. Multiple withdrawals removed about 515 million NIGHT from the bridge treasury; public reporting said reserves fell from roughly 527 million to 12 million NIGHT.\n\nThe resulting wrapped-NIGHT exposure on BNB Chain may have been severely undercollateralized. Media estimates of tens of millions of dollars were nominal token-value estimates, not evidence that the attacker realized the full amount.\n\n## Incident sequence\n1. BlockSec Phalcon and other monitors issued the first public alert at 13:47 Beijing time on July 21.\n2. Wanchain confirmed the Cardano-BNB Chain bridge incident at approximately 13:51.\n3. CertiK and others subsequently published address and amount analysis.\n4. The attacker reused a valid small-withdrawal signature to authorize much larger Cardano-side withdrawals.\n5. Public reporting described a swap of about 203 million NIGHT for approximately 2.83 million ADA, while NIGHT's market price fell sharply.\n6. The bridge was taken offline. Midnight Foundation said its mainnet and validators were unaffected, and some exchanges restricted related accounts or assets.\n\n## Fund flow\nNIGHT left the Wanchain bridge treasury on Cardano through the forged withdrawal path. At least one disclosed tranche of roughly 203 million NIGHT was exchanged for approximately 2.83 million ADA. Public evidence did not establish a complete cash-out route for all 515 million NIGHT.\n\n## Amount basis\nThe archive records $9 million, while public nominal-exposure estimates ranged from approximately $9 million to $13 million. Those estimates are kept separate from the quantity actually swapped and any realized proceeds.\n\n## Evidence boundary\nThe vulnerable bridge validator, approximate token quantities, disclosed swap, and bridge shutdown are supported by public sources. The evidence does not support describing the Midnight mainnet, Cardano consensus, or all NIGHT infrastructure as compromised.\n\n## Current status\nThe affected Wanchain bridge was taken offline. Exchanges imposed some restrictions on related accounts or assets, but no complete set of frozen deposit addresses or final recovery amount was published." }, "category": "bridge-exploit", "severity": "critical", "ecosystems": [ "BNB Chain", "Cardano" ], "chains": [ "BNB Chain", "Cardano" ], "lossUsd": 9000000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "累计约 5.15 亿枚 NIGHT；其中一笔 203,001,692 NIGHT 换成 2,831,361 ADA；名义市值媒体有约 900 万—1300 万美元差；已实现兑换与名义敞口必须分开写", "tw": "累計約 5.15 億枚 NIGHT；其中一筆 203,001,692 NIGHT 換成 2,831,361 ADA；名義市值媒體有約 900 萬—1300 萬美元差；已實現兌換與名義敞口必須分開寫", "en": "Reported loss: $9,000,000" }, "addressDisclosure": "published", "addresses": [ { "chain": "Cardano", "address": "addr1qysj48kpy8qra2g64scvu79n489qrv2uys5ggsrun29v5f5udqxfpr7x0pqfl6khjwv6vm0k8s3spn6h0zfrwszfqgcqeld8kj", "entity": { "zh": "[链：Cardano] [黑客地址] [Cardano 被盗资产接收] [NIGHT 换 ADA] [资金归集]", "tw": "[鏈：Cardano] [黑客地址] [Cardano 被盜資產接收] [NIGHT 換 ADA] [資金歸集]", "en": "attacker address documented by a public source" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/Phalcon_xyz/status/2079451633847783655", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Cardano] [黑客地址] [Cardano 被盗资产接收] [NIGHT 换 ADA] [资金归集]", "tw": "[鏈：Cardano] [黑客地址] [Cardano 被盜資產接收] [NIGHT 換 ADA] [資金歸集]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xFe930c2d63AeD9b82fC4DBC801920dD2c1a3224F", "entity": { "zh": "[链：BNB Chain] [Midnight NIGHT 代币合约] [合法桥前请求 tokenAccount]，不是黑客地址。", "tw": "[鏈：BNB Chain] [Midnight NIGHT 代幣合約] [合法橋前請求 tokenAccount]，不是黑客地址。", "en": "bridge address documented by a public source" }, "role": "bridge", "category": "bridge", "confidence": 0.9, "sourceUrl": "https://x.com/Phalcon_xyz/status/2079451633847783655", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [Midnight NIGHT 代币合约] [合法桥前请求 tokenAccount]，不是黑客地址。", "tw": "[鏈：BNB Chain] [Midnight NIGHT 代幣合約] [合法橋前請求 tokenAccount]，不是黑客地址。", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "BlockSec 根因", "tw": "BlockSec 根因", "en": "x.com source" }, "url": "https://x.com/Phalcon_xyz/status/2079451633847783655", "type": "research" }, { "label": { "zh": "BlockSec 初报", "tw": "BlockSec 初報", "en": "x.com source" }, "url": "https://x.com/Phalcon_xyz/status/2079443108027421183", "type": "research" }, { "label": { "zh": "CertiK 地址与金额", "tw": "CertiK 地址與金額", "en": "x.com source" }, "url": "https://x.com/CertiKAlert/status/2079461015495053624", "type": "research" }, { "label": { "zh": "Wanchain 官方公告", "tw": "Wanchain 官方公告", "en": "x.com source" }, "url": "https://x.com/wanchain_org/status/2079444149066244340", "type": "official" }, { "label": { "zh": "Cardanoscan", "tw": "Cardanoscan", "en": "cardanoscan.io source" }, "url": "https://cardanoscan.io/address/addr1qysj48kpy8qra2g64scvu79n489qrv2uys5ggsrun29v5f5udqxfpr7x0pqfl6khjwv6vm0k8s3spn6h0zfrwszfqgcqeld8kj", "type": "research" }, { "label": { "zh": "BscScan：Midnight NIGHT Token", "tw": "BscScan：Midnight NIGHT Token", "en": "bscscan.com source" }, "url": "https://bscscan.com/address/0xFe930c2d63AeD9b82fC4DBC801920dD2c1a3224F", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-041", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-040", "status": "verified", "incidentDate": "2026-07-20", "datePrecision": "day", "title": { "zh": "恶意 TRAE IDE 扩展", "tw": "惡意 TRAE IDE 擴展", "en": "Malicious TRAE IDE extension" }, "summary": { "zh": "恶意扩展被披露；开发者需卸载并轮换所有可能暴露的密钥。", "tw": "惡意擴展被披露；開發者需卸載並輪換所有可能暴露的密鑰。", "en": "A malicious IDE extension targeted developer credentials and wallet material through the software supply chain." }, "details": { "zh": "## 事件背景\n开发者 IDE 扩展拥有读取工作区、环境变量甚至执行脚本的高权限。恶意扩展 juannegro.solidity 伪装成 Solidity 插件：\n\n1. 在 Open VSX 下架后，仍可能从 TRAE 应用市场等渠道被获取；\n2. 安装后充当跨平台恶意软件投放器；\n3. 目标包括源代码、.env、RPC Key、部署私钥、浏览器/桌面钱包凭证。\n\n攻击面在开发者终端，不依赖某一条公链的合约漏洞；一旦私钥外泄，后续盗币可发生在任意链。\n\n## 事件经过\n1. SlowMist 披露 TRAE 市场仍可获取已在其他市场下架的恶意 Solidity 扩展。\n2. 扩展安装后投放信息窃取/远控类载荷。\n3. 可窃取源码、环境变量、RPC 与部署密钥、钱包数据。\n4. 公开渠道未给出统一链上归集地址与总损失。\n5. 处置：卸载扩展、轮换全部可能暴露的密钥、审计近期部署与授权。\n\n## 资金流向\n4. 公开渠道未给出统一链上归集地址与总损失。\n\n## 金额口径\n未公开统一链上损失。\n\n## 证据边界\n现有公开资料已确认事件基本事实；完整地址角色、技术根因或后续处置仍有未公开部分。\n\n## 处置状态\n恶意扩展被披露；开发者需卸载并轮换所有可能暴露的密钥。", "tw": "## 事件背景\n開發者 IDE 擴展擁有讀取工作區、環境變量甚至執行腳本的高權限。惡意擴展 juannegro.solidity 偽裝成 Solidity 插件：\n\n1. 在 Open VSX 下架後，仍可能從 TRAE 應用市場等渠道被獲取；\n2. 安裝後充當跨平臺惡意軟件投放器；\n3. 目標包括源代碼、.env、RPC Key、部署私鑰、瀏覽器/桌面錢包憑證。\n\n攻擊面在開發者終端，不依賴某一條公鏈的合約漏洞；一旦私鑰外洩，後續盜幣可發生在任意鏈。\n\n## 事件經過\n1. SlowMist 披露 TRAE 市場仍可獲取已在其他市場下架的惡意 Solidity 擴展。\n2. 擴展安裝後投放信息竊取/遠控類載荷。\n3. 可竊取源碼、環境變量、RPC 與部署密鑰、錢包數據。\n4. 公開渠道未給出統一鏈上歸集地址與總損失。\n5. 處置：卸載擴展、輪換全部可能暴露的密鑰、審計近期部署與授權。\n\n## 資金流向\n4. 公開渠道未給出統一鏈上歸集地址與總損失。\n\n## 金額口徑\n未公開統一鏈上損失。\n\n## 證據邊界\n現有公開資料已確認事件基本事實；完整地址角色、技術根因或後續處置仍有未公開部分。\n\n## 處置狀態\n惡意擴展被披露；開發者需卸載並輪換所有可能暴露的密鑰。", "en": "## Incident background\nIDE extensions can read workspaces and environment variables and may execute local scripts. The malicious extension juannegro.solidity impersonated a Solidity development plugin and acted as a cross-platform malware dropper. Although it had been removed from Open VSX, it remained obtainable through the TRAE marketplace and other channels. Its targets included source code, .env files, RPC credentials, deployment keys, and browser or desktop-wallet data.\n\nThe attack surface was the developer workstation rather than a blockchain contract. Once signing material is exposed, later theft can occur on any chain.\n\n## Incident sequence\n1. SlowMist reported that the TRAE marketplace still distributed a malicious Solidity extension removed from other marketplaces.\n2. Installation caused the extension to deploy information-stealing or remote-control payloads.\n3. The payload could collect source code, environment variables, RPC and deployment keys, and wallet data.\n4. Public sources did not disclose one on-chain consolidation address or an aggregate loss amount.\n5. Recommended containment included removing the extension, rotating all potentially exposed credentials, and reviewing recent deployments and wallet authorizations.\n\n## Fund flow\nThe malware could exfiltrate credentials to attacker-controlled infrastructure, enabling later wallet theft. No single on-chain recipient or complete asset-flow route was publicly identified.\n\n## Amount basis\nNo verified aggregate loss amount was published.\n\n## Evidence boundary\nPublic evidence supports the malicious-extension distribution path and credential exposure. It does not establish how many installations led to asset theft or a complete set of attacker-controlled wallets.\n\n## Current status\nThe extension was publicly identified as malicious. Potentially affected developers were advised to remove it, rotate exposed keys, and review account and deployment activity." }, "category": "supply-chain", "severity": "medium", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "未公开统一链上损失。", "tw": "未公開統一鏈上損失。", "en": "No verified aggregate on-chain loss amount was published." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "SlowMist 原帖", "tw": "SlowMist 原帖", "en": "x.com source" }, "url": "https://x.com/SlowMist_Team/status/2079121338053378515", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-040", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-039", "status": "verified", "incidentDate": "2026-07-20", "datePrecision": "day", "title": { "zh": "Zilliqa 合作交易所冷钱包被盗", "tw": "Zilliqa 合作交易所冷錢包被盜", "en": "Zilliqa partner exchange cold-wallet theft" }, "summary": { "zh": "交易所充提被临时限制；调查继续。用户侧应区分「公链被黑」与「合作托管方失陷」。", "tw": "交易所充提被臨時限制；調查繼續。用戶側應區分「公鏈被黑」與「合作託管方失陷」。", "en": "A cold wallet operated by a Zilliqa partner exchange was compromised; the cited sources did not establish one USD loss figure." }, "details": { "zh": "## 事件背景\nZilliqa 官方确认：被盗的是某合作交易所的离线冷钱包，不是 Zilliqa L1 共识、验证者集合或主网协议逻辑被攻破。冷钱包失陷通常意味着：\n\n1. 冷钱包私钥/助记词保管失当；\n2. 签名设备（HSM、多签协调机、气隙机）被入侵或被内部滥用；\n3. 提币/签名流程被社工或恶意运维绕过。\n\n链上表现是「未授权的 ZIL 转出」，根因在托管运营环境，故项目方第一反应是全网交易所暂停 ZIL 充提，防止赃币流入二级市场。\n\n## 事件经过\n1. 合作交易所冷钱包出现未经授权的 ZIL 转账。\n2. Zilliqa 官方披露并定性为合作方托管事故，非核心网络漏洞。\n3. 要求各交易所暂停 ZIL 充值与提现，切断变现路径。\n4. 受害交易所名称、金额、黑客地址、TxID 均未在公开渠道给出完整可核验清单。\n5. 调查持续；充提限制为临时风控。\n\n## 资金流向\n公开资料未披露独立、完整的逐跳资金路径。\n\n## 金额口径\n公开资料未披露统一损失金额。\n\n## 证据边界\n公开资料未提供完整地址与交易记录。\n\n## 处置状态\n交易所充提被临时限制；调查继续。用户侧应区分「公链被黑」与「合作托管方失陷」。", "tw": "## 事件背景\nZilliqa 官方確認：被盜的是某合作交易所的離線冷錢包，不是 Zilliqa L1 共識、驗證者集合或主網協議邏輯被攻破。冷錢包失陷通常意味著：\n\n1. 冷錢包私鑰/助記詞保管失當；\n2. 簽名設備（HSM、多籤協調機、氣隙機）被入侵或被內部濫用；\n3. 提幣/簽名流程被社工或惡意運維繞過。\n\n鏈上表現是「未授權的 ZIL 轉出」，根因在託管運營環境，故項目方第一反應是全網交易所暫停 ZIL 充提，防止贓幣流入二級市場。\n\n## 事件經過\n1. 合作交易所冷錢包出現未經授權的 ZIL 轉賬。\n2. Zilliqa 官方披露並定性為合作方託管事故，非核心網絡漏洞。\n3. 要求各交易所暫停 ZIL 充值與提現，切斷變現路徑。\n4. 受害交易所名稱、金額、黑客地址、TxID 均未在公開渠道給出完整可核驗清單。\n5. 調查持續；充提限制為臨時風控。\n\n## 資金流向\n公開資料未披露獨立、完整的逐跳資金路徑。\n\n## 金額口徑\n公開資料未披露統一損失金額。\n\n## 證據邊界\n公開資料未提供完整地址與交易記錄。\n\n## 處置狀態\n交易所充提被臨時限制；調查繼續。用戶側應區分「公鏈被黑」與「合作託管方失陷」。", "en": "## Incident background\nZilliqa said the compromised asset holder was an offline cold wallet operated by a partner exchange, not the Zilliqa L1 consensus, validator set, or mainnet protocol. A cold-wallet compromise can involve exposed private keys or seed phrases, compromised signing equipment, misuse of a multisignature or HSM workflow, an insider, or social engineering of the withdrawal process. Public evidence did not identify which mechanism applied here.\n\nThe on-chain result was an unauthorized ZIL transfer arising from a custody environment. Zilliqa asked exchanges to suspend ZIL deposits and withdrawals to limit the stolen assets' access to secondary-market liquidity.\n\n## Incident sequence\n1. Unauthorized ZIL transfers occurred from a partner exchange's cold wallet.\n2. Zilliqa characterized the event as a partner-custody incident rather than a core-network vulnerability.\n3. Exchanges were asked to suspend ZIL deposits and withdrawals.\n4. Public sources did not provide a complete, cross-verifiable set of the exchange name, amount, attacker address, and transaction IDs.\n5. The investigation continued while deposit and withdrawal restrictions remained a temporary risk-control measure.\n\n## Fund flow\nPublic sources confirmed an unauthorized transfer from the partner exchange's cold wallet but did not disclose a complete downstream route.\n\n## Amount basis\nNo verified aggregate loss amount was published.\n\n## Evidence boundary\nThe partner-custody characterization and temporary exchange restrictions are public. The precise key-compromise mechanism, complete address set, transaction list, and total loss remain undisclosed.\n\n## Current status\nZIL deposits and withdrawals were temporarily restricted while the investigation continued. The event concerns a custodian wallet, not a compromise of the Zilliqa blockchain." }, "category": "key-compromise", "severity": "medium", "ecosystems": [ "Zilliqa" ], "chains": [ "Zilliqa" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开资料未披露统一损失金额。", "tw": "公開資料未披露統一損失金額。", "en": "Public sources did not disclose a verified aggregate loss amount." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "Zilliqa 官方公告", "tw": "Zilliqa 官方公告", "en": "x.com source" }, "url": "https://x.com/zilliqa/status/2079148672122818621", "type": "official" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-039", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-038", "status": "verified", "incidentDate": "2026-07-20", "datePrecision": "day", "title": { "zh": "一年前恶意 Approve 延迟盗币", "tw": "一年前惡意 Approve 延遲盜幣", "en": "Delayed theft from a year-old malicious approval" }, "summary": { "zh": "约 8.4 万美元 USDT 被转走；同一钓鱼基础设施还出现在 7 月 22 日的 Permit 事件中。", "tw": "約 8.4 萬美元 USDT 被轉走；同一釣魚基礎設施還出現在 7 月 22 日的 Permit 事件中。", "en": "An approval granted about a year earlier was used to steal approximately $84,000 after funds returned to the victim wallet." }, "details": { "zh": "## 事件背景\n典型沉睡授权（sleeping allowance） 攻击：\n\n1. 受害者很早前在钓鱼站签过 USDT approve（spender 为攻击者合约/EOA）；\n2. 当时钱包 USDT 不多或已被小额偷过，受害者未 revoke；\n3. 授权在链上永久有效（除非主动 revoke 或花光 allowance）；\n4. 当受害者再次转入大额 USDT，攻击者无需新签名即可 transferFrom。\n\n与「当场钓鱼」不同，这是时间延迟收割。\n\n## 事件经过\n1. 约一年前受害者签下恶意 USDT Approve。\n2. 授权长期未撤销。\n3. 7 月 20 日前后钱包重新出现 USDT 余额。\n4. 钓鱼 spender 0xAfb2…723E 转走约 8.4 万美元 USDT。\n5. 同一钓鱼基础设施在 7 月 22 日 Permit 案再次出现。\n\n## 资金流向\n公开资料未披露独立、完整的逐跳资金路径。\n\n## 金额口径\n约 8.4 万美元 USDT\n\n## 证据边界\n现有公开资料已确认事件基本事实；完整地址角色、技术根因或后续处置仍有未公开部分。\n\n## 处置状态\n约 8.4 万美元 USDT 被转走；同一钓鱼基础设施还出现在 7 月 22 日的 Permit 事件中。", "tw": "## 事件背景\n典型沉睡授權（sleeping allowance） 攻擊：\n\n1. 受害者很早前在釣魚站簽過 USDT approve（spender 為攻擊者合約/EOA）；\n2. 當時錢包 USDT 不多或已被小額偷過，受害者未 revoke；\n3. 授權在鏈上永久有效（除非主動 revoke 或花光 allowance）；\n4. 當受害者再次轉入大額 USDT，攻擊者無需新簽名即可 transferFrom。\n\n與「當場釣魚」不同，這是時間延遲收割。\n\n## 事件經過\n1. 約一年前受害者簽下惡意 USDT Approve。\n2. 授權長期未撤銷。\n3. 7 月 20 日前後錢包重新出現 USDT 餘額。\n4. 釣魚 spender 0xAfb2…723E 轉走約 8.4 萬美元 USDT。\n5. 同一釣魚基礎設施在 7 月 22 日 Permit 案再次出現。\n\n## 資金流向\n公開資料未披露獨立、完整的逐跳資金路徑。\n\n## 金額口徑\n約 8.4 萬美元 USDT\n\n## 證據邊界\n現有公開資料已確認事件基本事實；完整地址角色、技術根因或後續處置仍有未公開部分。\n\n## 處置狀態\n約 8.4 萬美元 USDT 被轉走；同一釣魚基礎設施還出現在 7 月 22 日的 Permit 事件中。", "en": "## Incident background\nThis was a delayed allowance theft. The victim had approved a malicious spender roughly one year earlier and did not revoke the authorization. An ERC-20 allowance remains valid until it is revoked or consumed, so the attacker could wait for USDT to return to the wallet and then call transferFrom without obtaining another signature.\n\nUnlike an immediate phishing theft, the harmful transaction occurred long after the original approval.\n\n## Incident sequence\n1. The victim signed a malicious USDT approval about one year earlier.\n2. The allowance remained active.\n3. USDT returned to the wallet around July 20.\n4. The phishing-related spender 0xAfb2…723E transferred approximately 84,000 USDT.\n5. The same phishing infrastructure appeared again in the July 22 Permit case.\n\n## Fund flow\nThe malicious spender used the dormant allowance to transfer approximately 84,000 USDT from the victim wallet. Public sources did not disclose a complete downstream consolidation route.\n\n## Amount basis\nThe reported loss was approximately $84,000.\n\n## Evidence boundary\nThe prior approval, spender, and theft amount are publicly reported. The complete downstream address path and ultimate controller remain unconfirmed.\n\n## Current status\nApproximately 84,000 USDT was transferred through the old approval. The related authorization infrastructure was also linked to the later Permit incident." }, "category": "phishing-approval", "severity": "high", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 84000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 8.4 万美元 USDT", "tw": "約 8.4 萬美元 USDT", "en": "Reported loss: $84,000" }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0xAfb2423F447D3e16931164C9970B9741aAb1723E", "entity": { "zh": "[链：Ethereum] [钓鱼地址] [恶意 Spender]", "tw": "[鏈：Ethereum] [釣魚地址] [惡意 Spender]", "en": "attacker address documented by a public source" }, "role": "attacker", "category": "scam", "confidence": 0.9, "sourceUrl": "https://x.com/GoPlusSecurity/status/2079036694725365986", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [钓鱼地址] [恶意 Spender]", "tw": "[鏈：Ethereum] [釣魚地址] [惡意 Spender]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xE6F3D501eB6730C75965CdF523377470C1b23408", "entity": { "zh": "[链：Ethereum] [受害地址]", "tw": "[鏈：Ethereum] [受害地址]", "en": "victim address documented by a public source" }, "role": "victim", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/GoPlusSecurity/status/2079036694725365986", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [受害地址]", "tw": "[鏈：Ethereum] [受害地址]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "GoPlus 原帖", "tw": "GoPlus 原帖", "en": "x.com source" }, "url": "https://x.com/GoPlusSecurity/status/2079036694725365986", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-038", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-037", "status": "verified", "incidentDate": "2026-07-20", "datePrecision": "day", "title": { "zh": "RWT", "tw": "RWT", "en": "RWT protocol exploit" }, "summary": { "zh": "约 11.81 万美元损失；根因与攻击者归集地址待进一步 Trace。", "tw": "約 11.81 萬美元損失；根因與攻擊者歸集地址待進一步 Trace。", "en": "A protocol weakness caused approximately $118,100 in reported losses." }, "details": { "zh": "## 事件背景\n仅有异常 Tx 与损失金额，无官方根因。可能为价格操纵或权限问题，证据不足不强行定性。\n\n## 事件经过\n1. 7 月 20 日 09:34 TenArmor 确认 RWT 异常。\n2. 损失约 11.81 万美元。\n3. 记录攻击 Tx；地址角色待 Trace。\n\n## 资金流向\n公开资料未披露独立、完整的逐跳资金路径。\n\n## 金额口径\n约 11.81 万美元\n\n## 证据边界\n现有公开资料未完整确认地址角色或技术根因。\n\n## 处置状态\n约 11.81 万美元损失；根因与攻击者归集地址待进一步 Trace。", "tw": "## 事件背景\n僅有異常 Tx 與損失金額，無官方根因。可能為價格操縱或權限問題，證據不足不強行定性。\n\n## 事件經過\n1. 7 月 20 日 09:34 TenArmor 確認 RWT 異常。\n2. 損失約 11.81 萬美元。\n3. 記錄攻擊 Tx；地址角色待 Trace。\n\n## 資金流向\n公開資料未披露獨立、完整的逐跳資金路徑。\n\n## 金額口徑\n約 11.81 萬美元\n\n## 證據邊界\n現有公開資料未完整確認地址角色或技術根因。\n\n## 處置狀態\n約 11.81 萬美元損失；根因與攻擊者歸集地址待進一步 Trace。", "en": "## Incident background\nPublic evidence consists primarily of an abnormal on-chain transaction and a reported loss amount. No project post-mortem established whether the cause was price manipulation, a permissions failure, or another contract weakness.\n\n## Incident sequence\n1. TenArmor reported the RWT anomaly at 09:34 Beijing time on July 20.\n2. The reported loss was approximately $118,100.\n3. The attack transaction was published, but the roles of the participating addresses were not fully attributed.\n\n## Fund flow\nThe published transaction shows the abnormal outflow, but public sources did not provide a complete downstream fund-flow path.\n\n## Amount basis\nThe incident is recorded at the reported loss of $118,100.\n\n## Evidence boundary\nThe transaction and reported amount are public. The technical root cause, attacker attribution, and downstream address roles remain unconfirmed.\n\n## Current status\nThe event remained under technical and address-attribution review, with no public freeze or return confirmed." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "BNB Chain" ], "chains": [ "BNB Chain" ], "lossUsd": 118100, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 11.81 万美元", "tw": "約 11.81 萬美元", "en": "Reported loss: $118,100" }, "addressDisclosure": "published", "addresses": [ { "chain": "BNB Chain", "address": "0x84DD3A5D4DE44c8ad0CE032BeAb8bc3f01D1dcf7", "entity": { "zh": "[链：BNB Chain / BSC] [黑客地址] [攻击者 EOA] [攻击发起 From]", "tw": "[鏈：BNB Chain / BSC] [黑客地址] [攻擊者 EOA] [攻擊發起 From]", "en": "attacker address documented by a public source" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://bscscan.com/tx/0x22300140e7c44899c2602382a6e7a4a34a70f47f9736721744bc6434c07171dc", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain / BSC] [黑客地址] [攻击者 EOA] [攻击发起 From]", "tw": "[鏈：BNB Chain / BSC] [黑客地址] [攻擊者 EOA] [攻擊發起 From]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x7ed953Ff42509568f620aa340a33A9373447f4CE", "entity": { "zh": "[链：BNB Chain / BSC] [黑客合约] [主攻击合约 To] [资金调度]", "tw": "[鏈：BNB Chain / BSC] [黑客合約] [主攻擊合約 To] [資金調度]", "en": "contract address documented by a public source" }, "role": "contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://bscscan.com/tx/0x22300140e7c44899c2602382a6e7a4a34a70f47f9736721744bc6434c07171dc", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain / BSC] [黑客合约] [主攻击合约 To] [资金调度]", "tw": "[鏈：BNB Chain / BSC] [黑客合約] [主攻擊合約 To] [資金調度]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x8812bB5fb89d69d35ac84d2c37b55769395b9f90", "entity": { "zh": "[链：BNB Chain / BSC] [黑客关联地址] [RWT/USDT 中转]", "tw": "[鏈：BNB Chain / BSC] [黑客關聯地址] [RWT/USDT 中轉]", "en": "attacker address documented by a public source" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://bscscan.com/tx/0x22300140e7c44899c2602382a6e7a4a34a70f47f9736721744bc6434c07171dc", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain / BSC] [黑客关联地址] [RWT/USDT 中转]", "tw": "[鏈：BNB Chain / BSC] [黑客關聯地址] [RWT/USDT 中轉]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xf8a36777415c09feaff3dc78dcbb3ed00ce989cd", "entity": { "zh": "[链：BNB Chain / BSC] [代币合约] [RWT Token]（非黑客）", "tw": "[鏈：BNB Chain / BSC] [代幣合約] [RWT Token]（非黑客）", "en": "contract address documented by a public source" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://bscscan.com/tx/0x22300140e7c44899c2602382a6e7a4a34a70f47f9736721744bc6434c07171dc", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain / BSC] [代币合约] [RWT Token]（非黑客）", "tw": "[鏈：BNB Chain / BSC] [代幣合約] [RWT Token]（非黑客）", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xc1c2ef25372f12ce18d35044446064b720c4aa27", "entity": { "zh": "[链：BNB Chain / BSC] [交易对/LP] [Pancake V2 RWT-USDT]（路径合约）", "tw": "[鏈：BNB Chain / BSC] [交易對/LP] [Pancake V2 RWT-USDT]（路徑合約）", "en": "contract address documented by a public source" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://bscscan.com/tx/0x22300140e7c44899c2602382a6e7a4a34a70f47f9736721744bc6434c07171dc", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain / BSC] [交易对/LP] [Pancake V2 RWT-USDT]（路径合约）", "tw": "[鏈：BNB Chain / BSC] [交易對/LP] [Pancake V2 RWT-USDT]（路徑合約）", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "BscScan", "tw": "BscScan", "en": "bscscan.com source" }, "url": "https://bscscan.com/tx/0x22300140e7c44899c2602382a6e7a4a34a70f47f9736721744bc6434c07171dc", "type": "research" }, { "label": { "zh": "TenArmor 原帖", "tw": "TenArmor 原帖", "en": "x.com source" }, "url": "https://x.com/TenArmorAlert/status/2079016942556594337", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-037", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-036", "status": "verified", "incidentDate": "2026-07-20", "datePrecision": "day", "title": { "zh": "Allbridge Core", "tw": "Allbridge Core", "en": "Allbridge Core bridge exploit" }, "summary": { "zh": "协议暂停；赃款跨到 Ethereum。项目请求套利者退回异常获利用于补偿 LP。", "tw": "協議暫停；贓款跨到 Ethereum。項目請求套利者退回異常獲利用於補償 LP。", "en": "A bridge weakness caused approximately $1.65 million in reported losses." }, "details": { "zh": "## 事件背景\nAllbridge Core 在 Solana 稳定币池使用虚拟余额/内部会计近似真实储备。缺陷在于：\n\n1. 发送池与接收池状态更新不一致；\n2. 对同一 USDT mint 做 USDT → USDT「同币兑换」时，最终只有接收池状态被正确更新，发送侧偏斜无法回到均衡；\n3. 攻击者可用闪电贷反复执行该路径，把池子会计打歪，再用极少 USDT 换出巨额 USDC；\n4. 同类闪贷扭曲池比例的手法 2023 年曾出现，但 Solana 部署侧修复/不变量未全面继承（第三方 post-mortem 观点）。\n\n## 事件经过\n1. 从 Kamino 借入约 112 万美元 USDC 闪电贷。\n2. 连续约 5 次 USDT → USDT 交换，故意制造虚拟余额偏斜。\n3. 以约 3,987 USDT 换出约 224 万 USDC（虚增会计的直接证据）。\n4. 偿还闪电贷后，净利约 165 万美元。\n5. 经 Mayan 桥到 Ethereum 地址 0x6515…ffDe 并分散。\n6. 官方暂停协议，要求受影响池 LP 撤资；呼吁异常套利者退回利润补偿 LP。\n7. 误标纠正：0x01a494079DCB715f622340301463cE50cd69A4D0 — [链：EVM] 为补偿/退还地址，不是黑客。\n\n## 资金流向\n5. 经 Mayan 桥到 Ethereum 地址 0x651591b68A9c9650FB23F642162353306281ffDe — [链：Ethereum] 并分散。\n\n## 金额口径\n约 165 万美元 USDT/USDC\n\n## 证据边界\n现有公开资料已确认事件基本事实；完整地址角色、技术根因或后续处置仍有未公开部分。\n\n## 处置状态\n协议暂停；赃款跨到 Ethereum。项目请求套利者退回异常获利用于补偿 LP。", "tw": "## 事件背景\nAllbridge Core 在 Solana 穩定幣池使用虛擬餘額/內部會計近似真實儲備。缺陷在於：\n\n1. 發送池與接收池狀態更新不一致；\n2. 對同一 USDT mint 做 USDT → USDT「同幣兌換」時，最終只有接收池狀態被正確更新，發送側偏斜無法回到均衡；\n3. 攻擊者可用閃電貸反覆執行該路徑，把池子會計打歪，再用極少 USDT 換出鉅額 USDC；\n4. 同類閃貸扭曲池比例的手法 2023 年曾出現，但 Solana 部署側修復/不變量未全面繼承（第三方 post-mortem 觀點）。\n\n## 事件經過\n1. 從 Kamino 借入約 112 萬美元 USDC 閃電貸。\n2. 連續約 5 次 USDT → USDT 交換，故意製造虛擬餘額偏斜。\n3. 以約 3,987 USDT 換出約 224 萬 USDC（虛增會計的直接證據）。\n4. 償還閃電貸後，淨利約 165 萬美元。\n5. 經 Mayan 橋到 Ethereum 地址 0x6515…ffDe 並分散。\n6. 官方暫停協議，要求受影響池 LP 撤資；呼籲異常套利者退回利潤補償 LP。\n7. 誤標糾正：0x01a494079DCB715f622340301463cE50cd69A4D0 — [鏈：EVM] 為補償/退還地址，不是黑客。\n\n## 資金流向\n5. 經 Mayan 橋到 Ethereum 地址 0x651591b68A9c9650FB23F642162353306281ffDe — [鏈：Ethereum] 並分散。\n\n## 金額口徑\n約 165 萬美元 USDT/USDC\n\n## 證據邊界\n現有公開資料已確認事件基本事實；完整地址角色、技術根因或後續處置仍有未公開部分。\n\n## 處置狀態\n協議暫停；贓款跨到 Ethereum。項目請求套利者退回異常獲利用於補償 LP。", "en": "## Incident background\nAllbridge Core uses virtual balances and internal accounting to approximate reserves in its Solana stablecoin pool. Public technical analysis found that the sending and receiving pool states could diverge. In a USDT-to-USDT path using the same mint, the receiving side was updated while the sending-side imbalance was not fully restored. Repeated flash-loan swaps could therefore distort accounting and allow a small USDT input to withdraw a much larger amount of USDC.\n\nThe pattern resembles a 2023 virtual-balance manipulation. Third-party analysis said the relevant invariant or fix had not been fully carried into the Solana deployment.\n\n## Incident sequence\n1. The attacker borrowed approximately 1.12 million USDC from Kamino through a flash loan.\n2. About five consecutive USDT-to-USDT swaps created a virtual-balance imbalance.\n3. The distorted accounting allowed approximately 2.24 million USDC to be exchanged for about 3,987 USDT.\n4. After repaying the flash loan, the reported net profit was approximately $1.65 million.\n5. Funds crossed through Mayan to Ethereum address 0x651591b68A9c9650FB23F642162353306281ffDe and were then dispersed.\n6. Allbridge paused the affected service, asked affected liquidity providers to withdraw, and called on abnormal arbitrageurs to return profits for LP compensation.\n7. Address 0x01a494079DCB715f622340301463cE50cd69A4D0 was published as a compensation or return address, not as an attacker.\n\n## Fund flow\nThe attacker used the Solana pool imbalance to extract USDC, repaid the Kamino flash loan, and bridged proceeds through Mayan to 0x651591b68A9c9650FB23F642162353306281ffDe on Ethereum before dispersal.\n\n## Amount basis\nThe reported net loss was approximately $1.65 million.\n\n## Evidence boundary\nPublic sources support the virtual-balance mechanism, flash-loan sequence, amount, Mayan route, and Ethereum recipient. The compensation address is explicitly separated from attacker addresses, and final downstream ownership remains unconfirmed.\n\n## Current status\nThe affected service was paused. Proceeds reached Ethereum, while Allbridge requested the return of abnormal profits to compensate liquidity providers." }, "category": "bridge-exploit", "severity": "high", "ecosystems": [ "Ethereum", "Solana" ], "chains": [ "Ethereum", "Solana" ], "lossUsd": 1650000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 165 万美元 USDT/USDC", "tw": "約 165 萬美元 USDT/USDC", "en": "Reported loss: $1,650,000" }, "addressDisclosure": "published", "addresses": [ { "chain": "Solana", "address": "FhffBraZsGn4H2LxLNToEcaHWEfWwT2UcSz4oRHb7Qdc", "entity": { "zh": "[链：Solana] [黑客地址] [Solana 被盗资产接收] [跨链桥入口]", "tw": "[鏈：Solana] [黑客地址] [Solana 被盜資產接收] [跨鏈橋入口]", "en": "bridge address documented by a public source" }, "role": "bridge", "category": "bridge", "confidence": 0.9, "sourceUrl": "https://x.com/CertiKAlert/status/2079013163014770987", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Solana] [黑客地址] [Solana 被盗资产接收] [跨链桥入口]", "tw": "[鏈：Solana] [黑客地址] [Solana 被盜資產接收] [跨鏈橋入口]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Solana", "address": "7DyZQw3iV5zhHssnNA6Nopi5zc8NGLbYjHMcaok6NN66", "entity": { "zh": "[链：Solana] [受害地址] [Allbridge 受影响账户]", "tw": "[鏈：Solana] [受害地址] [Allbridge 受影響賬戶]", "en": "victim address documented by a public source" }, "role": "victim", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/CertiKAlert/status/2079013163014770987", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Solana] [受害地址] [Allbridge 受影响账户]", "tw": "[鏈：Solana] [受害地址] [Allbridge 受影響賬戶]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x651591b68A9c9650FB23F642162353306281ffDe", "entity": { "zh": "[链：Ethereum] [跨链桥出口] [Ethereum 被盗资产接收] [资金分散]", "tw": "[鏈：Ethereum] [跨鏈橋出口] [Ethereum 被盜資產接收] [資金分散]", "en": "bridge address documented by a public source" }, "role": "bridge", "category": "bridge", "confidence": 0.9, "sourceUrl": "https://x.com/CertiKAlert/status/2079013163014770987", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [跨链桥出口] [Ethereum 被盗资产接收] [资金分散]", "tw": "[鏈：Ethereum] [跨鏈橋出口] [Ethereum 被盜資產接收] [資金分散]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "CertiK 事件与出口地址", "tw": "CertiK 事件與出口地址", "en": "x.com source" }, "url": "https://x.com/CertiKAlert/status/2079013163014770987", "type": "research" }, { "label": { "zh": "GoPlus 完整地址线程", "tw": "GoPlus 完整地址線程", "en": "x.com source" }, "url": "https://x.com/GoPlusSecurity/status/2079226292994707555", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-036", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-033", "status": "verified", "incidentDate": "2026-07-18", "datePrecision": "day", "title": { "zh": "虚假 Web3 招聘 GitHub 木马", "tw": "虛假 Web3 招聘 GitHub 木馬", "en": "Fake Web3 recruitment GitHub malware" }, "summary": { "zh": "活动被 SlowMist 识别并预警；具体受害人数和链上损失未完整披露。", "tw": "活動被 SlowMist 識別並預警；具體受害人數和鏈上損失未完整披露。", "en": "Fraudulent recruiting workflows delivered malware through GitHub repositories, creating credential and wallet-theft risk." }, "details": { "zh": "## 事件背景\n针对 Web3 开发者的社工 + 供应链组合拳：信任建立在「面试/试工」场景，恶意代码藏在看起来正常的 GitHub「MVP 作业」里。开发者本地 npm install / 运行项目即中招，与智能合约审计无关。\n\n## 事件经过\n1. 攻击者伪装 LinkedIn 招聘/HR，长期聊天建立信任。\n2. 发送「请实现/运行这个面试 MVP」的 GitHub 仓库。\n3. 仓库依赖或脚本含木马，执行后窃取 .env、私钥、浏览器钱包与凭证。\n4. 可能进一步造成多链盗币；公开无统一归集地址。\n5. SlowMist 披露预警。\n\n## 资金流向\n4. 可能进一步造成多链盗币；公开无统一归集地址。\n\n## 金额口径\n未公开统一损失金额。\n\n## 证据边界\n现有公开资料已确认事件基本事实；完整地址角色、技术根因或后续处置仍有未公开部分。\n\n## 处置状态\n活动被 SlowMist 识别并预警；具体受害人数和链上损失未完整披露。", "tw": "## 事件背景\n針對 Web3 開發者的社工 + 供應鏈組合拳：信任建立在「面試/試工」場景，惡意代碼藏在看起來正常的 GitHub「MVP 作業」裡。開發者本地 npm install / 運行項目即中招，與智能合約審計無關。\n\n## 事件經過\n1. 攻擊者偽裝 LinkedIn 招聘/HR，長期聊天建立信任。\n2. 發送「請實現/運行這個面試 MVP」的 GitHub 倉庫。\n3. 倉庫依賴或腳本含木馬，執行後竊取 .env、私鑰、瀏覽器錢包與憑證。\n4. 可能進一步造成多鏈盜幣；公開無統一歸集地址。\n5. SlowMist 披露預警。\n\n## 資金流向\n4. 可能進一步造成多鏈盜幣；公開無統一歸集地址。\n\n## 金額口徑\n未公開統一損失金額。\n\n## 證據邊界\n現有公開資料已確認事件基本事實；完整地址角色、技術根因或後續處置仍有未公開部分。\n\n## 處置狀態\n活動被 SlowMist 識別並預警；具體受害人數和鏈上損失未完整披露。", "en": "## Incident background\nThe campaign combined social engineering with a software-supply-chain attack against Web3 developers. Attackers built trust through fake recruitment conversations or trial assignments and concealed malicious code in apparently legitimate GitHub projects. Compromise occurred when a developer installed dependencies or ran the project locally; no smart-contract flaw was required.\n\n## Incident sequence\n1. An attacker impersonated a recruiter on LinkedIn and built trust through an extended conversation.\n2. The target received a GitHub repository presented as an interview assignment.\n3. Dependencies or scripts in the project installed malware capable of stealing .env files, private keys, browser-wallet data, and other credentials.\n4. Stolen credentials could enable asset theft across multiple chains, although no single consolidation address was published.\n5. SlowMist issued a public warning about the campaign.\n\n## Fund flow\nThe campaign first exfiltrated developer credentials and could then enable multi-chain wallet theft. Public sources did not identify one complete on-chain fund-flow route.\n\n## Amount basis\nNo verified aggregate loss amount was published.\n\n## Evidence boundary\nThe recruitment lure, malicious repositories, and credential-theft risk are publicly documented. The total number of victims, realized losses, and complete attacker-wallet set remain undisclosed.\n\n## Current status\nSlowMist publicly identified the campaign and warned developers. Aggregate victim and loss figures were not available." }, "category": "supply-chain", "severity": "medium", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "未公开统一损失金额。", "tw": "未公開統一損失金額。", "en": "No verified aggregate loss amount was published." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "SlowMist 原帖", "tw": "SlowMist 原帖", "en": "x.com source" }, "url": "https://x.com/SlowMist_Team/status/2078379701249466450", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-033", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-032", "status": "verified", "incidentDate": "2026-07-17", "datePrecision": "day", "title": { "zh": "CrowdRingCircle / 众环 CRC", "tw": "CrowdRingCircle / 眾環 CRC", "en": "CrowdRingCircle protocol incident" }, "summary": { "zh": "约 20.14 万美元流失；地址角色仍待 Trace 确认。", "tw": "約 20.14 萬美元流失；地址角色仍待 Trace 確認。", "en": "A smart-contract weakness caused approximately $201,400 in reported losses." }, "details": { "zh": "## 事件背景\n与 FCOW 类似：有链上异常流出，无官方根因文档。可能是池操纵、合约逻辑或权限问题，证据边界内只记现象。\n\n## 事件经过\n1. 7 月 17 日 09:18 TenArmor 告警 CrowdRingCircle/众环 CRC。\n2. 确认约 20.14 万美元异常流失。\n3. 记录攻击 Tx；不把路径上的 DEX router/LP 直接标为黑客。\n\n## 资金流向\n公开资料未披露独立、完整的逐跳资金路径。\n\n## 金额口径\n约 20.14 万美元\n\n## 证据边界\n现有公开资料未完整确认地址角色或技术根因。\n\n## 处置状态\n约 20.14 万美元流失；地址角色仍待 Trace 确认。", "tw": "## 事件背景\n與 FCOW 類似：有鏈上異常流出，無官方根因文檔。可能是池操縱、合約邏輯或權限問題，證據邊界內只記現象。\n\n## 事件經過\n1. 7 月 17 日 09:18 TenArmor 告警 CrowdRingCircle/眾環 CRC。\n2. 確認約 20.14 萬美元異常流失。\n3. 記錄攻擊 Tx；不把路徑上的 DEX router/LP 直接標為黑客。\n\n## 資金流向\n公開資料未披露獨立、完整的逐跳資金路徑。\n\n## 金額口徑\n約 20.14 萬美元\n\n## 證據邊界\n現有公開資料未完整確認地址角色或技術根因。\n\n## 處置狀態\n約 20.14 萬美元流失；地址角色仍待 Trace 確認。", "en": "## Incident background\nPublic evidence showed an abnormal outflow involving CrowdRingCircle, but no project post-mortem established the technical cause. Pool manipulation, contract logic, and permissions failure remained possible explanations, so no unsupported root-cause attribution is assigned.\n\n## Incident sequence\n1. TenArmor reported the CrowdRingCircle or CRC anomaly at 09:18 Beijing time on July 17.\n2. The reported abnormal loss was approximately $201,400.\n3. The attack transaction was published. DEX routers and liquidity-pool contracts appearing in the route are treated as infrastructure, not automatically as attacker-controlled addresses.\n\n## Fund flow\nThe published transaction supports an abnormal outflow, but public sources did not disclose a complete downstream route.\n\n## Amount basis\nThe incident is recorded at the reported loss of $201,400.\n\n## Evidence boundary\nThe transaction and loss estimate are public. The technical root cause, attacker address roles, and final destination of funds remain unconfirmed.\n\n## Current status\nThe loss was reported at approximately $201,400. Address attribution and the underlying exploit mechanism remained under review." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "BNB Chain" ], "chains": [ "BNB Chain" ], "lossUsd": 201400, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 20.14 万美元", "tw": "約 20.14 萬美元", "en": "Reported loss: $201,400" }, "addressDisclosure": "published", "addresses": [ { "chain": "BNB Chain", "address": "0x34579eA92a07a88F5505dFaA4D99Ab94b2784087", "entity": { "zh": "[链：BNB Chain / BSC] [黑客地址] [攻击者 EOA] [攻击发起 From] [持有众环 CRC]", "tw": "[鏈：BNB Chain / BSC] [黑客地址] [攻擊者 EOA] [攻擊發起 From] [持有眾環 CRC]", "en": "attacker address documented by a public source" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://bscscan.com/tx/0xeaef22325e02ac65a8e1f2e1a3a43f7b7ac8d2323ce6f698a90813e77017c834", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain / BSC] [黑客地址] [攻击者 EOA] [攻击发起 From] [持有众环 CRC]", "tw": "[鏈：BNB Chain / BSC] [黑客地址] [攻擊者 EOA] [攻擊發起 From] [持有眾環 CRC]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xc5940d118f9c2070478545ba80a780aa8f86d133", "entity": { "zh": "[链：BNB Chain / BSC] [黑客合约] [攻击中 Create]", "tw": "[鏈：BNB Chain / BSC] [黑客合約] [攻擊中 Create]", "en": "contract address documented by a public source" }, "role": "contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://bscscan.com/tx/0xeaef22325e02ac65a8e1f2e1a3a43f7b7ac8d2323ce6f698a90813e77017c834", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain / BSC] [黑客合约] [攻击中 Create]", "tw": "[鏈：BNB Chain / BSC] [黑客合約] [攻擊中 Create]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x2eadbcdcd4ab4bb7f8b01610794ea09a64cd5da1", "entity": { "zh": "[链：BNB Chain / BSC] [黑客合约] [主执行/资金归集] [被盗资产接收]", "tw": "[鏈：BNB Chain / BSC] [黑客合約] [主執行/資金歸集] [被盜資產接收]", "en": "contract address documented by a public source" }, "role": "contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://bscscan.com/tx/0xeaef22325e02ac65a8e1f2e1a3a43f7b7ac8d2323ce6f698a90813e77017c834", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain / BSC] [黑客合约] [主执行/资金归集] [被盗资产接收]", "tw": "[鏈：BNB Chain / BSC] [黑客合約] [主執行/資金歸集] [被盜資產接收]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x8581433150f2c48ff2efe5a22b17c7d405054509", "entity": { "zh": "[链：BNB Chain / BSC] [代币合约] [众环 CRC Token]（非黑客）", "tw": "[鏈：BNB Chain / BSC] [代幣合約] [眾環 CRC Token]（非黑客）", "en": "contract address documented by a public source" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://bscscan.com/tx/0xeaef22325e02ac65a8e1f2e1a3a43f7b7ac8d2323ce6f698a90813e77017c834", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain / BSC] [代币合约] [众环 CRC Token]（非黑客）", "tw": "[鏈：BNB Chain / BSC] [代幣合約] [眾環 CRC Token]（非黑客）", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xd8799a644850c065388c22df4ee0c28472922526", "entity": { "zh": "[链：BNB Chain / BSC] [交易对/LP] [Pancake V2 CRC-USDT]（路径合约）", "tw": "[鏈：BNB Chain / BSC] [交易對/LP] [Pancake V2 CRC-USDT]（路徑合約）", "en": "contract address documented by a public source" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://bscscan.com/tx/0xeaef22325e02ac65a8e1f2e1a3a43f7b7ac8d2323ce6f698a90813e77017c834", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain / BSC] [交易对/LP] [Pancake V2 CRC-USDT]（路径合约）", "tw": "[鏈：BNB Chain / BSC] [交易對/LP] [Pancake V2 CRC-USDT]（路徑合約）", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "BscScan", "tw": "BscScan", "en": "bscscan.com source" }, "url": "https://bscscan.com/tx/0xeaef22325e02ac65a8e1f2e1a3a43f7b7ac8d2323ce6f698a90813e77017c834", "type": "research" }, { "label": { "zh": "TenArmor 原帖", "tw": "TenArmor 原帖", "en": "x.com source" }, "url": "https://x.com/TenArmorAlert/status/2077925916228120766", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-032", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-031", "status": "verified", "incidentDate": "2026-07-17", "datePrecision": "day", "title": { "zh": "FCOW", "tw": "FCOW", "en": "FCOW protocol exploit" }, "summary": { "zh": "损失约 6.13 万美元；攻击者 EOA 与主攻击合约已入账，完整经济模型根因仍待专项复盘。", "tw": "損失約 6.13 萬美元；攻擊者 EOA 與主攻擊合約已入賬，完整經濟模型根因仍待專項復盤。", "en": "A protocol weakness caused approximately $61,300 in reported losses." }, "details": { "zh": "## 事件背景\n公开信息以 TenArmor 告警与 BscScan 异常攻击交易为主，无项目方完整技术复盘。链上可见攻击者 EOA 调用主攻击合约，并在交易内 Create 多个辅助合约，对 FCOW/USDT 池进行操纵性兑换与资金调度。在无官方根因文档前，不将 LP/Token 合约误标为黑客。\n\n## 事件经过\n1. 7 月 17 日 09:07（北京时间）TenArmor 告警 FCOW。\n2. BNB Chain 上确认异常交易与约 6.13 万美元损失。\n3. BscScan Trace：From 为攻击者 EOA，To 为主攻击合约，交易内创建多个辅助合约并调度 FCOW/USDT。\n4. 记录完整地址与角色；Pancake 池与 FCOW Token 标为路径/代币合约（非黑客）。\n\n## 资金流向\n公开资料未披露独立、完整的逐跳资金路径。\n\n## 金额口径\n约 6.13 万美元\n\n## 证据边界\n现有公开资料已确认事件基本事实；完整地址角色、技术根因或后续处置仍有未公开部分。\n\n## 处置状态\n损失约 6.13 万美元；攻击者 EOA 与主攻击合约已入账，完整经济模型根因仍待专项复盘。", "tw": "## 事件背景\n公開信息以 TenArmor 告警與 BscScan 異常攻擊交易為主，無項目方完整技術復盤。鏈上可見攻擊者 EOA 調用主攻擊合約，並在交易內 Create 多個輔助合約，對 FCOW/USDT 池進行操縱性兌換與資金調度。在無官方根因文檔前，不將 LP/Token 合約誤標為黑客。\n\n## 事件經過\n1. 7 月 17 日 09:07（北京時間）TenArmor 告警 FCOW。\n2. BNB Chain 上確認異常交易與約 6.13 萬美元損失。\n3. BscScan Trace：From 為攻擊者 EOA，To 為主攻擊合約，交易內創建多個輔助合約並調度 FCOW/USDT。\n4. 記錄完整地址與角色；Pancake 池與 FCOW Token 標為路徑/代幣合約（非黑客）。\n\n## 資金流向\n公開資料未披露獨立、完整的逐跳資金路徑。\n\n## 金額口徑\n約 6.13 萬美元\n\n## 證據邊界\n現有公開資料已確認事件基本事實；完整地址角色、技術根因或後續處置仍有未公開部分。\n\n## 處置狀態\n損失約 6.13 萬美元；攻擊者 EOA 與主攻擊合約已入賬，完整經濟模型根因仍待專項復盤。", "en": "## Incident background\nPublic reporting centered on a TenArmor alert and the abnormal BNB Chain transaction; the project had not published a complete technical post-mortem. On-chain traces show an attacker EOA calling a principal attack contract, which created several auxiliary contracts and interacted with the FCOW/USDT pool. Contracts that merely appeared in the transaction route, including the token and liquidity pool, are not treated as attacker-controlled without supporting evidence.\n\n## Incident sequence\n1. TenArmor reported the FCOW incident at 09:07 Beijing time on July 17.\n2. The abnormal transaction and an estimated loss of approximately $61,300 were identified on BNB Chain.\n3. BscScan traces show the attacker EOA calling the principal attack contract, which created auxiliary contracts and coordinated interactions with the FCOW/USDT pool.\n4. The EOA and principal attack contract were recorded separately from the Pancake pool and FCOW token contract.\n\n## Fund flow\nThe attack transaction extracted value through interactions with the FCOW/USDT pool. Public sources did not disclose a complete downstream route after the principal attack contract.\n\n## Amount basis\nThe incident is recorded at the reported loss of $61,300.\n\n## Evidence boundary\nThe transaction structure, attacker EOA, principal attack contract, and amount are publicly supported. A complete economic root cause and every auxiliary-contract role remain unconfirmed.\n\n## Current status\nThe reported loss was approximately $61,300. Principal attacker-controlled addresses were identified, while the full exploit model remained under technical review." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "BNB Chain" ], "chains": [ "BNB Chain" ], "lossUsd": 61300, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 6.13 万美元", "tw": "約 6.13 萬美元", "en": "Reported loss: $61,300" }, "addressDisclosure": "published", "addresses": [ { "chain": "BNB Chain", "address": "0x1e2E1D433D5409b531d55ddADd3D6755f02515af", "entity": { "zh": "[链：BNB Chain] [黑客地址] [攻击者 EOA] [攻击发起 From]", "tw": "[鏈：BNB Chain] [黑客地址] [攻擊者 EOA] [攻擊發起 From]", "en": "attacker address documented by a public source" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://bscscan.com/tx/0x78a6463e1b74607d62aba5e834836f9b34d2df3993fbd9d120b15e4b71e5c601", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [黑客地址] [攻击者 EOA] [攻击发起 From]", "tw": "[鏈：BNB Chain] [黑客地址] [攻擊者 EOA] [攻擊發起 From]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x772744C4bfF10e4158dA50F2f3E028b16c5494cd", "entity": { "zh": "[链：BNB Chain] [黑客合约] [主攻击合约 To] [资金调度]", "tw": "[鏈：BNB Chain] [黑客合約] [主攻擊合約 To] [資金調度]", "en": "contract address documented by a public source" }, "role": "contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://bscscan.com/tx/0x78a6463e1b74607d62aba5e834836f9b34d2df3993fbd9d120b15e4b71e5c601", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [黑客合约] [主攻击合约 To] [资金调度]", "tw": "[鏈：BNB Chain] [黑客合約] [主攻擊合約 To] [資金調度]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x7d13bd1bb1ba50945878911d73bd42d12da693a1", "entity": { "zh": "[链：BNB Chain] [黑客合约] [攻击中 Create 的辅助合约] [资金中转]", "tw": "[鏈：BNB Chain] [黑客合約] [攻擊中 Create 的輔助合約] [資金中轉]", "en": "contract address documented by a public source" }, "role": "contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://bscscan.com/tx/0x78a6463e1b74607d62aba5e834836f9b34d2df3993fbd9d120b15e4b71e5c601", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [黑客合约] [攻击中 Create 的辅助合约] [资金中转]", "tw": "[鏈：BNB Chain] [黑客合約] [攻擊中 Create 的輔助合約] [資金中轉]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xdc69553ae9681dec8e77bb60f262278332d6ac6e", "entity": { "zh": "[链：BNB Chain] [黑客合约] [攻击中 Create] [FCOW 持仓/分发]", "tw": "[鏈：BNB Chain] [黑客合約] [攻擊中 Create] [FCOW 持倉/分發]", "en": "contract address documented by a public source" }, "role": "contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://bscscan.com/tx/0x78a6463e1b74607d62aba5e834836f9b34d2df3993fbd9d120b15e4b71e5c601", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [黑客合约] [攻击中 Create] [FCOW 持仓/分发]", "tw": "[鏈：BNB Chain] [黑客合約] [攻擊中 Create] [FCOW 持倉/分發]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xcf51963d55e6ec01d3bc9f55ecd537939a614468", "entity": { "zh": "[链：BNB Chain] [代币合约] [FCOW Token]（非黑客）", "tw": "[鏈：BNB Chain] [代幣合約] [FCOW Token]（非黑客）", "en": "contract address documented by a public source" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://bscscan.com/tx/0x78a6463e1b74607d62aba5e834836f9b34d2df3993fbd9d120b15e4b71e5c601", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [代币合约] [FCOW Token]（非黑客）", "tw": "[鏈：BNB Chain] [代幣合約] [FCOW Token]（非黑客）", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x4514ffcbbd1e28d76b38b50515d19fcbe81ecd0d", "entity": { "zh": "[链：BNB Chain] [交易对/LP] [Pancake V2 FCOW-USDT]（路径合约，非黑客）", "tw": "[鏈：BNB Chain] [交易對/LP] [Pancake V2 FCOW-USDT]（路徑合約，非黑客）", "en": "contract address documented by a public source" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://bscscan.com/tx/0x78a6463e1b74607d62aba5e834836f9b34d2df3993fbd9d120b15e4b71e5c601", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [交易对/LP] [Pancake V2 FCOW-USDT]（路径合约，非黑客）", "tw": "[鏈：BNB Chain] [交易對/LP] [Pancake V2 FCOW-USDT]（路徑合約，非黑客）", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "BscScan 攻击交易", "tw": "BscScan 攻擊交易", "en": "bscscan.com source" }, "url": "https://bscscan.com/tx/0x78a6463e1b74607d62aba5e834836f9b34d2df3993fbd9d120b15e4b71e5c601", "type": "research" }, { "label": { "zh": "TenArmorAlert", "tw": "TenArmorAlert", "en": "x.com source" }, "url": "https://x.com/TenArmorAlert", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-031", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-030", "status": "verified", "incidentDate": "2026-07-17", "datePrecision": "day", "title": { "zh": "Across Protocol / Risk Labs relayer 伪造存款事件", "tw": "Across Protocol / Risk Labs relayer 偽造存款事件", "en": "Across Protocol / Risk Labs relayer forged-deposit incident" }, "summary": { "zh": "Across 官方复盘确认 Solana 链下事件读取缺陷导致 Risk Labs relayer 为伪造存款垫付真实资产，公开损失约 360 万美元。2026 年 7 月 28 日，攻击者标记地址向 Across Hub Pool Owner Multisig 返还 331.8 ETH，披露时估值约 623,900 美元。", "tw": "Across 官方復盤確認 Solana 鏈下事件讀取缺陷導致 Risk Labs relayer 為偽造存款墊付真實資產，公開損失約 360 萬美元。2026 年 7 月 28 日，攻擊者標記地址向 Across Hub Pool Owner Multisig 返還 331.8 ETH，披露時估值約 623,900 美元。", "en": "Across confirmed that a Solana off-chain event-reading defect caused a Risk Labs relayer to advance real assets against forged deposits, with reported loss of approximately $3.6 million. On July 28, 2026, a labeled attacker address returned 331.8 ETH to the Across Hub Pool Owner Multisig, valued at about $623,900 when disclosed." }, "details": { "zh": "## 事件背景\n2026 年 7 月 17 日，攻击者利用 Solana 链下事件读取软件的验证缺陷，使 Risk Labs 运营的 relayer 接受不存在的源链存款并在目标侧垫付真实资产。用户资金未受影响。\n\n## 事件经过\n攻击者构造伪造存款事件；读取软件没有充分验证对应交易的最终成功状态；relayer 将伪造事件视为真实存款并完成目标侧付款。Across 随后暂停 Solana 存款、修复并恢复服务。\n\n## 资金流向\n损失由 relayer 垫资路径承担，而不是桥资金池或用户资产直接被抽干。2026 年 7 月 28 日，攻击者标记地址向 Across Hub Pool Owner Multisig 转入 331.8 ETH。\n\n## 金额口径\n约 4,170 万美元是伪造存款事件名义规模，不是实际损失。公开损失采用约 360 万美元；返还的 331.8 ETH 按披露时估值约 623,900 美元，单独记入追回金额。\n\n## 证据边界\nAcross 官方复盘支持伪造存款机制、relayer 承担损失和用户资金未受影响；PeckShield 的链上监测支持 331.8 ETH 转入项目多签。最终净损失仍待项目后续统一。\n\n## 处置状态\nSolana 存款功能已修复并恢复。331.8 ETH 已进入 Across Hub Pool Owner Multisig，因此按公开估值记录追回 623,900 美元；其余资金状态未公开。", "tw": "## 事件背景\n2026 年 7 月 17 日，攻擊者利用 Solana 鏈下事件讀取軟體的驗證缺陷，使 Risk Labs 運營的 relayer 接受不存在的源鏈存款並在目標側墊付真實資產。使用者資金未受影響。\n\n## 事件經過\n攻擊者構造偽造存款事件；讀取軟體沒有充分驗證對應交易的最終成功狀態；relayer 將偽造事件視為真實存款並完成目標側付款。Across 隨後暫停 Solana 存款、修復並恢復服務。\n\n## 資金流向\n損失由 relayer 墊資路徑承擔，而不是橋資金池或使用者資產直接被抽乾。2026 年 7 月 28 日，攻擊者標記地址向 Across Hub Pool Owner Multisig 轉入 331.8 ETH。\n\n## 金額口徑\n約 4,170 萬美元是偽造存款事件名義規模，不是實際損失。公開損失採用約 360 萬美元；返還的 331.8 ETH 按披露時估值約 623,900 美元，單獨記入追回金額。\n\n## 證據邊界\nAcross 官方復盤支援偽造存款機制、relayer 承擔損失和使用者資金未受影響；PeckShield 的鏈上監測支援 331.8 ETH 轉入專案多簽。最終淨損失仍待專案後續統一。\n\n## 處置狀態\nSolana 存款功能已修復並恢復。331.8 ETH 已進入 Across Hub Pool Owner Multisig，因此按公開估值記錄追回 623,900 美元；其餘資金狀態未公開。", "en": "## Incident overview\nOn July 17, 2026, an attacker exploited validation in Solana off-chain event-reading software so that a Risk Labs-operated relayer accepted nonexistent source-chain deposits and advanced real assets on destination chains. User funds were unaffected.\n\n## Incident sequence\nThe attacker constructed forged deposit events. The reader did not adequately verify final success of the corresponding transaction, and the relayer treated the events as real deposits and paid on destination chains. Across paused Solana deposits, remediated the issue, and restored service.\n\n## Fund flow\nThe relayer-advance path absorbed the loss rather than a bridge liquidity pool or user assets being directly drained. On July 28, a labeled attacker address transferred 331.8 ETH to the Across Hub Pool Owner Multisig.\n\n## Amount basis\nApproximately $41.7 million was nominal forged-deposit-event value, not realized loss. Reported loss uses approximately $3.6 million. The returned 331.8 ETH was valued at about $623,900 when disclosed and is recorded separately as recovery.\n\n## Evidence boundary\nAcross’s postmortem supports the forged-deposit mechanism, relayer-borne loss, and absence of user loss. PeckShield’s on-chain monitoring supports the 331.8 ETH transfer to the project multisig. Final net loss remains subject to a later project update.\n\n## Current status\nSolana deposits were remediated and restored. Because 331.8 ETH entered the Across Hub Pool Owner Multisig, $623,900 is recorded as recovered on the public valuation basis. The status of the remaining assets is not disclosed." }, "category": "bridge-exploit", "severity": "high", "ecosystems": [ "Ethereum", "Solana" ], "chains": [ "Ethereum", "Solana" ], "lossUsd": 3600000, "frozenUsd": 0, "recoveredUsd": 623900, "assetLoss": { "zh": "公开损失约 360 万美元；331.8 ETH 已返还项目多签，披露时估值约 623,900 美元。", "tw": "公開損失約 360 萬美元；331.8 ETH 已返還專案多簽，披露時估值約 623,900 美元。", "en": "Reported loss is approximately $3.6 million; 331.8 ETH was returned to the project multisig and was valued at about $623,900 when disclosed." }, "addressDisclosure": "published", "addresses": [ { "chain": "Solana", "address": "8bkoZToaTBBtAPczgHqD4XVxWtvBkiy4crtexEtYDYSL", "entity": { "zh": "[链：Solana] [黑客地址] [伪造存款信号]", "tw": "[鏈：Solana] [黑客地址] [偽造存款信號]", "en": "attacker address documented by a public source" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/AcrossProtocol/status/2078164426268557340", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Solana] [黑客地址] [伪造存款信号]", "tw": "[鏈：Solana] [黑客地址] [偽造存款信號]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xa0C0e9f307b5A26cA3FB5891c19154fc7A02BeF7", "entity": { "zh": "[链：Ethereum] [黑客地址] [Across Protocol Exploiter 1] [被盗资产接收]", "tw": "[鏈：Ethereum] [黑客地址] [Across Protocol Exploiter 1] [被盜資產接收]", "en": "attacker address documented by a public source" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/AcrossProtocol/status/2078164426268557340", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [黑客地址] [Across Protocol Exploiter 1] [被盗资产接收]", "tw": "[鏈：Ethereum] [黑客地址] [Across Protocol Exploiter 1] [被盜資產接收]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xA6fb971F3B7a9b9F76EdA76bc89268fe26560189", "entity": { "zh": "[链：Ethereum] [黑客地址] [Across Protocol Exploiter 2] [初始由 Tornado Cash 注资] [资金路径]", "tw": "[鏈：Ethereum] [黑客地址] [Across Protocol Exploiter 2] [初始由 Tornado Cash 注資] [資金路徑]", "en": "attacker address documented by a public source" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/AcrossProtocol/status/2078164426268557340", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [黑客地址] [Across Protocol Exploiter 2] [初始由 Tornado Cash 注资] [资金路径]", "tw": "[鏈：Ethereum] [黑客地址] [Across Protocol Exploiter 2] [初始由 Tornado Cash 注資] [資金路徑]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "Across 官方", "tw": "Across 官方", "en": "x.com source" }, "url": "https://x.com/AcrossProtocol/status/2078164426268557340", "type": "official" }, { "label": { "zh": "M13 地址披露", "tw": "M13 地址披露", "en": "x.com source" }, "url": "https://x.com/m13_digital/status/2078244008002826524", "type": "research" }, { "label": { "zh": "Ethereum Exploiter 1", "tw": "Ethereum Exploiter 1", "en": "etherscan.io source" }, "url": "https://etherscan.io/address/0xa0c0e9f307b5a26ca3fb5891c19154fc7a02bef7", "type": "research" }, { "label": { "zh": "Ethereum Exploiter 2", "tw": "Ethereum Exploiter 2", "en": "etherscan.io source" }, "url": "https://etherscan.io/address/0xA6fb971F3B7a9b9F76EdA76bc89268fe26560189", "type": "research" }, { "label": { "zh": "Across 官方事件复盘", "tw": "Across 官方事件復盤", "en": "Across official incident postmortem" }, "url": "https://x.com/AcrossProtocol/status/2080722320814121237", "type": "official" }, { "label": { "zh": "PeckShield 返还监测", "tw": "PeckShield 返還監測", "en": "PeckShield return monitoring" }, "url": "https://x.com/PeckShieldAlert/status/2082034098458214567", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-030", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-028", "status": "verified", "incidentDate": "2026-07-16", "datePrecision": "day", "title": { "zh": "DeFiTuna", "tw": "DeFiTuna", "en": "DeFiTuna oracle manipulation" }, "summary": { "zh": "项目称攻击向量已缓解，并启动调查和资金追回。", "tw": "項目稱攻擊向量已緩解，並啟動調查和資金追回。", "en": "A pricing weakness enabled abnormal liquidations and approximately $580,000 in reported losses." }, "details": { "zh": "## 事件背景\nDeFiTuna 借贷池在评估抵押品时，信任了可被攻击者自建低流动性池扭曲的价格，并叠加：\n\n1. 估值舍入误差：在极端薄池或特殊数量级下，内部计价出现有利于攻击者的舍入；\n2. 健康度检查缺陷：本应拦截的「假高抵押、真低流动性」仓位被判定为健康；\n3. 结果是：几乎卖不掉的池 LP/代币被系统当成高价值抵押，从而从 USDC 借贷池借走真实稳定币。\n\n本质是抵押品预言机/内部定价未对自建池与操纵性流动性设防。\n\n## 事件经过\n1. 攻击者创建或利用高度缺乏流动性的 TUNA/USDC 池。\n2. 通过操纵池价与估值路径，抬高自己仓位的「账面抵押价值」。\n3. 绕过健康度检查，从 USDC 借贷池抽走约 56.96 万—58 万美元。\n4. 借贷池留下近同规模赤字（坏账/穿仓）。\n5. 资金据报拆到两个地址，但公开渠道未形成可交叉验证的完整地址列表。\n6. 项目方称攻击向量已缓解，启动调查与追回。\n\n## 资金流向\n公开资料未披露独立、完整的逐跳资金路径。\n\n## 金额口径\n约 56.96 万—58 万美元 USDC\n\n## 证据边界\n公开资料未提供完整地址与交易记录。\n\n## 处置状态\n项目称攻击向量已缓解，并启动调查和资金追回。", "tw": "## 事件背景\nDeFiTuna 借貸池在評估抵押品時，信任了可被攻擊者自建低流動性池扭曲的價格，併疊加：\n\n1. 估值舍入誤差：在極端薄池或特殊數量級下，內部計價出現有利於攻擊者的舍入；\n2. 健康度檢查缺陷：本應攔截的「假高抵押、真低流動性」倉位被判定為健康；\n3. 結果是：幾乎賣不掉的池 LP/代幣被系統當成高價值抵押，從而從 USDC 借貸池借走真實穩定幣。\n\n本質是抵押品預言機/內部定價未對自建池與操縱性流動性設防。\n\n## 事件經過\n1. 攻擊者創建或利用高度缺乏流動性的 TUNA/USDC 池。\n2. 通過操縱池價與估值路徑，抬高自己倉位的「賬面抵押價值」。\n3. 繞過健康度檢查，從 USDC 借貸池抽走約 56.96 萬—58 萬美元。\n4. 借貸池留下近同規模赤字（壞賬/穿倉）。\n5. 資金據報拆到兩個地址，但公開渠道未形成可交叉驗證的完整地址列表。\n6. 項目方稱攻擊向量已緩解，啟動調查與追回。\n\n## 資金流向\n公開資料未披露獨立、完整的逐跳資金路徑。\n\n## 金額口徑\n約 56.96 萬—58 萬美元 USDC\n\n## 證據邊界\n公開資料未提供完整地址與交易記錄。\n\n## 處置狀態\n項目稱攻擊向量已緩解，並啟動調查和資金追回。", "en": "## Incident background\nDeFiTuna's lending design accepted collateral valuations derived from low-liquidity pools that an attacker could create or manipulate. Public analysis described two compounding weaknesses:\n\n1. Rounding in very thin pools or unusual value ranges could favor the attacker;\n2. The health check could treat illiquid collateral with an artificially high quoted value as adequately collateralized.\n\nThe attacker could therefore present hard-to-sell pool positions or tokens as valuable collateral and borrow real stablecoins from the USDC lending pool. The underlying issue was a pricing path that lacked protection against self-created pools and manipulable liquidity.\n\n## Incident sequence\n1. The attacker created or exploited a highly illiquid TUNA/USDC market.\n2. Pool-price and valuation manipulation increased the apparent collateral value.\n3. The position passed the health check, allowing approximately $569,600 to $580,000 to be withdrawn from the USDC lending pool.\n4. The lending pool was left with a deficit of similar size.\n5. Public reports said funds reached two addresses, but did not provide a complete cross-verifiable address set.\n6. The project said it mitigated the attack vector and began an investigation and recovery effort.\n\n## Fund flow\nManipulated collateral valuations enabled real USDC to leave the lending pool. Public sources did not disclose a complete downstream route for the two reported recipient addresses.\n\n## Amount basis\nThe incident is recorded at $580,000, the upper end of the publicly reported range.\n\n## Evidence boundary\nThe pricing and health-check weaknesses, amount range, and resulting pool deficit are publicly reported. The complete attacker-address set and final destination of funds remain undisclosed.\n\n## Current status\nThe project said the attack vector had been mitigated and that investigation and recovery work had begun. No completed return was publicly confirmed." }, "category": "oracle-manipulation", "severity": "high", "ecosystems": [ "Ethereum", "Solana" ], "chains": [ "Ethereum", "Solana" ], "lossUsd": 580000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 56.96 万—58 万美元 USDC", "tw": "約 56.96 萬—58 萬美元 USDC", "en": "Reported loss: $580,000" }, "addressDisclosure": "published", "addresses": [ { "chain": "Solana", "address": "9ytGWP8tCRF1keREJ5VHqBpSuM9MZYwm3oFQQa1SvESb", "entity": { "zh": "[链：Solana] [黑客地址] [Attacker 1]", "tw": "[鏈：Solana] [黑客地址] [Attacker 1]", "en": "attacker address documented by a public source" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://www.certik.com/blog/defituna-incident-analysis", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Solana] [黑客地址] [Attacker 1]", "tw": "[鏈：Solana] [黑客地址] [Attacker 1]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Solana", "address": "917DKTphW3rhBG5gsJpwKsNGisNV2dx74uUFd8HBEjtg", "entity": { "zh": "[链：Solana] [黑客地址] [Attacker 2] [假池/Fake Pool]", "tw": "[鏈：Solana] [黑客地址] [Attacker 2] [假池/Fake Pool]", "en": "attacker address documented by a public source" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://www.certik.com/blog/defituna-incident-analysis", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Solana] [黑客地址] [Attacker 2] [假池/Fake Pool]", "tw": "[鏈：Solana] [黑客地址] [Attacker 2] [假池/Fake Pool]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Solana", "address": "7hiHL8AgDuLNVDQLfN3GHdLAEeCN1F7uz6nSANRvFJst", "entity": { "zh": "[链：Solana] [黑客地址] [Attacker 3] [limit-order 抽 USDC]", "tw": "[鏈：Solana] [黑客地址] [Attacker 3] [limit-order 抽 USDC]", "en": "attacker address documented by a public source" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://www.certik.com/blog/defituna-incident-analysis", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Solana] [黑客地址] [Attacker 3] [limit-order 抽 USDC]", "tw": "[鏈：Solana] [黑客地址] [Attacker 3] [limit-order 抽 USDC]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Solana", "address": "BK9aTnKfPNnnj45Me5ACrky2vexzUrZHRzr4BjmQpH3c", "entity": { "zh": "[链：Solana] [黑客地址] [Attacker 4] [limit-order 抽 USDC]", "tw": "[鏈：Solana] [黑客地址] [Attacker 4] [limit-order 抽 USDC]", "en": "attacker address documented by a public source" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://www.certik.com/blog/defituna-incident-analysis", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Solana] [黑客地址] [Attacker 4] [limit-order 抽 USDC]", "tw": "[鏈：Solana] [黑客地址] [Attacker 4] [limit-order 抽 USDC]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Solana", "address": "8P3H7Hy98LWhw5QhuXdoigVdAzPCYRTYjdtQQKhGwvqD", "entity": { "zh": "[链：Solana] [黑客地址] [Attacker 5]", "tw": "[鏈：Solana] [黑客地址] [Attacker 5]", "en": "attacker address documented by a public source" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://www.certik.com/blog/defituna-incident-analysis", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Solana] [黑客地址] [Attacker 5]", "tw": "[鏈：Solana] [黑客地址] [Attacker 5]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Solana", "address": "GrXBhM6Ty6YxubFp8zubtJF12WXmKj1dhMyakRPeaDpo", "entity": { "zh": "[链：Solana] [黑客地址] [Attacker 6]", "tw": "[鏈：Solana] [黑客地址] [Attacker 6]", "en": "attacker address documented by a public source" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://www.certik.com/blog/defituna-incident-analysis", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Solana] [黑客地址] [Attacker 6]", "tw": "[鏈：Solana] [黑客地址] [Attacker 6]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Solana", "address": "F4xUroPaHro4gb2JAqa3e93E7DdZytRQJ4L2cHT5E53p", "entity": { "zh": "[链：Solana] [黑客地址] [Attacker 7]", "tw": "[鏈：Solana] [黑客地址] [Attacker 7]", "en": "attacker address documented by a public source" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://www.certik.com/blog/defituna-incident-analysis", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Solana] [黑客地址] [Attacker 7]", "tw": "[鏈：Solana] [黑客地址] [Attacker 7]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Solana", "address": "ETGhosPrFApbiiKXDpxrhBz7J2MdTA3dxnL2Nkio9vEX", "entity": { "zh": "[链：Solana] [黑客地址] [Attacker 8]", "tw": "[鏈：Solana] [黑客地址] [Attacker 8]", "en": "attacker address documented by a public source" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://www.certik.com/blog/defituna-incident-analysis", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Solana] [黑客地址] [Attacker 8]", "tw": "[鏈：Solana] [黑客地址] [Attacker 8]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Solana", "address": "4ZKkGZuoXqgSHbmsJXUib3dgn5WNhzbPEXrxuMYJ5oQ3", "entity": { "zh": "[链：Solana] [黑客地址] [Attacker 9]", "tw": "[鏈：Solana] [黑客地址] [Attacker 9]", "en": "attacker address documented by a public source" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://www.certik.com/blog/defituna-incident-analysis", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Solana] [黑客地址] [Attacker 9]", "tw": "[鏈：Solana] [黑客地址] [Attacker 9]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Solana", "address": "tuna4uSQZncNeeiAMKbstuxA9CUkHH6HmC64wgmnogD", "entity": { "zh": "[链：Solana] [协议程序] [DefiTuna Program]", "tw": "[鏈：Solana] [協議程序] [DefiTuna Program]", "en": "other address documented by a public source" }, "role": "other", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://www.certik.com/blog/defituna-incident-analysis", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Solana] [协议程序] [DefiTuna Program]", "tw": "[鏈：Solana] [協議程序] [DefiTuna Program]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Solana", "address": "D76dDcSU5HnAGqVEZCDLyGgLpTp4xZuqeZyVDtUdDv55", "entity": { "zh": "[链：Solana] [受害地址] [Damaged USDC vault]", "tw": "[鏈：Solana] [受害地址] [Damaged USDC vault]", "en": "victim address documented by a public source" }, "role": "victim", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://www.certik.com/blog/defituna-incident-analysis", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Solana] [受害地址] [Damaged USDC vault]", "tw": "[鏈：Solana] [受害地址] [Damaged USDC vault]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xb2cD3E99E45F8ab15fee77a014A3D82F9FE05f3E", "entity": { "zh": "ETH 跨链出口（Mayan）： — [链：Ethereum] [跨链桥出口] [被盗资产接收]", "tw": "ETH 跨鏈出口（Mayan）： — [鏈：Ethereum] [跨鏈橋出口] [被盜資產接收]", "en": "bridge address documented by a public source" }, "role": "bridge", "category": "bridge", "confidence": 0.9, "sourceUrl": "https://www.certik.com/blog/defituna-incident-analysis", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "ETH 跨链出口（Mayan）： — [链：Ethereum] [跨链桥出口] [被盗资产接收]", "tw": "ETH 跨鏈出口（Mayan）： — [鏈：Ethereum] [跨鏈橋出口] [被盜資產接收]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x509B9D094A6C26D716aaC131E8aDee5B16B86d3e", "entity": { "zh": "ETH 持仓： — [链：Ethereum] [资金归集] [DAI/ETH 持仓]", "tw": "ETH 持倉： — [鏈：Ethereum] [資金歸集] [DAI/ETH 持倉]", "en": "other address documented by a public source" }, "role": "other", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://www.certik.com/blog/defituna-incident-analysis", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "ETH 持仓： — [链：Ethereum] [资金归集] [DAI/ETH 持仓]", "tw": "ETH 持倉： — [鏈：Ethereum] [資金歸集] [DAI/ETH 持倉]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "CertiK 完整 Incident Analysis", "tw": "CertiK 完整 Incident Analysis", "en": "certik.com source" }, "url": "https://www.certik.com/blog/defituna-incident-analysis", "type": "research" }, { "label": { "zh": "CertiKAlert", "tw": "CertiKAlert", "en": "x.com source" }, "url": "https://x.com/CertiKAlert/status/2078077637302399435", "type": "research" }, { "label": { "zh": "DeFiTuna 官方", "tw": "DeFiTuna 官方", "en": "x.com source" }, "url": "https://x.com/DeFiTuna/status/2077772502521053668", "type": "official" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-028", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-027", "status": "verified", "incidentDate": "2026-07-16", "datePrecision": "day", "title": { "zh": "Chi Protocol", "tw": "Chi Protocol", "en": "Chi Protocol exploit" }, "summary": { "zh": "金额不大，但储备基本被抽干；属于硬编码面值导致的经济漏洞。", "tw": "金額不大，但儲備基本被抽乾；屬於硬編碼面值導致的經濟漏洞。", "en": "A protocol weakness was exploited for approximately $8,500." }, "details": { "zh": "## 事件背景\nChi Protocol 发行 USC 等稳定币，储备为 LST/LRT 等。漏洞在 mint 与 burn/赎回不对称：\n\n- 市场上 USC 已严重脱锚（远低于 1 美元）；\n- 赎回/burn() 路径仍硬编码 1 USC = 1 USD 计算可赎回抵押；\n- 攻击者可在薄池低价买 USC，再按面值销毁换出 weETH/stETH/WETH 等储备；\n- 形成无风险套利，直至储备被抽空。SlowMist 归档日期有 7/13，披露帖有 7/16，可并存。\n\n## 事件经过\n1. USC 在 Uniswap 等薄池脱锚。\n2. 攻击者（可配合闪电贷）低价扫货 USC。\n3. 调用协议 burn/赎回，按 1 美元面值抽走抵押储备。\n4. 损失金额约 8,500 美元，但储备几乎耗尽——金额小、系统性伤害大。\n5. 完整攻击地址/Tx 公开摘要不足。\n\n## 资金流向\n公开资料未披露独立、完整的逐跳资金路径。\n\n## 金额口径\n约 8500 美元；储备几乎被耗尽\n\n## 证据边界\n公开资料未提供完整地址与交易记录。\n\n## 处置状态\n金额不大，但储备基本被抽干；属于硬编码面值导致的经济漏洞。", "tw": "## 事件背景\nChi Protocol 發行 USC 等穩定幣，儲備為 LST/LRT 等。漏洞在 mint 與 burn/贖回不對稱：\n\n- 市場上 USC 已嚴重脫錨（遠低於 1 美元）；\n- 贖回/burn() 路徑仍硬編碼 1 USC = 1 USD 計算可贖回抵押；\n- 攻擊者可在薄池低價買 USC，再按面值銷燬換出 weETH/stETH/WETH 等儲備；\n- 形成無風險套利，直至儲備被抽空。SlowMist 歸檔日期有 7/13，披露帖有 7/16，可並存。\n\n## 事件經過\n1. USC 在 Uniswap 等薄池脫錨。\n2. 攻擊者（可配合閃電貸）低價掃貨 USC。\n3. 調用協議 burn/贖回，按 1 美元面值抽走抵押儲備。\n4. 損失金額約 8,500 美元，但儲備幾乎耗盡——金額小、系統性傷害大。\n5. 完整攻擊地址/Tx 公開摘要不足。\n\n## 資金流向\n公開資料未披露獨立、完整的逐跳資金路徑。\n\n## 金額口徑\n約 8500 美元；儲備幾乎被耗盡\n\n## 證據邊界\n公開資料未提供完整地址與交易記錄。\n\n## 處置狀態\n金額不大，但儲備基本被抽乾；屬於硬編碼面值導致的經濟漏洞。", "en": "## Incident background\nChi Protocol issued USC against reserves that included liquid staking and restaking assets. A mismatch developed between the market price of USC and the protocol's redemption logic:\n\n- USC traded well below $1;\n- The burn or redemption path still valued 1 USC at $1;\n- An attacker could buy discounted USC in a thin market and redeem it at face value for weETH, stETH, WETH, or other reserves;\n- Repeated arbitrage could continue until reserves were depleted.\n\nSlowMist dated the incident to July 13 and published its disclosure on July 16; those dates refer to the event and later reporting respectively.\n\n## Incident sequence\n1. USC lost its peg in thin markets such as Uniswap.\n2. The attacker acquired discounted USC, potentially with flash-loan support.\n3. The protocol's burn or redeem function released collateral at a hard-coded $1 face value.\n4. The reported dollar loss was approximately $8,500, while the reserve depletion represented a broader systemic impact.\n5. Public summaries did not provide a complete attack-address and transaction set.\n\n## Fund flow\nDiscounted USC was acquired in the market and redeemed against protocol reserves at the fixed face value. A complete downstream route for the withdrawn reserve assets was not published.\n\n## Amount basis\nThe reported realized loss was approximately $8,500. The near depletion of reserves is a separate measure of protocol impact.\n\n## Evidence boundary\nThe depeg and asymmetric redemption mechanism are publicly described. The complete attacker address set, transactions, and any flash-loan role remain undisclosed.\n\n## Current status\nThe recorded dollar amount was relatively small, but the hard-coded redemption value reportedly left reserves nearly depleted." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 8500, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 8500 美元；储备几乎被耗尽", "tw": "約 8500 美元；儲備幾乎被耗盡", "en": "Reported loss: $8,500" }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0x38547D918b9645F2D94336B6b61AEB08053E142c", "entity": { "zh": "[链：Ethereum] [受影响合约/代币] [USC Token]（不是黑客地址）", "tw": "[鏈：Ethereum] [受影響合約/代幣] [USC Token]（不是黑客地址）", "en": "contract address documented by a public source" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/SolidityScan/status/2077518136375480584", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [受影响合约/代币] [USC Token]（不是黑客地址）", "tw": "[鏈：Ethereum] [受影響合約/代幣] [USC Token]（不是黑客地址）", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "SolidityScan 原帖", "tw": "SolidityScan 原帖", "en": "x.com source" }, "url": "https://x.com/SolidityScan/status/2077518136375480584", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-027", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-026", "status": "verified", "incidentDate": "2026-07-16", "datePrecision": "day", "title": { "zh": "Cascade CLS Vault", "tw": "Cascade CLS Vault", "en": "Cascade CLS Vault exploit" }, "summary": { "zh": "用户资金损失约 134 万 USDC；赃款完成多跳跨链。", "tw": "用戶資金損失約 134 萬 USDC；贓款完成多跳跨鏈。", "en": "A vault weakness caused approximately $1.34 million in reported losses." }, "details": { "zh": "## 事件背景\nCascade 为多资产永续平台，CLS（Collaborative Liquidity / 金库策略）在 Arbitrum 上以 USDC 为用户锁仓流动性，并在薄流动性市场中承担做市/持仓一侧（公开分析指金库偏空头侧）。攻击经济逻辑（综合 Cecuro/TechTimes 等）：\n\n1. 攻击者在特定薄市场堆积大量多头；\n2. 人为抬高 mark price（标记价格）；\n3. 触发 CLS 金库空头侧的强平/自动去杠杆（ADL）；\n4. 金库被平仓的仓位与攻击者盈利多头对敲，攻击者按虚高价锁定利润并提走 USDC。\n\n根因属于交易/风控参数与标记价格可操纵性，完整是否含私钥泄露仍待官方复盘；公开材料更支持经济操纵路径。\n\n## 事件经过\n1. 7 月 16 日 13:25（北京时间）前后披露 CLS 金库遭攻击，损失约 134 万 USDC（亦写 1.3M/1.34M）。\n2. 攻击者立即提现利润。\n3. 跨链逃避冻结：USDC 从 Arbitrum → Solana，再经 Relay Protocol 以 DAI 形式到 Ethereum（避开 USDC 发行方黑名单）。\n4. Cascade 暂停交易与提现，邀请 SEAL 911 等介入。\n5. 社区称 CLS 约 95% 资金被提走等比例未获官方页面独立确认，正文慎用。\n\n## 资金流向\n3. 跨链逃避冻结：USDC 从 Arbitrum → Solana，再经 Relay Protocol 以 DAI 形式到 Ethereum（避开 USDC 发行方黑名单）。\n\n## 金额口径\n约 134 万 USDC\n\n## 证据边界\n公开资料未提供完整地址与交易记录。 现有公开资料未完整确认地址角色或技术根因。\n\n## 处置状态\n用户资金损失约 134 万 USDC；赃款完成多跳跨链。", "tw": "## 事件背景\nCascade 為多資產永續平臺，CLS（Collaborative Liquidity / 金庫策略）在 Arbitrum 上以 USDC 為用戶鎖倉流動性，並在薄流動性市場中承擔做市/持倉一側（公開分析指金庫偏空頭側）。攻擊經濟邏輯（綜合 Cecuro/TechTimes 等）：\n\n1. 攻擊者在特定薄市場堆積大量多頭；\n2. 人為抬高 mark price（標記價格）；\n3. 觸發 CLS 金庫空頭側的強平/自動去槓桿（ADL）；\n4. 金庫被平倉的倉位與攻擊者盈利多頭對敲，攻擊者按虛高價鎖定利潤並提走 USDC。\n\n根因屬於交易/風控參數與標記價格可操縱性，完整是否含私鑰洩露仍待官方復盤；公開材料更支持經濟操縱路徑。\n\n## 事件經過\n1. 7 月 16 日 13:25（北京時間）前後披露 CLS 金庫遭攻擊，損失約 134 萬 USDC（亦寫 1.3M/1.34M）。\n2. 攻擊者立即提現利潤。\n3. 跨鏈逃避凍結：USDC 從 Arbitrum → Solana，再經 Relay Protocol 以 DAI 形式到 Ethereum（避開 USDC 發行方黑名單）。\n4. Cascade 暫停交易與提現，邀請 SEAL 911 等介入。\n5. 社區稱 CLS 約 95% 資金被提走等比例未獲官方頁面獨立確認，正文慎用。\n\n## 資金流向\n3. 跨鏈逃避凍結：USDC 從 Arbitrum → Solana，再經 Relay Protocol 以 DAI 形式到 Ethereum（避開 USDC 發行方黑名單）。\n\n## 金額口徑\n約 134 萬 USDC\n\n## 證據邊界\n公開資料未提供完整地址與交易記錄。 現有公開資料未完整確認地址角色或技術根因。\n\n## 處置狀態\n用戶資金損失約 134 萬 USDC；贓款完成多跳跨鏈。", "en": "## Incident background\nCascade operates a multi-asset trading platform. Its Collaborative Liquidity Strategy, or CLS, used USDC to provide liquidity on Arbitrum and was reportedly positioned on the short side of a thin market. Public analysis described an economic manipulation:\n\n1. The attacker accumulated large long positions in the thin market;\n2. The mark price was pushed upward;\n3. The CLS vault's short positions were forced through liquidation or automatic deleveraging;\n4. Closing the vault's positions realized the attacker's long-side gains at the manipulated price, after which USDC was withdrawn.\n\nPublic evidence supports the economic-manipulation path. It did not establish that a private key was fully compromised.\n\n## Incident sequence\n1. The CLS vault attack was disclosed at approximately 13:25 Beijing time on July 16, with losses reported at about 1.3 million to 1.34 million USDC.\n2. The attacker withdrew the resulting proceeds.\n3. USDC moved from Arbitrum to Solana and then reached Ethereum as DAI through Relay Protocol, reducing exposure to a USDC issuer blacklist.\n4. Cascade suspended trading and withdrawals and sought assistance from SEAL 911 and others.\n5. Community reports said about 95% of CLS funds had been withdrawn, but that proportion was not independently confirmed in a project statement.\n\n## Fund flow\nProceeds moved from Arbitrum to Solana, then through Relay Protocol to Ethereum in DAI form.\n\n## Amount basis\nThe incident is recorded at the upper end of the reported range, $1.34 million.\n\n## Evidence boundary\nThe reported amount, service suspension, and multi-chain route are public. The precise market-control mechanism, any key compromise, complete address set, and the claimed 95% proportion remain unconfirmed.\n\n## Current status\nApproximately 1.34 million USDC was reported lost. The assets completed a multi-hop cross-chain route, while Cascade suspended trading and withdrawals." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "Ethereum", "Solana", "Arbitrum" ], "chains": [ "Ethereum", "Solana", "Arbitrum" ], "lossUsd": 1340000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 134 万 USDC", "tw": "約 134 萬 USDC", "en": "Reported loss: $1,340,000" }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "PeckShield 原帖", "tw": "PeckShield 原帖", "en": "x.com source" }, "url": "https://x.com/PeckShieldAlert/status/2077625630536180100", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-026", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-047", "status": "verified", "incidentDate": "2026-07-15", "datePrecision": "day", "title": { "zh": "macOS 信息窃取木马：劫持 Telegram + 调包 Ledger/Trezor", "tw": "macOS 信息竊取木馬：劫持 Telegram + 調包 Ledger/Trezor", "en": "macOS infostealer hijacks Telegram and swaps hardware-wallet apps" }, "summary": { "zh": "属高危终端威胁预警；中招后应视为「Telegram + 钱包种子」同时沦陷，立即轮换密钥、冻结 CEX、通知联系人防二次社工。", "tw": "屬高危終端威脅預警；中招後應視為「Telegram + 錢包種子」同時淪陷，立即輪換密鑰、凍結 CEX、通知聯繫人防二次社工。", "en": "Malware replaced Telegram and Ledger/Trezor software while stealing local credentials; aggregate on-chain loss remains unknown." }, "details": { "zh": "## 事件背景\nSlowMist 披露的 macOS stealer 同时打两条高价值路径：\n\n1. Telegram Desktop 会话文件：直接拷贝已登录 session，攻击者可在另一设备「继承」会话，受害者体感像「没输密码/2FA 却丢号」；\n2. 钱包与 Keychain：采集 macOS Keychain、浏览器数据、多款桌面钱包库；\n3. 硬件钱包调包：投放假 Ledger/Trezor 应用，诱导输入助记词/PIN/passphrase。\n\n根因是终端失陷 + 对「会话=登录态」「官方钱包 UI」的信任被伪造。\n\n## 事件经过\n1. 用户通过未知渠道感染 macOS 信息窃取木马（常与假更新、盗版、恶意广告相关）。\n2. 木马采集 Keychain、Safari/浏览器 cookie、Apple Notes、Telegram Desktop 数据、钱包数据库。\n3. 外传至 C2；攻击者导入 Telegram 会话接管账号（可用于社工好友或担保群身份）。\n4. 同步尝试离线破解钱包库，或用假硬件钱包应用骗助记词。\n5. SlowMist 在隔离环境复现攻击链并公开 IOC（IP/URL，非链上地址）。\n\n## 资金流向\n公开资料未披露独立、完整的逐跳资金路径。\n\n## 金额口径\n未公开统一链上总损失；该记录属于终端威胁情报，尚未确认对应的链上盗币事件。\n\n## 证据边界\n无合格完整黑客地址入账。\n\n## 处置状态\n属高危终端威胁预警；中招后应视为「Telegram + 钱包种子」同时沦陷，立即轮换密钥、冻结 CEX、通知联系人防二次社工。", "tw": "## 事件背景\nSlowMist 披露的 macOS stealer 同時打兩條高價值路徑：\n\n1. Telegram Desktop 會話文件：直接拷貝已登錄 session，攻擊者可在另一設備「繼承」會話，受害者體感像「沒輸密碼/2FA 卻丟號」；\n2. 錢包與 Keychain：採集 macOS Keychain、瀏覽器數據、多款桌面錢包庫；\n3. 硬件錢包調包：投放假 Ledger/Trezor 應用，誘導輸入助記詞/PIN/passphrase。\n\n根因是終端失陷 + 對「會話=登錄態」「官方錢包 UI」的信任被偽造。\n\n## 事件經過\n1. 用戶通過未知渠道感染 macOS 信息竊取木馬（常與假更新、盜版、惡意廣告相關）。\n2. 木馬採集 Keychain、Safari/瀏覽器 cookie、Apple Notes、Telegram Desktop 數據、錢包數據庫。\n3. 外傳至 C2；攻擊者導入 Telegram 會話接管賬號（可用於社工好友或擔保群身份）。\n4. 同步嘗試離線破解錢包庫，或用假硬件錢包應用騙助記詞。\n5. SlowMist 在隔離環境復現攻擊鏈並公開 IOC（IP/URL，非鏈上地址）。\n\n## 資金流向\n公開資料未披露獨立、完整的逐跳資金路徑。\n\n## 金額口徑\n未公開統一鏈上總損失；該記錄屬於終端威脅情報，尚未確認對應的鏈上盜幣事件。\n\n## 證據邊界\n無合格完整黑客地址入賬。\n\n## 處置狀態\n屬高危終端威脅預警；中招後應視為「Telegram + 錢包種子」同時淪陷，立即輪換密鑰、凍結 CEX、通知聯繫人防二次社工。", "en": "## Incident background\nSlowMist described macOS information-stealing malware that targeted several high-value data paths at once:\n\n1. Telegram Desktop session files, which can let an attacker import an already authenticated session on another device;\n2. macOS Keychain, browser data, and desktop-wallet files;\n3. Fake Ledger or Trezor applications designed to solicit a seed phrase, PIN, or passphrase.\n\nThe threat combined endpoint compromise with forged trust in an existing login session or an apparently legitimate hardware-wallet interface.\n\n## Incident sequence\n1. Victims could be infected through fake updates, pirated software, malicious advertising, or other untrusted downloads.\n2. The malware collected Keychain data, browser cookies, Apple Notes, Telegram Desktop files, and wallet databases.\n3. Data was exfiltrated to command-and-control infrastructure. Imported Telegram sessions could then support account takeover and secondary social engineering.\n4. The attacker could also attempt offline wallet-file cracking or present a fake hardware-wallet application to capture recovery material.\n5. SlowMist reproduced the chain in an isolated environment and published off-chain indicators, including IP addresses and URLs.\n\n## Fund flow\nThe malware exposed credentials and wallet material that could enable later theft, but public sources did not identify one complete on-chain recipient or fund-flow route.\n\n## Amount basis\nNo verified aggregate on-chain loss amount was published.\n\n## Evidence boundary\nThe malware behavior and off-chain indicators are public. Victim count, realized asset loss, and a complete attacker-wallet set were not disclosed.\n\n## Current status\nThe campaign remained a high-risk endpoint threat. Potential victims were advised to treat Telegram sessions and wallet material as compromised, rotate credentials, contact relevant exchanges, and warn contacts about secondary scams." }, "category": "supply-chain", "severity": "medium", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "未公开统一链上总损失；该记录属于终端威胁情报，尚未确认对应的链上盗币事件。", "tw": "未公開統一鏈上總損失；該記錄屬於終端威脅情報，尚未確認對應的鏈上盜幣事件。", "en": "No verified aggregate on-chain loss was published; this is endpoint-threat intelligence without a confirmed corresponding theft." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "SlowMist 分析", "tw": "SlowMist 分析", "en": "slowmist.medium.com source" }, "url": "https://slowmist.medium.com/telegram-account-compromised-wallet-swapped-how-does-macos-malware-break-through-your-defenses-dad9bfed9c02", "type": "research" }, { "label": { "zh": "二次报道", "tw": "二次報道", "en": "bitcoinfoundation.org source" }, "url": "https://bitcoinfoundation.org/news/crimes-and-fraud-news/mac-malware-can-hijack-telegram-target-crypto-wallets-cybersecurity-analysts-warn/", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-047", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-024", "status": "verified", "incidentDate": "2026-07-15", "datePrecision": "day", "title": { "zh": "Ostium", "tw": "Ostium", "en": "Ostium oracle manipulation incident" }, "summary": { "zh": "Ostium 暂停交易；大部分赃款已换成 ETH 并混入 Tornado Cash，剩余部分跨回 Ethereum 分散。", "tw": "Ostium 暫停交易；大部分贓款已換成 ETH 並混入 Tornado Cash，剩餘部分跨回 Ethereum 分散。", "en": "An oracle and pricing weakness caused approximately $23.75 million in reported losses." }, "details": { "zh": "## 事件背景\nOstium 是 Arbitrum 上的 RWA 永续（黄金/原油/股指/外汇等），OLP 金库用 USDC 做流动性。价格依赖链下报价 + 链上授权预言机报告（PriceUpKeep 转发器等自动化组件）。关键缺陷：\n\n1. 攻击者拿到预言机签名者密钥或滥用已注册的 PriceUpKeep 转发权限；\n2. 协议校验「签名是否有效、转发器是否注册」，但没有有效约束：报告时间戳不得为未来、价格偏离外部源的硬限制、单笔/短时异常盈利熔断；\n3. 于是攻击者提交未来日期 + 被操纵价格的「合法签名报告」；\n4. 再在高杠杆（公开称可达约 100x）下开平仓循环，制造账面上的交易盈利，从 OLP 金库结算出巨额 USDC。\n\n这不是普通用户仓位被强平，而是预言机信任根被攻破后的金库会计操纵。因统计批次不同，公开金额包括约 1,186 万、1,800 万、2,375 万及约 2,400 万美元；这些数字应分别理解，不能相加。\n\n## 事件经过\n1. 注资：攻击者从 ChangeNOW、Bybit 等获得初始 ETH，跨入 Arbitrum。\n2. 滥用报价路径：通过已注册 PriceUpKeep 转发器提交带有效签名、但价格与时间被操纵的 oracle report。\n3. 虚假盈利循环：在被操纵价格下高杠杆开平仓，触发 OLP 向攻击者支付「盈利」。\n4. 抽水：OLP 被抽走约 1,186 万—2,375 万+ USDC（Blockaid/媒体初值多写约 1800 万；后续跟踪可到约 2400 万）。\n5. 换 ETH：USDC 兑成约 12,084—12,085 ETH。\n6. 清洗：大部分 ETH 进 Tornado Cash；部分跨回 Ethereum 分散到多个下游地址。\n7. 项目：暂停全部交易并调查；Blockaid 披露关键 Tx 0x359f8c05...。\n\n## 资金流向\n5. 换 ETH：USDC 兑成约 12,084—12,085 ETH。\n6. 清洗：大部分 ETH 进 Tornado Cash；部分跨回 Ethereum 分散到多个下游地址。\n\n## 金额口径\n不同批次统计约 1186 万、1800 万至 2375 万美元；总口径最高约 2400 万美元\n\n## 证据边界\n现有公开资料已确认事件基本事实；完整地址角色、技术根因或后续处置仍有未公开部分。\n\n## 处置状态\nOstium 暂停交易；大部分赃款已换成 ETH 并混入 Tornado Cash，剩余部分跨回 Ethereum 分散。", "tw": "## 事件背景\nOstium 是 Arbitrum 上的 RWA 永續（黃金/原油/股指/外匯等），OLP 金庫用 USDC 做流動性。價格依賴鏈下報價 + 鏈上授權預言機報告（PriceUpKeep 轉發器等自動化組件）。關鍵缺陷：\n\n1. 攻擊者拿到預言機簽名者密鑰或濫用已註冊的 PriceUpKeep 轉發權限；\n2. 協議校驗「簽名是否有效、轉發器是否註冊」，但沒有有效約束：報告時間戳不得為未來、價格偏離外部源的硬限制、單筆/短時異常盈利熔斷；\n3. 於是攻擊者提交未來日期 + 被操縱價格的「合法簽名報告」；\n4. 再在高槓杆（公開稱可達約 100x）下開平倉循環，製造賬面上的交易盈利，從 OLP 金庫結算出鉅額 USDC。\n\n這不是普通用戶倉位被強平，而是預言機信任根被攻破後的金庫會計操縱。因統計批次不同，公開金額包括約 1,186 萬、1,800 萬、2,375 萬及約 2,400 萬美元；這些數字應分別理解，不能相加。\n\n## 事件經過\n1. 注資：攻擊者從 ChangeNOW、Bybit 等獲得初始 ETH，跨入 Arbitrum。\n2. 濫用報價路徑：通過已註冊 PriceUpKeep 轉發器提交帶有效簽名、但價格與時間被操縱的 oracle report。\n3. 虛假盈利循環：在被操縱價格下高槓杆開平倉，觸發 OLP 向攻擊者支付「盈利」。\n4. 抽水：OLP 被抽走約 1,186 萬—2,375 萬+ USDC（Blockaid/媒體初值多寫約 1800 萬；後續跟蹤可到約 2400 萬）。\n5. 換 ETH：USDC 兌成約 12,084—12,085 ETH。\n6. 清洗：大部分 ETH 進 Tornado Cash；部分跨回 Ethereum 分散到多個下游地址。\n7. 項目：暫停全部交易並調查；Blockaid 披露關鍵 Tx 0x359f8c05...。\n\n## 資金流向\n5. 換 ETH：USDC 兌成約 12,084—12,085 ETH。\n6. 清洗：大部分 ETH 進 Tornado Cash；部分跨回 Ethereum 分散到多個下游地址。\n\n## 金額口徑\n不同批次統計約 1186 萬、1800 萬至 2375 萬美元；總口徑最高約 2400 萬美元\n\n## 證據邊界\n現有公開資料已確認事件基本事實；完整地址角色、技術根因或後續處置仍有未公開部分。\n\n## 處置狀態\nOstium 暫停交易；大部分贓款已換成 ETH 並混入 Tornado Cash，剩餘部分跨回 Ethereum 分散。", "en": "## Incident background\nOstium offers leveraged markets for real-world-asset references such as gold, crude oil, equity indexes, and foreign exchange on Arbitrum. Its OLP vault supplies USDC liquidity. Pricing relied on off-chain quotes submitted through authorized on-chain components such as PriceUpKeep forwarders.\n\nPublic technical analysis described a compromise or abuse of oracle-signing authority. The protocol validated the signature and registered forwarder but lacked effective safeguards against future-dated reports, extreme deviation from external prices, and abnormal short-term profit. An attacker could therefore submit a correctly signed report containing manipulated timing and prices, open and close highly leveraged positions, and settle artificial gains from the OLP vault.\n\n## Incident sequence\n1. Initial ETH reached the attacker through sources including ChangeNOW and Bybit before moving to Arbitrum.\n2. Registered PriceUpKeep forwarding paths submitted validly signed but manipulated price and timestamp data.\n3. The attacker opened and closed highly leveraged positions against the false prices, causing OLP to recognize artificial trading gains.\n4. Public estimates of USDC withdrawn ranged from approximately $11.86 million to more than $23.75 million; earlier reports also cited about $18 million and later tracking approached $24 million.\n5. The withdrawn USDC was exchanged for approximately 12,084 to 12,085 ETH.\n6. Most ETH entered Tornado Cash, while the remainder crossed back to Ethereum and was dispersed.\n7. Ostium suspended trading and investigated. Blockaid published a principal transaction beginning 0x359f8c05.\n\n## Fund flow\nUSDC left the OLP vault through artificial trading-profit settlements, was converted into approximately 12,084 to 12,085 ETH, and largely entered Tornado Cash. A smaller portion moved across Ethereum addresses.\n\n## Amount basis\nThe archive records $23.75 million. Lower and higher public figures reflect different observation times or transaction batches and are not added together.\n\n## Evidence boundary\nThe manipulated oracle-report path, OLP withdrawals, ETH conversion, and mixer use are publicly reported. Public sources did not establish whether the signer key itself was stolen or another authorized forwarding path was abused.\n\n## Current status\nOstium suspended trading. Most reported proceeds were converted to ETH and deposited into Tornado Cash, with the remainder dispersed on Ethereum." }, "category": "oracle-manipulation", "severity": "critical", "ecosystems": [ "Ethereum", "Arbitrum" ], "chains": [ "Ethereum", "Arbitrum" ], "lossUsd": 23750000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "不同批次统计约 1186 万、1800 万至 2375 万美元；总口径最高约 2400 万美元", "tw": "不同批次統計約 1186 萬、1800 萬至 2375 萬美元；總口徑最高約 2400 萬美元", "en": "Reported loss: $23,750,000" }, "addressDisclosure": "published", "addresses": [ { "chain": "Arbitrum", "address": "0x321df194646029e7a6193ea05573d4b9c398bfd9", "entity": { "zh": "[链：Arbitrum] [黑客主地址] [被盗 USDC 归集] [兑换 ETH]", "tw": "[鏈：Arbitrum] [黑客主地址] [被盜 USDC 歸集] [兌換 ETH]", "en": "attacker address documented by a public source" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/CyversAlerts/status/2077411437782114541", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Arbitrum] [黑客主地址] [被盗 USDC 归集] [兑换 ETH]", "tw": "[鏈：Arbitrum] [黑客主地址] [被盜 USDC 歸集] [兌換 ETH]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Arbitrum", "address": "0xd1794196f0fc99c7f27970e661597d77d9a85869", "entity": { "zh": "[链：Arbitrum] [攻击者 EOA] [攻击交易发起]", "tw": "[鏈：Arbitrum] [攻擊者 EOA] [攻擊交易發起]", "en": "attacker address documented by a public source" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/CyversAlerts/status/2077411437782114541", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Arbitrum] [攻击者 EOA] [攻击交易发起]", "tw": "[鏈：Arbitrum] [攻擊者 EOA] [攻擊交易發起]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Arbitrum", "address": "0xfe12f6360000de49d5506d52ee5ac4bc9dd5bd2e", "entity": { "zh": "[链：Arbitrum] [黑客合约] [交易执行代理]", "tw": "[鏈：Arbitrum] [黑客合約] [交易執行代理]", "en": "contract address documented by a public source" }, "role": "contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/CyversAlerts/status/2077411437782114541", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Arbitrum] [黑客合约] [交易执行代理]", "tw": "[鏈：Arbitrum] [黑客合約] [交易執行代理]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x5209536357034c39E172161501761681aE170873", "entity": { "zh": "[链：Ethereum] [跨链桥出口] [下游分散]", "tw": "[鏈：Ethereum] [跨鏈橋出口] [下游分散]", "en": "bridge address documented by a public source" }, "role": "bridge", "category": "bridge", "confidence": 0.9, "sourceUrl": "https://x.com/CyversAlerts/status/2077411437782114541", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [跨链桥出口] [下游分散]", "tw": "[鏈：Ethereum] [跨鏈橋出口] [下游分散]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xe494eed9200385a39dc4038438171051984f518f", "entity": { "zh": "[链：Ethereum] [跨链桥出口] [下游分散]", "tw": "[鏈：Ethereum] [跨鏈橋出口] [下游分散]", "en": "bridge address documented by a public source" }, "role": "bridge", "category": "bridge", "confidence": 0.9, "sourceUrl": "https://x.com/CyversAlerts/status/2077411437782114541", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [跨链桥出口] [下游分散]", "tw": "[鏈：Ethereum] [跨鏈橋出口] [下游分散]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x3147a355D55755a30e0f2b86b15429ba1f5E191f", "entity": { "zh": "[链：Ethereum] [跨链桥出口] [下游分散]", "tw": "[鏈：Ethereum] [跨鏈橋出口] [下游分散]", "en": "bridge address documented by a public source" }, "role": "bridge", "category": "bridge", "confidence": 0.9, "sourceUrl": "https://x.com/CyversAlerts/status/2077411437782114541", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [跨链桥出口] [下游分散]", "tw": "[鏈：Ethereum] [跨鏈橋出口] [下游分散]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "Cyvers 资金路径", "tw": "Cyvers 資金路徑", "en": "x.com source" }, "url": "https://x.com/CyversAlerts/status/2077411437782114541", "type": "research" }, { "label": { "zh": "SlowMist 根因", "tw": "SlowMist 根因", "en": "x.com source" }, "url": "https://x.com/SlowMist_Team/status/2077421399292166157", "type": "research" }, { "label": { "zh": "CertiK 下游地址", "tw": "CertiK 下游地址", "en": "x.com source" }, "url": "https://x.com/CertiKAlert/status/2077613558368788526", "type": "research" }, { "label": { "zh": "Lookonchain 混币路径", "tw": "Lookonchain 混幣路徑", "en": "x.com source" }, "url": "https://x.com/lookonchain/status/2077559071159558379", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-024", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-022", "status": "verified", "incidentDate": "2026-07-15", "datePrecision": "day", "title": { "zh": "Drips Network", "tw": "Drips Network", "en": "Drips Network protocol incident" }, "summary": { "zh": "协议损失约 24,882.99 DAI；根因明确为无边界检查的有符号类型转换。", "tw": "協議損失約 24,882.99 DAI；根因明確為無邊界檢查的有符號類型轉換。", "en": "A protocol incident led to approximately $24,883 in reported losses." }, "details": { "zh": "## 事件背景\n经典有符号/无符号整数转换漏洞：\n\n- 函数 DaiDripsHub.give(address,uint128) 接受无符号 uint128 amt；\n- 内部把 amt 转成 int128 做余额加减；\n- 缺少 amt <= type(int128).max 检查；\n- 当 amt 接近 2^128 时，转换后变成负数（或极端有符号值），内部会计被破坏，攻击者可据此提取不应得的 DAI。\n\n## 事件经过\n1. 攻击者构造畸形 amt 调用 give。\n2. 类型转换溢出/绕界，内部余额逻辑失效。\n3. 攻击者提走约 24,882.99 DAI。\n4. SlowMist 给出根因说明；完整攻击者地址与 Tx 未在公开摘要齐备。\n\n## 资金流向\n公开资料未披露独立、完整的逐跳资金路径。\n\n## 金额口径\n24,882.99 DAI\n\n## 证据边界\n公开资料未提供完整地址与交易记录。\n\n## 处置状态\n协议损失约 24,882.99 DAI；根因明确为无边界检查的有符号类型转换。", "tw": "## 事件背景\n經典有符號/無符號整數轉換漏洞：\n\n- 函數 DaiDripsHub.give(address,uint128) 接受無符號 uint128 amt；\n- 內部把 amt 轉成 int128 做餘額加減；\n- 缺少 amt <= type(int128).max 檢查；\n- 當 amt 接近 2^128 時，轉換後變成負數（或極端有符號值），內部會計被破壞，攻擊者可據此提取不應得的 DAI。\n\n## 事件經過\n1. 攻擊者構造畸形 amt 調用 give。\n2. 類型轉換溢出/繞界，內部餘額邏輯失效。\n3. 攻擊者提走約 24,882.99 DAI。\n4. SlowMist 給出根因說明；完整攻擊者地址與 Tx 未在公開摘要齊備。\n\n## 資金流向\n公開資料未披露獨立、完整的逐跳資金路徑。\n\n## 金額口徑\n24,882.99 DAI\n\n## 證據邊界\n公開資料未提供完整地址與交易記錄。\n\n## 處置狀態\n協議損失約 24,882.99 DAI；根因明確為無邊界檢查的有符號類型轉換。", "en": "## Incident background\nDrips Network's DaiDripsHub.give(address,uint128) accepted an unsigned uint128 amount and converted it internally to int128 for balance arithmetic. The implementation did not require amt to be less than or equal to type(int128).max. Values near the upper uint128 range could therefore become negative or otherwise invalid after signed conversion, corrupting internal accounting and allowing unearned DAI withdrawals.\n\n## Incident sequence\n1. The attacker supplied a crafted amount to give.\n2. The missing bounds check caused an invalid signed conversion and broke the balance logic.\n3. Approximately 24,882.99 DAI was withdrawn.\n4. SlowMist published the technical cause, but public summaries did not include a complete attacker-address and transaction set.\n\n## Fund flow\nThe flawed accounting path released approximately 24,882.99 DAI. A complete downstream route was not publicly disclosed.\n\n## Amount basis\nThe incident is recorded at the reported loss of $24,883.\n\n## Evidence boundary\nThe signed-conversion weakness and loss amount are public. The complete attacker address set, transaction list, and final destination of funds remain undisclosed.\n\n## Current status\nThe loss was approximately 24,882.99 DAI. The identified root cause was the missing bound before conversion from uint128 to int128." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 24882.99, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "24,882.99 DAI", "tw": "24,882.99 DAI", "en": "Reported loss: $24,883" }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "SlowMist 技术说明", "tw": "SlowMist 技術說明", "en": "x.com source" }, "url": "https://x.com/SlowMist_Team/status/2077232524955423144", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-022", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-021", "status": "verified", "incidentDate": "2026-07-14", "datePrecision": "day", "title": { "zh": "VECAndETH", "tw": "VECAndETH", "en": "VECAndETH protocol exploit" }, "summary": { "zh": "损失约 10.96 万美元；地址角色仍需基于完整 Trace 确认。", "tw": "損失約 10.96 萬美元；地址角色仍需基於完整 Trace 確認。", "en": "A contract-level weakness was exploited for approximately $109,600." }, "details": { "zh": "## 事件背景\n公开信息指向同一原子交易内的价格操纵：通过组合 swap / 流动性操作扭曲 VEC/ETH 相关定价，使协议在错误价格下释放价值。因项目方无完整 post-mortem，具体是现货池操纵、预言机读取槽位还是内部汇率公式，保持克制，不臆造函数名。\n\n## 事件经过\n1. 7 月 14 日 09:26（北京时间）TenArmor 告警。\n2. 攻击交易在 BNB Chain 上执行，扭曲 VEC/ETH 价格并提取错误定价下的资产。\n3. 损失约 10.96 万美元。\n4. 已有完整攻击 Tx；黑客 EOA / 攻击合约角色需 Trace 后再贴标签，避免把 router 误标黑客。\n\n## 资金流向\n公开资料未披露独立、完整的逐跳资金路径。\n\n## 金额口径\n约 10.96 万美元\n\n## 证据边界\n现有公开资料未完整确认地址角色或技术根因。\n\n## 处置状态\n损失约 10.96 万美元；地址角色仍需基于完整 Trace 确认。", "tw": "## 事件背景\n公開信息指向同一原子交易內的價格操縱：通過組合 swap / 流動性操作扭曲 VEC/ETH 相關定價，使協議在錯誤價格下釋放價值。因項目方無完整 post-mortem，具體是現貨池操縱、預言機讀取槽位還是內部匯率公式，保持克制，不臆造函數名。\n\n## 事件經過\n1. 7 月 14 日 09:26（北京時間）TenArmor 告警。\n2. 攻擊交易在 BNB Chain 上執行，扭曲 VEC/ETH 價格並提取錯誤定價下的資產。\n3. 損失約 10.96 萬美元。\n4. 已有完整攻擊 Tx；黑客 EOA / 攻擊合約角色需 Trace 後再貼標籤，避免把 router 誤標黑客。\n\n## 資金流向\n公開資料未披露獨立、完整的逐跳資金路徑。\n\n## 金額口徑\n約 10.96 萬美元\n\n## 證據邊界\n現有公開資料未完整確認地址角色或技術根因。\n\n## 處置狀態\n損失約 10.96 萬美元；地址角色仍需基於完整 Trace 確認。", "en": "## Incident background\nPublic evidence indicates price manipulation within one atomic BNB Chain transaction. Combined swap and liquidity operations distorted VEC/ETH-related pricing and caused assets to be released at an incorrect value. Because no complete project post-mortem was available, the evidence did not establish whether the specific cause was spot-pool manipulation, an oracle-reading window, or an internal exchange-rate formula.\n\n## Incident sequence\n1. TenArmor issued an alert at 09:26 Beijing time on July 14.\n2. The attack transaction distorted VEC/ETH pricing and extracted mispriced assets on BNB Chain.\n3. The reported loss was approximately $109,600.\n4. The transaction was published, but the separate roles of the attacker EOA and attack contract still required attribution; router infrastructure is not treated as an attacker by default.\n\n## Fund flow\nThe atomic transaction extracted value through the manipulated VEC/ETH pricing path. Public sources did not disclose a complete downstream route.\n\n## Amount basis\nThe incident is recorded at the reported loss of $109,600.\n\n## Evidence boundary\nThe transaction, pricing anomaly, and loss estimate are public. The exact vulnerable function, attacker-address roles, and final destination remain unconfirmed.\n\n## Current status\nThe reported loss was approximately $109,600. Technical root-cause and address-role review remained incomplete." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "BNB Chain" ], "chains": [ "BNB Chain" ], "lossUsd": 109600, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 10.96 万美元", "tw": "約 10.96 萬美元", "en": "Reported loss: $109,600" }, "addressDisclosure": "published", "addresses": [ { "chain": "BNB Chain", "address": "0x39B3D12f8C4e9644f8A9Eba9c07Ca37DF9eCF27c", "entity": { "zh": "[链：BNB Chain / BSC] [黑客地址] [攻击者 EOA/合约] [From=To 自调用] [被盗资产接收]", "tw": "[鏈：BNB Chain / BSC] [黑客地址] [攻擊者 EOA/合約] [From=To 自調用] [被盜資產接收]", "en": "contract address documented by a public source" }, "role": "contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://bscscan.com/tx/0xe1f1e3e0706aa995b47a8ba1d310526e14f4db6ad78277853fa10932236eeb72", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain / BSC] [黑客地址] [攻击者 EOA/合约] [From=To 自调用] [被盗资产接收]", "tw": "[鏈：BNB Chain / BSC] [黑客地址] [攻擊者 EOA/合約] [From=To 自調用] [被盜資產接收]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xdD48A20Bf08500416f246F3a7899e916e8f03075", "entity": { "zh": "[链：BNB Chain / BSC] [委托执行地址 EIP-7702 Delegated] [攻击执行路径]", "tw": "[鏈：BNB Chain / BSC] [委託執行地址 EIP-7702 Delegated] [攻擊執行路徑]", "en": "other address documented by a public source" }, "role": "other", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://bscscan.com/tx/0xe1f1e3e0706aa995b47a8ba1d310526e14f4db6ad78277853fa10932236eeb72", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain / BSC] [委托执行地址 EIP-7702 Delegated] [攻击执行路径]", "tw": "[鏈：BNB Chain / BSC] [委託執行地址 EIP-7702 Delegated] [攻擊執行路徑]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "BscScan", "tw": "BscScan", "en": "bscscan.com source" }, "url": "https://bscscan.com/tx/0xe1f1e3e0706aa995b47a8ba1d310526e14f4db6ad78277853fa10932236eeb72", "type": "research" }, { "label": { "zh": "TenArmor 原帖", "tw": "TenArmor 原帖", "en": "x.com source" }, "url": "https://x.com/TenArmorAlert/status/2076840799535542500", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-021", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-020", "status": "verified", "incidentDate": "2026-07-13", "datePrecision": "day", "title": { "zh": "Lumi Finance 智能账户授权漏洞", "tw": "Lumi Finance 智能賬戶授權漏洞", "en": "Lumi Finance smart-account authorization flaw" }, "summary": { "zh": "约 26.4 万美元被盗；项目需把验证逻辑改为无状态副作用并撤销风险授权。", "tw": "約 26.4 萬美元被盜；項目需把驗證邏輯改為無狀態副作用並撤銷風險授權。", "en": "An authorization weakness affecting smart accounts enabled approximately $270,000 in unauthorized asset transfers." }, "details": { "zh": "## 事件背景\nLumi Finance 使用 ERC-4337 账户抽象（Sodium 智能账户）。漏洞出在 validateUserOp / _validateSignature 路径：\n\n1. 验证 UserOperation 时允许执行带状态副作用的逻辑（例如 ERC-20 approve）；\n2. 攻击者可把自身地址作为 signer 参数传入；ECDSA.tryRecover 失败时不 revert，反而走到攻击合约的 isValidSignature，使验证「通过」；\n3. 攻击者控制的 Paymaster / spender 在验证阶段批量拿到多个智能账户的 token allowance；\n4. 用户从未在 UI 上确认「转走资产」，只是账户校验逻辑被滥用 → 随后 transferFrom 抽干授权额度。\n\n根因一句话：验证阶段必须无副作用（stateless validation），却被做成了可写授权的后门。\n\n## 事件经过\n1. Blockaid 等监测到 Lumi 相关异常转出（约 7 月 13 日）。\n2. 攻击者构造恶意 UserOperation，在 validate 阶段对大量智能账户执行 Approve。\n3. 随即用拿到的 allowance 转出 USDC 等资产，合计约 26.4 万—27 万美元。\n4. SlowMist 公开技术根因；完整攻击者/受害者地址列表未在摘要中全部给出。\n5. 修复方向：验证改无副作用、撤销风险授权、升级账户实现。\n\n## 资金流向\n1. Blockaid 等监测到 Lumi 相关异常转出（约 7 月 13 日）。\n3. 随即用拿到的 allowance 转出 USDC 等资产，合计约 26.4 万—27 万美元。\n\n## 金额口径\n约 26.4 万—27 万美元（媒体/SlowMist 多写约 27 万；原稿 26.4 万为并行口径）\n\n## 证据边界\n公开资料未提供完整地址与交易记录。\n\n## 处置状态\n约 26.4 万美元被盗；项目需把验证逻辑改为无状态副作用并撤销风险授权。", "tw": "## 事件背景\nLumi Finance 使用 ERC-4337 賬戶抽象（Sodium 智能賬戶）。漏洞出在 validateUserOp / _validateSignature 路徑：\n\n1. 驗證 UserOperation 時允許執行帶狀態副作用的邏輯（例如 ERC-20 approve）；\n2. 攻擊者可把自身地址作為 signer 參數傳入；ECDSA.tryRecover 失敗時不 revert，反而走到攻擊合約的 isValidSignature，使驗證「通過」；\n3. 攻擊者控制的 Paymaster / spender 在驗證階段批量拿到多個智能賬戶的 token allowance；\n4. 用戶從未在 UI 上確認「轉走資產」，只是賬戶校驗邏輯被濫用 → 隨後 transferFrom 抽乾授權額度。\n\n根因一句話：驗證階段必須無副作用（stateless validation），卻被做成了可寫授權的後門。\n\n## 事件經過\n1. Blockaid 等監測到 Lumi 相關異常轉出（約 7 月 13 日）。\n2. 攻擊者構造惡意 UserOperation，在 validate 階段對大量智能賬戶執行 Approve。\n3. 隨即用拿到的 allowance 轉出 USDC 等資產，合計約 26.4 萬—27 萬美元。\n4. SlowMist 公開技術根因；完整攻擊者/受害者地址列表未在摘要中全部給出。\n5. 修復方向：驗證改無副作用、撤銷風險授權、升級賬戶實現。\n\n## 資金流向\n1. Blockaid 等監測到 Lumi 相關異常轉出（約 7 月 13 日）。\n3. 隨即用拿到的 allowance 轉出 USDC 等資產，合計約 26.4 萬—27 萬美元。\n\n## 金額口徑\n約 26.4 萬—27 萬美元（媒體/SlowMist 多寫約 27 萬；原稿 26.4 萬為並行口徑）\n\n## 證據邊界\n公開資料未提供完整地址與交易記錄。\n\n## 處置狀態\n約 26.4 萬美元被盜；項目需把驗證邏輯改為無狀態副作用並撤銷風險授權。", "en": "## Incident background\nLumi Finance used ERC-4337 account abstraction through Sodium Smart Accounts. The weakness was in the validateUserOp and _validateSignature path:\n\n1. Validation could execute logic with state-changing side effects, including ERC-20 approvals;\n2. An attacker could supply an attacker-controlled signer parameter. If ECDSA.tryRecover failed, the code did not revert and instead called isValidSignature on the attack contract;\n3. The attacker-controlled paymaster or spender could obtain token allowances from multiple smart accounts during validation;\n4. Users did not approve an asset transfer in the interface, yet the attacker could later use transferFrom against the allowance.\n\nThe core failure was allowing writable authorization changes during a validation phase that should have been free of side effects.\n\n## Incident sequence\n1. Blockaid and other monitors detected abnormal Lumi-related transfers around July 13.\n2. The attacker submitted malicious UserOperations that executed approvals across multiple smart accounts during validation.\n3. The resulting allowances were used immediately to transfer assets including USDC, with public estimates ranging from approximately $264,000 to $270,000.\n4. SlowMist published the technical cause; public summaries did not provide a complete victim and attacker address list.\n5. Remediation required side-effect-free validation, revocation of exposed allowances, and an upgraded account implementation.\n\n## Fund flow\nMalicious UserOperations created allowances during validation, after which the attacker used transferFrom to withdraw assets from affected smart accounts.\n\n## Amount basis\nThe archive records $270,000, the upper end of the publicly reported range.\n\n## Evidence boundary\nThe validation weakness and amount range are public. The complete set of affected accounts, attacker addresses, and downstream recipients was not disclosed.\n\n## Current status\nApproximately $264,000 to $270,000 was reported stolen. Remediation centered on stateless validation, allowance revocation, and account-implementation upgrades." }, "category": "wallet-vulnerability", "severity": "high", "ecosystems": [ "Arbitrum" ], "chains": [ "Arbitrum" ], "lossUsd": 270000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 26.4 万—27 万美元（媒体/SlowMist 多写约 27 万；原稿 26.4 万为并行口径）", "tw": "約 26.4 萬—27 萬美元（媒體/SlowMist 多寫約 27 萬；原稿 26.4 萬為並行口徑）", "en": "Reported loss: $270,000" }, "addressDisclosure": "published", "addresses": [ { "chain": "Arbitrum", "address": "0xCe1a3BB0b98D0D90C7Dd0620Ab86C9A771888d88", "entity": { "zh": "[链：Arbitrum] [黑客地址] [攻击者 EOA]", "tw": "[鏈：Arbitrum] [黑客地址] [攻擊者 EOA]", "en": "attacker address documented by a public source" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/SlowMist_Team/status/2076669154036527314", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Arbitrum] [黑客地址] [攻击者 EOA]", "tw": "[鏈：Arbitrum] [黑客地址] [攻擊者 EOA]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Arbitrum", "address": "0x56362412AE17cac443AAFBAb4289946Ad958E8a1", "entity": { "zh": "[链：Arbitrum] [黑客合约] [恶意 Paymaster/Spender/ERC-1271 签名者]", "tw": "[鏈：Arbitrum] [黑客合約] [惡意 Paymaster/Spender/ERC-1271 簽名者]", "en": "contract address documented by a public source" }, "role": "contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/SlowMist_Team/status/2076669154036527314", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Arbitrum] [黑客合约] [恶意 Paymaster/Spender/ERC-1271 签名者]", "tw": "[鏈：Arbitrum] [黑客合約] [惡意 Paymaster/Spender/ERC-1271 簽名者]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Arbitrum", "address": "0xb5BC46dF04dEe31D219E7664122e29EEd9506b8b", "entity": { "zh": "[链：Arbitrum] [受影响合约] [Sodium 实现]", "tw": "[鏈：Arbitrum] [受影響合約] [Sodium 實現]", "en": "contract address documented by a public source" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/SlowMist_Team/status/2076669154036527314", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Arbitrum] [受影响合约] [Sodium 实现]", "tw": "[鏈：Arbitrum] [受影響合約] [Sodium 實現]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Arbitrum", "address": "0x5FF137D4b0FDCD49DcA30c7CF57E578a026d2789", "entity": { "zh": "[链：Arbitrum] [ERC-4337 EntryPoint v0.6]", "tw": "[鏈：Arbitrum] [ERC-4337 EntryPoint v0.6]", "en": "other address documented by a public source" }, "role": "other", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/SlowMist_Team/status/2076669154036527314", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Arbitrum] [ERC-4337 EntryPoint v0.6]", "tw": "[鏈：Arbitrum] [ERC-4337 EntryPoint v0.6]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "SlowMist 根因", "tw": "SlowMist 根因", "en": "x.com source" }, "url": "https://x.com/SlowMist_Team/status/2076669154036527314", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-020", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-048", "status": "verified", "incidentDate": "2026-07-12", "datePrecision": "day", "title": { "zh": "PHX（BSC）Pancake LP 被抽", "tw": "PHX（BSC）Pancake LP 被抽", "en": "PHX Pancake LP drain on BNB Chain" }, "summary": { "zh": "LP 侧约 156.21 WBNB（~$89.6K）被抽；典型小市值土狗单笔风险。 地址与 Tx 已按 BscScan / TenArmor / 技术复盘入正式账本。", "tw": "LP 側約 156.21 WBNB（~$89.6K）被抽；典型小市值土狗單筆風險。 地址與 Tx 已按 BscScan / TenArmor / 技術復盤入正式賬本。", "en": "Liquidity was removed from a PHX Pancake pool, causing approximately $89,600 in reported losses." }, "details": { "zh": "## 事件背景\nPHX 为低市值、上线不久的 BSC 代币，在 PancakeSwap V2 与 WBNB 组池。代币自定义 fee-on-transfer / burn 逻辑在错误时序调用 pair 的 sync，使池子记账 reserve 与真实余额脱节。攻击者用 Lista DAO Moolah 等闪电贷放大操纵，在同一笔交易内把失步后的 WBNB 抽走并偿还贷款，净利约 156.2056833669 WBNB（TenArmor 约 $89.6K）。根因在代币合约，而非 Pancake 本体被黑。\n\n## 事件经过\n1. TenArmorAlert 监测到 PHX 相关可疑攻击 Tx，损失约 $89.6K。\n2. 攻击部署合约栈（交易内 Create + 执行器）；先借入流动性，把资金打入 PHX-WBNB 池并配合 fee/burn 路径扭曲余额。\n3. burn → sync 错误顺序导致一侧 reserve 与真实余额失步，下一笔 swap 按错误定价吐出 WBNB。\n4. 攻击者 EOA 归集利润、偿还闪电贷，攻击在单笔 Tx 内结束。\n5. 与 6 月底 AIDC、OLPC/LABUBU 及本月 VECAndETH/FCOW/CRC/RWT 等同属 BSC 自定义税费/burn × AMM 攻击簇。\n\n## 资金流向\n4. 攻击者 EOA 归集利润、偿还闪电贷，攻击在单笔 Tx 内结束。\n\n## 金额口径\n约 156.2056833669 WBNB；TenArmor 估值约 8.96 万美元（~$89.6K）\n\n## 证据边界\n现有公开资料已确认事件基本事实；完整地址角色、技术根因或后续处置仍有未公开部分。\n\n## 处置状态\n- LP 侧约 156.21 WBNB（~$89.6K）被抽；典型小市值土狗单笔风险。\n- 地址与 Tx 已按 BscScan / TenArmor / 技术复盘纳入已核验地址记录。", "tw": "## 事件背景\nPHX 為低市值、上線不久的 BSC 代幣，在 PancakeSwap V2 與 WBNB 組池。代幣自定義 fee-on-transfer / burn 邏輯在錯誤時序調用 pair 的 sync，使池子記賬 reserve 與真實餘額脫節。攻擊者用 Lista DAO Moolah 等閃電貸放大操縱，在同一筆交易內把失步後的 WBNB 抽走並償還貸款，淨利約 156.2056833669 WBNB（TenArmor 約 $89.6K）。根因在代幣合約，而非 Pancake 本體被黑。\n\n## 事件經過\n1. TenArmorAlert 監測到 PHX 相關可疑攻擊 Tx，損失約 $89.6K。\n2. 攻擊部署合約棧（交易內 Create + 執行器）；先借入流動性，把資金打入 PHX-WBNB 池並配合 fee/burn 路徑扭曲餘額。\n3. burn → sync 錯誤順序導致一側 reserve 與真實餘額失步，下一筆 swap 按錯誤定價吐出 WBNB。\n4. 攻擊者 EOA 歸集利潤、償還閃電貸，攻擊在單筆 Tx 內結束。\n5. 與 6 月底 AIDC、OLPC/LABUBU 及本月 VECAndETH/FCOW/CRC/RWT 等同屬 BSC 自定義稅費/burn × AMM 攻擊簇。\n\n## 資金流向\n4. 攻擊者 EOA 歸集利潤、償還閃電貸，攻擊在單筆 Tx 內結束。\n\n## 金額口徑\n約 156.2056833669 WBNB；TenArmor 估值約 8.96 萬美元（~$89.6K）\n\n## 證據邊界\n現有公開資料已確認事件基本事實；完整地址角色、技術根因或後續處置仍有未公開部分。\n\n## 處置狀態\n- LP 側約 156.21 WBNB（~$89.6K）被抽；典型小市值土狗單筆風險。\n- 地址與 Tx 已按 BscScan / TenArmor / 技術復盤納入已核驗地址記錄。", "en": "## Incident background\nPHX was a recently launched, low-market-cap BNB Chain token paired with WBNB in PancakeSwap V2. Its custom fee-on-transfer and burn logic called the pair's sync function at an unsafe point, causing the recorded reserve to diverge from the actual balance. The attacker used flash liquidity, including Lista DAO Moolah, to amplify the imbalance. In one transaction, the attacker withdrew the mispriced WBNB, repaid the loan, and realized approximately 156.2056833669 WBNB, reported by TenArmor at about $89,600.\n\nThe vulnerable logic was in the PHX token contract, not PancakeSwap itself.\n\n## Incident sequence\n1. TenArmor reported a suspicious PHX transaction and an estimated $89,600 loss.\n2. An attacker-controlled deployment and executor borrowed liquidity, entered the PHX-WBNB pool, and distorted balances through the fee and burn path.\n3. The burn-before-sync sequence caused recorded reserves to diverge from actual balances, allowing the next swap to release WBNB at an incorrect price.\n4. The attacker EOA consolidated proceeds and repaid the flash loan within the same transaction.\n5. The mechanism resembled other BNB Chain custom tax or burn interactions with AMMs, including AIDC, OLPC or LABUBU, and later VECAndETH, FCOW, CRC, and RWT incidents.\n\n## Fund flow\nWBNB left the PHX liquidity pool, moved to the attacker-controlled execution path, and funded repayment of the flash loan; the remainder became the attacker's profit.\n\n## Amount basis\nThe reported profit was approximately 156.21 WBNB, valued at about $89,600.\n\n## Evidence boundary\nThe transaction, attacker-controlled execution path, token-level reserve desynchronization, and amount are publicly supported. The PancakeSwap pool and router are infrastructure, not evidence that PancakeSwap was compromised.\n\n## Current status\nApproximately 156.21 WBNB was extracted from the liquidity pool. The attacker address and transaction were published through BscScan, TenArmor, and technical analysis." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "BNB Chain" ], "chains": [ "BNB Chain" ], "lossUsd": 89600, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 156.2056833669 WBNB；TenArmor 估值约 8.96 万美元（~$89.6K）", "tw": "約 156.2056833669 WBNB；TenArmor 估值約 8.96 萬美元（~$89.6K）", "en": "Reported loss: $89,600" }, "addressDisclosure": "published", "addresses": [ { "chain": "BNB Chain", "address": "0xf61FF6CD361561aC0274a7d3D197C79310bDEE61", "entity": { "zh": "[链：BNB Chain] [黑客地址] [攻击者 EOA] [资金归集]", "tw": "[鏈：BNB Chain] [黑客地址] [攻擊者 EOA] [資金歸集]", "en": "attacker address documented by a public source" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/TenArmorAlert/status/2076475785322635586", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [黑客地址] [攻击者 EOA] [资金归集]", "tw": "[鏈：BNB Chain] [黑客地址] [攻擊者 EOA] [資金歸集]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x843d8c184355d53f68ecdd1114d1327f3be08d6d", "entity": { "zh": "[链：BNB Chain] [黑客合约] [交易内 Create]", "tw": "[鏈：BNB Chain] [黑客合約] [交易內 Create]", "en": "contract address documented by a public source" }, "role": "contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/TenArmorAlert/status/2076475785322635586", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [黑客合约] [交易内 Create]", "tw": "[鏈：BNB Chain] [黑客合約] [交易內 Create]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x8d161cb068a576b53f5be6f9f024b9c489e005f8", "entity": { "zh": "[链：BNB Chain] [黑客合约] [攻击执行器]", "tw": "[鏈：BNB Chain] [黑客合約] [攻擊執行器]", "en": "contract address documented by a public source" }, "role": "contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/TenArmorAlert/status/2076475785322635586", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [黑客合约] [攻击执行器]", "tw": "[鏈：BNB Chain] [黑客合約] [攻擊執行器]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x2540cdc3317aa614178c29e2a1c7d5cdcebba481", "entity": { "zh": "[链：BNB Chain] [代币合约] [PHX Token]（不是黑客）", "tw": "[鏈：BNB Chain] [代幣合約] [PHX Token]（不是黑客）", "en": "contract address documented by a public source" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/TenArmorAlert/status/2076475785322635586", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [代币合约] [PHX Token]（不是黑客）", "tw": "[鏈：BNB Chain] [代幣合約] [PHX Token]（不是黑客）", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x09dbd035059b954d1d9c0076bdf6f70d2efeb6cf", "entity": { "zh": "[链：BNB Chain] [交易对/LP] [PancakeSwap V2 PHX-WBNB]（不是黑客）", "tw": "[鏈：BNB Chain] [交易對/LP] [PancakeSwap V2 PHX-WBNB]（不是黑客）", "en": "attacker address documented by a public source" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/TenArmorAlert/status/2076475785322635586", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [交易对/LP] [PancakeSwap V2 PHX-WBNB]（不是黑客）", "tw": "[鏈：BNB Chain] [交易對/LP] [PancakeSwap V2 PHX-WBNB]（不是黑客）", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "TenArmor 原帖", "tw": "TenArmor 原帖", "en": "x.com source" }, "url": "https://x.com/TenArmorAlert/status/2076475785322635586", "type": "research" }, { "label": { "zh": "BscScan 攻击交易", "tw": "BscScan 攻擊交易", "en": "bscscan.com source" }, "url": "https://bscscan.com/tx/0xb5a64c9c43da7b817b2450149b55cb542697d9a676b2f8a89ec748b37f821ebe", "type": "research" }, { "label": { "zh": "技术复盘 · The Crypto Times", "tw": "技術復盤 · The Crypto Times", "en": "cryptotimes.io source" }, "url": "https://www.cryptotimes.io/2026/07/13/phx-wbnb-liquidity-pool-drained-of-nearly-90k-in-bnb-chain-exploit/", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-048", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-019", "status": "verified", "incidentDate": "2026-07-11", "datePrecision": "day", "title": { "zh": "Solana OG 个人钱包被盗", "tw": "Solana OG 個人錢包被盜", "en": "Solana OG personal wallet theft" }, "summary": { "zh": "被盗 SOL 已大体完成出售和跨链；后续是否进入混币器未获同等级证据确认。", "tw": "被盜 SOL 已大體完成出售和跨鏈；後續是否進入混幣器未獲同等級證據確認。", "en": "A long-time Solana holder lost assets estimated at about $14.2 million after a personal wallet compromise." }, "details": { "zh": "## 事件背景\n这是个人钱包被盗，不是协议 TVL 被抽干。公开监测只看到「大额 SOL 非正常转出 → 市价卖出 → 跨链」，根因在公开渠道仍属 [待核]，可能包括：\n\n1. 私钥/种子泄露（钓鱼、木马、备份泄露、假硬件钱包）；\n2. 恶意授权 / 恶意签名（Approve、恶意 program 调用）；\n3. 社会工程（假客服、假空投、远程协助）；\n4. 设备失陷后的会话劫持。\n\n在未看到受害方设备取证与完整签名日志前，不能把根因写成某一种。\n\n## 事件经过\n1. 约 181,000 SOL 从受害钱包转出至攻击者控制地址（当时约 1,420 万美元）。\n2. 攻击者在 Solana 上卖出全部 SOL，换成可跨链资产。\n3. 经跨链桥进入 Ethereum，接收地址拿到资金后继续归集。\n4. 最终兑得约 7,918 ETH。\n5. 受害者完整地址未公开；是否进入 Tornado 等混币器未获与主路径同级证据。\n\n## 资金流向\n1. 约 181,000 SOL 从受害钱包转出至攻击者控制地址（当时约 1,420 万美元）。\n2. 攻击者在 Solana 上卖出全部 SOL，换成可跨链资产。\n3. 经跨链桥进入 Ethereum，接收地址拿到资金后继续归集。\n4. 最终兑得约 7,918 ETH。\n5. 受害者完整地址未公开；是否进入 Tornado 等混币器未获与主路径同级证据。\n\n## 金额口径\n181,000 SOL，约 1420 万美元\n\n## 证据边界\n现有公开资料未完整确认地址角色或技术根因。\n\n## 处置状态\n被盗 SOL 已大体完成出售和跨链；后续是否进入混币器未获同等级证据确认。", "tw": "## 事件背景\n這是個人錢包被盜，不是協議 TVL 被抽乾。公開監測只看到「大額 SOL 非正常轉出 → 市價賣出 → 跨鏈」，根因在公開渠道仍屬 [待核]，可能包括：\n\n1. 私鑰/種子洩露（釣魚、木馬、備份洩露、假硬件錢包）；\n2. 惡意授權 / 惡意簽名（Approve、惡意 program 調用）；\n3. 社會工程（假客服、假空投、遠程協助）；\n4. 設備失陷後的會話劫持。\n\n在未看到受害方設備取證與完整簽名日誌前，不能把根因寫成某一種。\n\n## 事件經過\n1. 約 181,000 SOL 從受害錢包轉出至攻擊者控制地址（當時約 1,420 萬美元）。\n2. 攻擊者在 Solana 上賣出全部 SOL，換成可跨鏈資產。\n3. 經跨鏈橋進入 Ethereum，接收地址拿到資金後繼續歸集。\n4. 最終兌得約 7,918 ETH。\n5. 受害者完整地址未公開；是否進入 Tornado 等混幣器未獲與主路徑同級證據。\n\n## 資金流向\n1. 約 181,000 SOL 從受害錢包轉出至攻擊者控制地址（當時約 1,420 萬美元）。\n2. 攻擊者在 Solana 上賣出全部 SOL，換成可跨鏈資產。\n3. 經跨鏈橋進入 Ethereum，接收地址拿到資金後繼續歸集。\n4. 最終兌得約 7,918 ETH。\n5. 受害者完整地址未公開；是否進入 Tornado 等混幣器未獲與主路徑同級證據。\n\n## 金額口徑\n181,000 SOL，約 1420 萬美元\n\n## 證據邊界\n現有公開資料未完整確認地址角色或技術根因。\n\n## 處置狀態\n被盜 SOL 已大體完成出售和跨鏈；後續是否進入混幣器未獲同等級證據確認。", "en": "## Incident background\nThis event concerned a personal wallet, not a protocol treasury or TVL pool. Public monitoring showed a large SOL transfer, market sale, and cross-chain conversion, but did not establish the initial compromise mechanism. Possible causes included seed or private-key exposure, a malicious signature or authorization, social engineering, or device and session compromise. Without device forensics and complete signing records, no one cause can be confirmed.\n\n## Incident sequence\n1. Approximately 181,000 SOL left the victim wallet for an attacker-controlled address, valued at about $14.2 million at the time.\n2. The attacker sold the SOL on Solana and converted the proceeds into bridgeable assets.\n3. Funds crossed to Ethereum and were consolidated after arrival.\n4. The route ultimately produced approximately 7,918 ETH.\n5. The full victim address was not published, and mixer use was not confirmed to the same evidentiary standard as the principal route.\n\n## Fund flow\nApproximately 181,000 SOL moved from the victim wallet, was sold on Solana, crossed to Ethereum, and was converted into approximately 7,918 ETH.\n\n## Amount basis\nThe incident is recorded at the reported value of approximately $14.2 million.\n\n## Evidence boundary\nThe SOL quantity, approximate value, sale, bridge route, and ETH output are publicly reported. The initial compromise mechanism, complete victim address, and any later mixer route remain unconfirmed.\n\n## Current status\nThe stolen SOL was sold and bridged to Ethereum. No public evidence at the same level confirmed subsequent mixer deposits, freezing, or return." }, "category": "key-compromise", "severity": "critical", "ecosystems": [ "Ethereum", "Solana" ], "chains": [ "Ethereum", "Solana" ], "lossUsd": 14200000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "181,000 SOL，约 1420 万美元", "tw": "181,000 SOL，約 1420 萬美元", "en": "Reported loss: $14,200,000" }, "addressDisclosure": "published", "addresses": [ { "chain": "Solana", "address": "HwtbQBNnLERakdUDuCCLWmUs2oETLFQZeHUWeQdPads", "entity": { "zh": "[链：Solana] [黑客地址] [Solana 被盗资产接收] [跨链桥入口]", "tw": "[鏈：Solana] [黑客地址] [Solana 被盜資產接收] [跨鏈橋入口]", "en": "bridge address documented by a public source" }, "role": "bridge", "category": "bridge", "confidence": 0.9, "sourceUrl": "https://x.com/lookonchain/status/2075870871500308860", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Solana] [黑客地址] [Solana 被盗资产接收] [跨链桥入口]", "tw": "[鏈：Solana] [黑客地址] [Solana 被盜資產接收] [跨鏈橋入口]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xD66E7F945672381193525f0a3F34aa0789b13cD3", "entity": { "zh": "[链：Ethereum] [跨链桥出口] [Ethereum 接收]", "tw": "[鏈：Ethereum] [跨鏈橋出口] [Ethereum 接收]", "en": "bridge address documented by a public source" }, "role": "bridge", "category": "bridge", "confidence": 0.9, "sourceUrl": "https://x.com/lookonchain/status/2075870871500308860", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [跨链桥出口] [Ethereum 接收]", "tw": "[鏈：Ethereum] [跨鏈橋出口] [Ethereum 接收]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x124bc160Ef2D2eB3851683D78412e0E5c35002B1", "entity": { "zh": "[链：Ethereum] [Ethereum 资金归集]", "tw": "[鏈：Ethereum] [Ethereum 資金歸集]", "en": "other address documented by a public source" }, "role": "other", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/lookonchain/status/2075870871500308860", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [Ethereum 资金归集]", "tw": "[鏈：Ethereum] [Ethereum 資金歸集]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "Lookonchain 原帖", "tw": "Lookonchain 原帖", "en": "x.com source" }, "url": "https://x.com/lookonchain/status/2075870871500308860", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-019", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-018", "status": "verified", "incidentDate": "2026-07-11", "datePrecision": "day", "title": { "zh": "Bonzo Lend", "tw": "Bonzo Lend", "en": "Bonzo Lend oracle manipulation" }, "summary": { "zh": "约数百万美元进入 Ethereum 并混币；Hedera 核心网络未被攻破，问题位于 Bonzo 及其预言机验证路径。", "tw": "約數百萬美元進入 Ethereum 並混幣；Hedera 核心網絡未被攻破，問題位於 Bonzo 及其預言機驗證路徑。", "en": "A pricing and liquidation weakness caused approximately $9.05 million in reported losses." }, "details": { "zh": "## 事件背景\nBonzo Lend 部署在 Hedera，价格依赖第三方 Supra 预言机。BLS 验证路径存在致命实现错误：错误接受 [0,0] 零签名与零公钥作为「有效」聚合签名。于是攻击者可以：\n\n1. 构造伪造的 SAUCE / wHBAR 价格报告；\n2. 让 Oracle Adapter 写入极端价格；\n3. 在借贷协议中把几乎无价值的抵押品显示成巨额抵押，从而借出真实的 USDC、WHBAR 等资产。\n\n这是预言机验证逻辑漏洞，不是 Hedera L1 共识被攻破。官方与安全公司均强调问题位于 Bonzo 及其预言机适配/验证路径。\n\n## 事件经过\n1. 攻击者在 Hedera 上准备账户（含 0.0.10633526 — [链：Hedera] 等）并触发伪造价格写入。\n2. 以少量 SAUCE 等资产通过扭曲后的价格「包装」成巨额抵押。\n3. 借出约 905 万美元量级的 USDC / WHBAR 等。\n4. 经 SaucerSwap 换币，降低持仓集中度。\n5. 经 LayerZero 把资金跨到 Ethereum（公开可追踪跨出约 500 万+ 美元量级；PeckShield 等亦报过约 525 万美元跨链观察口径）。\n6. 在 Ethereum 换成 ETH / WBTC；部分进入 Tornado Cash。\n7. 另有第二提款账户等角色被社区讨论（含自称白帽/退还待核地址），须单独标签，不与主黑客混为一谈。\n8. Bonzo 暂停协议并发布事件报告。\n\n## 资金流向\n5. 经 LayerZero 把资金跨到 Ethereum（公开可追踪跨出约 500 万+ 美元量级；PeckShield 等亦报过约 525 万美元跨链观察口径）。\n6. 在 Ethereum 换成 ETH / WBTC；部分进入 Tornado Cash。\n\n## 金额口径\n约 905 万美元\n\n## 证据边界\n现有公开资料已确认事件基本事实；完整地址角色、技术根因或后续处置仍有未公开部分。\n\n## 处置状态\n约数百万美元进入 Ethereum 并混币；Hedera 核心网络未被攻破，问题位于 Bonzo 及其预言机验证路径。", "tw": "## 事件背景\nBonzo Lend 部署在 Hedera，價格依賴第三方 Supra 預言機。BLS 驗證路徑存在致命實現錯誤：錯誤接受 [0,0] 零簽名與零公鑰作為「有效」聚合簽名。於是攻擊者可以：\n\n1. 構造偽造的 SAUCE / wHBAR 價格報告；\n2. 讓 Oracle Adapter 寫入極端價格；\n3. 在借貸協議中把幾乎無價值的抵押品顯示成鉅額抵押，從而借出真實的 USDC、WHBAR 等資產。\n\n這是預言機驗證邏輯漏洞，不是 Hedera L1 共識被攻破。官方與安全公司均強調問題位於 Bonzo 及其預言機適配/驗證路徑。\n\n## 事件經過\n1. 攻擊者在 Hedera 上準備賬戶（含 0.0.10633526 — [鏈：Hedera] 等）並觸發偽造價格寫入。\n2. 以少量 SAUCE 等資產通過扭曲後的價格「包裝」成鉅額抵押。\n3. 借出約 905 萬美元量級的 USDC / WHBAR 等。\n4. 經 SaucerSwap 換幣，降低持倉集中度。\n5. 經 LayerZero 把資金跨到 Ethereum（公開可追蹤跨出約 500 萬+ 美元量級；PeckShield 等亦報過約 525 萬美元跨鏈觀察口徑）。\n6. 在 Ethereum 換成 ETH / WBTC；部分進入 Tornado Cash。\n7. 另有第二提款賬戶等角色被社區討論（含自稱白帽/退還待核地址），須單獨標籤，不與主黑客混為一談。\n8. Bonzo 暫停協議併發布事件報告。\n\n## 資金流向\n5. 經 LayerZero 把資金跨到 Ethereum（公開可追蹤跨出約 500 萬+ 美元量級；PeckShield 等亦報過約 525 萬美元跨鏈觀察口徑）。\n6. 在 Ethereum 換成 ETH / WBTC；部分進入 Tornado Cash。\n\n## 金額口徑\n約 905 萬美元\n\n## 證據邊界\n現有公開資料已確認事件基本事實；完整地址角色、技術根因或後續處置仍有未公開部分。\n\n## 處置狀態\n約數百萬美元進入 Ethereum 並混幣；Hedera 核心網絡未被攻破，問題位於 Bonzo 及其預言機驗證路徑。", "en": "## Incident background\nBonzo Lend operated on Hedera and relied on the third-party Supra oracle. Its BLS verification path incorrectly accepted zero signatures and zero public keys, represented as [0,0], as valid aggregate signatures. An attacker could therefore create false SAUCE or wHBAR price reports, write extreme values through the oracle adapter, and make low-value collateral appear sufficient to borrow real USDC, WHBAR, and other assets.\n\nThe weakness was in Bonzo's oracle-verification integration, not in Hedera's L1 consensus.\n\n## Incident sequence\n1. The attacker prepared a Hedera account, including 0.0.10633526, and submitted forged price data.\n2. A small amount of SAUCE and other assets was assigned an inflated collateral value.\n3. The attacker borrowed approximately $9.05 million in USDC, WHBAR, and other assets.\n4. Assets were exchanged through SaucerSwap to reduce concentration.\n5. More than $5 million crossed to Ethereum through LayerZero; separate public estimates cited approximately $5.25 million.\n6. On Ethereum, assets were converted into ETH or WBTC, with part entering Tornado Cash.\n7. Community reporting discussed a second withdrawal account and an address described as a possible white-hat or pending-return address. Those roles remain separate from the principal attacker.\n8. Bonzo paused the protocol and published an incident report.\n\n## Fund flow\nBorrowed assets moved through SaucerSwap, then more than $5 million crossed through LayerZero to Ethereum. Part was converted into ETH or WBTC and deposited into Tornado Cash.\n\n## Amount basis\nThe reported loss was approximately $9.05 million.\n\n## Evidence boundary\nThe zero-signature verification defect, principal route, and loss amount are public. Secondary account, white-hat, and pending-return roles remain unconfirmed and are not merged with the main attacker.\n\n## Current status\nBonzo paused the protocol. Millions of dollars reached Ethereum and part entered a mixer, while Hedera's core network remained unaffected." }, "category": "oracle-manipulation", "severity": "critical", "ecosystems": [ "Ethereum", "Hedera" ], "chains": [ "Ethereum", "Hedera" ], "lossUsd": 9050000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 905 万美元", "tw": "約 905 萬美元", "en": "Reported loss: $9,050,000" }, "addressDisclosure": "published", "addresses": [ { "chain": "Hedera", "address": "0x9a4966152f6e10b33cb7a37975e8619816d6a494", "entity": { "zh": "[链：Hedera（EVM 别名）] [黑客地址] [Hedera EVM 映射] [跨链桥入口]", "tw": "[鏈：Hedera（EVM 別名）] [黑客地址] [Hedera EVM 映射] [跨鏈橋入口]", "en": "bridge address documented by a public source" }, "role": "bridge", "category": "bridge", "confidence": 0.9, "sourceUrl": "https://x.com/PeckShieldAlert/status/2075867053408629179", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Hedera（EVM 别名）] [黑客地址] [Hedera EVM 映射] [跨链桥入口]", "tw": "[鏈：Hedera（EVM 別名）] [黑客地址] [Hedera EVM 映射] [跨鏈橋入口]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xaf20D792A19fD42dCf697ceBa6100291D96dD93e", "entity": { "zh": "[链：Ethereum] [跨链桥出口] [Ethereum 被盗资产接收]", "tw": "[鏈：Ethereum] [跨鏈橋出口] [Ethereum 被盜資產接收]", "en": "bridge address documented by a public source" }, "role": "bridge", "category": "bridge", "confidence": 0.9, "sourceUrl": "https://x.com/PeckShieldAlert/status/2075867053408629179", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [跨链桥出口] [Ethereum 被盗资产接收]", "tw": "[鏈：Ethereum] [跨鏈橋出口] [Ethereum 被盜資產接收]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "PeckShield 资金路径", "tw": "PeckShield 資金路徑", "en": "x.com source" }, "url": "https://x.com/PeckShieldAlert/status/2075867053408629179", "type": "research" }, { "label": { "zh": "GoPlus 技术分析", "tw": "GoPlus 技術分析", "en": "x.com source" }, "url": "https://x.com/GoPlusSecurity/status/2076248543954911572", "type": "research" }, { "label": { "zh": "Bonzo 官方报告", "tw": "Bonzo 官方報告", "en": "bonzo.finance source" }, "url": "https://bonzo.finance/blog/bonzo-lend-incident-report-oracle-provider-exploit", "type": "official" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-018", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-023", "status": "verified", "incidentDate": "2026-07-06", "datePrecision": "day", "title": { "zh": "BarnBridge SMART Yield", "tw": "BarnBridge SMART Yield", "en": "BarnBridge SMART Yield governance attack" }, "summary": { "zh": "约 77.66 万 USDC 从历史授权用户处被转走；事件显示废弃协议和长期 Approve 仍有持续风险。用户应定期 revoke 已停运协议授权。", "tw": "約 77.66 萬 USDC 從歷史授權用戶處被轉走；事件顯示廢棄協議和長期 Approve 仍有持續風險。用戶應定期 revoke 已停運協議授權。", "en": "A malicious governance path was used to extract approximately 776,600 USDC." }, "details": { "zh": "## 事件背景\nBarnBridge 早在 SEC 和解后基本停运，但 SMART Yield 旧治理与代理升级权限仍在链上存活，且大量用户多年前的 USDC 无限/大额 Approve 从未撤销。攻击路径是「治理接管 + 旧授权收割」：\n\n1. 低活跃 DAO 中，少量 BOND 即可取得足够投票权（公开分析称购票成本可低至约数百美元量级，亦有「存入约 32 万 BOND」口径）；\n2. 恶意提案把 SmartYield/controller proxy 实现升级成攻击者合约；\n3. 新实现调用 CompoundProvider 的特权函数（如 _takeUnderlying / transferFees 一类）；\n4. 合约凭用户历史 allowance 直接 transferFrom 用户钱包 USDC——用户无需再签名。\n\nBlockaid 曾预警旧提案 #14/#15 的授权风险（USDC/DAI/USDT/GUSD/RAI）。注意：受害合约名含 CompoundProvider，不等于 Compound 协议本体被黑。\n\n## 事件经过\n1. 准备（约 7 月 5–6 日）：攻击相关地址从 Tornado Cash 等注资；购入/锁定 BOND 获取投票权（公开口径约 32 万 BOND）。\n2. 提案：提交恶意治理提案，目标为升级 controller 代理实现。\n3. 等待：度过治理期/时间参数后，于 7 月 15 日执行。\n4. 升级：proxy 指向恶意实现 0x66c6…7580。\n5. 收割：恶意逻辑调用 CompoundProvider 特权路径，对约 50–51 个仍保留 USDC 授权的用户执行 transferFrom。\n6. 归集：约 776,600 USDC 进入 0xF908…97A1。\n7. 换币：USDC 兑成约 415 ETH，再转到下游地址（分析扩展见 0x2c4c…ef16 等，具体地址角色按公开证据区分）。\n8. 注资链（AML 分析·待核）：0xdaa0…8310 等与 Tornado 注资相关，该资金联系不足以确认现实身份。\n\n## 资金流向\n1. 准备（约 7 月 5–6 日）：攻击相关地址从 Tornado Cash 等注资；购入/锁定 BOND 获取投票权（公开口径约 32 万 BOND）。\n6. 归集：约 776,600 USDC 进入 0xF908610E9174c7cd6e9dfD371e238be4511297A1 — [链：Ethereum]。\n7. 换币：USDC 兑成约 415 ETH，再转到下游地址（分析扩展见 0x2c4c1848e22006d63ebb732b61edc871af30ef16 — [链：Ethereum] 等，具体地址角色按公开证据区分）。\n8. 注资链（AML 分析·待核）：0xdaa037f99d168b552c0c61b7fb64cf7819d78310 — [链：Ethereum] 等与 Tornado 注资相关，该资金联系不足以确认现实身份。\n\n## 金额口径\n约 776,600 USDC\n\n## 证据边界\n现有公开资料已确认事件基本事实；完整地址角色、技术根因或后续处置仍有未公开部分。\n\n## 处置状态\n约 77.66 万 USDC 从历史授权用户处被转走；事件显示废弃协议和长期 Approve 仍有持续风险。用户应定期 revoke 已停运协议授权。", "tw": "## 事件背景\nBarnBridge 早在 SEC 和解後基本停運，但 SMART Yield 舊治理與代理升級權限仍在鏈上存活，且大量用戶多年前的 USDC 無限/大額 Approve 從未撤銷。攻擊路徑是「治理接管 + 舊授權收割」：\n\n1. 低活躍 DAO 中，少量 BOND 即可取得足夠投票權（公開分析稱購票成本可低至約數百美元量級，亦有「存入約 32 萬 BOND」口徑）；\n2. 惡意提案把 SmartYield/controller proxy 實現升級成攻擊者合約；\n3. 新實現調用 CompoundProvider 的特權函數（如 _takeUnderlying / transferFees 一類）；\n4. 合約憑用戶歷史 allowance 直接 transferFrom 用戶錢包 USDC——用戶無需再簽名。\n\nBlockaid 曾預警舊提案 #14/#15 的授權風險（USDC/DAI/USDT/GUSD/RAI）。注意：受害合約名含 CompoundProvider，不等於 Compound 協議本體被黑。\n\n## 事件經過\n1. 準備（約 7 月 5–6 日）：攻擊相關地址從 Tornado Cash 等注資；購入/鎖定 BOND 獲取投票權（公開口徑約 32 萬 BOND）。\n2. 提案：提交惡意治理提案，目標為升級 controller 代理實現。\n3. 等待：度過治理期/時間參數後，於 7 月 15 日執行。\n4. 升級：proxy 指向惡意實現 0x66c6…7580。\n5. 收割：惡意邏輯調用 CompoundProvider 特權路徑，對約 50–51 個仍保留 USDC 授權的用戶執行 transferFrom。\n6. 歸集：約 776,600 USDC 進入 0xF908…97A1。\n7. 換幣：USDC 兌成約 415 ETH，再轉到下游地址（分析擴展見 0x2c4c…ef16 等，具體地址角色按公開證據區分）。\n8. 注資鏈（AML 分析·待核）：0xdaa0…8310 等與 Tornado 注資相關，該資金聯繫不足以確認現實身份。\n\n## 資金流向\n1. 準備（約 7 月 5–6 日）：攻擊相關地址從 Tornado Cash 等注資；購入/鎖定 BOND 獲取投票權（公開口徑約 32 萬 BOND）。\n6. 歸集：約 776,600 USDC 進入 0xF908610E9174c7cd6e9dfD371e238be4511297A1 — [鏈：Ethereum]。\n7. 換幣：USDC 兌成約 415 ETH，再轉到下游地址（分析擴展見 0x2c4c1848e22006d63ebb732b61edc871af30ef16 — [鏈：Ethereum] 等，具體地址角色按公開證據區分）。\n8. 注資鏈（AML 分析·待核）：0xdaa037f99d168b552c0c61b7fb64cf7819d78310 — [鏈：Ethereum] 等與 Tornado 注資相關，該資金聯繫不足以確認現實身份。\n\n## 金額口徑\n約 776,600 USDC\n\n## 證據邊界\n現有公開資料已確認事件基本事實；完整地址角色、技術根因或後續處置仍有未公開部分。\n\n## 處置狀態\n約 77.66 萬 USDC 從歷史授權用戶處被轉走；事件顯示廢棄協議和長期 Approve 仍有持續風險。用戶應定期 revoke 已停運協議授權。", "en": "## Incident background\nBarnBridge was largely inactive after its SEC settlement, but SMART Yield's legacy governance and proxy-upgrade authority remained on-chain. Many users also retained old, unlimited or high-value USDC allowances. The attacker combined governance takeover with harvesting of those dormant approvals:\n\n1. Low participation allowed a relatively small BOND position to obtain sufficient voting power. Public estimates ranged from a few hundred dollars for incremental voting influence to a deposit of about 320,000 BOND;\n2. A malicious proposal upgraded the SmartYield or controller proxy to an attacker-controlled implementation;\n3. The new implementation invoked privileged CompoundProvider functions such as _takeUnderlying or transferFees;\n4. Historical allowances then enabled transferFrom calls against user wallets without new signatures.\n\nThe affected contract name included CompoundProvider, but public evidence does not show that the Compound protocol itself was compromised.\n\n## Incident sequence\n1. Around July 5 and 6, related addresses received funding through routes including Tornado Cash and acquired or locked approximately 320,000 BOND.\n2. A malicious governance proposal sought to upgrade the controller proxy implementation.\n3. After the governance and timing requirements elapsed, the proposal executed on July 15.\n4. The proxy was pointed to malicious implementation 0x66c6…7580.\n5. The malicious logic used the CompoundProvider privilege path to call transferFrom against approximately 50 to 51 users with active USDC allowances.\n6. Approximately 776,600 USDC was consolidated at 0xF908610E9174c7cd6e9dfD371e238be4511297A1.\n7. The USDC was converted into approximately 415 ETH and moved to downstream addresses, including 0x2c4c1848e22006d63ebb732b61edc871af30ef16.\n8. Address 0xdaa037f99d168b552c0c61b7fb64cf7819d78310 was publicly associated with Tornado-funded preparation, but that link does not establish a real-world identity.\n\n## Fund flow\nTornado-linked funding supported acquisition or locking of BOND, the governance upgrade enabled transfers from users with old allowances, approximately 776,600 USDC consolidated at 0xF908…97A1, and the proceeds were converted into roughly 415 ETH before further transfers.\n\n## Amount basis\nThe incident is recorded at approximately 776,600 USDC.\n\n## Evidence boundary\nThe governance proposal, malicious implementation, affected allowance holders, consolidation address, and approximate ETH conversion are publicly supported. Preparatory funding links do not prove real-world identity, and infrastructure contracts are not treated as attackers.\n\n## Current status\nApproximately 776,600 USDC was transferred from users with legacy approvals. The incident demonstrates the continuing risk of inactive protocols, low-participation governance, and long-lived token allowances." }, "category": "governance-attack", "severity": "high", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 776600, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 776,600 USDC", "tw": "約 776,600 USDC", "en": "Reported loss: $776,600" }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0xF908610E9174c7cd6e9dfD371e238be4511297A1", "entity": { "zh": "[链：Ethereum] [黑客地址] [最终资金归集]", "tw": "[鏈：Ethereum] [黑客地址] [最終資金歸集]", "en": "attacker address documented by a public source" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/Phalcon_xyz/status/2077243530280587721", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [黑客地址] [最终资金归集]", "tw": "[鏈：Ethereum] [黑客地址] [最終資金歸集]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x66c6f3b4B4b458e6d764759Ecf122484ebEf7580", "entity": { "zh": "[链：Ethereum] [黑客合约] [恶意控制器]", "tw": "[鏈：Ethereum] [黑客合約] [惡意控制器]", "en": "contract address documented by a public source" }, "role": "contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/Phalcon_xyz/status/2077243530280587721", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [黑客合约] [恶意控制器]", "tw": "[鏈：Ethereum] [黑客合約] [惡意控制器]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x4cAE362D7F227e3d306f70ce4878E245563F3069", "entity": { "zh": "[链：Ethereum] [受害地址] [被接管治理合约]", "tw": "[鏈：Ethereum] [受害地址] [被接管治理合約]", "en": "victim address documented by a public source" }, "role": "victim", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/Phalcon_xyz/status/2077243530280587721", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [受害地址] [被接管治理合约]", "tw": "[鏈：Ethereum] [受害地址] [被接管治理合約]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xdaa037f99d168b552c0c61b7fb64cf7819d78310", "entity": { "zh": "[链：Ethereum] [攻击者 EOA] [Tornado 注资相关] [分析扩展]", "tw": "[鏈：Ethereum] [攻擊者 EOA] [Tornado 注資相關] [分析擴展]", "en": "attacker address documented by a public source" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/Phalcon_xyz/status/2077243530280587721", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [攻击者 EOA] [Tornado 注资相关] [分析扩展]", "tw": "[鏈：Ethereum] [攻擊者 EOA] [Tornado 注資相關] [分析擴展]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x2c4c1848e22006d63ebb732b61edc871af30ef16", "entity": { "zh": "[链：Ethereum] [ETH 下游持仓] [分析扩展]", "tw": "[鏈：Ethereum] [ETH 下游持倉] [分析擴展]", "en": "other address documented by a public source" }, "role": "other", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/Phalcon_xyz/status/2077243530280587721", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [ETH 下游持仓] [分析扩展]", "tw": "[鏈：Ethereum] [ETH 下游持倉] [分析擴展]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "BlockSec Phalcon", "tw": "BlockSec Phalcon", "en": "x.com source" }, "url": "https://x.com/Phalcon_xyz/status/2077243530280587721", "type": "research" }, { "label": { "zh": "GoPlus 地址与过程", "tw": "GoPlus 地址與過程", "en": "x.com source" }, "url": "https://x.com/GoPlusSecurity/status/2077368561937564043", "type": "research" }, { "label": { "zh": "AML Crypto 复盘", "tw": "AML Crypto 復盤", "en": "amlcrypto.io source" }, "url": "https://amlcrypto.io/blog/barn-bridge-exploit", "type": "research" }, { "label": { "zh": "Compound 社区澄清非 Compound 本体", "tw": "Compound 社區澄清非 Compound 本體", "en": "comp.xyz source" }, "url": "https://www.comp.xyz/t/clarification-barnbridge-compoundprovider-incident-compound-protocol-is-not-affected/7961", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-023", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-015", "status": "verified", "incidentDate": "2026-07-06", "datePrecision": "day", "title": { "zh": "BONK DAO 恶意治理", "tw": "BONK DAO 惡意治理", "en": "BONK DAO malicious governance proposal" }, "summary": { "zh": "部分 BONK 进入交易所路径，大部分曾停留在攻击者控制地址；项目与交易所、Solana 基金会及执法部门合作追踪。", "tw": "部分 BONK 進入交易所路徑，大部分曾停留在攻擊者控制地址；項目與交易所、Solana 基金會及執法部門合作追蹤。", "en": "A malicious governance action created an exposure estimated at about $20 million and triggered emergency community response." }, "details": { "zh": "## 事件背景\n这不是智能合约 reentrancy 或私钥被盗，而是恶意治理（governance attack）：\n\n1. BonkDAO 金库规模远大于「凑齐法定投票门槛」的成本；\n2. 公开分析指攻击者约花费 400 万—440 万美元在二级市场/交易所买入 BONK，达到约 1% 投票门槛（亦有口径写 Bybit、Binance 等渠道吸筹约 8822.85 亿枚量级）；\n3. 社区投票率极低、又缺乏有效时间锁（timelock）/多签否决/守护模块时，攻击者可以独自通过恶意提案（公开讨论涉及 BIP-76 等）；\n4. 提案一旦执行，国库 BONK 被「合法」转出到攻击者控制的接收结构（报道称 BONK 2.0 等相关钱包），链上看起来像治理执行而非 hack opcode。\n\n## 事件经过\n1. 吸筹：7 月初攻击者在 CEX/链上买入足量 BONK 凑齐治理门槛。\n2. 提案：提交并将恶意提案推进至可执行（7 月 6 日执行，7 月 7 日集中披露）。\n3. 转出国库：约 4.426 万亿 BONK（攻击时约 2,000 万—2,130 万美元）从国库转到提案指定收款地址。\n4. 归集：资金从初始收款地址归集到主黑客钱包，再拆到二级地址。\n5. 出金尝试：部分 BONK 转向新钱包并试探 OKX / Binance / Coinbase 等充值路径；后续监测见分批转入币安等（公开监测有 3861 亿、4000 亿等批次叙述）。\n6. 响应：项目方协同交易所、Solana Foundation、执法与分析公司冻结/追踪；社区就「算不算 hack」发生治理哲学争议，但不影响资金已离库的事实。\n\n## 资金流向\n1. 吸筹：7 月初攻击者在 CEX/链上买入足量 BONK 凑齐治理门槛。\n3. 转出国库：约 4.426 万亿 BONK（攻击时约 2,000 万—2,130 万美元）从国库转到提案指定收款地址。\n4. 归集：资金从初始收款地址归集到主黑客钱包，再拆到二级地址。\n5. 出金尝试：部分 BONK 转向新钱包并试探 OKX / Binance / Coinbase 等充值路径；后续监测见分批转入币安等（公开监测有 3861 亿、4000 亿等批次叙述）。\n\n## 金额口径\n约 4.426 万亿 BONK，攻击时约 2000 万—2130 万美元\n\n## 证据边界\n现有公开资料已确认事件基本事实；完整地址角色、技术根因或后续处置仍有未公开部分。\n\n## 处置状态\n部分 BONK 进入交易所路径，大部分曾停留在攻击者控制地址；项目与交易所、Solana 基金会及执法部门合作追踪。", "tw": "## 事件背景\n這不是智能合約 reentrancy 或私鑰被盜，而是惡意治理（governance attack）：\n\n1. BonkDAO 金庫規模遠大於「湊齊法定投票門檻」的成本；\n2. 公開分析指攻擊者約花費 400 萬—440 萬美元在二級市場/交易所買入 BONK，達到約 1% 投票門檻（亦有口徑寫 Bybit、Binance 等渠道吸籌約 8822.85 億枚量級）；\n3. 社區投票率極低、又缺乏有效時間鎖（timelock）/多籤否決/守護模塊時，攻擊者可以獨自通過惡意提案（公開討論涉及 BIP-76 等）；\n4. 提案一旦執行，國庫 BONK 被「合法」轉出到攻擊者控制的接收結構（報道稱 BONK 2.0 等相關錢包），鏈上看起來像治理執行而非 hack opcode。\n\n## 事件經過\n1. 吸籌：7 月初攻擊者在 CEX/鏈上買入足量 BONK 湊齊治理門檻。\n2. 提案：提交併將惡意提案推進至可執行（7 月 6 日執行，7 月 7 日集中披露）。\n3. 轉出國庫：約 4.426 萬億 BONK（攻擊時約 2,000 萬—2,130 萬美元）從國庫轉到提案指定收款地址。\n4. 歸集：資金從初始收款地址歸集到主黑客錢包，再拆到二級地址。\n5. 出金嘗試：部分 BONK 轉向新錢包並試探 OKX / Binance / Coinbase 等充值路徑；後續監測見分批轉入幣安等（公開監測有 3861 億、4000 億等批次敘述）。\n6. 響應：項目方協同交易所、Solana Foundation、執法與分析公司凍結/追蹤；社區就「算不算 hack」發生治理哲學爭議，但不影響資金已離庫的事實。\n\n## 資金流向\n1. 吸籌：7 月初攻擊者在 CEX/鏈上買入足量 BONK 湊齊治理門檻。\n3. 轉出國庫：約 4.426 萬億 BONK（攻擊時約 2,000 萬—2,130 萬美元）從國庫轉到提案指定收款地址。\n4. 歸集：資金從初始收款地址歸集到主黑客錢包，再拆到二級地址。\n5. 出金嘗試：部分 BONK 轉向新錢包並試探 OKX / Binance / Coinbase 等充值路徑；後續監測見分批轉入幣安等（公開監測有 3861 億、4000 億等批次敘述）。\n\n## 金額口徑\n約 4.426 萬億 BONK，攻擊時約 2000 萬—2130 萬美元\n\n## 證據邊界\n現有公開資料已確認事件基本事實；完整地址角色、技術根因或後續處置仍有未公開部分。\n\n## 處置狀態\n部分 BONK 進入交易所路徑，大部分曾停留在攻擊者控制地址；項目與交易所、Solana 基金會及執法部門合作追蹤。", "en": "## Incident background\nThe BonkDAO event was a governance attack rather than reentrancy or private-key theft:\n\n1. The treasury value substantially exceeded the cost of acquiring the voting threshold;\n2. Public analysis estimated that the attacker spent approximately $4 million to $4.4 million acquiring BONK through markets and exchanges. Another estimate described accumulation of roughly 882.285 billion BONK through venues including Bybit and Binance;\n3. Low voter participation and limited timelock, multisignature-veto, or guardian protections allowed one actor to advance a malicious proposal;\n4. Once executed, the proposal transferred treasury BONK through the normal governance mechanism to attacker-controlled recipients.\n\nPublic discussion referenced BIP-76 and related proposals. The transaction looked like authorized governance execution on-chain even though the proposal was malicious.\n\n## Incident sequence\n1. In early July, the attacker acquired enough BONK through centralized exchanges and on-chain markets to meet the governance threshold.\n2. The malicious proposal advanced to execution on July 6 and was widely reported on July 7.\n3. Approximately 4.426 trillion BONK, valued at roughly $20 million to $21.3 million at the time, left the treasury for the proposal's designated recipient.\n4. Funds moved from the initial recipient to a principal attacker wallet and then to secondary addresses.\n5. Some BONK moved to new wallets and tested deposit routes associated with OKX, Binance, and Coinbase. Monitoring included later batches of approximately 386.1 billion and 400 billion BONK to Binance-linked routes.\n6. The project coordinated with exchanges, Solana Foundation, law enforcement, and analytics firms to trace and restrict the assets.\n\n## Fund flow\nThe attacker acquired voting power, executed the proposal, moved approximately 4.426 trillion BONK from the treasury to the designated recipient, consolidated it in attacker-controlled wallets, and sent portions toward exchange-deposit routes.\n\n## Amount basis\nThe archive records $20 million. Public estimates valued the 4.426 trillion BONK at approximately $20 million to $21.3 million at the time.\n\n## Evidence boundary\nThe governance execution, token amount, treasury outflow, and principal exchange-related routes are public. Exchange-path observations do not establish that every deposit was accepted or frozen.\n\n## Current status\nSome BONK reached exchange-related routes while a substantial portion remained at attacker-controlled addresses. The project and external partners continued tracing and restriction efforts." }, "category": "governance-attack", "severity": "critical", "ecosystems": [ "Solana" ], "chains": [ "Solana" ], "lossUsd": 20000000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 4.426 万亿 BONK，攻击时约 2000 万—2130 万美元", "tw": "約 4.426 萬億 BONK，攻擊時約 2000 萬—2130 萬美元", "en": "Reported loss: $20,000,000" }, "addressDisclosure": "published", "addresses": [ { "chain": "Solana", "address": "9bxWkNf3BtJ6iehq9KbX9uCWMjem4TFiPZ19T2sYJHvQ", "entity": { "zh": "[链：Solana] [恶意提案初始收款] [被盗资产接收]", "tw": "[鏈：Solana] [惡意提案初始收款] [被盜資產接收]", "en": "attacker address documented by a public source" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/CertiKAlert/status/2074295582131449903", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Solana] [恶意提案初始收款] [被盗资产接收]", "tw": "[鏈：Solana] [惡意提案初始收款] [被盜資產接收]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Solana", "address": "EXaJnmrLf7RAKLfn1hehoKX94keKYmvZm5H5zuYVeh42", "entity": { "zh": "[链：Solana] [黑客地址] [主资金归集]", "tw": "[鏈：Solana] [黑客地址] [主資金歸集]", "en": "attacker address documented by a public source" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/CertiKAlert/status/2074295582131449903", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Solana] [黑客地址] [主资金归集]", "tw": "[鏈：Solana] [黑客地址] [主資金歸集]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Solana", "address": "FhYPjrH12uLaLXFttCHgEKKFvBPoN6rztMPs2E8LWUNJ", "entity": { "zh": "[链：Solana] [二级归集] [交易所充值前置]", "tw": "[鏈：Solana] [二級歸集] [交易所充值前置]", "en": "exchange address documented by a public source" }, "role": "exchange", "category": "exchange", "confidence": 0.9, "sourceUrl": "https://x.com/CertiKAlert/status/2074295582131449903", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Solana] [二级归集] [交易所充值前置]", "tw": "[鏈：Solana] [二級歸集] [交易所充值前置]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "CertiK 初始接收地址", "tw": "CertiK 初始接收地址", "en": "x.com source" }, "url": "https://x.com/CertiKAlert/status/2074295582131449903", "type": "research" }, { "label": { "zh": "CertiK 主归集地址", "tw": "CertiK 主歸集地址", "en": "x.com source" }, "url": "https://x.com/CertiKAlert/status/2074297091724390820", "type": "research" }, { "label": { "zh": "Chainalysis 治理关系", "tw": "Chainalysis 治理關係", "en": "x.com source" }, "url": "https://x.com/chainalysis/status/2074315262485299686", "type": "research" }, { "label": { "zh": "新钱包及 Binance 流向", "tw": "新錢包及 Binance 流向", "en": "x.com source" }, "url": "https://x.com/cryptos6_bk10x/status/2077829543143031285", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-015", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-007", "status": "verified", "incidentDate": "2026-07-06", "datePrecision": "day", "title": { "zh": "Summer.fi / Lazy Summer", "tw": "Summer.fi / Lazy Summer", "en": "Summer.fi shared-accounting price manipulation" }, "summary": { "zh": "截至 7 月 8 日至少 600 ETH 进入 Tornado Cash；项目暂停并修复受影响路径。", "tw": "截至 7 月 8 日至少 600 ETH 進入 Tornado Cash；項目暫停並修復受影響路徑。", "en": "An attacker manipulated shared vault accounting and price calculations, causing approximately $6.04 million in reported losses." }, "details": { "zh": "## 事件背景\nLazy Summer / Summer.fi 的 FleetCommander 与多个金库在会计上共享或依赖可被外部扭曲的 totalAssets() / NAV 计算。攻击者预先在低流动性场所积累 vgUSDC 等份额，再结合：\n\n1. 大额闪电贷瞬间改变池子与金库资产结构；\n2. 捐赠或低流动性份额抬价，使金库 NAV/份额赎回价短期虚增（公开分析约抬高 ~9.5% 量级）；\n3. 在同一原子交易内高价赎回，把虚增 NAV 兑换成其他存款人的真实资产。\n\n与 Edel 类似，根因仍是份额会计信任了可被单笔交易操纵的余额，缺少对异常 NAV 跳动的硬熔断。\n\n## 事件经过\n1. 预持仓：攻击者此前积累低流动性 vgUSDC 等份额，为抬价做准备。\n2. 闪电贷：借入约 6,540 万美元量级闪电贷。\n3. 存入扭曲：存入约 6,480 万美元，并通过对金库/底层会计的操纵抬高 NAV。\n4. 虚高赎回：按被抬高的份额价格赎回约 7,090 万美元。\n5. 价差变现：存入与赎回差额约 600 万—604 万美元（多为 DAI 口径）即攻击利润，对应其他 LP 的损失。\n6. 离场：利润换成 DAI/ETH，并分批进入 Tornado Cash（监测至 7 月 8 日至少约 600 ETH 已混）。\n7. 项目：暂停相关金库、存款上限清零，修复受影响路径。\n\n## 资金流向\n6. 离场：利润换成 DAI/ETH，并分批进入 Tornado Cash（监测至 7 月 8 日至少约 600 ETH 已混）。\n\n## 金额口径\n约 604 万美元 DAI\n\n## 证据边界\n现有公开资料已确认事件基本事实；完整地址角色、技术根因或后续处置仍有未公开部分。\n\n## 处置状态\n截至 7 月 8 日至少 600 ETH 进入 Tornado Cash；项目暂停并修复受影响路径。", "tw": "## 事件背景\nLazy Summer / Summer.fi 的 FleetCommander 與多個金庫在會計上共享或依賴可被外部扭曲的 totalAssets() / NAV 計算。攻擊者預先在低流動性場所積累 vgUSDC 等份額，再結合：\n\n1. 大額閃電貸瞬間改變池子與金庫資產結構；\n2. 捐贈或低流動性份額抬價，使金庫 NAV/份額贖回價短期虛增（公開分析約抬高 ~9.5% 量級）；\n3. 在同一原子交易內高價贖回，把虛增 NAV 兌換成其他存款人的真實資產。\n\n與 Edel 類似，根因仍是份額會計信任了可被單筆交易操縱的餘額，缺少對異常 NAV 跳動的硬熔斷。\n\n## 事件經過\n1. 預持倉：攻擊者此前積累低流動性 vgUSDC 等份額，為抬價做準備。\n2. 閃電貸：借入約 6,540 萬美元量級閃電貸。\n3. 存入扭曲：存入約 6,480 萬美元，並通過對金庫/底層會計的操縱抬高 NAV。\n4. 虛高贖回：按被抬高的份額價格贖回約 7,090 萬美元。\n5. 價差變現：存入與贖回差額約 600 萬—604 萬美元（多為 DAI 口徑）即攻擊利潤，對應其他 LP 的損失。\n6. 離場：利潤換成 DAI/ETH，並分批進入 Tornado Cash（監測至 7 月 8 日至少約 600 ETH 已混）。\n7. 項目：暫停相關金庫、存款上限清零，修復受影響路徑。\n\n## 資金流向\n6. 離場：利潤換成 DAI/ETH，並分批進入 Tornado Cash（監測至 7 月 8 日至少約 600 ETH 已混）。\n\n## 金額口徑\n約 604 萬美元 DAI\n\n## 證據邊界\n現有公開資料已確認事件基本事實；完整地址角色、技術根因或後續處置仍有未公開部分。\n\n## 處置狀態\n截至 7 月 8 日至少 600 ETH 進入 Tornado Cash；項目暫停並修復受影響路徑。", "en": "## Incident background\nLazy Summer or Summer.fi's FleetCommander shared accounting across vaults and relied on totalAssets() and NAV values that could be distorted externally. The attacker accumulated low-liquidity shares such as vgUSDC and combined them with:\n\n1. Large flash loans that changed pool and vault balances within one transaction;\n2. Donations or price movements in low-liquidity shares that increased the vault NAV and redemption price by about 9.5%, according to public analysis;\n3. Redemption at the inflated price in the same atomic transaction, converting the accounting distortion into assets deposited by other users.\n\nAs in the Edel incident, the share-accounting design trusted balances that one transaction could manipulate and lacked an effective circuit breaker for abnormal NAV changes.\n\n## Incident sequence\n1. The attacker accumulated low-liquidity shares, including vgUSDC, before the exploit.\n2. Approximately $65.4 million was borrowed through flash loans.\n3. Roughly $64.8 million was deposited while vault or underlying accounting was manipulated to increase NAV.\n4. The attacker redeemed approximately $70.9 million at the inflated share price.\n5. The difference between deposit and redemption, approximately $6 million to $6.04 million and largely measured in DAI, represented the attack profit and corresponding LP loss.\n6. Proceeds were converted into DAI or ETH and deposited into Tornado Cash in batches; at least about 600 ETH had entered the mixer by July 8.\n7. The project paused affected vaults, reduced deposit limits to zero, and began remediation.\n\n## Fund flow\nFlash-loan funds and the attacker's pre-positioned shares were used to inflate NAV, redeem real assets, convert proceeds into DAI or ETH, and deposit at least approximately 600 ETH into Tornado Cash.\n\n## Amount basis\nThe archive records $6.04 million, the upper end of the publicly reported $6 million to $6.04 million range.\n\n## Evidence boundary\nThe flash-loan scale, manipulated NAV, redemption amount, profit range, and mixer deposits are publicly reported. The record does not combine the gross redemption value with the net loss.\n\n## Current status\nAt least approximately 600 ETH had entered Tornado Cash by July 8. The project paused the affected paths and began repairs." }, "category": "protocol-exploit", "severity": "critical", "ecosystems": [ "Ethereum", "Base" ], "chains": [ "Ethereum", "Base" ], "lossUsd": 6040000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 604 万美元 DAI", "tw": "約 604 萬美元 DAI", "en": "Reported loss: $6,040,000" }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0x7BF716167B48CF527725722C6d79494b45B3BDCa", "entity": { "zh": "[链：Ethereum] [黑客地址] [攻击者 EOA] [被盗资产接收] [混币前置]", "tw": "[鏈：Ethereum] [黑客地址] [攻擊者 EOA] [被盜資產接收] [混幣前置]", "en": "attacker address documented by a public source" }, "role": "attacker", "category": "mixer", "confidence": 0.9, "sourceUrl": "https://x.com/CertiKAlert/status/2074005902362132625", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [黑客地址] [攻击者 EOA] [被盗资产接收] [混币前置]", "tw": "[鏈：Ethereum] [黑客地址] [攻擊者 EOA] [被盜資產接收] [混幣前置]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "CertiK 攻击 Tx", "tw": "CertiK 攻擊 Tx", "en": "x.com source" }, "url": "https://x.com/CertiKAlert/status/2074005902362132625", "type": "research" }, { "label": { "zh": "Cyvers 资金来源与根因", "tw": "Cyvers 資金來源與根因", "en": "x.com source" }, "url": "https://x.com/CyversAlerts/status/2074024662619562049", "type": "research" }, { "label": { "zh": "PeckShield 后续", "tw": "PeckShield 後續", "en": "x.com source" }, "url": "https://x.com/PeckShieldAlert/status/2074743013369356433", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-007", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-046", "status": "verified", "incidentDate": "2026-07-04", "datePrecision": "day", "title": { "zh": "Gate 用户约 170 万美元账户接管争议", "tw": "Gate 用戶約 170 萬美元賬戶接管爭議", "en": "Gate user account-takeover dispute involving $1.7 million" }, "summary": { "zh": "Gate 用户报告账户被接管并损失约 170 万美元；资产已在链上拆分，平台随后道歉并协助追踪，双方对认证经过与责任仍有争议。", "tw": "Gate 用戶報告賬戶被接管並損失約 170 萬美元；資產已在鏈上拆分，平臺隨後道歉並協助追蹤，雙方對認證經過與責任仍有爭議。", "en": "A Gate user reported an account takeover and approximately $1.7 million in disputed losses; responsibility remains contested." }, "details": { "zh": "## 事件背景\n这不是 Gate 热钱包被外部黑客「打穿合约」的系统性链上漏洞，而是账户接管（Account Takeover）+ 风控/客服审核争议：\n\n1. 攻击者在约 4 天内逐步重置手机、邮箱、Google 验证器、资金密码，并添加免验证提币地址；\n2. Gate 称各步均通过短信/邮箱验证码、活体人脸、2019 年历史 C2C/支付宝类材料；\n3. 当事人逐项否认（无 iPhone 14、未做人脸、未提交手持证件视频等）；\n4. 平台已执行「安全项修改等待期 + 提现保护期」，但攻击者选择等冷静期走完再一次性大额提币——说明缺的是「连续重置 + 新设备 + 新地址 + 大额」的叠加风控，而不是完全没有冷静期；\n5. 最强解释假说（非司法结论）是身份材料泄露 + 通讯入口失守 + 深伪/摄像头注入闯活体的组合；责任归属以前台不可见的后台日志与司法结论为准。\n\n## 事件经过\n1. 07-04：新设备发起重置手机/邮箱；Gate 称活体人脸通过（当事人否认）。\n2. 07-05：解绑手机；要求提交 2019 年指定历史交易/支付宝录屏；客服执行解绑（材料来源双方冲突，争议最大节点）。\n3. 07-06：改登录密码 → 重设 Google 验证器 → 重置资金密码，当事人被逐步挤出账户控制权。\n4. 07-07：旧 Mac/passkey 登录后完成多笔提币；新地址被设为免验证；约 5 笔资产离开 Gate 热钱包。\n5. 链上第一跳：资金进入 HUB 0x3466…4133（约 49.96 ETH、746,475 HSK、156.6 万 USDT）。\n6. 第二跳：拆到下游 1 0xd435…45e7 与下游 2 0xb1EB…774e；HSK 分批 swap 成 USDT，再进入 0x789... 系列拆分。\n7. 07-08 起：当事人 @jheioff 公开；Gate 初定性「个别案例」；后转向道歉并成立专项组，称对接 Tether 等追冻。\n8. 市场：事件发酵后 Gate 约 7 日净流出约 2.07 亿美元（DeFiLlama 口径）。\n9. 第三方分析：盗款下游有触及 Newpay/新币系通道的讨论——标为 [OTC/担保通道关联待核]，非终局认定。\n10. 截至 07-20：公开层面未见大额追回/赔付实锤；后台活体原件/设备指纹/真实 IP/客服记录仍未对外完整公开。\n\n## 资金流向\n公开资料未披露独立、完整的逐跳资金路径。\n\n## 金额口径\n约 49.96 ETH + 746,475 HSK + 约 1,565,982 USDT（合计约 170 万美元量级）\n\n## 证据边界\n现有公开资料未完整确认地址角色或技术根因。\n\n## 处置状态\n用户资产已在链上拆分；平台从最初否认转向道歉并协助追款。双方对认证经过仍有冲突，后台记录未公开，责任尚无司法终局。", "tw": "## 事件背景\n這不是 Gate 熱錢包被外部黑客「打穿合約」的系統性鏈上漏洞，而是賬戶接管（Account Takeover）+ 風控/客服審核爭議：\n\n1. 攻擊者在約 4 天內逐步重置手機、郵箱、Google 驗證器、資金密碼，並添加免驗證提幣地址；\n2. Gate 稱各步均通過短信/郵箱驗證碼、活體人臉、2019 年曆史 C2C/支付寶類材料；\n3. 當事人逐項否認（無 iPhone 14、未做人臉、未提交手持證件視頻等）；\n4. 平臺已執行「安全項修改等待期 + 提現保護期」，但攻擊者選擇等冷靜期走完再一次性大額提幣——說明缺的是「連續重置 + 新設備 + 新地址 + 大額」的疊加風控，而不是完全沒有冷靜期；\n5. 最強解釋假說（非司法結論）是身份材料洩露 + 通訊入口失守 + 深偽/攝像頭注入闖活體的組合；責任歸屬以前臺不可見的後臺日誌與司法結論為準。\n\n## 事件經過\n1. 07-04：新設備發起重置手機/郵箱；Gate 稱活體人臉通過（當事人否認）。\n2. 07-05：解綁手機；要求提交 2019 年指定歷史交易/支付寶錄屏；客服執行解綁（材料來源雙方衝突，爭議最大節點）。\n3. 07-06：改登錄密碼 → 重設 Google 驗證器 → 重置資金密碼，當事人被逐步擠出賬戶控制權。\n4. 07-07：舊 Mac/passkey 登錄後完成多筆提幣；新地址被設為免驗證；約 5 筆資產離開 Gate 熱錢包。\n5. 鏈上第一跳：資金進入 HUB 0x3466…4133（約 49.96 ETH、746,475 HSK、156.6 萬 USDT）。\n6. 第二跳：拆到下游 1 0xd435…45e7 與下游 2 0xb1EB…774e；HSK 分批 swap 成 USDT，再進入 0x789... 系列拆分。\n7. 07-08 起：當事人 @jheioff 公開；Gate 初定性「個別案例」；後轉向道歉併成立專項組，稱對接 Tether 等追凍。\n8. 市場：事件發酵後 Gate 約 7 日淨流出約 2.07 億美元（DeFiLlama 口徑）。\n9. 第三方分析：盜款下游有觸及 Newpay/新幣系通道的討論——標為 [OTC/擔保通道關聯待核]，非終局認定。\n10. 截至 07-20：公開層面未見大額追回/賠付實錘；後臺活體原件/設備指紋/真實 IP/客服記錄仍未對外完整公開。\n\n## 資金流向\n公開資料未披露獨立、完整的逐跳資金路徑。\n\n## 金額口徑\n約 49.96 ETH + 746,475 HSK + 約 1,565,982 USDT（合計約 170 萬美元量級）\n\n## 證據邊界\n現有公開資料未完整確認地址角色或技術根因。\n\n## 處置狀態\n用戶資產已在鏈上拆分；平臺從最初否認轉向道歉並協助追款。雙方對認證經過仍有衝突，後臺記錄未公開，責任尚無司法終局。", "en": "## Incident background\nThe Gate dispute concerned an account takeover and the platform's identity-review and risk-control process, not a smart-contract exploit of Gate's hot wallet.\n\n1. Over approximately four days, the attacker reset the phone number, email address, Google Authenticator, and fund password and added a withdrawal address exempted from repeated verification;\n2. Gate said the changes required SMS or email codes, liveness checks, and historical 2019 C2C or Alipay evidence;\n3. The user disputed those assertions, including the device, facial-verification, and identity-video claims;\n4. Waiting and withdrawal-protection periods were applied, but the attacker waited for them to expire before making large withdrawals. The disputed control gap was the combined pattern of repeated resets, a new device, a new address, and a large amount;\n5. Possible explanations included compromised identity material, loss of communication channels, and deepfake or camera-injection attacks against liveness checks. Backend logs and any legal findings were not public.\n\n## Incident sequence\n1. On July 4, a new device initiated phone and email resets. Gate said a liveness check passed; the user denied completing it.\n2. On July 5, customer service removed the phone binding after requesting historical 2019 transaction and Alipay-screen-recording evidence. The parties disputed the origin of that evidence.\n3. On July 6, the login password, Google Authenticator, and fund password were reset, progressively excluding the user from the account.\n4. On July 7, an old Mac or passkey session was used for multiple withdrawals, and the new address was marked for reduced verification. About five asset transfers left Gate's hot wallet.\n5. The first on-chain hub was 0x3466…4133, which received approximately 49.96 ETH, 746,475 HSK, and 1.566 million USDT.\n6. Funds split toward 0xd435…45e7 and 0xb1EB…774e. HSK was converted into USDT in batches and then divided across a series of 0x789… addresses.\n7. Beginning July 8, the user @jheioff disclosed the case. Gate first described it as an isolated incident, then apologized, formed a special team, and said it would contact Tether and others about freezes.\n8. DeFiLlama data showed approximately $207 million in Gate net outflows over about seven days after the dispute became public; that market-flow figure is not the user's loss.\n9. Third-party analysis discussed a possible downstream association with Newpay or related OTC or guarantee-channel infrastructure, but did not establish a final attribution.\n10. By July 20, no large return or compensation had been publicly confirmed, and the original liveness records, device fingerprints, IP data, and customer-service logs remained undisclosed.\n\n## Fund flow\nApproximately 49.96 ETH, 746,475 HSK, and 1.566 million USDT moved through hub 0x3466…4133, split toward two downstream addresses, and underwent further USDT conversion and address fragmentation.\n\n## Amount basis\nThe disputed user loss was approximately $1.7 million. The separate $207 million exchange net-outflow figure is not included in that amount.\n\n## Evidence boundary\nThe user's account, platform statements, and on-chain movements are public, but the parties dispute the authentication and review history. Backend evidence and final responsibility were not publicly adjudicated, and the possible OTC-channel association remains unconfirmed.\n\n## Current status\nThe assets were split across downstream addresses. Gate moved from an initial isolated-case characterization to an apology and tracing assistance, while responsibility, recovery, and compensation remained unresolved." }, "category": "account-takeover", "severity": "high", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 1700000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 49.96 ETH + 746,475 HSK + 约 1,565,982 USDT（合计约 170 万美元量级）", "tw": "約 49.96 ETH + 746,475 HSK + 約 1,565,982 USDT（合計約 170 萬美元量級）", "en": "Reported loss: $1,700,000" }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0x34660cD71651977D221Ea6fDA506f5D096064133", "entity": { "zh": "[链：Ethereum] [被盗资产接收] [资金归集 HUB]", "tw": "[鏈：Ethereum] [被盜資產接收] [資金歸集 HUB]", "en": "other address documented by a public source" }, "role": "other", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://etherscan.io/address/0x34660cD71651977D221Ea6fDA506f5D096064133", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [被盗资产接收] [资金归集 HUB]", "tw": "[鏈：Ethereum] [被盜資產接收] [資金歸集 HUB]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xd4355D99ef1b6F98d3A9AfE8BcA6D0C0852e45e7", "entity": { "zh": "[链：Ethereum] [下游 1] [资金分散]", "tw": "[鏈：Ethereum] [下游 1] [資金分散]", "en": "other address documented by a public source" }, "role": "other", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://etherscan.io/address/0x34660cD71651977D221Ea6fDA506f5D096064133", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [下游 1] [资金分散]", "tw": "[鏈：Ethereum] [下游 1] [資金分散]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xb1EB41492DFC1BD7024286D160efe69a2a6f774e", "entity": { "zh": "[链：Ethereum] [下游 2] [HSK 兑换路径]", "tw": "[鏈：Ethereum] [下游 2] [HSK 兌換路徑]", "en": "other address documented by a public source" }, "role": "other", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://etherscan.io/address/0x34660cD71651977D221Ea6fDA506f5D096064133", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [下游 2] [HSK 兑换路径]", "tw": "[鏈：Ethereum] [下游 2] [HSK 兌換路徑]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "Etherscan HUB", "tw": "Etherscan HUB", "en": "etherscan.io source" }, "url": "https://etherscan.io/address/0x34660cD71651977D221Ea6fDA506f5D096064133", "type": "research" }, { "label": { "zh": "CryptoBriefing 流出", "tw": "CryptoBriefing 流出", "en": "cryptobriefing.com source" }, "url": "https://cryptobriefing.com/gate-207m-outflows-user-theft-incident/", "type": "research" }, { "label": { "zh": "Blockcast 进展", "tw": "Blockcast 進展", "en": "blockcast.it source" }, "url": "https://blockcast.it/2026/07/14/gate-faces-1-7m-user-hack-incident-as-ceo-vows-to-recover-funds/", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-046", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-012", "status": "verified", "incidentDate": "2026-07-03", "datePrecision": "day", "title": { "zh": "Hinkal Protocol", "tw": "Hinkal Protocol", "en": "Hinkal Protocol exploit" }, "summary": { "zh": "受影响合约被项目方冻结；大部分赃款已混币或跨到 Bitcoin。", "tw": "受影響合約被項目方凍結；大部分贓款已混幣或跨到 Bitcoin。", "en": "A protocol weakness was exploited for approximately $820,000, according to the cited on-chain security disclosures." }, "details": { "zh": "## 事件背景\nHinkal 是主打稳定币隐私/保密交易的 DeFi 协议。核心缺陷在证明与签名没有把「承诺 commitment、nullifier、交易 call data」绑定成不可拆分的整体：\n\n- 正常隐私池要求：同一笔记（note）只能花费一次，nullifier 防双花，且提取参数必须被证明覆盖；\n- 实现上，攻击者可反复构造新的 nullifier、stealth 地址、H0/H1 以及 calldataHash，使验证器误以为每次都是合法新花费；\n- 入口还暴露了 prooflessDeposit()（无证明存款）一类路径，降低了攻击前置成本，使「先塞入再反复 transact 抽出」成为可脚本化循环。\n\n因此这不是用户被钓鱼签名，而是协议合约执行路径/校验逻辑被利用，可在不持有真实存款证明的情况下抽走池内 USDC。\n\n## 事件经过\n1. 切入：攻击者调用 prooflessDeposit() 在有缺陷的路径上建立可操作状态。\n2. 循环提取：多次调用 transact()，公开监测显示单次约提取 2.5 万美元量级，重复直至池内可抽资金耗尽。\n3. 规模：合计抽走约 80 万—82 万美元 USDC。\n4. 换币：USDC 在 Ethereum 上换成 ETH。\n5. 清洗分叉：\n- 约 410 ETH 进入 Tornado Cash；\n- 约 44.67 ETH 经 THORChain 换成 BTC，跨出 EVM 视线。\n6. 项目响应：受影响合约被冻结；团队称事件限于特定 Ethereum 池，并表态用户补偿口径（以官方最终公告为准）。\n\n## 资金流向\n- 约 410 ETH 进入 Tornado Cash；\n\n## 金额口径\n约 80 万—82 万美元 USDC\n\n## 证据边界\n公开资料未提供完整地址与交易记录。\n\n## 处置状态\n受影响合约被项目方冻结；大部分赃款已混币或跨到 Bitcoin。", "tw": "## 事件背景\nHinkal 是主打穩定幣隱私/保密交易的 DeFi 協議。核心缺陷在證明與簽名沒有把「承諾 commitment、nullifier、交易 call data」綁定成不可拆分的整體：\n\n- 正常隱私池要求：同一筆記（note）只能花費一次，nullifier 防雙花，且提取參數必須被證明覆蓋；\n- 實現上，攻擊者可反覆構造新的 nullifier、stealth 地址、H0/H1 以及 calldataHash，使驗證器誤以為每次都是合法新花費；\n- 入口還暴露了 prooflessDeposit()（無證明存款）一類路徑，降低了攻擊前置成本，使「先塞入再反覆 transact 抽出」成為可腳本化循環。\n\n因此這不是用戶被釣魚簽名，而是協議合約執行路徑/校驗邏輯被利用，可在不持有真實存款證明的情況下抽走池內 USDC。\n\n## 事件經過\n1. 切入：攻擊者調用 prooflessDeposit() 在有缺陷的路徑上建立可操作狀態。\n2. 循環提取：多次調用 transact()，公開監測顯示單次約提取 2.5 萬美元量級，重複直至池內可抽資金耗盡。\n3. 規模：合計抽走約 80 萬—82 萬美元 USDC。\n4. 換幣：USDC 在 Ethereum 上換成 ETH。\n5. 清洗分叉：\n- 約 410 ETH 進入 Tornado Cash；\n- 約 44.67 ETH 經 THORChain 換成 BTC，跨出 EVM 視線。\n6. 項目響應：受影響合約被凍結；團隊稱事件限於特定 Ethereum 池，並表態用戶補償口徑（以官方最終公告為準）。\n\n## 資金流向\n- 約 410 ETH 進入 Tornado Cash；\n\n## 金額口徑\n約 80 萬—82 萬美元 USDC\n\n## 證據邊界\n公開資料未提供完整地址與交易記錄。\n\n## 處置狀態\n受影響合約被項目方凍結；大部分贓款已混幣或跨到 Bitcoin。", "en": "## Incident background\nHinkal is a DeFi protocol for private or confidential stablecoin transfers. Its proof and signature design failed to bind the commitment, nullifier, and transaction call data into one inseparable statement.\n\n- A normal privacy pool requires each note to be spent only once, uses a nullifier to prevent double spending, and proves the withdrawal parameters;\n- The implementation allowed an attacker to construct new nullifiers, stealth addresses, H0 or H1 values, and calldataHash values repeatedly, causing the verifier to treat each attempt as a new valid spend;\n- A prooflessDeposit() path further reduced the setup cost and made repeated transact() withdrawals scriptable.\n\nThe attacker therefore exploited protocol verification logic to withdraw USDC without a corresponding valid deposit proof; this was not a user phishing-signature event.\n\n## Incident sequence\n1. The attacker called prooflessDeposit() to establish state through the flawed path.\n2. Repeated transact() calls withdrew approximately $25,000 each until available pool funds were exhausted.\n3. Total USDC withdrawn was reported at approximately $800,000 to $820,000.\n4. The USDC was converted into ETH on Ethereum.\n5. Approximately 410 ETH entered Tornado Cash, while about 44.67 ETH crossed through THORChain into BTC.\n6. The project froze the affected contracts, said the incident was limited to a specific Ethereum pool, and described a compensation plan pending final terms.\n\n## Fund flow\nUSDC left the affected pool through repeated withdrawals, was converted into ETH, then split: approximately 410 ETH entered Tornado Cash and about 44.67 ETH crossed through THORChain into BTC.\n\n## Amount basis\nThe archive records $820,000, the upper end of the publicly reported $800,000 to $820,000 range.\n\n## Evidence boundary\nThe verification weakness, repeated-withdrawal pattern, amount range, and principal ETH routes are publicly reported. A complete address and transaction list was not disclosed.\n\n## Current status\nThe project froze the affected contracts. Most disclosed proceeds had entered Tornado Cash or crossed to Bitcoin, while final compensation terms remained pending." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "Ethereum", "Bitcoin" ], "chains": [ "Ethereum", "Bitcoin" ], "lossUsd": 820000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "约 80 万—82 万美元 USDC", "tw": "約 80 萬—82 萬美元 USDC", "en": "Reported loss: $820,000" }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0xbB3f01a1b1C68F3DEB36C55342b5F5706c32fc20", "entity": { "zh": "[链：Ethereum] [黑客地址] [攻击者 EOA] [被盗资产接收] [资金归集]", "tw": "[鏈：Ethereum] [黑客地址] [攻擊者 EOA] [被盜資產接收] [資金歸集]", "en": "attacker address documented by a public source" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/CertiKAlert/status/2072856656099324255", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [黑客地址] [攻击者 EOA] [被盗资产接收] [资金归集]", "tw": "[鏈：Ethereum] [黑客地址] [攻擊者 EOA] [被盜資產接收] [資金歸集]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x25e5e82f5702A27C3466fE68f14abDbbAdFca826", "entity": { "zh": "[链：Ethereum] [受害地址] [受影响合约]", "tw": "[鏈：Ethereum] [受害地址] [受影響合約]", "en": "victim address documented by a public source" }, "role": "victim", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/CertiKAlert/status/2072856656099324255", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [受害地址] [受影响合约]", "tw": "[鏈：Ethereum] [受害地址] [受影響合約]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "CertiK 地址", "tw": "CertiK 地址", "en": "x.com source" }, "url": "https://x.com/CertiKAlert/status/2072856656099324255", "type": "research" }, { "label": { "zh": "PeckShield 资金路径", "tw": "PeckShield 資金路徑", "en": "x.com source" }, "url": "https://x.com/PeckShieldAlert/status/2072859957167640946", "type": "research" }, { "label": { "zh": "GoPlus 分析", "tw": "GoPlus 分析", "en": "x.com source" }, "url": "https://x.com/GoPlusSecurity/status/2072904217178820833", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-012", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-045", "status": "verified", "incidentDate": "2026-07-02", "datePrecision": "day", "title": { "zh": "Alkanes / DIESEL 索引器攻击", "tw": "Alkanes / DIESEL 索引器攻擊", "en": "Alkanes / DIESEL indexer attack" }, "summary": { "zh": "Subfrost 称用户资金未损失，攻击尝试被架构拦截；索引器状态一致性问题随后被修复或缓解。", "tw": "Subfrost 稱用戶資金未損失，攻擊嘗試被架構攔截；索引器狀態一致性問題隨後被修復或緩解。", "en": "An indexer-level attack disrupted data integrity, but the cited sources did not identify a direct asset loss." }, "details": { "zh": "## 事件背景\nAlkanes 元协议索引器同时维护两套状态：\n\n1. 原子持久化存储（应在失败时完整回滚）；\n2. 内存余额映射（热路径缓存）。\n\n当高 ID 代币触发 u128 溢出时：持久化层正确回滚，但内存映射没有撤销错误写入 → 索引器以为存在巨量 DIESEL，而 Bitcoin L1 上并无对应真实资产。这是索引器状态机不一致，不是 BTC 共识被攻破。若桥/结算层盲目信任索引器余额，就会把幻影代币兑成真实 BTC。\n\n## 事件经过\n1. 约 7 月 2 日攻击者构造极端数值触发溢出与状态分裂。\n2. 通过约 24 次级联翻倍，把幻影 DIESEL 放大到约 1 亿枚。\n3. 尝试将幻影余额换成 frBTC / 抽取桥储备。\n4. Subfrost 桥接与结算架构拒绝释放无抵押 BTC，约 82.3 BTC 风险敞口被拦截。\n5. 7 月 3–4 日官方/社区复盘；宣称用户损失为 0。\n6. 随后修复索引器一致性；相关 bc1p 地址中桥储备地址不是黑客。\n\n## 资金流向\n3. 尝试将幻影余额换成 frBTC / 抽取桥储备。\n4. Subfrost 桥接与结算架构拒绝释放无抵押 BTC，约 82.3 BTC 风险敞口被拦截。\n6. 随后修复索引器一致性；相关 bc1p 地址中桥储备地址不是黑客。\n\n## 金额口径\n用户损失为 0；约 82.3 BTC 属于被拦截的风险敞口，不是已实现损失。\n\n## 证据边界\n现有公开资料已确认事件基本事实；完整地址角色、技术根因或后续处置仍有未公开部分。\n\n## 处置状态\nSubfrost 称用户资金未损失，攻击尝试被架构拦截；索引器状态一致性问题随后被修复或缓解。", "tw": "## 事件背景\nAlkanes 元協議索引器同時維護兩套狀態：\n\n1. 原子持久化存儲（應在失敗時完整回滾）；\n2. 內存餘額映射（熱路徑緩存）。\n\n當高 ID 代幣觸發 u128 溢出時：持久化層正確回滾，但內存映射沒有撤銷錯誤寫入 → 索引器以為存在巨量 DIESEL，而 Bitcoin L1 上並無對應真實資產。這是索引器狀態機不一致，不是 BTC 共識被攻破。若橋/結算層盲目信任索引器餘額，就會把幻影代幣兌成真實 BTC。\n\n## 事件經過\n1. 約 7 月 2 日攻擊者構造極端數值觸發溢出與狀態分裂。\n2. 通過約 24 次級聯翻倍，把幻影 DIESEL 放大到約 1 億枚。\n3. 嘗試將幻影餘額換成 frBTC / 抽取橋儲備。\n4. Subfrost 橋接與結算架構拒絕釋放無抵押 BTC，約 82.3 BTC 風險敞口被攔截。\n5. 7 月 3–4 日官方/社區復盤；宣稱用戶損失為 0。\n6. 隨後修復索引器一致性；相關 bc1p 地址中橋儲備地址不是黑客。\n\n## 資金流向\n3. 嘗試將幻影餘額換成 frBTC / 抽取橋儲備。\n4. Subfrost 橋接與結算架構拒絕釋放無抵押 BTC，約 82.3 BTC 風險敞口被攔截。\n6. 隨後修復索引器一致性；相關 bc1p 地址中橋儲備地址不是黑客。\n\n## 金額口徑\n用戶損失為 0；約 82.3 BTC 屬於被攔截的風險敞口，不是已實現損失。\n\n## 證據邊界\n現有公開資料已確認事件基本事實；完整地址角色、技術根因或後續處置仍有未公開部分。\n\n## 處置狀態\nSubfrost 稱用戶資金未損失，攻擊嘗試被架構攔截；索引器狀態一致性問題隨後被修復或緩解。", "en": "## Incident background\nThe Alkanes metaprotocol indexer maintained two state layers:\n\n1. Atomic persistent storage, which should roll back fully after a failed operation;\n2. An in-memory balance map used as a hot-path cache.\n\nWhen a high-ID token triggered a uint128 overflow, persistent storage rolled back correctly, but the memory map retained the erroneous write. The indexer then reported a large DIESEL balance that had no corresponding asset on Bitcoin L1. This was an indexer-state inconsistency, not a Bitcoin consensus failure. A bridge or settlement layer that trusted the indexer could have exchanged the phantom balance for real BTC.\n\n## Incident sequence\n1. Around July 2, the attacker supplied extreme values that triggered overflow and divergence between the two state layers.\n2. About 24 cascading doublings increased the phantom DIESEL balance to roughly 100 million tokens.\n3. The attacker attempted to exchange the phantom balance for frBTC or withdraw bridge reserves.\n4. Subfrost's bridge and settlement design refused to release uncollateralized BTC, blocking exposure of approximately 82.3 BTC.\n5. A project and community review on July 3 and 4 reported zero user loss.\n6. The indexer-consistency issue was then repaired. A related bc1p bridge-reserve address is not an attacker address.\n\n## Fund flow\nThe attacker attempted to convert a phantom DIESEL balance into frBTC or bridge reserves, but Subfrost blocked release of approximately 82.3 BTC in uncollateralized exposure.\n\n## Amount basis\nReported user loss was $0. The separate 82.3 BTC figure represents blocked exposure, not realized loss.\n\n## Evidence boundary\nThe indexer inconsistency, phantom-token scale, blocked exposure, and zero-loss statement are public. The bridge-reserve address is kept separate from attacker attribution.\n\n## Current status\nSubfrost said the architecture blocked the withdrawal and that users lost no funds. The indexer-state issue was subsequently repaired or mitigated." }, "category": "protocol-exploit", "severity": "medium", "ecosystems": [ "Bitcoin" ], "chains": [ "Bitcoin" ], "lossUsd": 0, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "用户损失为 0；约 82.3 BTC 属于被拦截的风险敞口，不是已实现损失。", "tw": "用戶損失為 0；約 82.3 BTC 屬於被攔截的風險敞口，不是已實現損失。", "en": "Reported user loss was $0; approximately 82.3 BTC was blocked exposure, not realized loss." }, "addressDisclosure": "published", "addresses": [ { "chain": "Bitcoin", "address": "bc1ppjkfcx89pa8w2v6fv57rflvhxcp74usk9xy7eh8avlq0an8hards05tu8t", "entity": { "zh": "[链：Bitcoin L1 / Alkanes] [攻击关联地址] [幻影 DIESEL 持仓] [具体角色待核]", "tw": "[鏈：Bitcoin L1 / Alkanes] [攻擊關聯地址] [幻影 DIESEL 持倉] [具體角色待核]", "en": "other address documented by a public source" }, "role": "other", "category": "unknown", "confidence": 0.65, "sourceUrl": "https://x.com/YL20020628/status/2072633859716571530", "evidenceStatus": "community_reported", "evidenceSummary": { "zh": "[链：Bitcoin L1 / Alkanes] [攻击关联地址] [幻影 DIESEL 持仓] [具体角色待核]", "tw": "[鏈：Bitcoin L1 / Alkanes] [攻擊關聯地址] [幻影 DIESEL 持倉] [具體角色待核]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Bitcoin", "address": "bc1psjzvcv0n86u00wtekvp02eh53n8tytsw8dc8wpvrhf3hqtxjahvqlx23e6", "entity": { "zh": "[链：Bitcoin L1 / Alkanes] [攻击关联地址] [异常兑换路径] [具体角色待核]", "tw": "[鏈：Bitcoin L1 / Alkanes] [攻擊關聯地址] [異常兌換路徑] [具體角色待核]", "en": "other address documented by a public source" }, "role": "other", "category": "unknown", "confidence": 0.65, "sourceUrl": "https://x.com/YL20020628/status/2072633859716571530", "evidenceStatus": "community_reported", "evidenceSummary": { "zh": "[链：Bitcoin L1 / Alkanes] [攻击关联地址] [异常兑换路径] [具体角色待核]", "tw": "[鏈：Bitcoin L1 / Alkanes] [攻擊關聯地址] [異常兌換路徑] [具體角色待核]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true }, { "chain": "Bitcoin", "address": "bc1p5lushqjk7kxpqa87ppwn0dealucyqa6t40ppdkhpqm3grcpqvw9s3wdsx7", "entity": { "zh": "[链：Bitcoin L1 / Alkanes] [受影响桥储备地址] [frBTC 桥余额]，不是黑客地址。", "tw": "[鏈：Bitcoin L1 / Alkanes] [受影響橋儲備地址] [frBTC 橋餘額]，不是黑客地址。", "en": "bridge address documented by a public source" }, "role": "bridge", "category": "bridge", "confidence": 0.9, "sourceUrl": "https://x.com/YL20020628/status/2072633859716571530", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Bitcoin L1 / Alkanes] [受影响桥储备地址] [frBTC 桥余额]，不是黑客地址。", "tw": "[鏈：Bitcoin L1 / Alkanes] [受影響橋儲備地址] [frBTC 橋餘額]，不是黑客地址。", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "问题地址披露", "tw": "問題地址披露", "en": "x.com source" }, "url": "https://x.com/YL20020628/status/2072633859716571530", "type": "research" }, { "label": { "zh": "Subfrost 事后分析", "tw": "Subfrost 事後分析", "en": "x.com source" }, "url": "https://x.com/gabe_subfrost/status/2073217660880388224", "type": "research" }, { "label": { "zh": "后续总结", "tw": "後續總結", "en": "x.com source" }, "url": "https://x.com/haoRU_3to1/status/2073304718315544691", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-045", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-009", "status": "verified", "incidentDate": "2026-07-01", "datePrecision": "day", "title": { "zh": "恶意 npm 包供应链攻击", "tw": "惡意 npm 包供應鏈攻擊", "en": "Malicious npm package supply-chain campaign" }, "summary": { "zh": "恶意包和伪造仓库被安全机构识别并预警，实际受害钱包数量和总损失尚未公开。", "tw": "惡意包和偽造倉庫被安全機構識別並預警，實際受害錢包數量和總損失尚未公開。", "en": "At least 30 lookalike Web3 packages carried credential-stealing code; aggregate wallet losses were not publicly established." }, "details": { "zh": "## 事件背景\n攻击面不在某条链的智能合约，而在 Web3 开发供应链：npm 公共仓库审核弱、包名仿冒成本低。攻击者批量发布至少 30 个伪装成交易机器人、策略库或 DeFi 工具的 npm 包（公开点名包括 stake-math@3.5.4 等），包内夹带 JavaScript 信息窃取器（infostealer）。开发者一旦 npm install / CI 拉取依赖，恶意代码即在本地或构建环境执行，可读取：\n\n- .env、部署私钥、RPC Key、交易所 API；\n- 浏览器钱包扩展数据与密钥库路径；\n- 交易机器人配置与会话 cookie。\n\n这是典型的依赖投毒（dependency confusion / typosquat 类供应链），损失分散在多个受害钱包，难以用「单协议被黑金额」统计。\n\n## 事件经过\n1. 攻击者注册/发布大量仿冒 npm 包并提高版本号诱导更新。\n2. 开发者或自动化流水线安装依赖，postinstall / 运行时触发窃取逻辑。\n3. 木马采集环境变量、钱包凭证、浏览器数据、机器人配置。\n4. 数据外传到攻击者控制的 C2；随后可能出现链上盗币（各案独立，无统一归集地址公开）。\n5. SlowMist 等安全机构识别恶意包与伪造仓库并公开预警。\n6. 因受害面分散，公开渠道未给出「总损失美元」与单一黑客主地址。\n\n## 资金流向\n4. 数据外传到攻击者控制的 C2；随后可能出现链上盗币（各案独立，无统一归集地址公开）。\n\n## 金额口径\n未公开统一链上损失。\n\n## 证据边界\n现有公开资料未完整确认地址角色或技术根因。\n\n## 处置状态\n恶意包和伪造仓库被安全机构识别并预警，实际受害钱包数量和总损失尚未公开。", "tw": "## 事件背景\n攻擊面不在某條鏈的智能合約，而在 Web3 開發供應鏈：npm 公共倉庫審核弱、包名仿冒成本低。攻擊者批量發佈至少 30 個偽裝成交易機器人、策略庫或 DeFi 工具的 npm 包（公開點名包括 stake-math@3.5.4 等），包內夾帶 JavaScript 信息竊取器（infostealer）。開發者一旦 npm install / CI 拉取依賴，惡意代碼即在本地或構建環境執行，可讀取：\n\n- .env、部署私鑰、RPC Key、交易所 API；\n- 瀏覽器錢包擴展數據與密鑰庫路徑；\n- 交易機器人配置與會話 cookie。\n\n這是典型的依賴投毒（dependency confusion / typosquat 類供應鏈），損失分散在多個受害錢包，難以用「單協議被黑金額」統計。\n\n## 事件經過\n1. 攻擊者註冊/發佈大量仿冒 npm 包並提高版本號誘導更新。\n2. 開發者或自動化流水線安裝依賴，postinstall / 運行時觸發竊取邏輯。\n3. 木馬採集環境變量、錢包憑證、瀏覽器數據、機器人配置。\n4. 數據外傳到攻擊者控制的 C2；隨後可能出現鏈上盜幣（各案獨立，無統一歸集地址公開）。\n5. SlowMist 等安全機構識別惡意包與偽造倉庫並公開預警。\n6. 因受害面分散，公開渠道未給出「總損失美元」與單一黑客主地址。\n\n## 資金流向\n4. 數據外傳到攻擊者控制的 C2；隨後可能出現鏈上盜幣（各案獨立，無統一歸集地址公開）。\n\n## 金額口徑\n未公開統一鏈上損失。\n\n## 證據邊界\n現有公開資料未完整確認地址角色或技術根因。\n\n## 處置狀態\n惡意包和偽造倉庫被安全機構識別並預警，實際受害錢包數量和總損失尚未公開。", "en": "## Incident background\nThe campaign targeted the Web3 software supply chain rather than a blockchain contract. Limited package-registry screening and inexpensive name impersonation allowed an attacker to publish at least 30 npm packages disguised as trading bots, strategy libraries, or DeFi tools. Publicly named examples included stake-math@3.5.4. The packages contained JavaScript information-stealing malware that could execute during npm installation, CI, or runtime and access:\n\n- .env files, deployment keys, RPC credentials, and exchange API credentials;\n- Browser-wallet extension data and keystore paths;\n- Trading-bot configurations and session cookies.\n\nThis was a dependency-poisoning or typosquatting campaign. Any resulting losses would be distributed across separate victim wallets rather than one protocol treasury.\n\n## Incident sequence\n1. The attacker registered many lookalike npm packages and published higher version numbers to encourage installation or updates.\n2. Developers or automated pipelines installed the dependencies, triggering malicious postinstall or runtime code.\n3. The malware collected environment variables, wallet credentials, browser data, and bot configurations.\n4. Stolen data was sent to attacker-controlled command-and-control infrastructure. Separate on-chain thefts could follow, but no common consolidation address was disclosed.\n5. SlowMist and other security researchers identified malicious packages and lookalike repositories and issued public warnings.\n6. Public sources did not establish an aggregate dollar loss or one principal attacker wallet.\n\n## Fund flow\nThe immediate flow was off-chain exfiltration of credentials to command-and-control infrastructure. Any later wallet thefts were incident-specific, and no common on-chain route was published.\n\n## Amount basis\nNo verified aggregate on-chain loss was published.\n\n## Evidence boundary\nThe malicious packages, delivery mechanism, and credential targets are publicly documented. Victim count, realized loss, and a complete attacker-wallet set remain undisclosed.\n\n## Current status\nSecurity researchers identified and reported the malicious packages and lookalike repositories. The number of affected wallets and total loss remained unknown." }, "category": "supply-chain", "severity": "medium", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "未公开统一链上损失。", "tw": "未公開統一鏈上損失。", "en": "No verified aggregate on-chain loss was published." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "SlowMist 原帖", "tw": "SlowMist 原帖", "en": "x.com source" }, "url": "https://x.com/SlowMist_Team/status/2072241756746486034", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-009", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-008", "status": "verified", "incidentDate": "2026-07-01", "datePrecision": "day", "title": { "zh": "Edel Finance / BackedFi 借贷市场", "tw": "Edel Finance / BackedFi 借貸市場", "en": "Edel Finance ERC-4626 donation attack" }, "summary": { "zh": "项目遏制漏洞，但形成约 40.3 万美元坏账；攻击者所得已进入 Tornado Cash。RWA / xStocks / ERC4626 封装资产若被借贷协议直接当预言机，同类「捐赠抬汇率」会反复出现。", "tw": "項目遏制漏洞，但形成約 40.3 萬美元壞賬；攻擊者所得已進入 Tornado Cash。RWA / xStocks / ERC4626 封裝資產若被借貸協議直接當預言機，同類「捐贈抬匯率」會反覆出現。", "en": "Attackers manipulated an ERC-4626 share price used as collateral, extracting about $353,000 and leaving roughly $403,000 in bad debt." }, "details": { "zh": "## 事件背景\nwGOOGLx（wrapped xStocks / 代币化谷歌股票的封装版）在 Edel Lending 中被当作抵押品。其价格源通过 ERC-4626 金库的 convertToAssets() 计算「每一份额对应多少底层资产」，而 totalAssets() 直接读取底层 GOOGLx 在金库合约中的余额，没有独立的预言机 TWAP，也没有：\n\n1. 份额价格变化上限（max share price deviation / rate limiter）；\n2. 捐赠攻击防护（donation / inflation attack protection，例如 virtual shares、dead shares、或对直接 transfer 进金库的资产不计入定价）；\n3. 最小流动性 / 滑点约束，防止单笔外部转入瞬间扭曲 NAV。\n\n因此，任何人只要把底层 GOOGLx 直接转入金库地址（不走正常 mint 路径），totalAssets() 就会上升，而份额总数不变 → convertToAssets() 算出的「每份 wGOOGLx 价值」被人为抬高。借贷侧若按该虚高价格认定抵押率，攻击者就能用少量真实成本撬动大量借款额度。本质是 ERC-4626 会计假设「金库资产只来自合法存取」被打破 + 借贷协议把可操纵的份额汇率当成可信抵押品预言机。\n\n## 事件经过\n1. 准备资金：攻击者通过闪电贷或临时资金拿到足够的底层 GOOGLx / 相关资产，用于后续「捐赠」与循环操作。\n2. 直接捐赠扭曲汇率：将底层 GOOGLx 直接转入 ERC-4626 金库（不铸造对应份额），使 totalAssets() 暴涨、份额供给不变。\n3. 估值失真：wGOOGLx 经 convertToAssets() 算出的份额价值被抬高到合理价值的约 78 倍。\n4. 虚高抵押借贷：攻击者把被高估的 wGOOGLx 作为抵押品，在 Edel 的约 6 个借贷市场中反复存入并借出其他资产（稳定币/主流资产等）。\n5. 循环放大：在操纵窗口内可多次 deposit/borrow，把会计偏差兑换成可提取的真实资产，形成协议侧坏账。\n6. 出金换 ETH：全部获利资产被兑换为约 224 ETH（约 35.3 万美元量级）。\n7. 混币离场：ETH 转入 Tornado Cash，链上追踪难度陡增。\n8. 项目侧：漏洞路径被遏制后，协议账面仍留下约 40.3 万美元不良债务（坏账口径与攻击者套现口径不同，须分开表述）。\n\n## 资金流向\n2. 直接捐赠扭曲汇率：将底层 GOOGLx 直接转入 ERC-4626 金库（不铸造对应份额），使 totalAssets() 暴涨、份额供给不变。\n5. 循环放大：在操纵窗口内可多次 deposit/borrow，把会计偏差兑换成可提取的真实资产，形成协议侧坏账。\n6. 出金换 ETH：全部获利资产被兑换为约 224 ETH（约 35.3 万美元量级）。\n7. 混币离场：ETH 转入 Tornado Cash，链上追踪难度陡增。\n\n## 金额口径\n攻击者实现约 224 ETH、约 35.3 万美元；协议不良债务约 40.3 万美元\n\n## 证据边界\n现有公开资料已确认事件基本事实；完整地址角色、技术根因或后续处置仍有未公开部分。\n\n## 处置状态\n项目遏制漏洞，但形成约 40.3 万美元坏账；攻击者所得已进入 Tornado Cash。RWA / xStocks / ERC4626 封装资产若被借贷协议直接当预言机，同类「捐赠抬汇率」会反复出现。", "tw": "## 事件背景\nwGOOGLx（wrapped xStocks / 代幣化谷歌股票的封裝版）在 Edel Lending 中被當作抵押品。其價格源通過 ERC-4626 金庫的 convertToAssets() 計算「每一份額對應多少底層資產」，而 totalAssets() 直接讀取底層 GOOGLx 在金庫合約中的餘額，沒有獨立的預言機 TWAP，也沒有：\n\n1. 份額價格變化上限（max share price deviation / rate limiter）；\n2. 捐贈攻擊防護（donation / inflation attack protection，例如 virtual shares、dead shares、或對直接 transfer 進金庫的資產不計入定價）；\n3. 最小流動性 / 滑點約束，防止單筆外部轉入瞬間扭曲 NAV。\n\n因此，任何人只要把底層 GOOGLx 直接轉入金庫地址（不走正常 mint 路徑），totalAssets() 就會上升，而份額總數不變 → convertToAssets() 算出的「每份 wGOOGLx 價值」被人為抬高。借貸側若按該虛高價格認定抵押率，攻擊者就能用少量真實成本撬動大量借款額度。本質是 ERC-4626 會計假設「金庫資產只來自合法存取」被打破 + 借貸協議把可操縱的份額匯率當成可信抵押品預言機。\n\n## 事件經過\n1. 準備資金：攻擊者通過閃電貸或臨時資金拿到足夠的底層 GOOGLx / 相關資產，用於後續「捐贈」與循環操作。\n2. 直接捐贈扭曲匯率：將底層 GOOGLx 直接轉入 ERC-4626 金庫（不鑄造對應份額），使 totalAssets() 暴漲、份額供給不變。\n3. 估值失真：wGOOGLx 經 convertToAssets() 算出的份額價值被抬高到合理價值的約 78 倍。\n4. 虛高抵押借貸：攻擊者把被高估的 wGOOGLx 作為抵押品，在 Edel 的約 6 個借貸市場中反覆存入並借出其他資產（穩定幣/主流資產等）。\n5. 循環放大：在操縱窗口內可多次 deposit/borrow，把會計偏差兌換成可提取的真實資產，形成協議側壞賬。\n6. 出金換 ETH：全部獲利資產被兌換為約 224 ETH（約 35.3 萬美元量級）。\n7. 混幣離場：ETH 轉入 Tornado Cash，鏈上追蹤難度陡增。\n8. 項目側：漏洞路徑被遏制後，協議賬面仍留下約 40.3 萬美元不良債務（壞賬口徑與攻擊者套現口徑不同，須分開表述）。\n\n## 資金流向\n2. 直接捐贈扭曲匯率：將底層 GOOGLx 直接轉入 ERC-4626 金庫（不鑄造對應份額），使 totalAssets() 暴漲、份額供給不變。\n5. 循環放大：在操縱窗口內可多次 deposit/borrow，把會計偏差兌換成可提取的真實資產，形成協議側壞賬。\n6. 出金換 ETH：全部獲利資產被兌換為約 224 ETH（約 35.3 萬美元量級）。\n7. 混幣離場：ETH 轉入 Tornado Cash，鏈上追蹤難度陡增。\n\n## 金額口徑\n攻擊者實現約 224 ETH、約 35.3 萬美元；協議不良債務約 40.3 萬美元\n\n## 證據邊界\n現有公開資料已確認事件基本事實；完整地址角色、技術根因或後續處置仍有未公開部分。\n\n## 處置狀態\n項目遏制漏洞，但形成約 40.3 萬美元壞賬；攻擊者所得已進入 Tornado Cash。RWA / xStocks / ERC4626 封裝資產若被借貸協議直接當預言機，同類「捐贈抬匯率」會反覆出現。", "en": "## Incident background\nwGOOGLx, a wrapped tokenized-Google-equity asset, was accepted as collateral by Edel Lending. Its price path used the ERC-4626 vault's convertToAssets() result, while totalAssets() read the underlying GOOGLx balance held by the vault. The design lacked an independent oracle or TWAP and did not include:\n\n1. A maximum share-price deviation or rate limiter;\n2. Protection against donation or inflation attacks, such as virtual shares, dead shares, or exclusion of direct transfers from pricing;\n3. Minimum-liquidity or slippage limits preventing one external transfer from changing NAV immediately.\n\nA direct transfer of GOOGLx to the vault increased totalAssets() without minting new shares. convertToAssets() then reported an inflated value for each wGOOGLx share. The lending system treated that manipulable exchange rate as trusted collateral pricing, allowing the attacker to borrow real assets against artificially overvalued shares.\n\n## Incident sequence\n1. The attacker obtained underlying GOOGLx or related assets through flash liquidity or temporary funding.\n2. GOOGLx was transferred directly to the ERC-4626 vault without minting corresponding shares, increasing totalAssets() while share supply remained unchanged.\n3. The calculated wGOOGLx share value rose to approximately 78 times its reasonable value.\n4. The attacker used the overvalued wGOOGLx as collateral and repeatedly borrowed stablecoins or other assets across approximately six Edel markets.\n5. Repeated deposit and borrow operations converted the accounting distortion into extractable assets and left protocol bad debt.\n6. Proceeds were converted into approximately 224 ETH, valued at about $353,000.\n7. The ETH entered Tornado Cash.\n8. After the exploit path was contained, Edel reported approximately $403,000 in bad debt. The bad-debt amount and the attacker's realized proceeds are separate measures.\n\n## Fund flow\nThe attacker donated underlying assets to inflate the ERC-4626 exchange rate, borrowed against overvalued wGOOGLx across multiple markets, converted proceeds into approximately 224 ETH, and deposited the ETH into Tornado Cash.\n\n## Amount basis\nThe archive records approximately $403,000 in protocol bad debt. The attacker's realized proceeds were reported separately at about 224 ETH or $353,000.\n\n## Evidence boundary\nThe ERC-4626 donation mechanism, approximate 78-fold valuation increase, borrowing route, proceeds, and bad-debt figure are publicly reported. Gross borrowings, realized proceeds, and bad debt are not added together.\n\n## Current status\nEdel contained the vulnerable path, but approximately $403,000 in bad debt remained. The attacker's reported proceeds entered Tornado Cash." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 403000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "攻击者实现约 224 ETH、约 35.3 万美元；协议不良债务约 40.3 万美元", "tw": "攻擊者實現約 224 ETH、約 35.3 萬美元；協議不良債務約 40.3 萬美元", "en": "Reported loss: $403,000" }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0x58428161bB55c14A413945f06cbDeC157F411C76", "entity": { "zh": "[链：Ethereum] [黑客地址] [攻击者 EOA] [被盗资产接收] [混币前置]", "tw": "[鏈：Ethereum] [黑客地址] [攻擊者 EOA] [被盜資產接收] [混幣前置]", "en": "attacker address documented by a public source" }, "role": "attacker", "category": "mixer", "confidence": 0.9, "sourceUrl": "https://x.com/SlowMist_Team/status/2072146843044319478", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [黑客地址] [攻击者 EOA] [被盗资产接收] [混币前置]", "tw": "[鏈：Ethereum] [黑客地址] [攻擊者 EOA] [被盜資產接收] [混幣前置]", "en": "Role and tags are preserved from the cited public record." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "SlowMist 根因分析", "tw": "SlowMist 根因分析", "en": "x.com source" }, "url": "https://x.com/SlowMist_Team/status/2072146843044319478", "type": "research" }, { "label": { "zh": "CertiK 攻击者地址", "tw": "CertiK 攻擊者地址", "en": "x.com source" }, "url": "https://x.com/CertiKAlert/status/2072143306805645523", "type": "research" }, { "label": { "zh": "Cyvers 及 Edel 官方说明", "tw": "Cyvers 及 Edel 官方說明", "en": "x.com source" }, "url": "https://x.com/CyversAlerts/status/2072259516435939780", "type": "official" }, { "label": { "zh": "Edel 官方", "tw": "Edel 官方", "en": "x.com source" }, "url": "https://x.com/edeldotfinance/status/2072154468058022033", "type": "official" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-008", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-106", "status": "verified", "incidentDate": "2026-06-29", "datePrecision": "day", "title": { "zh": "Vault4626（未具名 Base 金库）", "tw": "Vault4626（未具名 Base 金庫）", "en": "Unnamed Base ERC-4626 vault exploit" }, "summary": { "zh": "公开来源确认 Vault4626（未具名 Base 金库） 发生智能合约漏洞、链上攻击事件，但未披露统一可核的美元损失额。", "tw": "公開來源確認 Vault4626（未具名 Base 金庫） 發生智能合約漏洞、鏈上攻擊事件，但未披露統一可核的美元損失額。", "en": "Public sources identify Unnamed Base ERC-4626 vault exploit as a on-chain smart-contract exploit incident. No single verifiable USD loss amount was published." }, "details": { "zh": "## 事件背景\nVault4626.totalAssets() quotes idle non-asset WETH into asset value, while redeem() later\n\n## 事件经过\n攻击者调用存在缺陷的合约路径，利用闪电流动性、储备/价格操纵、错误记账、权限或签名校验缺陷完成资产提取；交易已由 DeFiHackLabs 在历史状态上复现。\n\n## 资金流向\n受害合约或流动性池 → 攻击合约或攻击者地址。公开资料未披露后续兑换与资金转移路径。\n\n## 金额口径\n复现流程涉及约 13.53 WETH，但现有来源不足以支持稳定美元损失值。\n\n## 地址与交易\n- `0xA27eAE743Cd8C03E9b7c25ebF43DADbBC6Df9bFA` — `[链：Base] [攻击者] [身份：事件 51] [状态：公开来源确认]`\n- `0x47e775b8f175034b22fbA3A0F5B9E0F02551Af3C` — `[链：Base] [攻击合约] [身份：事件 51] [状态：公开来源确认]`\n- `0xD08579102fc28355C5839019b730Ce58F84E6a4d` — `[链：Base] [受害/漏洞合约] [身份：事件 51] [状态：公开来源确认]`\n- `0x2f2e12fbdf541c28f3667153e5338f73a313096338dc5ca592453566debcd790` — `[链：Base] [攻击 Tx] [身份：事件 51] [状态：公开来源确认]`\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\nVault4626.totalAssets() quotes idle non-asset WETH into asset value, while redeem() later\n\n## 事件經過\n攻擊者調用存在缺陷的合約路徑，利用閃電流動性、儲備/價格操縱、錯誤記賬、權限或簽名校驗缺陷完成資產提取；交易已由 DeFiHackLabs 在歷史狀態上覆現。\n\n## 資金流向\n受害合約或流動性池 → 攻擊合約或攻擊者地址。公開資料未披露後續兌換與資金轉移路徑。\n\n## 金額口徑\n復現流程涉及約 13.53 WETH，但現有來源不足以支持穩定美元損失值。\n\n## 地址與交易\n- `0xA27eAE743Cd8C03E9b7c25ebF43DADbBC6Df9bFA` — `[鏈：Base] [攻擊者] [身份：事件 51] [狀態：公開來源確認]`\n- `0x47e775b8f175034b22fbA3A0F5B9E0F02551Af3C` — `[鏈：Base] [攻擊合約] [身份：事件 51] [狀態：公開來源確認]`\n- `0xD08579102fc28355C5839019b730Ce58F84E6a4d` — `[鏈：Base] [受害/漏洞合約] [身份：事件 51] [狀態：公開來源確認]`\n- `0x2f2e12fbdf541c28f3667153e5338f73a313096338dc5ca592453566debcd790` — `[鏈：Base] [攻擊 Tx] [身份：事件 51] [狀態：公開來源確認]`\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nVault4626.totalAssets() quotes idle non-asset WETH into asset value, while redeem() later\n\n## Incident sequence\nThe attacker used the cited contract or infrastructure weakness to move assets from the affected contract, wallet or pool. Historical-state reproduction or the cited public alert supports the event; later movement remains undisclosed.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nThe reproduced flow involved approximately 13.53 WETH, but the available sources did not support a stable USD loss value.\n\n## Addresses and transactions\n1. `0xA27eAE743Cd8C03E9b7c25ebF43DADbBC6Df9bFA` — Base; publicly identified attacker address.\n2. `0x47e775b8f175034b22fbA3A0F5B9E0F02551Af3C` — Base; publicly identified attacker contract.\n3. `0xD08579102fc28355C5839019b730Ce58F84E6a4d` — Base; affected or vulnerable contract (not an attacker).\n4. `0x2f2e12fbdf541c28f3667153e5338f73a313096338dc5ca592453566debcd790` — Base; attack or execution transaction.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "protocol-exploit", "severity": "low", "ecosystems": [ "Base" ], "chains": [ "Base" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "复现流程涉及约 13.53 WETH，但现有来源不足以支持稳定美元损失值。", "tw": "復現流程涉及約 13.53 WETH，但現有來源不足以支持穩定美元損失值。", "en": "The reproduced flow involved approximately 13.53 WETH, but the available sources did not support a stable USD loss value." }, "addressDisclosure": "published", "addresses": [ { "chain": "Base", "address": "0xA27eAE743Cd8C03E9b7c25ebF43DADbBC6Df9bFA", "entity": { "zh": "公开攻击者地址", "tw": "公開攻擊者地址", "en": "publicly identified attacker address" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/DefimonAlerts/status/2071495744071086510", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Base] [攻击者] [身份：事件 51] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：Base] [攻擊者] [身份：事件 51] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker address. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "Base", "address": "0x47e775b8f175034b22fbA3A0F5B9E0F02551Af3C", "entity": { "zh": "公开攻击合约", "tw": "公開攻擊合約", "en": "publicly identified attacker contract" }, "role": "attacker-contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/DefimonAlerts/status/2071495744071086510", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Base] [攻击合约] [身份：事件 51] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：Base] [攻擊合約] [身份：事件 51] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker contract. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "Base", "address": "0xD08579102fc28355C5839019b730Ce58F84E6a4d", "entity": { "zh": "受影响或漏洞合约（非攻击者）", "tw": "受影響或漏洞合約（非攻擊者）", "en": "affected or vulnerable contract (not an attacker)" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/DefimonAlerts/status/2071495744071086510", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Base] [受害/漏洞合约] [身份：事件 51] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：Base] [受害/漏洞合約] [身份：事件 51] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "affected or vulnerable contract (not an attacker). The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "公开安全预警或项目说明", "tw": "公開安全預警或專案說明", "en": "Public security alert or project statement" }, "url": "https://x.com/DefimonAlerts/status/2071495744071086510", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-106", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-105", "status": "verified", "incidentDate": "2026-06-28", "datePrecision": "day", "title": { "zh": "AIDC", "tw": "AIDC", "en": "AIDC — on-chain smart-contract exploit" }, "summary": { "zh": "公开来源确认 AIDC 发生智能合约漏洞、链上攻击事件，但未披露统一可核的美元损失额。", "tw": "公開來源確認 AIDC 發生智能合約漏洞、鏈上攻擊事件，但未披露統一可核的美元損失額。", "en": "Public sources identify AIDC — on-chain smart-contract exploit as a on-chain smart-contract exploit incident. No single verifiable USD loss amount was published." }, "details": { "zh": "## 事件背景\nAIDCToken lets ordinary transfers burn accumulated sell-side amounts directly from the AMM pair.\n\n## 事件经过\n攻击者调用存在缺陷的合约路径，利用闪电流动性、储备/价格操纵、错误记账、权限或签名校验缺陷完成资产提取；交易已由 DeFiHackLabs 在历史状态上复现。\n\n## 资金流向\n受害合约或流动性池 → 攻击合约或攻击者地址。公开资料未披露后续兑换与资金转移路径。\n\n## 金额口径\n复现流程涉及约 220.13 WBNB，但现有来源不足以支持稳定美元损失值。\n\n## 地址与交易\n- `0x89eb2c99e970d831525c7a52badc290afa116b63` — `[链：BNB Chain] [攻击者] [身份：事件 50] [状态：公开来源确认]`\n- `0x26f625738019a1d710b074b23714d1538a151de4` — `[链：BNB Chain] [攻击合约] [身份：事件 50] [状态：公开来源确认]`\n- `0x5021d71859f81b4c905b573591db8f9cc4a0c6fe` — `[链：BNB Chain] [受害/漏洞合约] [身份：事件 50] [状态：公开来源确认]`\n- `0x66960f7febf399fa8bd94904398f535c500f4f575dbf025de7b9ab450342645e` — `[链：BNB Chain] [攻击 Tx] [身份：事件 50] [状态：公开来源确认]`\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\nAIDCToken lets ordinary transfers burn accumulated sell-side amounts directly from the AMM pair.\n\n## 事件經過\n攻擊者調用存在缺陷的合約路徑，利用閃電流動性、儲備/價格操縱、錯誤記賬、權限或簽名校驗缺陷完成資產提取；交易已由 DeFiHackLabs 在歷史狀態上覆現。\n\n## 資金流向\n受害合約或流動性池 → 攻擊合約或攻擊者地址。公開資料未披露後續兌換與資金轉移路徑。\n\n## 金額口徑\n復現流程涉及約 220.13 WBNB，但現有來源不足以支持穩定美元損失值。\n\n## 地址與交易\n- `0x89eb2c99e970d831525c7a52badc290afa116b63` — `[鏈：BNB Chain] [攻擊者] [身份：事件 50] [狀態：公開來源確認]`\n- `0x26f625738019a1d710b074b23714d1538a151de4` — `[鏈：BNB Chain] [攻擊合約] [身份：事件 50] [狀態：公開來源確認]`\n- `0x5021d71859f81b4c905b573591db8f9cc4a0c6fe` — `[鏈：BNB Chain] [受害/漏洞合約] [身份：事件 50] [狀態：公開來源確認]`\n- `0x66960f7febf399fa8bd94904398f535c500f4f575dbf025de7b9ab450342645e` — `[鏈：BNB Chain] [攻擊 Tx] [身份：事件 50] [狀態：公開來源確認]`\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nAIDCToken lets ordinary transfers burn accumulated sell-side amounts directly from the AMM pair.\n\n## Incident sequence\nThe attacker used the cited contract or infrastructure weakness to move assets from the affected contract, wallet or pool. Historical-state reproduction or the cited public alert supports the event; later movement remains undisclosed.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nThe reproduced flow involved approximately 220.13 WBNB, but the available sources did not support a stable USD loss value.\n\n## Addresses and transactions\n1. `0x89eb2c99e970d831525c7a52badc290afa116b63` — BNB Chain; publicly identified attacker address.\n2. `0x26f625738019a1d710b074b23714d1538a151de4` — BNB Chain; publicly identified attacker contract.\n3. `0x5021d71859f81b4c905b573591db8f9cc4a0c6fe` — BNB Chain; affected or vulnerable contract (not an attacker).\n4. `0x66960f7febf399fa8bd94904398f535c500f4f575dbf025de7b9ab450342645e` — BNB Chain; attack or execution transaction.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "protocol-exploit", "severity": "low", "ecosystems": [ "BNB Chain" ], "chains": [ "BNB Chain" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "复现流程涉及约 220.13 WBNB，但现有来源不足以支持稳定美元损失值。", "tw": "復現流程涉及約 220.13 WBNB，但現有來源不足以支持穩定美元損失值。", "en": "The reproduced flow involved approximately 220.13 WBNB, but the available sources did not support a stable USD loss value." }, "addressDisclosure": "published", "addresses": [ { "chain": "BNB Chain", "address": "0x89eb2c99e970d831525c7a52badc290afa116b63", "entity": { "zh": "公开攻击者地址", "tw": "公開攻擊者地址", "en": "publicly identified attacker address" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/TenArmorAlert/status/2071415914948685892", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [攻击者] [身份：事件 50] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [攻擊者] [身份：事件 50] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker address. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x26f625738019a1d710b074b23714d1538a151de4", "entity": { "zh": "公开攻击合约", "tw": "公開攻擊合約", "en": "publicly identified attacker contract" }, "role": "attacker-contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/TenArmorAlert/status/2071415914948685892", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [攻击合约] [身份：事件 50] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [攻擊合約] [身份：事件 50] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker contract. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x5021d71859f81b4c905b573591db8f9cc4a0c6fe", "entity": { "zh": "受影响或漏洞合约（非攻击者）", "tw": "受影響或漏洞合約（非攻擊者）", "en": "affected or vulnerable contract (not an attacker)" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/TenArmorAlert/status/2071415914948685892", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [受害/漏洞合约] [身份：事件 50] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [受害/漏洞合約] [身份：事件 50] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "affected or vulnerable contract (not an attacker). The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "公开安全预警或项目说明", "tw": "公開安全預警或專案說明", "en": "Public security alert or project statement" }, "url": "https://x.com/TenArmorAlert/status/2071415914948685892", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-105", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-104", "status": "verified", "incidentDate": "2026-06-27", "datePrecision": "day", "title": { "zh": "Cook Finance Issuance", "tw": "Cook Finance Issuance", "en": "Cook Finance Issuance — on-chain smart-contract exploit" }, "summary": { "zh": "公开来源确认 Cook Finance Issuance 发生智能合约漏洞、链上攻击事件，损失约 $50,000。", "tw": "公開來源確認 Cook Finance Issuance 發生智能合約漏洞、鏈上攻擊事件，損失約 $50,000。", "en": "Public sources report Cook Finance Issuance — on-chain smart-contract exploit, with a loss of approximately $50,000." }, "details": { "zh": "## 事件背景\nissueWithSingleToken2 used attacker-supplied weightings to trade CKToken holdings\n\n## 事件经过\n攻击者调用存在缺陷的合约路径，利用闪电流动性、储备/价格操纵、错误记账、权限或签名校验缺陷完成资产提取；交易已由 DeFiHackLabs 在历史状态上复现。\n\n## 资金流向\n受害合约或流动性池 → 攻击合约或攻击者地址。公开资料未披露后续兑换与资金转移路径。\n\n## 金额口径\n公开可核损失按 $50,000 记录；原报告资产口径为“~$50,000 USD”。\n\n## 地址与交易\n- `0xee18c4c2e123402731f43d680e75ca2809c30f8b` — `[链：BNB Chain] [攻击者] [身份：事件 49] [状态：公开来源确认]`\n- `0xeffcb496cae89e7e92abe17d22386345707ceee4` — `[链：BNB Chain] [攻击合约] [身份：事件 49] [状态：公开来源确认]`\n- `0x7db3cbaf736c049933a3af28dbed4a4442aa89d0` — `[链：BNB Chain] [受害/漏洞合约] [身份：事件 49] [状态：公开来源确认]`\n- `0x51e46828b7aabfa810910b3f8ca535053716e6bcb8b7f94a4ff59757d71a1bca` — `[链：BNB Chain] [攻击 Tx] [身份：事件 49] [状态：公开来源确认]`\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\nissueWithSingleToken2 used attacker-supplied weightings to trade CKToken holdings\n\n## 事件經過\n攻擊者調用存在缺陷的合約路徑，利用閃電流動性、儲備/價格操縱、錯誤記賬、權限或簽名校驗缺陷完成資產提取；交易已由 DeFiHackLabs 在歷史狀態上覆現。\n\n## 資金流向\n受害合約或流動性池 → 攻擊合約或攻擊者地址。公開資料未披露後續兌換與資金轉移路徑。\n\n## 金額口徑\n公開可核損失按 $50,000 記錄；原報告資產口徑為“~$50,000 USD”。\n\n## 地址與交易\n- `0xee18c4c2e123402731f43d680e75ca2809c30f8b` — `[鏈：BNB Chain] [攻擊者] [身份：事件 49] [狀態：公開來源確認]`\n- `0xeffcb496cae89e7e92abe17d22386345707ceee4` — `[鏈：BNB Chain] [攻擊合約] [身份：事件 49] [狀態：公開來源確認]`\n- `0x7db3cbaf736c049933a3af28dbed4a4442aa89d0` — `[鏈：BNB Chain] [受害/漏洞合約] [身份：事件 49] [狀態：公開來源確認]`\n- `0x51e46828b7aabfa810910b3f8ca535053716e6bcb8b7f94a4ff59757d71a1bca` — `[鏈：BNB Chain] [攻擊 Tx] [身份：事件 49] [狀態：公開來源確認]`\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nissueWithSingleToken2 used attacker-supplied weightings to trade CKToken holdings\n\n## Incident sequence\nThe attacker used the cited contract or infrastructure weakness to move assets from the affected contract, wallet or pool. Historical-state reproduction or the cited public alert supports the event; later movement remains undisclosed.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nVerified loss is recorded at $50,000. The report's underlying asset basis was: ~$50,000 USD.\n\n## Addresses and transactions\n1. `0xee18c4c2e123402731f43d680e75ca2809c30f8b` — BNB Chain; publicly identified attacker address.\n2. `0xeffcb496cae89e7e92abe17d22386345707ceee4` — BNB Chain; publicly identified attacker contract.\n3. `0x7db3cbaf736c049933a3af28dbed4a4442aa89d0` — BNB Chain; affected or vulnerable contract (not an attacker).\n4. `0x51e46828b7aabfa810910b3f8ca535053716e6bcb8b7f94a4ff59757d71a1bca` — BNB Chain; attack or execution transaction.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "protocol-exploit", "severity": "low", "ecosystems": [ "BNB Chain" ], "chains": [ "BNB Chain" ], "lossUsd": 50000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开可核损失按 $50,000 记录；原报告资产口径为“~$50,000 USD”。", "tw": "公開可核損失按 $50,000 記錄；原報告資產口徑為“~$50,000 USD”。", "en": "Verified loss is recorded at $50,000. The report's underlying asset basis was: ~$50,000 USD." }, "addressDisclosure": "published", "addresses": [ { "chain": "BNB Chain", "address": "0xee18c4c2e123402731f43d680e75ca2809c30f8b", "entity": { "zh": "公开攻击者地址", "tw": "公開攻擊者地址", "en": "publicly identified attacker address" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/DefimonAlerts/status/2071497001443770684", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [攻击者] [身份：事件 49] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [攻擊者] [身份：事件 49] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker address. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xeffcb496cae89e7e92abe17d22386345707ceee4", "entity": { "zh": "公开攻击合约", "tw": "公開攻擊合約", "en": "publicly identified attacker contract" }, "role": "attacker-contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/DefimonAlerts/status/2071497001443770684", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [攻击合约] [身份：事件 49] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [攻擊合約] [身份：事件 49] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker contract. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x7db3cbaf736c049933a3af28dbed4a4442aa89d0", "entity": { "zh": "受影响或漏洞合约（非攻击者）", "tw": "受影響或漏洞合約（非攻擊者）", "en": "affected or vulnerable contract (not an attacker)" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/DefimonAlerts/status/2071497001443770684", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [受害/漏洞合约] [身份：事件 49] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [受害/漏洞合約] [身份：事件 49] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "affected or vulnerable contract (not an attacker). The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "公开安全预警或项目说明", "tw": "公開安全預警或專案說明", "en": "Public security alert or project statement" }, "url": "https://x.com/DefimonAlerts/status/2071497001443770684", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-104", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-103", "status": "verified", "incidentDate": "2026-06-26", "datePrecision": "day", "title": { "zh": "Mini Shai-Hulud / Miasma / Hades 扩展至 Go 模块", "tw": "Mini Shai-Hulud / Miasma / Hades 擴展至 Go 模塊", "en": "Mini Shai-Hulud, Miasma and Hades malware expands into Go modules" }, "summary": { "zh": "公开来源确认 Mini Shai-Hulud、Miasma 和 Hades 恶意软件扩展至 Go 模块，构成供应链安全事件；未披露统一可核损失金额。", "tw": "公開來源確認 Mini Shai-Hulud、Miasma 和 Hades 惡意軟件擴展至 Go 模塊，構成供應鏈安全事件；未披露統一可核損失金額。", "en": "Mini Shai-Hulud, Miasma, and Hades malware expanded into Go modules in a documented supply-chain campaign; no verified aggregate loss amount was published." }, "details": { "zh": "## 事件背景\n同源恶意软件家族从 npm 扩展到 Go 模块生态。\n\n## 事件经过\n安全机构或媒体在窗口内公开披露该独立活动/受害项目；按不同受害发布链、项目或攻击面分别列项，避免把多个事件压成一个“供应链簇”。\n\n## 资金流向\n恶意包、伪仓库或被入侵前端 → 开发者/用户设备 → 凭据、钱包授权或资产风险；没有统一可核链上收款地址。\n\n## 金额口径\n受影响 Go 模块带来凭据风险；未公开统一链上损失。\n\n## 地址与交易\n链上地址与 TxID 未公开（不适用）；事件属于链下供应链或前端安全。\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\n同源惡意軟件家族從 npm 擴展到 Go 模塊生態。\n\n## 事件經過\n安全機構或媒體在窗口內公開披露該獨立活動/受害專案；按不同受害發布鏈、專案或攻擊面分別列項，避免把多個事件壓成一個“供應鏈簇”。\n\n## 資金流向\n惡意包、偽倉庫或被入侵前端 → 開發者/用戶設備 → 憑據、錢包授權或資產風險；沒有統一可核鏈上收款地址。\n\n## 金額口徑\n受影響 Go 模塊帶來憑據風險；未公開統一鏈上損失。\n\n## 地址與交易\n鏈上地址與 TxID 未公開（不適用）；事件屬於鏈下供應鏈或前端安全。\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nThe related malware family expanded from npm packages into the Go-module ecosystem used by Cosmos developers.\n\n## Incident sequence\nSecurity researchers or public reporting disclosed this distinct campaign or affected project during the June window. It is kept separate from other supply-chain incidents because the affected publishing chain, project or attack surface differs.\n\n## Fund flow\nA malicious package, repository or compromised front end exposed developer or user devices to credential, wallet-authorization or asset risk. No single verified receiving address was published.\n\n## Amount basis\nAffected Go modules created credential exposure; no single verified on-chain loss amount was published.\n\n## Addresses and transactions\nNo applicable blockchain address or transaction was published because this is an off-chain supply-chain, malware, front-end, or enforcement event.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "supply-chain", "severity": "medium", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "受影响 Go 模块带来凭据风险；未公开统一链上损失。", "tw": "受影響 Go 模塊帶來憑據風險；未公開統一鏈上損失。", "en": "Affected Go modules created credential exposure; no single verified on-chain loss amount was published." }, "addressDisclosure": "not-applicable", "addresses": [], "references": [ { "label": { "zh": "公开安全预警或项目说明", "tw": "公開安全預警或專案說明", "en": "Public security alert or project statement" }, "url": "https://x.com/SlowMist_Team/status/2070351466435690693", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-103", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-102", "status": "verified", "incidentDate": "2026-06-25", "datePrecision": "day", "title": { "zh": "czirker 开发者账户与 23 个 npm 包污染", "tw": "czirker 開發者帳戶與 23 個 npm 包汙染", "en": "czirker developer account compromise contaminates 23 npm packages" }, "summary": { "zh": "czirker 开发者账户失陷后，23 个 npm 包受到污染；该供应链事件未披露统一可核损失金额。", "tw": "czirker 開發者賬戶失陷後，23 個 npm 包受到污染；該供應鏈事件未披露統一可核損失金額。", "en": "Compromise of the czirker developer account contaminated 23 npm packages; no verified aggregate loss amount was published." }, "details": { "zh": "## 事件背景\n被入侵开发者账户通过 binding.gyp 在 npm install 期间执行恶意代码。\n\n## 事件经过\n安全机构或媒体在窗口内公开披露该独立活动/受害项目；按不同受害发布链、项目或攻击面分别列项，避免把多个事件压成一个“供应链簇”。\n\n## 资金流向\n恶意包、伪仓库或被入侵前端 → 开发者/用户设备 → 凭据、钱包授权或资产风险；没有统一可核链上收款地址。\n\n## 金额口径\n23 个 npm 包受到影响；未公开统一链上损失。\n\n## 地址与交易\n链上地址与 TxID 未公开（不适用）；事件属于链下供应链或前端安全。\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\n被入侵開發者帳戶通過 binding.gyp 在 npm install 期間執行惡意代碼。\n\n## 事件經過\n安全機構或媒體在窗口內公開披露該獨立活動/受害專案；按不同受害發布鏈、專案或攻擊面分別列項，避免把多個事件壓成一個“供應鏈簇”。\n\n## 資金流向\n惡意包、偽倉庫或被入侵前端 → 開發者/用戶設備 → 憑據、錢包授權或資產風險；沒有統一可核鏈上收款地址。\n\n## 金額口徑\n23 個 npm 包受到影響；未公開統一鏈上損失。\n\n## 地址與交易\n鏈上地址與 TxID 未公開（不適用）；事件屬於鏈下供應鏈或前端安全。\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nA compromised developer account used binding.gyp to execute malicious code during npm installation.\n\n## Incident sequence\nSecurity researchers or public reporting disclosed this distinct campaign or affected project during the June window. It is kept separate from other supply-chain incidents because the affected publishing chain, project or attack surface differs.\n\n## Fund flow\nA malicious package, repository or compromised front end exposed developer or user devices to credential, wallet-authorization or asset risk. No single verified receiving address was published.\n\n## Amount basis\n23 npm packages were affected; no single verified on-chain loss amount was published.\n\n## Addresses and transactions\nNo applicable blockchain address or transaction was published because this is an off-chain supply-chain, malware, front-end, or enforcement event.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "supply-chain", "severity": "medium", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "23 个 npm 包受到影响；未公开统一链上损失。", "tw": "23 個 npm 包受到影響；未公開統一鏈上損失。", "en": "23 npm packages were affected; no single verified on-chain loss amount was published." }, "addressDisclosure": "not-applicable", "addresses": [], "references": [ { "label": { "zh": "公开安全预警或项目说明", "tw": "公開安全預警或專案說明", "en": "Public security alert or project statement" }, "url": "https://x.com/SlowMist_Team/status/2070060735607316693", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-102", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-101", "status": "verified", "incidentDate": "2026-06-25", "datePrecision": "day", "title": { "zh": "Polymarket International", "tw": "Polymarket International", "en": "Polymarket International — Front-end Vulnerability" }, "summary": { "zh": "公开来源确认 Polymarket International 发生 Front-end Vulnerability 事件，损失约 $3,000,000。", "tw": "公開來源確認 Polymarket International 發生 Front-end Vulnerability 事件，損失約 $3,000,000。", "en": "Public sources report Polymarket International — Front-end Vulnerability, with a loss of approximately $3,000,000." }, "details": { "zh": "## 事件背景\nFront-end Vulnerability；事件依据 DeFiLlama 月度记录及其他可检索公开来源核验。 原报告存在百万倍金额展开错误，相关数值已按正确单位更正；事件事实、来源和资产单位保持不变。\n\n## 事件经过\n公开记录确认项目在该日附近发生安全事件，但未披露完整攻击路径。\n\n## 资金流向\n资产从受害项目或钱包转向攻击者或异常接收方；公开资料未披露完整逐跳路径。\n\n## 金额口径\n公开来源支持的损失额约为 $3,000,000；原报告中的“约 $3,000,000,000,000”存在百万倍单位展开错误，已按正确单位更正。\n\n## 地址与交易\n公开资料未披露完整攻击地址与 TxID。\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\nFront-end Vulnerability；事件依據 DeFiLlama 月度記錄及其他可檢索公開來源核驗。 原報告存在百萬倍金額展開錯誤，相關數值已按正確單位更正；事件事實、來源和資產單位保持不變。\n\n## 事件經過\n公開記錄確認專案在該日附近發生安全事件，但未披露完整攻擊路徑。\n\n## 資金流向\n資產從受害專案或錢包轉向攻擊者或異常接收方；公開資料未披露完整逐跳路徑。\n\n## 金額口徑\n公開來源支持的損失額約為 $3,000,000；原報告中的“約 $3,000,000,000,000”存在百萬倍單位展開錯誤，已按正確單位更正。\n\n## 地址與交易\n公開資料未披露完整攻擊地址與 TxID。\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nPublic sources classify the incident as Front-end Vulnerability but do not disclose a complete exploit path.\n\n## Incident sequence\nPublic sources confirm a security incident near the stated date but do not disclose a complete exploit sequence, attribution, or downstream flow.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nPublic sources support a loss of approximately $3,000,000. The report contained a one-million-fold unit-expansion error, which has been corrected.\n\n## Addresses and transactions\nPublic sources do not disclose a complete address or transaction list.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "Polygon" ], "chains": [ "Polygon" ], "lossUsd": 3000000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开来源支持的损失额约为 $3,000,000；原报告中的“约 $3,000,000,000,000”存在百万倍单位展开错误，已按正确单位更正。", "tw": "公開來源支持的損失額約為 $3,000,000；原報告中的“約 $3,000,000,000,000”存在百萬倍單位展開錯誤，已按正確單位更正。", "en": "Public sources support a loss of approximately $3,000,000. The report contained a one-million-fold unit-expansion error, which has been corrected." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "公开安全预警或项目说明", "tw": "公開安全預警或專案說明", "en": "Public security alert or project statement" }, "url": "https://x.com/SlowMist_Team/status/2071437371590238249", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-101", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-100", "status": "verified", "incidentDate": "2026-06-25", "datePrecision": "day", "title": { "zh": "Ocean Protocol BPool/SideStaking", "tw": "Ocean Protocol BPool/SideStaking", "en": "Ocean Protocol BPool/SideStaking — on-chain smart-contract exploit" }, "summary": { "zh": "公开来源确认 Ocean Protocol BPool/SideStaking 发生智能合约漏洞、链上攻击事件，但未披露统一可核的美元损失额。", "tw": "公開來源確認 Ocean Protocol BPool/SideStaking 發生智能合約漏洞、鏈上攻擊事件，但未披露統一可核的美元損失額。", "en": "Public sources identify Ocean Protocol BPool/SideStaking — on-chain smart-contract exploit as a on-chain smart-contract exploit incident. No single verifiable USD loss amount was published." }, "details": { "zh": "## 事件背景\n链上复现确认合约逻辑、记账、权限或价格机制存在可被利用路径；具体步骤见攻击交易与复现源码。\n\n## 事件经过\n攻击者调用存在缺陷的合约路径，利用闪电流动性、储备/价格操纵、错误记账、权限或签名校验缺陷完成资产提取；交易已由 DeFiHackLabs 在历史状态上复现。\n\n## 资金流向\n受害合约或流动性池 → 攻击合约或攻击者地址。公开资料未披露后续兑换与资金转移路径。\n\n## 金额口径\n复现流程涉及约 127,860 mOCEAN，但没有稳定可核的美元损失口径。\n\n## 地址与交易\n- `0x3fa8cf7fea68c8e76a9838d77889464ddfb6a6cf` — `[链：Polygon] [攻击者] [身份：事件 45] [状态：公开来源确认]`\n- `0xdd4bfd70117b5b6b343fc8d2c8c0075d095dbee5` — `[链：Polygon] [攻击合约] [身份：事件 45] [状态：公开来源确认]`\n- `0xbb3051df2d3e408dae6e6daa2296bc6215f0dcfd` — `[链：Polygon] [受害/漏洞合约] [身份：事件 45] [状态：公开来源确认]`\n- `0x6dc8a7fba1303faef3ec7afa770b90b17ec5ecd73b51229277a9b0492e285796` — `[链：Polygon] [攻击 Tx] [身份：事件 45] [状态：公开来源确认]`\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\n鏈上覆現確認合約邏輯、記賬、權限或價格機制存在可被利用路徑；具體步驟見攻擊交易與復現源碼。\n\n## 事件經過\n攻擊者調用存在缺陷的合約路徑，利用閃電流動性、儲備/價格操縱、錯誤記賬、權限或簽名校驗缺陷完成資產提取；交易已由 DeFiHackLabs 在歷史狀態上覆現。\n\n## 資金流向\n受害合約或流動性池 → 攻擊合約或攻擊者地址。公開資料未披露後續兌換與資金轉移路徑。\n\n## 金額口徑\n復現流程涉及約 127,860 mOCEAN，但沒有穩定可核的美元損失口徑。\n\n## 地址與交易\n- `0x3fa8cf7fea68c8e76a9838d77889464ddfb6a6cf` — `[鏈：Polygon] [攻擊者] [身份：事件 45] [狀態：公開來源確認]`\n- `0xdd4bfd70117b5b6b343fc8d2c8c0075d095dbee5` — `[鏈：Polygon] [攻擊合約] [身份：事件 45] [狀態：公開來源確認]`\n- `0xbb3051df2d3e408dae6e6daa2296bc6215f0dcfd` — `[鏈：Polygon] [受害/漏洞合約] [身份：事件 45] [狀態：公開來源確認]`\n- `0x6dc8a7fba1303faef3ec7afa770b90b17ec5ecd73b51229277a9b0492e285796` — `[鏈：Polygon] [攻擊 Tx] [身份：事件 45] [狀態：公開來源確認]`\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nHistorical-state reproduction supports an exploitable contract, accounting, authorization, pricing, or signature-validation path. The exact evidence is preserved in the cited transaction and reproduction source.\n\n## Incident sequence\nThe attacker used the cited contract or infrastructure weakness to move assets from the affected contract, wallet or pool. Historical-state reproduction or the cited public alert supports the event; later movement remains undisclosed.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nThe reproduced flow involved approximately 127,860 mOCEAN; no stable verified USD loss basis was supplied.\n\n## Addresses and transactions\n1. `0x3fa8cf7fea68c8e76a9838d77889464ddfb6a6cf` — Polygon; publicly identified attacker address.\n2. `0xdd4bfd70117b5b6b343fc8d2c8c0075d095dbee5` — Polygon; publicly identified attacker contract.\n3. `0xbb3051df2d3e408dae6e6daa2296bc6215f0dcfd` — Polygon; affected or vulnerable contract (not an attacker).\n4. `0x6dc8a7fba1303faef3ec7afa770b90b17ec5ecd73b51229277a9b0492e285796` — Polygon; attack or execution transaction.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "protocol-exploit", "severity": "low", "ecosystems": [ "Polygon" ], "chains": [ "Polygon" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "复现流程涉及约 127,860 mOCEAN，但没有稳定可核的美元损失口径。", "tw": "復現流程涉及約 127,860 mOCEAN，但沒有穩定可核的美元損失口徑。", "en": "The reproduced flow involved approximately 127,860 mOCEAN; no stable verified USD loss basis was supplied." }, "addressDisclosure": "published", "addresses": [ { "chain": "Polygon", "address": "0x3fa8cf7fea68c8e76a9838d77889464ddfb6a6cf", "entity": { "zh": "公开攻击者地址", "tw": "公開攻擊者地址", "en": "publicly identified attacker address" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/defimonalerts/status/2070362661540286735", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Polygon] [攻击者] [身份：事件 45] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：Polygon] [攻擊者] [身份：事件 45] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker address. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "Polygon", "address": "0xdd4bfd70117b5b6b343fc8d2c8c0075d095dbee5", "entity": { "zh": "公开攻击合约", "tw": "公開攻擊合約", "en": "publicly identified attacker contract" }, "role": "attacker-contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/defimonalerts/status/2070362661540286735", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Polygon] [攻击合约] [身份：事件 45] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：Polygon] [攻擊合約] [身份：事件 45] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker contract. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "Polygon", "address": "0xbb3051df2d3e408dae6e6daa2296bc6215f0dcfd", "entity": { "zh": "受影响或漏洞合约（非攻击者）", "tw": "受影響或漏洞合約（非攻擊者）", "en": "affected or vulnerable contract (not an attacker)" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/defimonalerts/status/2070362661540286735", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Polygon] [受害/漏洞合约] [身份：事件 45] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：Polygon] [受害/漏洞合約] [身份：事件 45] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "affected or vulnerable contract (not an attacker). The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "公开安全预警或项目说明", "tw": "公開安全預警或專案說明", "en": "Public security alert or project statement" }, "url": "https://x.com/defimonalerts/status/2070362661540286735", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-100", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-099", "status": "verified", "incidentDate": "2026-06-25", "datePrecision": "day", "title": { "zh": "Lixir Finance Permit 伪签名盗币", "tw": "Lixir Finance Permit 偽簽名盜幣", "en": "Lixir Finance forged Permit signature theft" }, "summary": { "zh": "公开来源确认 Lixir Finance Permit 伪签名盗币发生智能合约漏洞、链上攻击事件，损失约 $12,300。", "tw": "公開來源確認 Lixir Finance Permit 偽簽名盜幣發生智能合約漏洞、鏈上攻擊事件，損失約 $12,300。", "en": "Public sources report Lixir Finance forged Permit signature theft, with a loss of approximately $12,300." }, "details": { "zh": "## 事件背景\n链上复现确认合约逻辑、记账、权限或价格机制存在可被利用路径；具体步骤见攻击交易与复现源码。\n\n## 事件经过\n攻击者调用存在缺陷的合约路径，利用闪电流动性、储备/价格操纵、错误记账、权限或签名校验缺陷完成资产提取；交易已由 DeFiHackLabs 在历史状态上复现。\n\n## 资金流向\n受害合约或流动性池 → 攻击合约或攻击者地址。公开资料未披露后续兑换与资金转移路径。\n\n## 金额口径\n公开可核损失按 $12,300 记录；原报告资产口径为“2.60 ETH, 4,477.72 USDC, 3,609.95 USDT, 24,182.56 LIX”。\n\n## 地址与交易\n- `0x3Fa8cF7FeA68C8E76A9838d77889464DdFb6a6cf` — `[链：Ethereum] [攻击者] [身份：事件 44] [状态：公开来源确认]`\n- `0xEFd1b12F5E3c35D7daE0D1449674C247566f9b76` — `[链：Ethereum] [攻击合约] [身份：事件 44] [状态：公开来源确认]`\n- `0xfD4c9a491DD777b8b3e13659e9E379252eC78390` — `[链：Ethereum] [受害/漏洞合约] [身份：事件 44] [状态：公开来源确认]`\n- `0x49bba4C5C4F8a2D444Ca5fDA1b3137D94Df40465` — `[链：Ethereum] [受害/漏洞合约] [身份：事件 44] [状态：公开来源确认]`\n- `0xF4AF7Ae20EB7334Cbdf334EaF850e7DB42394839` — `[链：Ethereum] [受害/漏洞合约] [身份：事件 44] [状态：公开来源确认]`\n- `0x17026faca0b8e4cb7531e4fb277c390eb165e81229628e0192923ad1d90a41da` — `[链：Ethereum] [攻击 Tx] [身份：事件 44] [状态：公开来源确认]`\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\n鏈上覆現確認合約邏輯、記賬、權限或價格機制存在可被利用路徑；具體步驟見攻擊交易與復現源碼。\n\n## 事件經過\n攻擊者調用存在缺陷的合約路徑，利用閃電流動性、儲備/價格操縱、錯誤記賬、權限或簽名校驗缺陷完成資產提取；交易已由 DeFiHackLabs 在歷史狀態上覆現。\n\n## 資金流向\n受害合約或流動性池 → 攻擊合約或攻擊者地址。公開資料未披露後續兌換與資金轉移路徑。\n\n## 金額口徑\n公開可核損失按 $12,300 記錄；原報告資產口徑為“2.60 ETH, 4,477.72 USDC, 3,609.95 USDT, 24,182.56 LIX”。\n\n## 地址與交易\n- `0x3Fa8cF7FeA68C8E76A9838d77889464DdFb6a6cf` — `[鏈：Ethereum] [攻擊者] [身份：事件 44] [狀態：公開來源確認]`\n- `0xEFd1b12F5E3c35D7daE0D1449674C247566f9b76` — `[鏈：Ethereum] [攻擊合約] [身份：事件 44] [狀態：公開來源確認]`\n- `0xfD4c9a491DD777b8b3e13659e9E379252eC78390` — `[鏈：Ethereum] [受害/漏洞合約] [身份：事件 44] [狀態：公開來源確認]`\n- `0x49bba4C5C4F8a2D444Ca5fDA1b3137D94Df40465` — `[鏈：Ethereum] [受害/漏洞合約] [身份：事件 44] [狀態：公開來源確認]`\n- `0xF4AF7Ae20EB7334Cbdf334EaF850e7DB42394839` — `[鏈：Ethereum] [受害/漏洞合約] [身份：事件 44] [狀態：公開來源確認]`\n- `0x17026faca0b8e4cb7531e4fb277c390eb165e81229628e0192923ad1d90a41da` — `[鏈：Ethereum] [攻擊 Tx] [身份：事件 44] [狀態：公開來源確認]`\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nHistorical-state reproduction supports an exploitable contract, accounting, authorization, pricing, or signature-validation path. The exact evidence is preserved in the cited transaction and reproduction source.\n\n## Incident sequence\nThe attacker used the cited contract or infrastructure weakness to move assets from the affected contract, wallet or pool. Historical-state reproduction or the cited public alert supports the event; later movement remains undisclosed.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nVerified loss is recorded at $12,300. The report's underlying asset basis was: 2.60 ETH, 4,477.72 USDC, 3,609.95 USDT, 24,182.56 LIX.\n\n## Addresses and transactions\n1. `0x3Fa8cF7FeA68C8E76A9838d77889464DdFb6a6cf` — Ethereum; publicly identified attacker address.\n2. `0xEFd1b12F5E3c35D7daE0D1449674C247566f9b76` — Ethereum; publicly identified attacker contract.\n3. `0xfD4c9a491DD777b8b3e13659e9E379252eC78390` — Ethereum; affected or vulnerable contract (not an attacker).\n4. `0x49bba4C5C4F8a2D444Ca5fDA1b3137D94Df40465` — Ethereum; affected or vulnerable contract (not an attacker).\n5. `0xF4AF7Ae20EB7334Cbdf334EaF850e7DB42394839` — Ethereum; affected or vulnerable contract (not an attacker).\n6. `0x17026faca0b8e4cb7531e4fb277c390eb165e81229628e0192923ad1d90a41da` — Ethereum; attack or execution transaction.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "protocol-exploit", "severity": "low", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 12300, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开可核损失按 $12,300 记录；原报告资产口径为“2.60 ETH, 4,477.72 USDC, 3,609.95 USDT, 24,182.56 LIX”。", "tw": "公開可核損失按 $12,300 記錄；原報告資產口徑為“2.60 ETH, 4,477.72 USDC, 3,609.95 USDT, 24,182.56 LIX”。", "en": "Verified loss is recorded at $12,300. The report's underlying asset basis was: 2.60 ETH, 4,477.72 USDC, 3,609.95 USDT, 24,182.56 LIX." }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0x3Fa8cF7FeA68C8E76A9838d77889464DdFb6a6cf", "entity": { "zh": "公开攻击者地址", "tw": "公開攻擊者地址", "en": "publicly identified attacker address" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/DefimonAlerts/status/2070362661691207935", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [攻击者] [身份：事件 44] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：Ethereum] [攻擊者] [身份：事件 44] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker address. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xEFd1b12F5E3c35D7daE0D1449674C247566f9b76", "entity": { "zh": "公开攻击合约", "tw": "公開攻擊合約", "en": "publicly identified attacker contract" }, "role": "attacker-contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/DefimonAlerts/status/2070362661691207935", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [攻击合约] [身份：事件 44] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：Ethereum] [攻擊合約] [身份：事件 44] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker contract. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xfD4c9a491DD777b8b3e13659e9E379252eC78390", "entity": { "zh": "受影响或漏洞合约（非攻击者）", "tw": "受影響或漏洞合約（非攻擊者）", "en": "affected or vulnerable contract (not an attacker)" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/DefimonAlerts/status/2070362661691207935", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [受害/漏洞合约] [身份：事件 44] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：Ethereum] [受害/漏洞合約] [身份：事件 44] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "affected or vulnerable contract (not an attacker). The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x49bba4C5C4F8a2D444Ca5fDA1b3137D94Df40465", "entity": { "zh": "受影响或漏洞合约（非攻击者）", "tw": "受影響或漏洞合約（非攻擊者）", "en": "affected or vulnerable contract (not an attacker)" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/DefimonAlerts/status/2070362661691207935", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [受害/漏洞合约] [身份：事件 44] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：Ethereum] [受害/漏洞合約] [身份：事件 44] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "affected or vulnerable contract (not an attacker). The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xF4AF7Ae20EB7334Cbdf334EaF850e7DB42394839", "entity": { "zh": "受影响或漏洞合约（非攻击者）", "tw": "受影響或漏洞合約（非攻擊者）", "en": "affected or vulnerable contract (not an attacker)" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/DefimonAlerts/status/2070362661691207935", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [受害/漏洞合约] [身份：事件 44] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：Ethereum] [受害/漏洞合約] [身份：事件 44] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "affected or vulnerable contract (not an attacker). The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "公开安全预警或项目说明", "tw": "公開安全預警或專案說明", "en": "Public security alert or project statement" }, "url": "https://x.com/DefimonAlerts/status/2070362661691207935", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-099", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-098", "status": "verified", "incidentDate": "2026-06-24", "datePrecision": "day", "title": { "zh": "Yield Yak 投票子域名前端钱包抽干器", "tw": "Yield Yak 投票子域名前端錢包抽乾器", "en": "Wallet drainer injected into Yield Yak voting subdomain" }, "summary": { "zh": "Yield Yak 投票子域名被注入钱包抽干器，形成前端安全事件；未披露统一可核损失金额。", "tw": "Yield Yak 投票子域名被注入錢包抽乾器，形成前端安全事件；未披露統一可核損失金額。", "en": "A wallet drainer was injected into the Yield Yak voting subdomain; no verified aggregate loss amount was published." }, "details": { "zh": "## 事件背景\nvote.yieldyak.com 遭前端攻击并植入多段抽干器代码。\n\n## 事件经过\n安全机构或媒体在窗口内公开披露该独立活动/受害项目；按不同受害发布链、项目或攻击面分别列项，避免把多个事件压成一个“供应链簇”。\n\n## 资金流向\n恶意包、伪仓库或被入侵前端 → 开发者/用户设备 → 凭据、钱包授权或资产风险；没有统一可核链上收款地址。\n\n## 金额口径\n检测到 11 段钱包抽干器代码；未公开统一可核的用户损失额。\n\n## 地址与交易\n链上地址与 TxID 未公开（不适用）；事件属于链下供应链或前端安全。\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\nvote.yieldyak.com 遭前端攻擊並植入多段抽乾器代碼。\n\n## 事件經過\n安全機構或媒體在窗口內公開披露該獨立活動/受害專案；按不同受害發布鏈、專案或攻擊面分別列項，避免把多個事件壓成一個“供應鏈簇”。\n\n## 資金流向\n惡意包、偽倉庫或被入侵前端 → 開發者/用戶設備 → 憑據、錢包授權或資產風險；沒有統一可核鏈上收款地址。\n\n## 金額口徑\n檢測到 11 段錢包抽乾器代碼；未公開統一可核的用戶損失額。\n\n## 地址與交易\n鏈上地址與 TxID 未公開（不適用）；事件屬於鏈下供應鏈或前端安全。\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nvote.yieldyak.com was compromised and multiple wallet-drainer code fragments were injected into the front end.\n\n## Incident sequence\nSecurity researchers or public reporting disclosed this distinct campaign or affected project during the June window. It is kept separate from other supply-chain incidents because the affected publishing chain, project or attack surface differs.\n\n## Fund flow\nA malicious package, repository or compromised front end exposed developer or user devices to credential, wallet-authorization or asset risk. No single verified receiving address was published.\n\n## Amount basis\nEleven wallet-drainer code fragments were detected; no verified aggregate user-loss amount was published.\n\n## Addresses and transactions\nNo applicable blockchain address or transaction was published because this is an off-chain supply-chain, malware, front-end, or enforcement event.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "supply-chain", "severity": "medium", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "检测到 11 段钱包抽干器代码；未公开统一可核的用户损失额。", "tw": "檢測到 11 段錢包抽乾器代碼；未公開統一可核的用戶損失額。", "en": "Eleven wallet-drainer code fragments were detected; no verified aggregate user-loss amount was published." }, "addressDisclosure": "not-applicable", "addresses": [], "references": [ { "label": { "zh": "cryptopolitan.com 公开来源", "tw": "cryptopolitan.com 公開來源", "en": "cryptopolitan.com public source" }, "url": "https://www.cryptopolitan.com/yield-yak-gitcoin-in-wallet-drainer-attack/", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-098", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-097", "status": "verified", "incidentDate": "2026-06-24", "datePrecision": "day", "title": { "zh": "DLMC", "tw": "DLMC", "en": "DLMC — on-chain smart-contract exploit" }, "summary": { "zh": "公开来源确认 DLMC 发生智能合约漏洞、链上攻击事件，损失约 $222,560。", "tw": "公開來源確認 DLMC 發生智能合約漏洞、鏈上攻擊事件，損失約 $222,560。", "en": "Public sources report DLMC — on-chain smart-contract exploit, with a loss of approximately $222,560." }, "details": { "zh": "## 事件背景\n链上复现确认合约逻辑、记账、权限或价格机制存在可被利用路径；具体步骤见攻击交易与复现源码。\n\n## 事件经过\n攻击者调用存在缺陷的合约路径，利用闪电流动性、储备/价格操纵、错误记账、权限或签名校验缺陷完成资产提取；交易已由 DeFiHackLabs 在历史状态上复现。\n\n## 资金流向\n受害合约或流动性池 → 攻击合约或攻击者地址。公开资料未披露后续兑换与资金转移路径。\n\n## 金额口径\n公开可核损失按 $222,560 记录；原报告资产口径为“222,560.22 USDT”。\n\n## 地址与交易\n- `0x701bb7b460ae231dbbcfa3d87f0ab5b458429699` — `[链：BNB Chain] [攻击者] [身份：事件 42] [状态：公开来源确认]`\n- `0xe81bf6e392eca9ad594b5452ea53cf7071760a04` — `[链：BNB Chain] [攻击合约] [身份：事件 42] [状态：公开来源确认]`\n- `0xf2ca2a3572b26ae7c479dc7ae36d922113b1bdf2` — `[链：BNB Chain] [受害/漏洞合约] [身份：事件 42] [状态：公开来源确认]`\n- `0x151025d3f0a782340a74d30ef33a5fad044b838e74437a803f0652e70c231306` — `[链：BNB Chain] [攻击 Tx] [身份：事件 42] [状态：公开来源确认]`\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\n鏈上覆現確認合約邏輯、記賬、權限或價格機制存在可被利用路徑；具體步驟見攻擊交易與復現源碼。\n\n## 事件經過\n攻擊者調用存在缺陷的合約路徑，利用閃電流動性、儲備/價格操縱、錯誤記賬、權限或簽名校驗缺陷完成資產提取；交易已由 DeFiHackLabs 在歷史狀態上覆現。\n\n## 資金流向\n受害合約或流動性池 → 攻擊合約或攻擊者地址。公開資料未披露後續兌換與資金轉移路徑。\n\n## 金額口徑\n公開可核損失按 $222,560 記錄；原報告資產口徑為“222,560.22 USDT”。\n\n## 地址與交易\n- `0x701bb7b460ae231dbbcfa3d87f0ab5b458429699` — `[鏈：BNB Chain] [攻擊者] [身份：事件 42] [狀態：公開來源確認]`\n- `0xe81bf6e392eca9ad594b5452ea53cf7071760a04` — `[鏈：BNB Chain] [攻擊合約] [身份：事件 42] [狀態：公開來源確認]`\n- `0xf2ca2a3572b26ae7c479dc7ae36d922113b1bdf2` — `[鏈：BNB Chain] [受害/漏洞合約] [身份：事件 42] [狀態：公開來源確認]`\n- `0x151025d3f0a782340a74d30ef33a5fad044b838e74437a803f0652e70c231306` — `[鏈：BNB Chain] [攻擊 Tx] [身份：事件 42] [狀態：公開來源確認]`\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nHistorical-state reproduction supports an exploitable contract, accounting, authorization, pricing, or signature-validation path. The exact evidence is preserved in the cited transaction and reproduction source.\n\n## Incident sequence\nThe attacker used the cited contract or infrastructure weakness to move assets from the affected contract, wallet or pool. Historical-state reproduction or the cited public alert supports the event; later movement remains undisclosed.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nVerified loss is recorded at $222,560. The report's underlying asset basis was: 222,560.22 USDT.\n\n## Addresses and transactions\n1. `0x701bb7b460ae231dbbcfa3d87f0ab5b458429699` — BNB Chain; publicly identified attacker address.\n2. `0xe81bf6e392eca9ad594b5452ea53cf7071760a04` — BNB Chain; publicly identified attacker contract.\n3. `0xf2ca2a3572b26ae7c479dc7ae36d922113b1bdf2` — BNB Chain; affected or vulnerable contract (not an attacker).\n4. `0x151025d3f0a782340a74d30ef33a5fad044b838e74437a803f0652e70c231306` — BNB Chain; attack or execution transaction.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "protocol-exploit", "severity": "medium", "ecosystems": [ "BNB Chain" ], "chains": [ "BNB Chain" ], "lossUsd": 222560.22, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开可核损失按 $222,560 记录；原报告资产口径为“222,560.22 USDT”。", "tw": "公開可核損失按 $222,560 記錄；原報告資產口徑為“222,560.22 USDT”。", "en": "Verified loss is recorded at $222,560. The report's underlying asset basis was: 222,560.22 USDT." }, "addressDisclosure": "published", "addresses": [ { "chain": "BNB Chain", "address": "0x701bb7b460ae231dbbcfa3d87f0ab5b458429699", "entity": { "zh": "公开攻击者地址", "tw": "公開攻擊者地址", "en": "publicly identified attacker address" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/TenArmorAlert/status/2069957542109958498", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [攻击者] [身份：事件 42] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [攻擊者] [身份：事件 42] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker address. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xe81bf6e392eca9ad594b5452ea53cf7071760a04", "entity": { "zh": "公开攻击合约", "tw": "公開攻擊合約", "en": "publicly identified attacker contract" }, "role": "attacker-contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/TenArmorAlert/status/2069957542109958498", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [攻击合约] [身份：事件 42] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [攻擊合約] [身份：事件 42] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker contract. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xf2ca2a3572b26ae7c479dc7ae36d922113b1bdf2", "entity": { "zh": "受影响或漏洞合约（非攻击者）", "tw": "受影響或漏洞合約（非攻擊者）", "en": "affected or vulnerable contract (not an attacker)" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/TenArmorAlert/status/2069957542109958498", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [受害/漏洞合约] [身份：事件 42] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [受害/漏洞合約] [身份：事件 42] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "affected or vulnerable contract (not an attacker). The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "公开安全预警或项目说明", "tw": "公開安全預警或專案說明", "en": "Public security alert or project statement" }, "url": "https://x.com/TenArmorAlert/status/2069957542109958498", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-097", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-096", "status": "verified", "incidentDate": "2026-06-23", "datePrecision": "day", "title": { "zh": "Royal.io/Royal Royalties", "tw": "Royal.io/Royal Royalties", "en": "Royal.io/Royal Royalties — on-chain smart-contract exploit" }, "summary": { "zh": "公开来源确认 Royal.io/Royal Royalties 发生智能合约漏洞、链上攻击事件，损失约 $261,163。", "tw": "公開來源確認 Royal.io/Royal Royalties 發生智能合約漏洞、鏈上攻擊事件，損失約 $261,163。", "en": "Public sources report Royal.io/Royal Royalties — on-chain smart-contract exploit, with a loss of approximately $261,163." }, "details": { "zh": "## 事件背景\nRoyal1155LDA updates custom per-tier balance bookkeeping for every ERC1155 batch\n\n## 事件经过\n攻击者调用存在缺陷的合约路径，利用闪电流动性、储备/价格操纵、错误记账、权限或签名校验缺陷完成资产提取；交易已由 DeFiHackLabs 在历史状态上复现。\n\n## 资金流向\n受害合约或流动性池 → 攻击合约或攻击者地址。公开资料未披露后续兑换与资金转移路径。\n\n## 金额口径\n公开可核损失按 $261,163 记录；原报告资产口径为“261,162.93 USDC”。\n\n## 地址与交易\n- `0xbd829aa63311bb1e3c0ea58a7193364de670bd56` — `[链：Polygon] [攻击者] [身份：事件 40] [状态：公开来源确认]`\n- `0x11ca9155aedfeb6772df5ea42ff714db7fba6adb` — `[链：Polygon] [攻击合约] [身份：事件 40] [状态：公开来源确认]`\n- `0xd5b297c08d890376b6cbdba6023a39ffbdf65c78` — `[链：Polygon] [受害/漏洞合约] [身份：事件 40] [状态：公开来源确认]`\n- `0x7a92106f145045b7a2bdce60a22109739f9b0cd0185bf16ff83fd1fac98cb42e` — `[链：Polygon] [攻击 Tx] [身份：事件 40] [状态：公开来源确认]`\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\nRoyal1155LDA updates custom per-tier balance bookkeeping for every ERC1155 batch\n\n## 事件經過\n攻擊者調用存在缺陷的合約路徑，利用閃電流動性、儲備/價格操縱、錯誤記賬、權限或簽名校驗缺陷完成資產提取；交易已由 DeFiHackLabs 在歷史狀態上覆現。\n\n## 資金流向\n受害合約或流動性池 → 攻擊合約或攻擊者地址。公開資料未披露後續兌換與資金轉移路徑。\n\n## 金額口徑\n公開可核損失按 $261,163 記錄；原報告資產口徑為“261,162.93 USDC”。\n\n## 地址與交易\n- `0xbd829aa63311bb1e3c0ea58a7193364de670bd56` — `[鏈：Polygon] [攻擊者] [身份：事件 40] [狀態：公開來源確認]`\n- `0x11ca9155aedfeb6772df5ea42ff714db7fba6adb` — `[鏈：Polygon] [攻擊合約] [身份：事件 40] [狀態：公開來源確認]`\n- `0xd5b297c08d890376b6cbdba6023a39ffbdf65c78` — `[鏈：Polygon] [受害/漏洞合約] [身份：事件 40] [狀態：公開來源確認]`\n- `0x7a92106f145045b7a2bdce60a22109739f9b0cd0185bf16ff83fd1fac98cb42e` — `[鏈：Polygon] [攻擊 Tx] [身份：事件 40] [狀態：公開來源確認]`\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nRoyal1155LDA updates custom per-tier balance bookkeeping for every ERC1155 batch\n\n## Incident sequence\nThe attacker used the cited contract or infrastructure weakness to move assets from the affected contract, wallet or pool. Historical-state reproduction or the cited public alert supports the event; later movement remains undisclosed.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nVerified loss is recorded at $261,163. The report's underlying asset basis was: 261,162.93 USDC.\n\n## Addresses and transactions\n1. `0xbd829aa63311bb1e3c0ea58a7193364de670bd56` — Polygon; publicly identified attacker address.\n2. `0x11ca9155aedfeb6772df5ea42ff714db7fba6adb` — Polygon; publicly identified attacker contract.\n3. `0xd5b297c08d890376b6cbdba6023a39ffbdf65c78` — Polygon; affected or vulnerable contract (not an attacker).\n4. `0x7a92106f145045b7a2bdce60a22109739f9b0cd0185bf16ff83fd1fac98cb42e` — Polygon; attack or execution transaction.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "protocol-exploit", "severity": "medium", "ecosystems": [ "Polygon" ], "chains": [ "Polygon" ], "lossUsd": 261162.93, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开可核损失按 $261,163 记录；原报告资产口径为“261,162.93 USDC”。", "tw": "公開可核損失按 $261,163 記錄；原報告資產口徑為“261,162.93 USDC”。", "en": "Verified loss is recorded at $261,163. The report's underlying asset basis was: 261,162.93 USDC." }, "addressDisclosure": "published", "addresses": [ { "chain": "Polygon", "address": "0xbd829aa63311bb1e3c0ea58a7193364de670bd56", "entity": { "zh": "公开攻击者地址", "tw": "公開攻擊者地址", "en": "publicly identified attacker address" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/TenArmorAlert/status/2069596801725002121", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Polygon] [攻击者] [身份：事件 40] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：Polygon] [攻擊者] [身份：事件 40] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker address. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "Polygon", "address": "0x11ca9155aedfeb6772df5ea42ff714db7fba6adb", "entity": { "zh": "公开攻击合约", "tw": "公開攻擊合約", "en": "publicly identified attacker contract" }, "role": "attacker-contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/TenArmorAlert/status/2069596801725002121", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Polygon] [攻击合约] [身份：事件 40] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：Polygon] [攻擊合約] [身份：事件 40] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker contract. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "Polygon", "address": "0xd5b297c08d890376b6cbdba6023a39ffbdf65c78", "entity": { "zh": "受影响或漏洞合约（非攻击者）", "tw": "受影響或漏洞合約（非攻擊者）", "en": "affected or vulnerable contract (not an attacker)" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/TenArmorAlert/status/2069596801725002121", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Polygon] [受害/漏洞合约] [身份：事件 40] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：Polygon] [受害/漏洞合約] [身份：事件 40] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "affected or vulnerable contract (not an attacker). The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "公开安全预警或项目说明", "tw": "公開安全預警或專案說明", "en": "Public security alert or project statement" }, "url": "https://x.com/TenArmorAlert/status/2069596801725002121", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-096", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-095", "status": "verified", "incidentDate": "2026-06-23", "datePrecision": "day", "title": { "zh": "Gitcoin 投票子域名前端钱包抽干器", "tw": "Gitcoin 投票子域名前端錢包抽乾器", "en": "Wallet drainer injected into a Gitcoin voting subdomain" }, "summary": { "zh": "Gitcoin 投票子域名被注入钱包抽干器，形成前端安全事件；未披露统一可核损失金额。", "tw": "Gitcoin 投票子域名被注入錢包抽乾器，形成前端安全事件；未披露統一可核損失金額。", "en": "A wallet drainer was injected into a Gitcoin voting subdomain; no verified aggregate loss amount was published." }, "details": { "zh": "## 事件背景\nGitcoin 相关投票子域名被植入钱包 drainer。\n\n## 事件经过\n安全机构或媒体在窗口内公开披露该独立活动/受害项目；按不同受害发布链、项目或攻击面分别列项，避免把多个事件压成一个“供应链簇”。\n\n## 资金流向\n恶意包、伪仓库或被入侵前端 → 开发者/用户设备 → 凭据、钱包授权或资产风险；没有统一可核链上收款地址。\n\n## 金额口径\n未公开统一可核的用户损失额。\n\n## 地址与交易\n链上地址与 TxID 未公开（不适用）；事件属于链下供应链或前端安全。\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\nGitcoin 相關投票子域名被植入錢包 drainer。\n\n## 事件經過\n安全機構或媒體在窗口內公開披露該獨立活動/受害專案；按不同受害發布鏈、專案或攻擊面分別列項，避免把多個事件壓成一個“供應鏈簇”。\n\n## 資金流向\n惡意包、偽倉庫或被入侵前端 → 開發者/用戶設備 → 憑據、錢包授權或資產風險；沒有統一可核鏈上收款地址。\n\n## 金額口徑\n未公開統一可核的用戶損失額。\n\n## 地址與交易\n鏈上地址與 TxID 未公開（不適用）；事件屬於鏈下供應鏈或前端安全。\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nA Gitcoin-related voting subdomain was compromised and modified to serve a wallet drainer.\n\n## Incident sequence\nSecurity researchers or public reporting disclosed this distinct campaign or affected project during the June window. It is kept separate from other supply-chain incidents because the affected publishing chain, project or attack surface differs.\n\n## Fund flow\nA malicious package, repository or compromised front end exposed developer or user devices to credential, wallet-authorization or asset risk. No single verified receiving address was published.\n\n## Amount basis\nNo verified aggregate user-loss amount was published.\n\n## Addresses and transactions\nNo applicable blockchain address or transaction was published because this is an off-chain supply-chain, malware, front-end, or enforcement event.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "supply-chain", "severity": "medium", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "未公开统一可核的用户损失额。", "tw": "未公開統一可核的用戶損失額。", "en": "No verified aggregate user-loss amount was published." }, "addressDisclosure": "not-applicable", "addresses": [], "references": [ { "label": { "zh": "cryptopolitan.com 公开来源", "tw": "cryptopolitan.com 公開來源", "en": "cryptopolitan.com public source" }, "url": "https://www.cryptopolitan.com/yield-yak-gitcoin-in-wallet-drainer-attack/", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-095", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-005", "status": "verified", "incidentDate": "2026-06-23", "datePrecision": "day", "title": { "zh": "SecondFi Cardano 钱包可预测私钥漏洞", "tw": "SecondFi Cardano 錢包可預測私鑰漏洞", "en": "SecondFi — Predictable Private Key Exploit" }, "summary": { "zh": "SecondFi 网页钱包软件签名器的确定性随机数推导缺陷使部分 Cardano 私钥可由公开签名推导。公开资料确认约 1,600 万枚 ADA、约 240 万美元资产被盗。", "tw": "SecondFi 網頁錢包軟件簽名器的確定性隨機數推導缺陷使部分 Cardano 私鑰可由公開簽名推導。公開資料確認約 1,600 萬枚 ADA、約 240 萬美元資產被盜。", "en": "A deterministic nonce-derivation flaw in the SecondFi web-wallet software signer made some Cardano private keys derivable from public signatures. Public reporting confirms about 16 million ADA, worth roughly $2.4 million, was stolen." }, "details": { "zh": "## 事件背景\nSecondFi（原 Yoroi，由 EMURGO 开发）的网页钱包软件签名器存在确定性随机数推导缺陷。攻击者可利用链上公开签名推导部分受影响钱包的私钥。这是钱包软件实现问题，不是 Cardano 账本或共识机制失陷。\n\n## 事件经过\n1. 公开资料显示，攻击主要发生在 2026 年 6 月 21 日至 23 日，并呈现自动化批量转移特征。\n2. 多轮攻击影响数百个地址，约 1,600 万枚 ADA 以及部分 Token 和 NFT 被转走。\n3. SecondFi 暂停服务并要求受影响用户把资产迁移到用可信钱包新建的地址，仅把旧助记词导入其他软件不能消除已经暴露的密钥风险。\n4. 项目随后完成余额快照并启动索赔和处置流程。\n\n## 资金流向\n资产从受影响的 SecondFi 用户地址转入攻击者控制地址。现有核验来源没有形成可逐笔复核的完整收款地址与交易清单，也没有确认后续进入交易所、跨链桥或混币器的完整路径。\n\n## 金额口径\n已确认被盗约 1,600 万枚 ADA，事发估值约 240 万美元。第三方提及的超过 2,000 万美元潜在风险敞口，以及项目紧急转移托管的约 1.29 亿枚 ADA，均不是已确认被盗金额，不能与 240 万美元相加。原报告的 2.4 万亿美元数字属于单位展开错误。\n\n## 地址与交易\n现有三项核验来源没有公布可逐笔复核的完整受害地址、攻击者地址和交易清单。\n\n## 证据边界\n公开资料支持软件签名器缺陷、批量盗币、已确认损失和项目处置。受影响地址数量、潜在风险敞口及抢救资产规模存在不同统计口径；确认损失仅计约 1,600 万枚 ADA、约 240 万美元列为确认损失。\n\n## 处置状态\nSecondFi 已暂停相关服务、完成余额快照并启动索赔流程。公开资料未确认已被盗的约 1,600 万枚 ADA 已返还受害者。", "tw": "## 事件背景\nSecondFi（原 Yoroi，由 EMURGO 開發）的網頁錢包軟件簽名器存在確定性隨機數推導缺陷。攻擊者可利用鏈上公開簽名推導部分受影響錢包的私鑰。這是錢包軟件實現問題，不是 Cardano 賬本或共識機制失陷。\n\n## 事件經過\n1. 公開資料顯示，攻擊主要發生在 2026 年 6 月 21 日至 23 日，並呈現自動化批量轉移特徵。\n2. 多輪攻擊影響數百個地址，約 1,600 萬枚 ADA 以及部分 Token 和 NFT 被轉走。\n3. SecondFi 暫停服務並要求受影響用戶把資產遷移到用可信錢包新建的地址，僅把舊助記詞導入其他軟件不能消除已經暴露的密鑰風險。\n4. 項目隨後完成餘額快照並啟動索賠和處置流程。\n\n## 資金流向\n資產從受影響的 SecondFi 用戶地址轉入攻擊者控制地址。現有核驗來源沒有形成可逐筆覆核的完整收款地址與交易清單，也沒有確認後續進入交易所、跨鏈橋或混幣器的完整路徑。\n\n## 金額口徑\n已確認被盜約 1,600 萬枚 ADA，事發估值約 240 萬美元。第三方提及的超過 2,000 萬美元潛在風險敞口，以及項目緊急轉移託管的約 1.29 億枚 ADA，均不是已確認被盜金額，不能與 240 萬美元相加。原報告的 2.4 萬億美元數字屬於單位展開錯誤。\n\n## 地址與交易\n現有三項核驗來源沒有公布可逐筆覆核的完整受害地址、攻擊者地址和交易清單。\n\n## 證據邊界\n公開資料支持軟件簽名器缺陷、批量盜幣、已確認損失和項目處置。受影響地址數量、潛在風險敞口及搶救資產規模存在不同統計口徑；確認損失僅計約 1,600 萬枚 ADA、約 240 萬美元列為確認損失。\n\n## 處置狀態\nSecondFi 已暫停相關服務、完成餘額快照並啟動索賠流程。公開資料未確認已被盜的約 1,600 萬枚 ADA 已返還受害者。", "en": "## Incident background\nThe SecondFi web wallet, formerly Yoroi and developed by EMURGO, contained a deterministic nonce-derivation flaw in its software signer. Attackers could use public on-chain signatures to derive some affected private keys. This was a wallet implementation failure, not a compromise of the Cardano ledger or consensus system.\n\n## Incident sequence\n1. Public reporting places the main automated thefts between June 21 and June 23, 2026.\n2. Multiple attack waves affected hundreds of addresses and moved about 16 million ADA, plus some tokens and NFTs.\n3. SecondFi suspended service and instructed affected users to move assets to newly generated addresses. Importing an old seed phrase into different software does not remove the risk attached to an exposed key.\n4. The project later completed a balance snapshot and opened a claims and remediation process.\n\n## Fund flow\nAssets moved from affected SecondFi user addresses to attacker-controlled addresses. The cited sources do not provide a complete, transaction-by-transaction recipient list or establish a full downstream route through exchanges, bridges, or mixers.\n\n## Amount basis\nConfirmed theft is approximately 16 million ADA, valued at about $2.4 million at the time. A third-party estimate of more than $20 million in potential exposure and roughly 129 million ADA moved into emergency custody are not confirmed theft and are not added to the $2.4 million loss. The original report's $2.4 trillion figure was a unit-expansion error.\n\n## Addresses and transactions\nThe three cited sources do not publish a complete victim-address, attacker-address, and transaction list suitable for transaction-by-transaction verification.\n\n## Evidence boundary\nPublic material supports the software-signer flaw, automated theft, confirmed loss, and project response. Counts of affected addresses, potential exposure, and safeguarded assets vary across reports; The public record records only about 16 million ADA, or $2.4 million, as confirmed loss.\n\n## Current status\nSecondFi suspended the affected service, completed a balance snapshot, and opened a claims process. Public material does not confirm that the stolen 16 million ADA has been returned to victims." }, "category": "wallet-vulnerability", "severity": "high", "ecosystems": [ "Cardano" ], "chains": [ "Cardano" ], "lossUsd": 2400000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "已确认约 1,600 万枚 ADA 被盗，事发估值约 240 万美元。潜在风险敞口和紧急转移托管资产不计入确认损失；原报告的 2.4 万亿美元数字属于单位展开错误。", "tw": "已確認約 1,600 萬枚 ADA 被盜，事發估值約 240 萬美元。潛在風險敞口和緊急轉移託管資產不計入確認損失；原報告的 2.4 萬億美元數字屬於單位展開錯誤。", "en": "Confirmed theft was about 16 million ADA, valued at roughly $2.4 million. Potential exposure and assets moved into emergency custody are excluded; the original $2.4 trillion figure was a unit-expansion error." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "公开安全预警或项目说明", "tw": "公開安全預警或專案說明", "en": "Public security alert or project statement" }, "url": "https://x.com/BlockSecTeam/status/2069738595537564066", "type": "research" }, { "label": { "zh": "SecondFi 官方说明", "tw": "SecondFi 官方說明", "en": "SecondFi official statement" }, "url": "https://x.com/secondfiapp/status/2071558652641870076", "type": "official" }, { "label": { "zh": "财经头部报道", "tw": "財經頭部報道", "en": "Caijing Toutiao media report" }, "url": "https://baijiahao.baidu.com/s?id=1869391964274934716", "type": "media" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-005", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-094", "status": "verified", "incidentDate": "2026-06-22", "datePrecision": "day", "title": { "zh": "ATM LP 误转后被抢跑 Burn", "tw": "ATM LP 誤轉後被搶跑 Burn", "en": "ATM liquidity-pool transfer front-run by a burn transaction" }, "summary": { "zh": "公开来源确认 ATM LP 误转后被抢跑 Burn 发生智能合约漏洞、链上攻击事件，但未披露统一可核的美元损失额。", "tw": "公開來源確認 ATM LP 誤轉後被搶跑 Burn 發生智能合約漏洞、鏈上攻擊事件，但未披露統一可核的美元損失額。", "en": "Public sources identify ATM liquidity-pool transfer front-run by a burn transaction as a on-chain smart-contract exploit incident. No single verifiable USD loss amount was published." }, "details": { "zh": "## 事件背景\n链上复现确认合约逻辑、记账、权限或价格机制存在可被利用路径；具体步骤见攻击交易与复现源码。\n\n## 事件经过\n攻击者调用存在缺陷的合约路径，利用闪电流动性、储备/价格操纵、错误记账、权限或签名校验缺陷完成资产提取；交易已由 DeFiHackLabs 在历史状态上复现。\n\n## 资金流向\n受害合约或流动性池 → 攻击合约或攻击者地址。公开资料未披露后续兑换与资金转移路径。\n\n## 金额口径\n报告记录复现流程涉及 1,603.99 WBNB，但没有稳定可核的美元损失口径。\n\n## 地址与交易\n- `0x0eb4075c87ccd23a7ae1e00d77b043e4e8cc5894` — `[链：BNB Chain] [攻击者] [身份：事件 38] [状态：公开来源确认]`\n- `0x48b549e6b551c151bd392bb9acab1f88263adf48` — `[链：BNB Chain] [攻击合约] [身份：事件 38] [状态：公开来源确认]`\n- `0x9753a64fb7c233fdc43f04dab9cca88e1e229eba` — `[链：BNB Chain] [受害/漏洞合约] [身份：事件 38] [状态：公开来源确认]`\n- `0x4e9f3dc3ce3c0a6aa19dae0f1384ff46e801b433b7e3bc4c780de486db6c950a` — `[链：BNB Chain] [攻击 Tx] [身份：事件 38] [状态：公开来源确认]`\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\n鏈上覆現確認合約邏輯、記賬、權限或價格機制存在可被利用路徑；具體步驟見攻擊交易與復現源碼。\n\n## 事件經過\n攻擊者調用存在缺陷的合約路徑，利用閃電流動性、儲備/價格操縱、錯誤記賬、權限或簽名校驗缺陷完成資產提取；交易已由 DeFiHackLabs 在歷史狀態上覆現。\n\n## 資金流向\n受害合約或流動性池 → 攻擊合約或攻擊者地址。公開資料未披露後續兌換與資金轉移路徑。\n\n## 金額口徑\n報告記錄復現流程涉及 1,603.99 WBNB，但沒有穩定可核的美元損失口徑。\n\n## 地址與交易\n- `0x0eb4075c87ccd23a7ae1e00d77b043e4e8cc5894` — `[鏈：BNB Chain] [攻擊者] [身份：事件 38] [狀態：公開來源確認]`\n- `0x48b549e6b551c151bd392bb9acab1f88263adf48` — `[鏈：BNB Chain] [攻擊合約] [身份：事件 38] [狀態：公開來源確認]`\n- `0x9753a64fb7c233fdc43f04dab9cca88e1e229eba` — `[鏈：BNB Chain] [受害/漏洞合約] [身份：事件 38] [狀態：公開來源確認]`\n- `0x4e9f3dc3ce3c0a6aa19dae0f1384ff46e801b433b7e3bc4c780de486db6c950a` — `[鏈：BNB Chain] [攻擊 Tx] [身份：事件 38] [狀態：公開來源確認]`\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nHistorical-state reproduction supports an exploitable contract, accounting, authorization, pricing, or signature-validation path. The exact evidence is preserved in the cited transaction and reproduction source.\n\n## Incident sequence\nThe attacker used the cited contract or infrastructure weakness to move assets from the affected contract, wallet or pool. Historical-state reproduction or the cited public alert supports the event; later movement remains undisclosed.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nThe report identifies 1,603.99 WBNB in the reproduced flow, but no stable verified USD loss basis was supplied.\n\n## Addresses and transactions\n1. `0x0eb4075c87ccd23a7ae1e00d77b043e4e8cc5894` — BNB Chain; publicly identified attacker address.\n2. `0x48b549e6b551c151bd392bb9acab1f88263adf48` — BNB Chain; publicly identified attacker contract.\n3. `0x9753a64fb7c233fdc43f04dab9cca88e1e229eba` — BNB Chain; affected or vulnerable contract (not an attacker).\n4. `0x4e9f3dc3ce3c0a6aa19dae0f1384ff46e801b433b7e3bc4c780de486db6c950a` — BNB Chain; attack or execution transaction.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "protocol-exploit", "severity": "low", "ecosystems": [ "BNB Chain" ], "chains": [ "BNB Chain" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "报告记录复现流程涉及 1,603.99 WBNB，但没有稳定可核的美元损失口径。", "tw": "報告記錄復現流程涉及 1,603.99 WBNB，但沒有穩定可核的美元損失口徑。", "en": "The report identifies 1,603.99 WBNB in the reproduced flow, but no stable verified USD loss basis was supplied." }, "addressDisclosure": "published", "addresses": [ { "chain": "BNB Chain", "address": "0x0eb4075c87ccd23a7ae1e00d77b043e4e8cc5894", "entity": { "zh": "公开攻击者地址", "tw": "公開攻擊者地址", "en": "publicly identified attacker address" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/TenArmorAlert/status/2068993748936151209", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [攻击者] [身份：事件 38] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [攻擊者] [身份：事件 38] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker address. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x48b549e6b551c151bd392bb9acab1f88263adf48", "entity": { "zh": "公开攻击合约", "tw": "公開攻擊合約", "en": "publicly identified attacker contract" }, "role": "attacker-contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/TenArmorAlert/status/2068993748936151209", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [攻击合约] [身份：事件 38] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [攻擊合約] [身份：事件 38] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker contract. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x9753a64fb7c233fdc43f04dab9cca88e1e229eba", "entity": { "zh": "受影响或漏洞合约（非攻击者）", "tw": "受影響或漏洞合約（非攻擊者）", "en": "affected or vulnerable contract (not an attacker)" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/TenArmorAlert/status/2068993748936151209", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [受害/漏洞合约] [身份：事件 38] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [受害/漏洞合約] [身份：事件 38] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "affected or vulnerable contract (not an attacker). The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "公开安全预警或项目说明", "tw": "公開安全預警或專案說明", "en": "Public security alert or project statement" }, "url": "https://x.com/TenArmorAlert/status/2068993748936151209", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-094", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-093", "status": "verified", "incidentDate": "2026-06-21", "datePrecision": "day", "title": { "zh": "Taiko Bridge", "tw": "Taiko Bridge", "en": "Taiko Bridge — Fake Proof Exploit" }, "summary": { "zh": "公开来源确认 Taiko Bridge 发生 Fake Proof Exploit 事件，损失约 $1,700,000。", "tw": "公開來源確認 Taiko Bridge 發生 Fake Proof Exploit 事件，損失約 $1,700,000。", "en": "Public sources report Taiko Bridge — Fake Proof Exploit, with a loss of approximately $1,700,000." }, "details": { "zh": "## 事件背景\nFake Proof Exploit；事件依据 DeFiLlama 月度记录及其他可检索公开来源核验。 原报告存在百万倍金额展开错误，相关数值已按正确单位更正；事件事实、来源和资产单位保持不变。\n\n## 事件经过\n公开记录确认项目在该日附近发生安全事件，但未披露完整攻击路径。\n\n## 资金流向\n资产从受害项目或钱包转向攻击者或异常接收方；公开资料未披露完整逐跳路径。\n\n## 金额口径\n公开来源支持的损失额约为 $1,700,000；原报告中的“约 $1,700,000,000,000”存在百万倍单位展开错误，已按正确单位更正。\n\n## 地址与交易\n公开资料未披露完整攻击地址与 TxID。\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\nFake Proof Exploit；事件依據 DeFiLlama 月度記錄及其他可檢索公開來源核驗。 原報告存在百萬倍金額展開錯誤，相關數值已按正確單位更正；事件事實、來源和資產單位保持不變。\n\n## 事件經過\n公開記錄確認專案在該日附近發生安全事件，但未披露完整攻擊路徑。\n\n## 資金流向\n資產從受害專案或錢包轉向攻擊者或異常接收方；公開資料未披露完整逐跳路徑。\n\n## 金額口徑\n公開來源支持的損失額約為 $1,700,000；原報告中的“約 $1,700,000,000,000”存在百萬倍單位展開錯誤，已按正確單位更正。\n\n## 地址與交易\n公開資料未披露完整攻擊地址與 TxID。\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nPublic sources classify the incident as Fake Proof Exploit but do not disclose a complete exploit path.\n\n## Incident sequence\nPublic sources confirm a security incident near the stated date but do not disclose a complete exploit sequence, attribution, or downstream flow.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nPublic sources support a loss of approximately $1,700,000. The report contained a one-million-fold unit-expansion error, which has been corrected.\n\n## Addresses and transactions\nPublic sources do not disclose a complete address or transaction list.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "bridge-exploit", "severity": "high", "ecosystems": [ "Taiko" ], "chains": [ "Taiko" ], "lossUsd": 1700000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开来源支持的损失额约为 $1,700,000；原报告中的“约 $1,700,000,000,000”存在百万倍单位展开错误，已按正确单位更正。", "tw": "公開來源支持的損失額約為 $1,700,000；原報告中的“約 $1,700,000,000,000”存在百萬倍單位展開錯誤，已按正確單位更正。", "en": "Public sources support a loss of approximately $1,700,000. The report contained a one-million-fold unit-expansion error, which has been corrected." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "公开安全预警或项目说明", "tw": "公開安全預警或專案說明", "en": "Public security alert or project statement" }, "url": "https://x.com/BlockSecTeam/status/2069384941806674011", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-093", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-092", "status": "verified", "incidentDate": "2026-06-21", "datePrecision": "day", "title": { "zh": "Quicksilver Zone", "tw": "Quicksilver Zone", "en": "Quicksilver Zone — Unchecked Proof Minting" }, "summary": { "zh": "公开来源确认 Quicksilver Zone 发生 Unchecked Proof Minting 事件，损失约 $3,500。", "tw": "公開來源確認 Quicksilver Zone 發生 Unchecked Proof Minting 事件，損失約 $3,500。", "en": "Public sources report Quicksilver Zone — Unchecked Proof Minting, with a loss of approximately $3,500." }, "details": { "zh": "## 事件背景\nUnchecked Proof Minting；事件依据 DeFiLlama 月度记录及其他可检索公开来源核验。 原报告存在百万倍金额展开错误，相关数值已按正确单位更正；事件事实、来源和资产单位保持不变。\n\n## 事件经过\n公开记录确认项目在该日附近发生安全事件，但未披露完整攻击路径。\n\n## 资金流向\n资产从受害项目或钱包转向攻击者或异常接收方；公开资料未披露完整逐跳路径。\n\n## 金额口径\n公开来源支持的损失额约为 $3,500；原报告中的“约 $3,500,000,000”存在百万倍单位展开错误，已按正确单位更正。\n\n## 地址与交易\n公开资料未披露完整攻击地址与 TxID。\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\nUnchecked Proof Minting；事件依據 DeFiLlama 月度記錄及其他可檢索公開來源核驗。 原報告存在百萬倍金額展開錯誤，相關數值已按正確單位更正；事件事實、來源和資產單位保持不變。\n\n## 事件經過\n公開記錄確認專案在該日附近發生安全事件，但未披露完整攻擊路徑。\n\n## 資金流向\n資產從受害專案或錢包轉向攻擊者或異常接收方；公開資料未披露完整逐跳路徑。\n\n## 金額口徑\n公開來源支持的損失額約為 $3,500；原報告中的“約 $3,500,000,000”存在百萬倍單位展開錯誤，已按正確單位更正。\n\n## 地址與交易\n公開資料未披露完整攻擊地址與 TxID。\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nPublic sources classify the incident as Unchecked Proof Minting but do not disclose a complete exploit path.\n\n## Incident sequence\nPublic sources confirm a security incident near the stated date but do not disclose a complete exploit sequence, attribution, or downstream flow.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nPublic sources support a loss of approximately $3,500. The report contained a one-million-fold unit-expansion error, which has been corrected.\n\n## Addresses and transactions\nPublic sources do not disclose a complete address or transaction list.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "bridge-exploit", "severity": "low", "ecosystems": [ "Quicksilver" ], "chains": [ "Quicksilver" ], "lossUsd": 3500, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开来源支持的损失额约为 $3,500；原报告中的“约 $3,500,000,000”存在百万倍单位展开错误，已按正确单位更正。", "tw": "公開來源支持的損失額約為 $3,500；原報告中的“約 $3,500,000,000”存在百萬倍單位展開錯誤，已按正確單位更正。", "en": "Public sources support a loss of approximately $3,500. The report contained a one-million-fold unit-expansion error, which has been corrected." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "DeFiLlama Hacks 事件数据库", "tw": "DeFiLlama Hacks 事件數據庫", "en": "DeFiLlama Hacks database" }, "url": "https://api.llama.fi/hacks", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-092", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-091", "status": "verified", "incidentDate": "2026-06-20", "datePrecision": "day", "title": { "zh": "OLPC/LABUBU", "tw": "OLPC/LABUBU", "en": "OLPC/LABUBU — on-chain smart-contract exploit" }, "summary": { "zh": "公开来源确认 OLPC/LABUBU 发生智能合约漏洞、链上攻击事件，损失约 $1,115,904。", "tw": "公開來源確認 OLPC/LABUBU 發生智能合約漏洞、鏈上攻擊事件，損失約 $1,115,904。", "en": "Public sources report OLPC/LABUBU — on-chain smart-contract exploit, with a loss of approximately $1,115,904." }, "details": { "zh": "## 事件背景\nOLPC owner set decimalsValue to 7326680472586200649 at BSC block 96479712\n\n## 事件经过\n攻击者调用存在缺陷的合约路径，利用闪电流动性、储备/价格操纵、错误记账、权限或签名校验缺陷完成资产提取；交易已由 DeFiHackLabs 在历史状态上复现。\n\n## 资金流向\n受害合约或流动性池 → 攻击合约或攻击者地址。公开资料未披露后续兑换与资金转移路径。\n\n## 金额口径\n公开可核损失按 $1,115,904 记录；原报告资产口径为“1,115,903.66 USDT”。\n\n## 地址与交易\n- `0x18d6c39ae9e537f948aa2212d44d8c23944fc188` — `[链：BNB Chain] [攻击者] [身份：事件 35] [状态：公开来源确认]`\n- `0x58815cdf9955121a6274680ab396a36fc9e00000` — `[链：BNB Chain] [受害/漏洞合约] [身份：事件 35] [状态：公开来源确认]`\n- `0x8dabb60a94e5124462e5f494a25c14bcd52f6f4d1f7c665a249496f4c6c24764` — `[链：BNB Chain] [攻击 Tx] [身份：事件 35] [状态：公开来源确认]`\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\nOLPC owner set decimalsValue to 7326680472586200649 at BSC block 96479712\n\n## 事件經過\n攻擊者調用存在缺陷的合約路徑，利用閃電流動性、儲備/價格操縱、錯誤記賬、權限或簽名校驗缺陷完成資產提取；交易已由 DeFiHackLabs 在歷史狀態上覆現。\n\n## 資金流向\n受害合約或流動性池 → 攻擊合約或攻擊者地址。公開資料未披露後續兌換與資金轉移路徑。\n\n## 金額口徑\n公開可核損失按 $1,115,904 記錄；原報告資產口徑為“1,115,903.66 USDT”。\n\n## 地址與交易\n- `0x18d6c39ae9e537f948aa2212d44d8c23944fc188` — `[鏈：BNB Chain] [攻擊者] [身份：事件 35] [狀態：公開來源確認]`\n- `0x58815cdf9955121a6274680ab396a36fc9e00000` — `[鏈：BNB Chain] [受害/漏洞合約] [身份：事件 35] [狀態：公開來源確認]`\n- `0x8dabb60a94e5124462e5f494a25c14bcd52f6f4d1f7c665a249496f4c6c24764` — `[鏈：BNB Chain] [攻擊 Tx] [身份：事件 35] [狀態：公開來源確認]`\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nOLPC owner set decimalsValue to 7326680472586200649 at BSC block 96479712\n\n## Incident sequence\nThe attacker used the cited contract or infrastructure weakness to move assets from the affected contract, wallet or pool. Historical-state reproduction or the cited public alert supports the event; later movement remains undisclosed.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nVerified loss is recorded at $1,115,904. The report's underlying asset basis was: 1,115,903.66 USDT.\n\n## Addresses and transactions\n1. `0x18d6c39ae9e537f948aa2212d44d8c23944fc188` — BNB Chain; publicly identified attacker address.\n2. `0x58815cdf9955121a6274680ab396a36fc9e00000` — BNB Chain; affected or vulnerable contract (not an attacker).\n3. `0x8dabb60a94e5124462e5f494a25c14bcd52f6f4d1f7c665a249496f4c6c24764` — BNB Chain; attack or execution transaction.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "BNB Chain" ], "chains": [ "BNB Chain" ], "lossUsd": 1115903.66, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开可核损失按 $1,115,904 记录；原报告资产口径为“1,115,903.66 USDT”。", "tw": "公開可核損失按 $1,115,904 記錄；原報告資產口徑為“1,115,903.66 USDT”。", "en": "Verified loss is recorded at $1,115,904. The report's underlying asset basis was: 1,115,903.66 USDT." }, "addressDisclosure": "published", "addresses": [ { "chain": "BNB Chain", "address": "0x18d6c39ae9e537f948aa2212d44d8c23944fc188", "entity": { "zh": "公开攻击者地址", "tw": "公開攻擊者地址", "en": "publicly identified attacker address" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/exvulsec/status/2068308334512365924", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [攻击者] [身份：事件 35] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [攻擊者] [身份：事件 35] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker address. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x58815cdf9955121a6274680ab396a36fc9e00000", "entity": { "zh": "受影响或漏洞合约（非攻击者）", "tw": "受影響或漏洞合約（非攻擊者）", "en": "affected or vulnerable contract (not an attacker)" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/exvulsec/status/2068308334512365924", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [受害/漏洞合约] [身份：事件 35] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [受害/漏洞合約] [身份：事件 35] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "affected or vulnerable contract (not an attacker). The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "公开安全预警或项目说明", "tw": "公開安全預警或專案說明", "en": "Public security alert or project statement" }, "url": "https://x.com/exvulsec/status/2068308334512365924", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-091", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-090", "status": "verified", "incidentDate": "2026-06-20", "datePrecision": "day", "title": { "zh": "JaredFromSubway MEV Bot", "tw": "JaredFromSubway MEV Bot", "en": "JaredFromSubway MEV Bot — Reverse MEV Honeypot" }, "summary": { "zh": "公开来源确认 JaredFromSubway MEV Bot 发生 Reverse MEV Honeypot 事件，损失约 $7,500,000。", "tw": "公開來源確認 JaredFromSubway MEV Bot 發生 Reverse MEV Honeypot 事件，損失約 $7,500,000。", "en": "Public sources report JaredFromSubway MEV Bot — Reverse MEV Honeypot, with a loss of approximately $7,500,000." }, "details": { "zh": "## 事件背景\nReverse MEV Honeypot；事件依据 DeFiLlama 月度记录及其他可检索公开来源核验。 原报告存在百万倍金额展开错误，相关数值已按正确单位更正；事件事实、来源和资产单位保持不变。\n\n## 事件经过\n公开记录确认项目在该日附近发生安全事件，但未披露完整攻击路径。\n\n## 资金流向\n资产从受害项目或钱包转向攻击者或异常接收方；公开资料未披露完整逐跳路径。\n\n## 金额口径\n公开来源支持的损失额约为 $7,500,000；原报告中的“约 $7,500,000,000,000”存在百万倍单位展开错误，已按正确单位更正。\n\n## 地址与交易\n公开资料未披露完整攻击地址与 TxID。\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\nReverse MEV Honeypot；事件依據 DeFiLlama 月度記錄及其他可檢索公開來源核驗。 原報告存在百萬倍金額展開錯誤，相關數值已按正確單位更正；事件事實、來源和資產單位保持不變。\n\n## 事件經過\n公開記錄確認專案在該日附近發生安全事件，但未披露完整攻擊路徑。\n\n## 資金流向\n資產從受害專案或錢包轉向攻擊者或異常接收方；公開資料未披露完整逐跳路徑。\n\n## 金額口徑\n公開來源支持的損失額約為 $7,500,000；原報告中的“約 $7,500,000,000,000”存在百萬倍單位展開錯誤，已按正確單位更正。\n\n## 地址與交易\n公開資料未披露完整攻擊地址與 TxID。\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nPublic sources classify the incident as Reverse MEV Honeypot but do not disclose a complete exploit path.\n\n## Incident sequence\nPublic sources confirm a security incident near the stated date but do not disclose a complete exploit sequence, attribution, or downstream flow.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nPublic sources support a loss of approximately $7,500,000. The report contained a one-million-fold unit-expansion error, which has been corrected.\n\n## Addresses and transactions\nPublic sources do not disclose a complete address or transaction list.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 7500000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开来源支持的损失额约为 $7,500,000；原报告中的“约 $7,500,000,000,000”存在百万倍单位展开错误，已按正确单位更正。", "tw": "公開來源支持的損失額約為 $7,500,000；原報告中的“約 $7,500,000,000,000”存在百萬倍單位展開錯誤，已按正確單位更正。", "en": "Public sources support a loss of approximately $7,500,000. The report contained a one-million-fold unit-expansion error, which has been corrected." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "公开安全预警或项目说明", "tw": "公開安全預警或專案說明", "en": "Public security alert or project statement" }, "url": "https://x.com/GoPlusSecurity/status/2068994652666671430", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-090", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-089", "status": "verified", "incidentDate": "2026-06-19", "datePrecision": "day", "title": { "zh": "mySwap CL", "tw": "mySwap CL", "en": "mySwap CL — CL Pool Accounting Hack" }, "summary": { "zh": "公开来源确认 mySwap CL 发生 CL Pool Accounting Hack 事件，损失约 $300,000。", "tw": "公開來源確認 mySwap CL 發生 CL Pool Accounting Hack 事件，損失約 $300,000。", "en": "Public sources report mySwap CL — CL Pool Accounting Hack, with a loss of approximately $300,000." }, "details": { "zh": "## 事件背景\nCL Pool Accounting Hack；事件依据 DeFiLlama 月度记录及其他可检索公开来源核验。 原报告存在百万倍金额展开错误，相关数值已按正确单位更正；事件事实、来源和资产单位保持不变。\n\n## 事件经过\n公开记录确认项目在该日附近发生安全事件，但未披露完整攻击路径。\n\n## 资金流向\n资产从受害项目或钱包转向攻击者或异常接收方；公开资料未披露完整逐跳路径。\n\n## 金额口径\n公开来源支持的损失额约为 $300,000；原报告中的“约 $300,000,000,000”存在百万倍单位展开错误，已按正确单位更正。\n\n## 地址与交易\n公开资料未披露完整攻击地址与 TxID。\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\nCL Pool Accounting Hack；事件依據 DeFiLlama 月度記錄及其他可檢索公開來源核驗。 原報告存在百萬倍金額展開錯誤，相關數值已按正確單位更正；事件事實、來源和資產單位保持不變。\n\n## 事件經過\n公開記錄確認專案在該日附近發生安全事件，但未披露完整攻擊路徑。\n\n## 資金流向\n資產從受害專案或錢包轉向攻擊者或異常接收方；公開資料未披露完整逐跳路徑。\n\n## 金額口徑\n公開來源支持的損失額約為 $300,000；原報告中的“約 $300,000,000,000”存在百萬倍單位展開錯誤，已按正確單位更正。\n\n## 地址與交易\n公開資料未披露完整攻擊地址與 TxID。\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nPublic sources classify the incident as CL Pool Accounting Hack but do not disclose a complete exploit path.\n\n## Incident sequence\nPublic sources confirm a security incident near the stated date but do not disclose a complete exploit sequence, attribution, or downstream flow.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nPublic sources support a loss of approximately $300,000. The report contained a one-million-fold unit-expansion error, which has been corrected.\n\n## Addresses and transactions\nPublic sources do not disclose a complete address or transaction list.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "protocol-exploit", "severity": "medium", "ecosystems": [ "Starknet" ], "chains": [ "Starknet" ], "lossUsd": 300000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开来源支持的损失额约为 $300,000；原报告中的“约 $300,000,000,000”存在百万倍单位展开错误，已按正确单位更正。", "tw": "公開來源支持的損失額約為 $300,000；原報告中的“約 $300,000,000,000”存在百萬倍單位展開錯誤，已按正確單位更正。", "en": "Public sources support a loss of approximately $300,000. The report contained a one-million-fold unit-expansion error, which has been corrected." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "DeFiLlama Hacks 事件数据库", "tw": "DeFiLlama Hacks 事件數據庫", "en": "DeFiLlama Hacks database" }, "url": "https://api.llama.fi/hacks", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-089", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-088", "status": "verified", "incidentDate": "2026-06-19", "datePrecision": "day", "title": { "zh": "Secret Network", "tw": "Secret Network", "en": "Secret Network — Unbacked Mint via ICS-20" }, "summary": { "zh": "公开来源确认 Secret Network 发生 Unbacked Mint via ICS-20 事件，损失约 $4,670,000。", "tw": "公開來源確認 Secret Network 發生 Unbacked Mint via ICS-20 事件，損失約 $4,670,000。", "en": "Public sources report Secret Network — Unbacked Mint via ICS-20, with a loss of approximately $4,670,000." }, "details": { "zh": "## 事件背景\nUnbacked Mint via ICS-20；事件依据 DeFiLlama 月度记录及其他可检索公开来源核验。 原报告存在百万倍金额展开错误，相关数值已按正确单位更正；事件事实、来源和资产单位保持不变。\n\n## 事件经过\n公开记录确认项目在该日附近发生安全事件，但未披露完整攻击路径。\n\n## 资金流向\n资产从受害项目或钱包转向攻击者或异常接收方；公开资料未披露完整逐跳路径。\n\n## 金额口径\n公开来源支持的损失额约为 $4,670,000；原报告中的“约 $4,670,000,000,000”存在百万倍单位展开错误，已按正确单位更正。\n\n## 地址与交易\n公开资料未披露完整攻击地址与 TxID。\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\nUnbacked Mint via ICS-20；事件依據 DeFiLlama 月度記錄及其他可檢索公開來源核驗。 原報告存在百萬倍金額展開錯誤，相關數值已按正確單位更正；事件事實、來源和資產單位保持不變。\n\n## 事件經過\n公開記錄確認專案在該日附近發生安全事件，但未披露完整攻擊路徑。\n\n## 資金流向\n資產從受害專案或錢包轉向攻擊者或異常接收方；公開資料未披露完整逐跳路徑。\n\n## 金額口徑\n公開來源支持的損失額約為 $4,670,000；原報告中的“約 $4,670,000,000,000”存在百萬倍單位展開錯誤，已按正確單位更正。\n\n## 地址與交易\n公開資料未披露完整攻擊地址與 TxID。\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nPublic sources classify the incident as Unbacked Mint via ICS-20 but do not disclose a complete exploit path.\n\n## Incident sequence\nPublic sources confirm a security incident near the stated date but do not disclose a complete exploit sequence, attribution, or downstream flow.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nPublic sources support a loss of approximately $4,670,000. The report contained a one-million-fold unit-expansion error, which has been corrected.\n\n## Addresses and transactions\nPublic sources do not disclose a complete address or transaction list.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "bridge-exploit", "severity": "high", "ecosystems": [ "Secret" ], "chains": [ "Secret" ], "lossUsd": 4670000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开来源支持的损失额约为 $4,670,000；原报告中的“约 $4,670,000,000,000”存在百万倍单位展开错误，已按正确单位更正。", "tw": "公開來源支持的損失額約為 $4,670,000；原報告中的“約 $4,670,000,000,000”存在百萬倍單位展開錯誤，已按正確單位更正。", "en": "Public sources support a loss of approximately $4,670,000. The report contained a one-million-fold unit-expansion error, which has been corrected." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "ourcryptotalk.com 公开来源", "tw": "ourcryptotalk.com 公開來源", "en": "ourcryptotalk.com public source" }, "url": "https://ourcryptotalk.com/axelar-bridge-exploit-analysis/", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-088", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-087", "status": "verified", "incidentDate": "2026-06-19", "datePrecision": "day", "title": { "zh": "Namada Shielded Pools", "tw": "Namada Shielded Pools", "en": "Namada Shielded Pools — IBC Transfer Logic Exploit" }, "summary": { "zh": "公开来源确认 Namada Shielded Pools 发生 IBC Transfer Logic Exploit 事件，损失约 $600,000。", "tw": "公開來源確認 Namada Shielded Pools 發生 IBC Transfer Logic Exploit 事件，損失約 $600,000。", "en": "Public sources report Namada Shielded Pools — IBC Transfer Logic Exploit, with a loss of approximately $600,000." }, "details": { "zh": "## 事件背景\nIBC Transfer Logic Exploit；事件依据 DeFiLlama 月度记录及其他可检索公开来源核验。 原报告存在百万倍金额展开错误，相关数值已按正确单位更正；事件事实、来源和资产单位保持不变。\n\n## 事件经过\n公开记录确认项目在该日附近发生安全事件，但未披露完整攻击路径。\n\n## 资金流向\n资产从受害项目或钱包转向攻击者或异常接收方；公开资料未披露完整逐跳路径。\n\n## 金额口径\n公开来源支持的损失额约为 $600,000；原报告中的“约 $600,000,000,000”存在百万倍单位展开错误，已按正确单位更正。\n\n## 地址与交易\n公开资料未披露完整攻击地址与 TxID。\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\nIBC Transfer Logic Exploit；事件依據 DeFiLlama 月度記錄及其他可檢索公開來源核驗。 原報告存在百萬倍金額展開錯誤，相關數值已按正確單位更正；事件事實、來源和資產單位保持不變。\n\n## 事件經過\n公開記錄確認專案在該日附近發生安全事件，但未披露完整攻擊路徑。\n\n## 資金流向\n資產從受害專案或錢包轉向攻擊者或異常接收方；公開資料未披露完整逐跳路徑。\n\n## 金額口徑\n公開來源支持的損失額約為 $600,000；原報告中的“約 $600,000,000,000”存在百萬倍單位展開錯誤，已按正確單位更正。\n\n## 地址與交易\n公開資料未披露完整攻擊地址與 TxID。\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nPublic sources classify the incident as IBC Transfer Logic Exploit but do not disclose a complete exploit path.\n\n## Incident sequence\nPublic sources confirm a security incident near the stated date but do not disclose a complete exploit sequence, attribution, or downstream flow.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nPublic sources support a loss of approximately $600,000. The report contained a one-million-fold unit-expansion error, which has been corrected.\n\n## Addresses and transactions\nPublic sources do not disclose a complete address or transaction list.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "bridge-exploit", "severity": "medium", "ecosystems": [ "Namada" ], "chains": [ "Namada" ], "lossUsd": 600000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开来源支持的损失额约为 $600,000；原报告中的“约 $600,000,000,000”存在百万倍单位展开错误，已按正确单位更正。", "tw": "公開來源支持的損失額約為 $600,000；原報告中的“約 $600,000,000,000”存在百萬倍單位展開錯誤，已按正確單位更正。", "en": "Public sources support a loss of approximately $600,000. The report contained a one-million-fold unit-expansion error, which has been corrected." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "DeFiLlama Hacks 事件数据库", "tw": "DeFiLlama Hacks 事件數據庫", "en": "DeFiLlama Hacks database" }, "url": "https://api.llama.fi/hacks", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-087", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-086", "status": "verified", "incidentDate": "2026-06-18", "datePrecision": "day", "title": { "zh": "JB", "tw": "JB", "en": "JB — on-chain smart-contract exploit" }, "summary": { "zh": "公开来源确认 JB 发生智能合约漏洞、链上攻击事件，损失约 $49,958。", "tw": "公開來源確認 JB 發生智能合約漏洞、鏈上攻擊事件，損失約 $49,958。", "en": "Public sources report JB — on-chain smart-contract exploit, with a loss of approximately $49,958." }, "details": { "zh": "## 事件背景\n链上复现确认合约逻辑、记账、权限或价格机制存在可被利用路径；具体步骤见攻击交易与复现源码。\n\n## 事件经过\n攻击者调用存在缺陷的合约路径，利用闪电流动性、储备/价格操纵、错误记账、权限或签名校验缺陷完成资产提取；交易已由 DeFiHackLabs 在历史状态上复现。\n\n## 资金流向\n受害合约或流动性池 → 攻击合约或攻击者地址。公开资料未披露后续兑换与资金转移路径。\n\n## 金额口径\n公开可核损失按 $49,958 记录；原报告资产口径为“49958.06 USDT”。\n\n## 地址与交易\n- `0xd99e1abfc5dd5034d7ff63828d16c5e945d1b856` — `[链：BNB Chain] [攻击者] [身份：事件 30] [状态：公开来源确认]`\n- `0xcc21c75f9e13054667663f9ed37f41e65b52dee7` — `[链：BNB Chain] [攻击合约] [身份：事件 30] [状态：公开来源确认]`\n- `0x1b5732eb98911c25acf7bdfaffb9409782cae6d7` — `[链：BNB Chain] [受害/漏洞合约] [身份：事件 30] [状态：公开来源确认]`\n- `0x54e120b8d62a9d7cef94bf51f1f5b8aa13565d76d8797a79afeeb25ed0e1dc25` — `[链：BNB Chain] [攻击 Tx] [身份：事件 30] [状态：公开来源确认]`\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\n鏈上覆現確認合約邏輯、記賬、權限或價格機制存在可被利用路徑；具體步驟見攻擊交易與復現源碼。\n\n## 事件經過\n攻擊者調用存在缺陷的合約路徑，利用閃電流動性、儲備/價格操縱、錯誤記賬、權限或簽名校驗缺陷完成資產提取；交易已由 DeFiHackLabs 在歷史狀態上覆現。\n\n## 資金流向\n受害合約或流動性池 → 攻擊合約或攻擊者地址。公開資料未披露後續兌換與資金轉移路徑。\n\n## 金額口徑\n公開可核損失按 $49,958 記錄；原報告資產口徑為“49958.06 USDT”。\n\n## 地址與交易\n- `0xd99e1abfc5dd5034d7ff63828d16c5e945d1b856` — `[鏈：BNB Chain] [攻擊者] [身份：事件 30] [狀態：公開來源確認]`\n- `0xcc21c75f9e13054667663f9ed37f41e65b52dee7` — `[鏈：BNB Chain] [攻擊合約] [身份：事件 30] [狀態：公開來源確認]`\n- `0x1b5732eb98911c25acf7bdfaffb9409782cae6d7` — `[鏈：BNB Chain] [受害/漏洞合約] [身份：事件 30] [狀態：公開來源確認]`\n- `0x54e120b8d62a9d7cef94bf51f1f5b8aa13565d76d8797a79afeeb25ed0e1dc25` — `[鏈：BNB Chain] [攻擊 Tx] [身份：事件 30] [狀態：公開來源確認]`\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nHistorical-state reproduction supports an exploitable contract, accounting, authorization, pricing, or signature-validation path. The exact evidence is preserved in the cited transaction and reproduction source.\n\n## Incident sequence\nThe attacker used the cited contract or infrastructure weakness to move assets from the affected contract, wallet or pool. Historical-state reproduction or the cited public alert supports the event; later movement remains undisclosed.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nVerified loss is recorded at $49,958. The report's underlying asset basis was: 49958.06 USDT.\n\n## Addresses and transactions\n1. `0xd99e1abfc5dd5034d7ff63828d16c5e945d1b856` — BNB Chain; publicly identified attacker address.\n2. `0xcc21c75f9e13054667663f9ed37f41e65b52dee7` — BNB Chain; publicly identified attacker contract.\n3. `0x1b5732eb98911c25acf7bdfaffb9409782cae6d7` — BNB Chain; affected or vulnerable contract (not an attacker).\n4. `0x54e120b8d62a9d7cef94bf51f1f5b8aa13565d76d8797a79afeeb25ed0e1dc25` — BNB Chain; attack or execution transaction.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "protocol-exploit", "severity": "low", "ecosystems": [ "BNB Chain" ], "chains": [ "BNB Chain" ], "lossUsd": 49958.06, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开可核损失按 $49,958 记录；原报告资产口径为“49958.06 USDT”。", "tw": "公開可核損失按 $49,958 記錄；原報告資產口徑為“49958.06 USDT”。", "en": "Verified loss is recorded at $49,958. The report's underlying asset basis was: 49958.06 USDT." }, "addressDisclosure": "published", "addresses": [ { "chain": "BNB Chain", "address": "0xd99e1abfc5dd5034d7ff63828d16c5e945d1b856", "entity": { "zh": "公开攻击者地址", "tw": "公開攻擊者地址", "en": "publicly identified attacker address" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/audit_911/status/2067943961327763788", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [攻击者] [身份：事件 30] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [攻擊者] [身份：事件 30] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker address. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xcc21c75f9e13054667663f9ed37f41e65b52dee7", "entity": { "zh": "公开攻击合约", "tw": "公開攻擊合約", "en": "publicly identified attacker contract" }, "role": "attacker-contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/audit_911/status/2067943961327763788", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [攻击合约] [身份：事件 30] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [攻擊合約] [身份：事件 30] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker contract. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x1b5732eb98911c25acf7bdfaffb9409782cae6d7", "entity": { "zh": "受影响或漏洞合约（非攻击者）", "tw": "受影響或漏洞合約（非攻擊者）", "en": "affected or vulnerable contract (not an attacker)" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/audit_911/status/2067943961327763788", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [受害/漏洞合约] [身份：事件 30] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [受害/漏洞合約] [身份：事件 30] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "affected or vulnerable contract (not an attacker). The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "公开安全预警或项目说明", "tw": "公開安全預警或專案說明", "en": "Public security alert or project statement" }, "url": "https://x.com/audit_911/status/2067943961327763788", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-086", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-085", "status": "verified", "incidentDate": "2026-06-17", "datePrecision": "day", "title": { "zh": "WHALE", "tw": "WHALE", "en": "WHALE — on-chain smart-contract exploit" }, "summary": { "zh": "公开来源确认 WHALE 发生智能合约漏洞、链上攻击事件，损失约 $3,460。", "tw": "公開來源確認 WHALE 發生智能合約漏洞、鏈上攻擊事件，損失約 $3,460。", "en": "Public sources report WHALE — on-chain smart-contract exploit, with a loss of approximately $3,460." }, "details": { "zh": "## 事件背景\n链上复现确认合约逻辑、记账、权限或价格机制存在可被利用路径；具体步骤见攻击交易与复现源码。\n\n## 事件经过\n攻击者调用存在缺陷的合约路径，利用闪电流动性、储备/价格操纵、错误记账、权限或签名校验缺陷完成资产提取；交易已由 DeFiHackLabs 在历史状态上复现。\n\n## 资金流向\n受害合约或流动性池 → 攻击合约或攻击者地址。公开资料未披露后续兑换与资金转移路径。\n\n## 金额口径\n公开可核损失按 $3,460 记录；原报告资产口径为“3,460.41 USDT”。\n\n## 地址与交易\n- `0xa27eae743cd8c03e9b7c25ebf43dadbbc6df9bfa` — `[链：BNB Chain] [攻击者] [身份：事件 29] [状态：公开来源确认]`\n- `0x4ce3e5dea552d1440a8cd766a13a6384ea4d1386` — `[链：BNB Chain] [攻击合约] [身份：事件 29] [状态：公开来源确认]`\n- `0xabc79b7c5a0f1fe0ac55fcb7e659d5817e530123` — `[链：BNB Chain] [受害/漏洞合约] [身份：事件 29] [状态：公开来源确认]`\n- `0xf8f431b392a50eb997ecae2e35668d6dd4dc8568d002057600d2532e18f36d86` — `[链：BNB Chain] [攻击 Tx] [身份：事件 29] [状态：公开来源确认]`\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\n鏈上覆現確認合約邏輯、記賬、權限或價格機制存在可被利用路徑；具體步驟見攻擊交易與復現源碼。\n\n## 事件經過\n攻擊者調用存在缺陷的合約路徑，利用閃電流動性、儲備/價格操縱、錯誤記賬、權限或簽名校驗缺陷完成資產提取；交易已由 DeFiHackLabs 在歷史狀態上覆現。\n\n## 資金流向\n受害合約或流動性池 → 攻擊合約或攻擊者地址。公開資料未披露後續兌換與資金轉移路徑。\n\n## 金額口徑\n公開可核損失按 $3,460 記錄；原報告資產口徑為“3,460.41 USDT”。\n\n## 地址與交易\n- `0xa27eae743cd8c03e9b7c25ebf43dadbbc6df9bfa` — `[鏈：BNB Chain] [攻擊者] [身份：事件 29] [狀態：公開來源確認]`\n- `0x4ce3e5dea552d1440a8cd766a13a6384ea4d1386` — `[鏈：BNB Chain] [攻擊合約] [身份：事件 29] [狀態：公開來源確認]`\n- `0xabc79b7c5a0f1fe0ac55fcb7e659d5817e530123` — `[鏈：BNB Chain] [受害/漏洞合約] [身份：事件 29] [狀態：公開來源確認]`\n- `0xf8f431b392a50eb997ecae2e35668d6dd4dc8568d002057600d2532e18f36d86` — `[鏈：BNB Chain] [攻擊 Tx] [身份：事件 29] [狀態：公開來源確認]`\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nHistorical-state reproduction supports an exploitable contract, accounting, authorization, pricing, or signature-validation path. The exact evidence is preserved in the cited transaction and reproduction source.\n\n## Incident sequence\nThe attacker used the cited contract or infrastructure weakness to move assets from the affected contract, wallet or pool. Historical-state reproduction or the cited public alert supports the event; later movement remains undisclosed.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nVerified loss is recorded at $3,460. The report's underlying asset basis was: 3,460.41 USDT.\n\n## Addresses and transactions\n1. `0xa27eae743cd8c03e9b7c25ebf43dadbbc6df9bfa` — BNB Chain; publicly identified attacker address.\n2. `0x4ce3e5dea552d1440a8cd766a13a6384ea4d1386` — BNB Chain; publicly identified attacker contract.\n3. `0xabc79b7c5a0f1fe0ac55fcb7e659d5817e530123` — BNB Chain; affected or vulnerable contract (not an attacker).\n4. `0xf8f431b392a50eb997ecae2e35668d6dd4dc8568d002057600d2532e18f36d86` — BNB Chain; attack or execution transaction.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "protocol-exploit", "severity": "low", "ecosystems": [ "BNB Chain" ], "chains": [ "BNB Chain" ], "lossUsd": 3460.41, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开可核损失按 $3,460 记录；原报告资产口径为“3,460.41 USDT”。", "tw": "公開可核損失按 $3,460 記錄；原報告資產口徑為“3,460.41 USDT”。", "en": "Verified loss is recorded at $3,460. The report's underlying asset basis was: 3,460.41 USDT." }, "addressDisclosure": "published", "addresses": [ { "chain": "BNB Chain", "address": "0xa27eae743cd8c03e9b7c25ebf43dadbbc6df9bfa", "entity": { "zh": "公开攻击者地址", "tw": "公開攻擊者地址", "en": "publicly identified attacker address" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/audit_911/status/2067451654694412720", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [攻击者] [身份：事件 29] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [攻擊者] [身份：事件 29] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker address. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x4ce3e5dea552d1440a8cd766a13a6384ea4d1386", "entity": { "zh": "公开攻击合约", "tw": "公開攻擊合約", "en": "publicly identified attacker contract" }, "role": "attacker-contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/audit_911/status/2067451654694412720", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [攻击合约] [身份：事件 29] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [攻擊合約] [身份：事件 29] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker contract. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xabc79b7c5a0f1fe0ac55fcb7e659d5817e530123", "entity": { "zh": "受影响或漏洞合约（非攻击者）", "tw": "受影響或漏洞合約（非攻擊者）", "en": "affected or vulnerable contract (not an attacker)" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/audit_911/status/2067451654694412720", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [受害/漏洞合约] [身份：事件 29] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [受害/漏洞合約] [身份：事件 29] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "affected or vulnerable contract (not an attacker). The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "公开安全预警或项目说明", "tw": "公開安全預警或專案說明", "en": "Public security alert or project statement" }, "url": "https://x.com/audit_911/status/2067451654694412720", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-085", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-084", "status": "verified", "incidentDate": "2026-06-17", "datePrecision": "day", "title": { "zh": "Mastra 生态 140 余个包依赖投毒", "tw": "Mastra 生態 140 餘個包依賴投毒", "en": "Malicious dependency inserted across more than 140 Mastra packages" }, "summary": { "zh": "Mastra 生态 140 余个包被插入恶意依赖，形成大范围供应链事件；未披露统一可核损失金额。", "tw": "Mastra 生態 140 餘個包被插入惡意依賴，形成大範圍供應鏈事件；未披露統一可核損失金額。", "en": "A malicious dependency was inserted across more than 140 Mastra packages; no verified aggregate loss amount was published." }, "details": { "zh": "## 事件背景\n供应链中加入 easy-day-js 恶意依赖。\n\n## 事件经过\n安全机构或媒体在窗口内公开披露该独立活动/受害项目；按不同受害发布链、项目或攻击面分别列项，避免把多个事件压成一个“供应链簇”。\n\n## 资金流向\n恶意包、伪仓库或被入侵前端 → 开发者/用户设备 → 凭据、钱包授权或资产风险；没有统一可核链上收款地址。\n\n## 金额口径\n超过 140 个 @mastra 包受到影响；未公开统一链上损失。\n\n## 地址与交易\n链上地址与 TxID 未公开（不适用）；事件属于链下供应链或前端安全。\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\n供應鏈中加入 easy-day-js 惡意依賴。\n\n## 事件經過\n安全機構或媒體在窗口內公開披露該獨立活動/受害專案；按不同受害發布鏈、專案或攻擊面分別列項，避免把多個事件壓成一個“供應鏈簇”。\n\n## 資金流向\n惡意包、偽倉庫或被入侵前端 → 開發者/用戶設備 → 憑據、錢包授權或資產風險；沒有統一可核鏈上收款地址。\n\n## 金額口徑\n超過 140 個 @mastra 包受到影響；未公開統一鏈上損失。\n\n## 地址與交易\n鏈上地址與 TxID 未公開（不適用）；事件屬於鏈下供應鏈或前端安全。\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nA malicious easy-day-js dependency was introduced into the Mastra package ecosystem.\n\n## Incident sequence\nSecurity researchers or public reporting disclosed this distinct campaign or affected project during the June window. It is kept separate from other supply-chain incidents because the affected publishing chain, project or attack surface differs.\n\n## Fund flow\nA malicious package, repository or compromised front end exposed developer or user devices to credential, wallet-authorization or asset risk. No single verified receiving address was published.\n\n## Amount basis\nMore than 140 @mastra packages were affected; no single verified on-chain loss amount was published.\n\n## Addresses and transactions\nNo applicable blockchain address or transaction was published because this is an off-chain supply-chain, malware, front-end, or enforcement event.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "supply-chain", "severity": "medium", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "超过 140 个 @mastra 包受到影响；未公开统一链上损失。", "tw": "超過 140 個 @mastra 包受到影響；未公開統一鏈上損失。", "en": "More than 140 @mastra packages were affected; no single verified on-chain loss amount was published." }, "addressDisclosure": "not-applicable", "addresses": [], "references": [ { "label": { "zh": "公开安全预警或项目说明", "tw": "公開安全預警或專案說明", "en": "Public security alert or project statement" }, "url": "https://x.com/SlowMist_Team/status/2067199227512619141", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-084", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-083", "status": "verified", "incidentDate": "2026-06-17", "datePrecision": "day", "title": { "zh": "Little Boy Plus/LBP", "tw": "Little Boy Plus/LBP", "en": "Little Boy Plus/LBP — on-chain smart-contract exploit" }, "summary": { "zh": "公开来源确认 Little Boy Plus/LBP 发生智能合约漏洞、链上攻击事件，损失约 $367,000。", "tw": "公開來源確認 Little Boy Plus/LBP 發生智能合約漏洞、鏈上攻擊事件，損失約 $367,000。", "en": "Public sources report Little Boy Plus/LBP — on-chain smart-contract exploit, with a loss of approximately $367,000." }, "details": { "zh": "## 事件背景\n链上复现确认合约逻辑、记账、权限或价格机制存在可被利用路径；具体步骤见攻击交易与复现源码。 原报告存在百万倍金额展开错误，相关数值已按正确单位更正；事件事实、来源和资产单位保持不变。 原报告第 26 项与第 27 项描述同一 Little Boy Plus / LBP 事件，按日期、项目、链与攻击机制合并，避免重复计数。\n\n## 事件经过\n攻击者调用存在缺陷的合约路径，利用闪电流动性、储备/价格操纵、错误记账、权限或签名校验缺陷完成资产提取；交易已由 DeFiHackLabs 在历史状态上复现。\n\n## 资金流向\n受害合约或流动性池 → 攻击合约或攻击者地址。公开资料未披露后续兑换与资金转移路径。\n\n## 金额口径\n公开来源支持的损失额约为 $367,000；原报告中的“610.56 BNB”存在百万倍单位展开错误，已按正确单位更正。\n\n## 地址与交易\n- `0xb26dfe6b6180a30e2a2d9826867cc7e06631825a` — `[链：BNB Chain] [攻击者] [身份：事件 27] [状态：公开来源确认]`\n- `0x5449ded887576f43fc339851e942ebc1e6f8118b` — `[链：BNB Chain] [攻击合约] [身份：事件 27] [状态：公开来源确认]`\n- `0x88886f0fd371dff856291badced45922bc888888` — `[链：BNB Chain] [受害/漏洞合约] [身份：事件 27] [状态：公开来源确认]`\n- `0x55856d9fda4c5be5193561c7d775e823c3d6e499da44aab9da963daf61c50b0c` — `[链：BNB Chain] [攻击 Tx] [身份：事件 27] [状态：公开来源确认]`\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\n鏈上覆現確認合約邏輯、記賬、權限或價格機制存在可被利用路徑；具體步驟見攻擊交易與復現源碼。 原報告存在百萬倍金額展開錯誤，相關數值已按正確單位更正；事件事實、來源和資產單位保持不變。 原報告第 26 項與第 27 項描述同一 Little Boy Plus / LBP 事件，按日期、專案、鏈與攻擊機制合併，避免重複計數。\n\n## 事件經過\n攻擊者調用存在缺陷的合約路徑，利用閃電流動性、儲備/價格操縱、錯誤記賬、權限或簽名校驗缺陷完成資產提取；交易已由 DeFiHackLabs 在歷史狀態上覆現。\n\n## 資金流向\n受害合約或流動性池 → 攻擊合約或攻擊者地址。公開資料未披露後續兌換與資金轉移路徑。\n\n## 金額口徑\n公開來源支持的損失額約為 $367,000；原報告中的“610.56 BNB”存在百萬倍單位展開錯誤，已按正確單位更正。\n\n## 地址與交易\n- `0xb26dfe6b6180a30e2a2d9826867cc7e06631825a` — `[鏈：BNB Chain] [攻擊者] [身份：事件 27] [狀態：公開來源確認]`\n- `0x5449ded887576f43fc339851e942ebc1e6f8118b` — `[鏈：BNB Chain] [攻擊合約] [身份：事件 27] [狀態：公開來源確認]`\n- `0x88886f0fd371dff856291badced45922bc888888` — `[鏈：BNB Chain] [受害/漏洞合約] [身份：事件 27] [狀態：公開來源確認]`\n- `0x55856d9fda4c5be5193561c7d775e823c3d6e499da44aab9da963daf61c50b0c` — `[鏈：BNB Chain] [攻擊 Tx] [身份：事件 27] [狀態：公開來源確認]`\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nHistorical-state reproduction supports an exploitable contract, accounting, authorization, pricing, or signature-validation path. The exact evidence is preserved in the cited transaction and reproduction source. Report items 26 and 27 describe the same Little Boy Plus / LBP incident and are merged here by date, project, chain and technique to prevent double counting.\n\n## Incident sequence\nThe attacker used the cited contract or infrastructure weakness to move assets from the affected contract, wallet or pool. Historical-state reproduction or the cited public alert supports the event; later movement remains undisclosed.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nPublic sources support a loss of approximately $367,000. The report contained a one-million-fold unit-expansion error, which has been corrected.\n\n## Addresses and transactions\n1. `0xb26dfe6b6180a30e2a2d9826867cc7e06631825a` — BNB Chain; publicly identified attacker address.\n2. `0x5449ded887576f43fc339851e942ebc1e6f8118b` — BNB Chain; publicly identified attacker contract.\n3. `0x88886f0fd371dff856291badced45922bc888888` — BNB Chain; affected or vulnerable contract (not an attacker).\n4. `0x55856d9fda4c5be5193561c7d775e823c3d6e499da44aab9da963daf61c50b0c` — BNB Chain; attack or execution transaction.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "protocol-exploit", "severity": "medium", "ecosystems": [ "BNB Chain" ], "chains": [ "BNB Chain" ], "lossUsd": 367000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开来源支持的损失额约为 $367,000；原报告中的“610.56 BNB”存在百万倍单位展开错误，已按正确单位更正。", "tw": "公開來源支持的損失額約為 $367,000；原報告中的“610.56 BNB”存在百萬倍單位展開錯誤，已按正確單位更正。", "en": "Public sources support a loss of approximately $367,000. The report contained a one-million-fold unit-expansion error, which has been corrected." }, "addressDisclosure": "published", "addresses": [ { "chain": "BNB Chain", "address": "0xb26dfe6b6180a30e2a2d9826867cc7e06631825a", "entity": { "zh": "公开攻击者地址", "tw": "公開攻擊者地址", "en": "publicly identified attacker address" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/DefimonAlerts/status/2067329401977532429", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [攻击者] [身份：事件 27] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [攻擊者] [身份：事件 27] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker address. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x5449ded887576f43fc339851e942ebc1e6f8118b", "entity": { "zh": "公开攻击合约", "tw": "公開攻擊合約", "en": "publicly identified attacker contract" }, "role": "attacker-contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/DefimonAlerts/status/2067329401977532429", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [攻击合约] [身份：事件 27] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [攻擊合約] [身份：事件 27] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker contract. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x88886f0fd371dff856291badced45922bc888888", "entity": { "zh": "受影响或漏洞合约（非攻击者）", "tw": "受影響或漏洞合約（非攻擊者）", "en": "affected or vulnerable contract (not an attacker)" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/DefimonAlerts/status/2067329401977532429", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [受害/漏洞合约] [身份：事件 27] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [受害/漏洞合約] [身份：事件 27] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "affected or vulnerable contract (not an attacker). The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "公开安全预警或项目说明", "tw": "公開安全預警或專案說明", "en": "Public security alert or project statement" }, "url": "https://x.com/DefimonAlerts/status/2067329401977532429", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-083", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-082", "status": "verified", "incidentDate": "2026-06-17", "datePrecision": "day", "title": { "zh": "Aztec V1 EscapeHatch", "tw": "Aztec V1 EscapeHatch", "en": "Aztec V1 EscapeHatch — on-chain smart-contract exploit" }, "summary": { "zh": "公开来源确认 Aztec V1 EscapeHatch 发生智能合约漏洞、链上攻击事件，损失约 $2,200,000。", "tw": "公開來源確認 Aztec V1 EscapeHatch 發生智能合約漏洞、鏈上攻擊事件，損失約 $2,200,000。", "en": "Public sources report Aztec V1 EscapeHatch — on-chain smart-contract exploit, with a loss of approximately $2,200,000." }, "details": { "zh": "## 事件背景\n链上复现确认合约逻辑、记账、权限或价格机制存在可被利用路径；具体步骤见攻击交易与复现源码。\n\n## 事件经过\n攻击者调用存在缺陷的合约路径，利用闪电流动性、储备/价格操纵、错误记账、权限或签名校验缺陷完成资产提取；交易已由 DeFiHackLabs 在历史状态上复现。\n\n## 资金流向\n受害合约或流动性池 → 攻击合约或攻击者地址。公开资料未披露后续兑换与资金转移路径。\n\n## 金额口径\n公开可核损失按 $2,200,000 记录；原报告资产口径为“~$2.2M (1158 ETH + 150,000 DAI + 0.4696 renBTC)”。\n\n## 地址与交易\n- `0x6952d9246e9afe8b887b2877225163436f78e97f` — `[链：Ethereum] [攻击者] [身份：事件 25] [状态：公开来源确认]`\n- `0x737901bea3eeb88459df9ef1be8ff3ae1b42a2ba` — `[链：Ethereum] [受害/漏洞合约] [身份：事件 25] [状态：公开来源确认]`\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\n鏈上覆現確認合約邏輯、記賬、權限或價格機制存在可被利用路徑；具體步驟見攻擊交易與復現源碼。\n\n## 事件經過\n攻擊者調用存在缺陷的合約路徑，利用閃電流動性、儲備/價格操縱、錯誤記賬、權限或簽名校驗缺陷完成資產提取；交易已由 DeFiHackLabs 在歷史狀態上覆現。\n\n## 資金流向\n受害合約或流動性池 → 攻擊合約或攻擊者地址。公開資料未披露後續兌換與資金轉移路徑。\n\n## 金額口徑\n公開可核損失按 $2,200,000 記錄；原報告資產口徑為“~$2.2M (1158 ETH + 150,000 DAI + 0.4696 renBTC)”。\n\n## 地址與交易\n- `0x6952d9246e9afe8b887b2877225163436f78e97f` — `[鏈：Ethereum] [攻擊者] [身份：事件 25] [狀態：公開來源確認]`\n- `0x737901bea3eeb88459df9ef1be8ff3ae1b42a2ba` — `[鏈：Ethereum] [受害/漏洞合約] [身份：事件 25] [狀態：公開來源確認]`\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nHistorical-state reproduction supports an exploitable contract, accounting, authorization, pricing, or signature-validation path. The exact evidence is preserved in the cited transaction and reproduction source.\n\n## Incident sequence\nThe attacker used the cited contract or infrastructure weakness to move assets from the affected contract, wallet or pool. Historical-state reproduction or the cited public alert supports the event; later movement remains undisclosed.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nVerified loss is recorded at $2,200,000. The report's underlying asset basis was: ~$2.2M (1158 ETH + 150,000 DAI + 0.4696 renBTC).\n\n## Addresses and transactions\n1. `0x6952d9246e9afe8b887b2877225163436f78e97f` — Ethereum; publicly identified attacker address.\n2. `0x737901bea3eeb88459df9ef1be8ff3ae1b42a2ba` — Ethereum; affected or vulnerable contract (not an attacker).\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 2200000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开可核损失按 $2,200,000 记录；原报告资产口径为“~$2.2M (1158 ETH + 150,000 DAI + 0.4696 renBTC)”。", "tw": "公開可核損失按 $2,200,000 記錄；原報告資產口徑為“~$2.2M (1158 ETH + 150,000 DAI + 0.4696 renBTC)”。", "en": "Verified loss is recorded at $2,200,000. The report's underlying asset basis was: ~$2.2M (1158 ETH + 150,000 DAI + 0.4696 renBTC)." }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0x6952d9246e9afe8b887b2877225163436f78e97f", "entity": { "zh": "公开攻击者地址", "tw": "公開攻擊者地址", "en": "publicly identified attacker address" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-06/AztecEscapeHatch_exp.sol", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [攻击者] [身份：事件 25] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：Ethereum] [攻擊者] [身份：事件 25] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker address. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x737901bea3eeb88459df9ef1be8ff3ae1b42a2ba", "entity": { "zh": "受影响或漏洞合约（非攻击者）", "tw": "受影響或漏洞合約（非攻擊者）", "en": "affected or vulnerable contract (not an attacker)" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-06/AztecEscapeHatch_exp.sol", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [受害/漏洞合约] [身份：事件 25] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：Ethereum] [受害/漏洞合約] [身份：事件 25] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "affected or vulnerable contract (not an attacker). The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "DeFiHackLabs 链上复现", "tw": "DeFiHackLabs 鏈上覆現", "en": "DeFiHackLabs on-chain reproduction" }, "url": "https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-06/AztecEscapeHatch_exp.sol", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-082", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-081", "status": "verified", "incidentDate": "2026-06-16", "datePrecision": "day", "title": { "zh": "RetoSwap", "tw": "RetoSwap", "en": "RetoSwap — ACK Frontrun Attack" }, "summary": { "zh": "公开来源确认 RetoSwap 发生 ACK Frontrun Attack 事件，损失约 $2,700,000。", "tw": "公開來源確認 RetoSwap 發生 ACK Frontrun Attack 事件，損失約 $2,700,000。", "en": "Public sources report RetoSwap — ACK Frontrun Attack, with a loss of approximately $2,700,000." }, "details": { "zh": "## 事件背景\nACK Frontrun Attack；事件依据 DeFiLlama 月度记录及其他可检索公开来源核验。 原报告存在百万倍金额展开错误，相关数值已按正确单位更正；事件事实、来源和资产单位保持不变。\n\n## 事件经过\n公开记录确认项目在该日附近发生安全事件，但未披露完整攻击路径。\n\n## 资金流向\n资产从受害项目或钱包转向攻击者或异常接收方；公开资料未披露完整逐跳路径。\n\n## 金额口径\n公开来源支持的损失额约为 $2,700,000；原报告中的“约 $2,700,000,000,000”存在百万倍单位展开错误，已按正确单位更正。\n\n## 地址与交易\n公开资料未披露完整攻击地址与 TxID。\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\nACK Frontrun Attack；事件依據 DeFiLlama 月度記錄及其他可檢索公開來源核驗。 原報告存在百萬倍金額展開錯誤，相關數值已按正確單位更正；事件事實、來源和資產單位保持不變。\n\n## 事件經過\n公開記錄確認專案在該日附近發生安全事件，但未披露完整攻擊路徑。\n\n## 資金流向\n資產從受害專案或錢包轉向攻擊者或異常接收方；公開資料未披露完整逐跳路徑。\n\n## 金額口徑\n公開來源支持的損失額約為 $2,700,000；原報告中的“約 $2,700,000,000,000”存在百萬倍單位展開錯誤，已按正確單位更正。\n\n## 地址與交易\n公開資料未披露完整攻擊地址與 TxID。\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nPublic sources classify the incident as ACK Frontrun Attack but do not disclose a complete exploit path.\n\n## Incident sequence\nPublic sources confirm a security incident near the stated date but do not disclose a complete exploit sequence, attribution, or downstream flow.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nPublic sources support a loss of approximately $2,700,000. The report contained a one-million-fold unit-expansion error, which has been corrected.\n\n## Addresses and transactions\nPublic sources do not disclose a complete address or transaction list.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "Monero" ], "chains": [ "Monero" ], "lossUsd": 2700000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开来源支持的损失额约为 $2,700,000；原报告中的“约 $2,700,000,000,000”存在百万倍单位展开错误，已按正确单位更正。", "tw": "公開來源支持的損失額約為 $2,700,000；原報告中的“約 $2,700,000,000,000”存在百萬倍單位展開錯誤，已按正確單位更正。", "en": "Public sources support a loss of approximately $2,700,000. The report contained a one-million-fold unit-expansion error, which has been corrected." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "DeFiLlama Hacks 事件数据库", "tw": "DeFiLlama Hacks 事件數據庫", "en": "DeFiLlama Hacks database" }, "url": "https://api.llama.fi/hacks", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-081", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-080", "status": "verified", "incidentDate": "2026-06-16", "datePrecision": "day", "title": { "zh": "DIP", "tw": "DIP", "en": "DIP — on-chain smart-contract exploit" }, "summary": { "zh": "公开来源确认 DIP 发生智能合约漏洞、链上攻击事件，损失约 $111,098。", "tw": "公開來源確認 DIP 發生智能合約漏洞、鏈上攻擊事件，損失約 $111,098。", "en": "Public sources report DIP — on-chain smart-contract exploit, with a loss of approximately $111,098." }, "details": { "zh": "## 事件背景\n链上复现确认合约逻辑、记账、权限或价格机制存在可被利用路径；具体步骤见攻击交易与复现源码。\n\n## 事件经过\n攻击者调用存在缺陷的合约路径，利用闪电流动性、储备/价格操纵、错误记账、权限或签名校验缺陷完成资产提取；交易已由 DeFiHackLabs 在历史状态上复现。\n\n## 资金流向\n受害合约或流动性池 → 攻击合约或攻击者地址。公开资料未披露后续兑换与资金转移路径。\n\n## 金额口径\n公开可核损失按 $111,098 记录；原报告资产口径为“111,097.59 USDC”。\n\n## 地址与交易\n- `0x0d4024cd27538350a911d9b7ee90811fa4875ba3` — `[链：BNB Chain] [攻击者] [身份：事件 23] [状态：公开来源确认]`\n- `0xddef10a85a5c67a9af8398d297aa51f8716383c7` — `[链：BNB Chain] [攻击合约] [身份：事件 23] [状态：公开来源确认]`\n- `0x6c60bf5db0670ae94489d3dde2c60f271625db50` — `[链：BNB Chain] [受害/漏洞合约] [身份：事件 23] [状态：公开来源确认]`\n- `0x1c09395848a87069c9d6ddbe5adc6249510aba7a2a83479a74b4280cafb5fb29` — `[链：BNB Chain] [攻击 Tx] [身份：事件 23] [状态：公开来源确认]`\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\n鏈上覆現確認合約邏輯、記賬、權限或價格機制存在可被利用路徑；具體步驟見攻擊交易與復現源碼。\n\n## 事件經過\n攻擊者調用存在缺陷的合約路徑，利用閃電流動性、儲備/價格操縱、錯誤記賬、權限或簽名校驗缺陷完成資產提取；交易已由 DeFiHackLabs 在歷史狀態上覆現。\n\n## 資金流向\n受害合約或流動性池 → 攻擊合約或攻擊者地址。公開資料未披露後續兌換與資金轉移路徑。\n\n## 金額口徑\n公開可核損失按 $111,098 記錄；原報告資產口徑為“111,097.59 USDC”。\n\n## 地址與交易\n- `0x0d4024cd27538350a911d9b7ee90811fa4875ba3` — `[鏈：BNB Chain] [攻擊者] [身份：事件 23] [狀態：公開來源確認]`\n- `0xddef10a85a5c67a9af8398d297aa51f8716383c7` — `[鏈：BNB Chain] [攻擊合約] [身份：事件 23] [狀態：公開來源確認]`\n- `0x6c60bf5db0670ae94489d3dde2c60f271625db50` — `[鏈：BNB Chain] [受害/漏洞合約] [身份：事件 23] [狀態：公開來源確認]`\n- `0x1c09395848a87069c9d6ddbe5adc6249510aba7a2a83479a74b4280cafb5fb29` — `[鏈：BNB Chain] [攻擊 Tx] [身份：事件 23] [狀態：公開來源確認]`\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nHistorical-state reproduction supports an exploitable contract, accounting, authorization, pricing, or signature-validation path. The exact evidence is preserved in the cited transaction and reproduction source.\n\n## Incident sequence\nThe attacker used the cited contract or infrastructure weakness to move assets from the affected contract, wallet or pool. Historical-state reproduction or the cited public alert supports the event; later movement remains undisclosed.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nVerified loss is recorded at $111,098. The report's underlying asset basis was: 111,097.59 USDC.\n\n## Addresses and transactions\n1. `0x0d4024cd27538350a911d9b7ee90811fa4875ba3` — BNB Chain; publicly identified attacker address.\n2. `0xddef10a85a5c67a9af8398d297aa51f8716383c7` — BNB Chain; publicly identified attacker contract.\n3. `0x6c60bf5db0670ae94489d3dde2c60f271625db50` — BNB Chain; affected or vulnerable contract (not an attacker).\n4. `0x1c09395848a87069c9d6ddbe5adc6249510aba7a2a83479a74b4280cafb5fb29` — BNB Chain; attack or execution transaction.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "protocol-exploit", "severity": "medium", "ecosystems": [ "BNB Chain" ], "chains": [ "BNB Chain" ], "lossUsd": 111097.59, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开可核损失按 $111,098 记录；原报告资产口径为“111,097.59 USDC”。", "tw": "公開可核損失按 $111,098 記錄；原報告資產口徑為“111,097.59 USDC”。", "en": "Verified loss is recorded at $111,098. The report's underlying asset basis was: 111,097.59 USDC." }, "addressDisclosure": "published", "addresses": [ { "chain": "BNB Chain", "address": "0x0d4024cd27538350a911d9b7ee90811fa4875ba3", "entity": { "zh": "公开攻击者地址", "tw": "公開攻擊者地址", "en": "publicly identified attacker address" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/TenArmorAlert/status/2067059314519417163", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [攻击者] [身份：事件 23] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [攻擊者] [身份：事件 23] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker address. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xddef10a85a5c67a9af8398d297aa51f8716383c7", "entity": { "zh": "公开攻击合约", "tw": "公開攻擊合約", "en": "publicly identified attacker contract" }, "role": "attacker-contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/TenArmorAlert/status/2067059314519417163", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [攻击合约] [身份：事件 23] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [攻擊合約] [身份：事件 23] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker contract. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x6c60bf5db0670ae94489d3dde2c60f271625db50", "entity": { "zh": "受影响或漏洞合约（非攻击者）", "tw": "受影響或漏洞合約（非攻擊者）", "en": "affected or vulnerable contract (not an attacker)" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/TenArmorAlert/status/2067059314519417163", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [受害/漏洞合约] [身份：事件 23] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [受害/漏洞合約] [身份：事件 23] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "affected or vulnerable contract (not an attacker). The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "公开安全预警或项目说明", "tw": "公開安全預警或專案說明", "en": "Public security alert or project statement" }, "url": "https://x.com/TenArmorAlert/status/2067059314519417163", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-080", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-109", "status": "verified", "incidentDate": "2026-06-15", "datePrecision": "day", "title": { "zh": "Thetanuts Finance", "tw": "Thetanuts Finance", "en": "Thetanuts Finance — on-chain smart-contract exploit" }, "summary": { "zh": "公开来源确认 Thetanuts Finance 发生智能合约漏洞、链上攻击事件，损失约 $105,000。", "tw": "公開來源確認 Thetanuts Finance 發生智能合約漏洞、鏈上攻擊事件，損失約 $105,000。", "en": "Public sources report Thetanuts Finance — on-chain smart-contract exploit, with a loss of approximately $105,000." }, "details": { "zh": "## 事件背景\nInteger division truncation in mint() after the vault was drained to a near-zero totalSupply.\n\n## 事件经过\n攻击者调用存在缺陷的合约路径，利用闪电流动性、储备/价格操纵、错误记账、权限或签名校验缺陷完成资产提取；交易已由 DeFiHackLabs 在历史状态上复现。\n\n## 资金流向\n受害合约或流动性池 → 攻击合约或攻击者地址。公开资料未披露后续兑换与资金转移路径。\n\n## 金额口径\nDeFiLlama 记录净损失约 10.5 万美元。报告同时描述约 210 万美元风险敞口及约 200 万美元由白帽救援；公开资料未确认其中有多少资产已实际返还受害者。\n\n## 地址与交易\n- `0x30498e4466789E534c72e03B52A16c978655b41e` — `[链：Ethereum] [攻击者] [身份：事件 54] [状态：公开来源确认]`\n- `0xa589c5342068B0C1fEFd44d3c95354427502AC91` — `[链：Ethereum] [攻击合约] [身份：事件 54] [状态：公开来源确认]`\n- `0xC2C3AE0a7b405058558C9b4a63b373486CB86Ac7` — `[链：Ethereum] [受害/漏洞合约] [身份：事件 54] [状态：公开来源确认]`\n- `0xbba9f138fe39503bfd1aa62932dbd6ab35d37d23d48e4b7bf2988a9d5dc39fec` — `[链：Ethereum] [攻击 Tx] [身份：事件 54] [状态：公开来源确认]`\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\nInteger division truncation in mint() after the vault was drained to a near-zero totalSupply.\n\n## 事件經過\n攻擊者調用存在缺陷的合約路徑，利用閃電流動性、儲備/價格操縱、錯誤記賬、權限或簽名校驗缺陷完成資產提取；交易已由 DeFiHackLabs 在歷史狀態上覆現。\n\n## 資金流向\n受害合約或流動性池 → 攻擊合約或攻擊者地址。公開資料未披露後續兌換與資金轉移路徑。\n\n## 金額口徑\nDeFiLlama 記錄淨損失約 10.5 萬美元。報告同時描述約 210 萬美元風險敞口及約 200 萬美元由白帽救援；公開資料未確認其中有多少資產已實際返還受害者。\n\n## 地址與交易\n- `0x30498e4466789E534c72e03B52A16c978655b41e` — `[鏈：Ethereum] [攻擊者] [身份：事件 54] [狀態：公開來源確認]`\n- `0xa589c5342068B0C1fEFd44d3c95354427502AC91` — `[鏈：Ethereum] [攻擊合約] [身份：事件 54] [狀態：公開來源確認]`\n- `0xC2C3AE0a7b405058558C9b4a63b373486CB86Ac7` — `[鏈：Ethereum] [受害/漏洞合約] [身份：事件 54] [狀態：公開來源確認]`\n- `0xbba9f138fe39503bfd1aa62932dbd6ab35d37d23d48e4b7bf2988a9d5dc39fec` — `[鏈：Ethereum] [攻擊 Tx] [身份：事件 54] [狀態：公開來源確認]`\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nInteger-division truncation in mint() became exploitable after the vault was drained to a near-zero totalSupply.\n\n## Incident sequence\nThe attacker used the cited contract or infrastructure weakness to move assets from the affected contract, wallet or pool. Historical-state reproduction or the cited public alert supports the event; later movement remains undisclosed.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nDeFiLlama records approximately $105,000 in loss. The report also describes roughly $2.1 million exposed and about $2 million rescued by a white hat; no exact public return amount is recorded as recovered.\n\n## Addresses and transactions\n1. `0x30498e4466789E534c72e03B52A16c978655b41e` — Ethereum; publicly identified attacker address.\n2. `0xa589c5342068B0C1fEFd44d3c95354427502AC91` — Ethereum; publicly identified attacker contract.\n3. `0xC2C3AE0a7b405058558C9b4a63b373486CB86Ac7` — Ethereum; affected or vulnerable contract (not an attacker).\n4. `0xbba9f138fe39503bfd1aa62932dbd6ab35d37d23d48e4b7bf2988a9d5dc39fec` — Ethereum; attack or execution transaction.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "protocol-exploit", "severity": "medium", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 105000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "DeFiLlama 记录净损失约 10.5 万美元。报告同时描述约 210 万美元风险敞口及约 200 万美元由白帽救援；公开资料未确认其中有多少资产已实际返还受害者。", "tw": "DeFiLlama 記錄淨損失約 10.5 萬美元。報告同時描述約 210 萬美元風險敞口及約 200 萬美元由白帽救援；公開資料未確認其中有多少資產已實際返還受害者。", "en": "DeFiLlama records approximately $105,000 in loss. The report also describes roughly $2.1 million exposed and about $2 million rescued by a white hat; no exact public return amount is recorded as recovered." }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0x30498e4466789E534c72e03B52A16c978655b41e", "entity": { "zh": "公开攻击者地址", "tw": "公開攻擊者地址", "en": "publicly identified attacker address" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/ThetanutsFi/status/2066569315961454925", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [攻击者] [身份：事件 54] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：Ethereum] [攻擊者] [身份：事件 54] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker address. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xa589c5342068B0C1fEFd44d3c95354427502AC91", "entity": { "zh": "公开攻击合约", "tw": "公開攻擊合約", "en": "publicly identified attacker contract" }, "role": "attacker-contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/ThetanutsFi/status/2066569315961454925", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [攻击合约] [身份：事件 54] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：Ethereum] [攻擊合約] [身份：事件 54] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker contract. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xC2C3AE0a7b405058558C9b4a63b373486CB86Ac7", "entity": { "zh": "受影响或漏洞合约（非攻击者）", "tw": "受影響或漏洞合約（非攻擊者）", "en": "affected or vulnerable contract (not an attacker)" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/ThetanutsFi/status/2066569315961454925", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [受害/漏洞合约] [身份：事件 54] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：Ethereum] [受害/漏洞合約] [身份：事件 54] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "affected or vulnerable contract (not an attacker). The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "公开安全预警或项目说明", "tw": "公開安全預警或專案說明", "en": "Public security alert or project statement" }, "url": "https://x.com/ThetanutsFi/status/2066569315961454925", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-109", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-079", "status": "verified", "incidentDate": "2026-06-15", "datePrecision": "day", "title": { "zh": "SStar Agent 伪 Web3 AI 项目恶意软件", "tw": "SStar Agent 偽 Web3 AI 專案惡意軟件", "en": "SStar Agent fake Web3 AI project malware campaign" }, "summary": { "zh": "SStar Agent 伪装成 Web3 AI 项目传播恶意软件；未披露统一可核损失金额。", "tw": "SStar Agent 偽裝成 Web3 AI 項目傳播惡意軟件；未披露統一可核損失金額。", "en": "The fake SStar Agent Web3 AI project distributed malware; no verified aggregate loss amount was published." }, "details": { "zh": "## 事件背景\n伪造 GitHub 项目以 AI 交易代理为诱饵传播恶意软件。\n\n## 事件经过\n安全机构或媒体在窗口内公开披露该独立活动/受害项目；按不同受害发布链、项目或攻击面分别列项，避免把多个事件压成一个“供应链簇”。\n\n## 资金流向\n恶意包、伪仓库或被入侵前端 → 开发者/用户设备 → 凭据、钱包授权或资产风险；没有统一可核链上收款地址。\n\n## 金额口径\n涉及钱包私钥和浏览器凭据风险；未公开统一可核损失额。\n\n## 地址与交易\n链上地址与 TxID 未公开（不适用）；事件属于链下供应链或前端安全。\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\n偽造 GitHub 專案以 AI 交易代理為誘餌傳播惡意軟件。\n\n## 事件經過\n安全機構或媒體在窗口內公開披露該獨立活動/受害專案；按不同受害發布鏈、專案或攻擊面分別列項，避免把多個事件壓成一個“供應鏈簇”。\n\n## 資金流向\n惡意包、偽倉庫或被入侵前端 → 開發者/用戶設備 → 憑據、錢包授權或資產風險；沒有統一可核鏈上收款地址。\n\n## 金額口徑\n涉及錢包私鑰和瀏覽器憑據風險；未公開統一可核損失額。\n\n## 地址與交易\n鏈上地址與 TxID 未公開（不適用）；事件屬於鏈下供應鏈或前端安全。\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nA counterfeit GitHub project presented as an AI trading agent was used to distribute credential- and wallet-targeting malware.\n\n## Incident sequence\nSecurity researchers or public reporting disclosed this distinct campaign or affected project during the June window. It is kept separate from other supply-chain incidents because the affected publishing chain, project or attack surface differs.\n\n## Fund flow\nA malicious package, repository or compromised front end exposed developer or user devices to credential, wallet-authorization or asset risk. No single verified receiving address was published.\n\n## Amount basis\nPotential wallet-key and browser-credential exposure; no single verified loss amount was published.\n\n## Addresses and transactions\nNo applicable blockchain address or transaction was published because this is an off-chain supply-chain, malware, front-end, or enforcement event.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "supply-chain", "severity": "medium", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "涉及钱包私钥和浏览器凭据风险；未公开统一可核损失额。", "tw": "涉及錢包私鑰和瀏覽器憑據風險；未公開統一可核損失額。", "en": "Potential wallet-key and browser-credential exposure; no single verified loss amount was published." }, "addressDisclosure": "not-applicable", "addresses": [], "references": [ { "label": { "zh": "公开安全预警或项目说明", "tw": "公開安全預警或專案說明", "en": "Public security alert or project statement" }, "url": "https://x.com/TheHackersNews/status/2066531622695084329", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-079", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-078", "status": "verified", "incidentDate": "2026-06-14", "datePrecision": "day", "title": { "zh": "Aztec Connect", "tw": "Aztec Connect", "en": "Aztec Connect — on-chain smart-contract exploit" }, "summary": { "zh": "公开来源确认 Aztec Connect 发生智能合约漏洞、链上攻击事件，损失约 $2,190,000。", "tw": "公開來源確認 Aztec Connect 發生智能合約漏洞、鏈上攻擊事件，損失約 $2,190,000。", "en": "Public sources report Aztec Connect — on-chain smart-contract exploit, with a loss of approximately $2,190,000." }, "details": { "zh": "## 事件背景\nnumRealTxs mismatch between proof/hash coverage and L1 settlement (core/Decoder.sol):\n\n## 事件经过\n攻击者调用存在缺陷的合约路径，利用闪电流动性、储备/价格操纵、错误记账、权限或签名校验缺陷完成资产提取；交易已由 DeFiHackLabs 在历史状态上复现。\n\n## 资金流向\n受害合约或流动性池 → 攻击合约或攻击者地址。公开资料未披露后续兑换与资金转移路径。\n\n## 金额口径\n公开可核损失按 $2,190,000 记录；原报告资产口径为“~$2.19M (908.99 ETH + 270.5K DAI + 167.9 wstETH + yvDAI/yvWETH/LUSD/yvLUSD)”。\n\n## 地址与交易\n- `0x0F18D8b44a740272f0be4d08338d2b165b7EdD17` — `[链：Ethereum] [攻击者] [身份：事件 21] [状态：公开来源确认]`\n- `0xFF1F2B4ADb9dF6FC8eAFecDcbF96A2B351680455` — `[链：Ethereum] [受害/漏洞合约] [身份：事件 21] [状态：公开来源确认]`\n- `0x074ec9317d8336db37e8c348fbdd7515573ff4088239c77ab429f522509aeeb1` — `[链：Ethereum] [攻击 Tx] [身份：事件 21] [状态：公开来源确认]`\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\nnumRealTxs mismatch between proof/hash coverage and L1 settlement (core/Decoder.sol):\n\n## 事件經過\n攻擊者調用存在缺陷的合約路徑，利用閃電流動性、儲備/價格操縱、錯誤記賬、權限或簽名校驗缺陷完成資產提取；交易已由 DeFiHackLabs 在歷史狀態上覆現。\n\n## 資金流向\n受害合約或流動性池 → 攻擊合約或攻擊者地址。公開資料未披露後續兌換與資金轉移路徑。\n\n## 金額口徑\n公開可核損失按 $2,190,000 記錄；原報告資產口徑為“~$2.19M (908.99 ETH + 270.5K DAI + 167.9 wstETH + yvDAI/yvWETH/LUSD/yvLUSD)”。\n\n## 地址與交易\n- `0x0F18D8b44a740272f0be4d08338d2b165b7EdD17` — `[鏈：Ethereum] [攻擊者] [身份：事件 21] [狀態：公開來源確認]`\n- `0xFF1F2B4ADb9dF6FC8eAFecDcbF96A2B351680455` — `[鏈：Ethereum] [受害/漏洞合約] [身份：事件 21] [狀態：公開來源確認]`\n- `0x074ec9317d8336db37e8c348fbdd7515573ff4088239c77ab429f522509aeeb1` — `[鏈：Ethereum] [攻擊 Tx] [身份：事件 21] [狀態：公開來源確認]`\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nnumRealTxs mismatch between proof/hash coverage and L1 settlement (core/Decoder.sol):\n\n## Incident sequence\nThe attacker used the cited contract or infrastructure weakness to move assets from the affected contract, wallet or pool. Historical-state reproduction or the cited public alert supports the event; later movement remains undisclosed.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nVerified loss is recorded at $2,190,000. The report's underlying asset basis was: ~$2.19M (908.99 ETH + 270.5K DAI + 167.9 wstETH + yvDAI/yvWETH/LUSD/yvLUSD).\n\n## Addresses and transactions\n1. `0x0F18D8b44a740272f0be4d08338d2b165b7EdD17` — Ethereum; publicly identified attacker address.\n2. `0xFF1F2B4ADb9dF6FC8eAFecDcbF96A2B351680455` — Ethereum; affected or vulnerable contract (not an attacker).\n3. `0x074ec9317d8336db37e8c348fbdd7515573ff4088239c77ab429f522509aeeb1` — Ethereum; attack or execution transaction.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 2190000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开可核损失按 $2,190,000 记录；原报告资产口径为“~$2.19M (908.99 ETH + 270.5K DAI + 167.9 wstETH + yvDAI/yvWETH/LUSD/yvLUSD)”。", "tw": "公開可核損失按 $2,190,000 記錄；原報告資產口徑為“~$2.19M (908.99 ETH + 270.5K DAI + 167.9 wstETH + yvDAI/yvWETH/LUSD/yvLUSD)”。", "en": "Verified loss is recorded at $2,190,000. The report's underlying asset basis was: ~$2.19M (908.99 ETH + 270.5K DAI + 167.9 wstETH + yvDAI/yvWETH/LUSD/yvLUSD)." }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0x0F18D8b44a740272f0be4d08338d2b165b7EdD17", "entity": { "zh": "公开攻击者地址", "tw": "公開攻擊者地址", "en": "publicly identified attacker address" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/aztecFND/status/2066175938887619055", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [攻击者] [身份：事件 21] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：Ethereum] [攻擊者] [身份：事件 21] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker address. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xFF1F2B4ADb9dF6FC8eAFecDcbF96A2B351680455", "entity": { "zh": "受影响或漏洞合约（非攻击者）", "tw": "受影響或漏洞合約（非攻擊者）", "en": "affected or vulnerable contract (not an attacker)" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/aztecFND/status/2066175938887619055", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [受害/漏洞合约] [身份：事件 21] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：Ethereum] [受害/漏洞合約] [身份：事件 21] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "affected or vulnerable contract (not an attacker). The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "公开安全预警或项目说明", "tw": "公開安全預警或專案說明", "en": "Public security alert or project statement" }, "url": "https://x.com/aztecFND/status/2066175938887619055", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-078", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-077", "status": "verified", "incidentDate": "2026-06-12", "datePrecision": "day", "title": { "zh": "openai_mcp 等 PyPI 恶意包活动", "tw": "openai_mcp 等 PyPI 惡意包活動", "en": "Malicious PyPI packages including openai_mcp" }, "summary": { "zh": "openai_mcp 等恶意 PyPI 包形成软件供应链攻击；未披露统一可核损失金额。", "tw": "openai_mcp 等惡意 PyPI 包形成軟件供應鏈攻擊；未披露統一可核損失金額。", "en": "Malicious PyPI packages including openai_mcp formed a software-supply-chain campaign; no verified aggregate loss amount was published." }, "details": { "zh": "## 事件背景\n恶意包利用.pth 和 Bun 运行时链执行载荷。\n\n## 事件经过\n安全机构或媒体在窗口内公开披露该独立活动/受害项目；按不同受害发布链、项目或攻击面分别列项，避免把多个事件压成一个“供应链簇”。\n\n## 资金流向\n恶意包、伪仓库或被入侵前端 → 开发者/用户设备 → 凭据、钱包授权或资产风险；没有统一可核链上收款地址。\n\n## 金额口径\n涉及凭据与钱包环境风险；未公开统一可核损失额。\n\n## 地址与交易\n链上地址与 TxID 未公开（不适用）；事件属于链下供应链或前端安全。\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\n惡意包利用.pth 和 Bun 運行時鏈執行載荷。\n\n## 事件經過\n安全機構或媒體在窗口內公開披露該獨立活動/受害專案；按不同受害發布鏈、專案或攻擊面分別列項，避免把多個事件壓成一個“供應鏈簇”。\n\n## 資金流向\n惡意包、偽倉庫或被入侵前端 → 開發者/用戶設備 → 憑據、錢包授權或資產風險；沒有統一可核鏈上收款地址。\n\n## 金額口徑\n涉及憑據與錢包環境風險；未公開統一可核損失額。\n\n## 地址與交易\n鏈上地址與 TxID 未公開（不適用）；事件屬於鏈下供應鏈或前端安全。\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nThe malicious packages used Python .pth processing and the Bun runtime to execute payloads in developer environments.\n\n## Incident sequence\nSecurity researchers or public reporting disclosed this distinct campaign or affected project during the June window. It is kept separate from other supply-chain incidents because the affected publishing chain, project or attack surface differs.\n\n## Fund flow\nA malicious package, repository or compromised front end exposed developer or user devices to credential, wallet-authorization or asset risk. No single verified receiving address was published.\n\n## Amount basis\nCredential and wallet-environment exposure; no single verified loss amount was published.\n\n## Addresses and transactions\nNo applicable blockchain address or transaction was published because this is an off-chain supply-chain, malware, front-end, or enforcement event.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "supply-chain", "severity": "medium", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "涉及凭据与钱包环境风险；未公开统一可核损失额。", "tw": "涉及憑據與錢包環境風險；未公開統一可核損失額。", "en": "Credential and wallet-environment exposure; no single verified loss amount was published." }, "addressDisclosure": "not-applicable", "addresses": [], "references": [ { "label": { "zh": "公开安全预警或项目说明", "tw": "公開安全預警或專案說明", "en": "Public security alert or project statement" }, "url": "https://x.com/SlowMist_Team/status/2065396059879477455", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-077", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-075", "status": "verified", "incidentDate": "2026-06-10", "datePrecision": "day", "title": { "zh": "Raydium AMM", "tw": "Raydium AMM", "en": "Raydium AMM — Fake LP Mint Attack" }, "summary": { "zh": "公开来源确认 Raydium AMM 发生 Fake LP Mint Attack 事件，损失约 $1,340,000。", "tw": "公開來源確認 Raydium AMM 發生 Fake LP Mint Attack 事件，損失約 $1,340,000。", "en": "Public sources report Raydium AMM — Fake LP Mint Attack, with a loss of approximately $1,340,000." }, "details": { "zh": "## 事件背景\nFake LP Mint Attack；事件依据 DeFiLlama 月度记录及其他可检索公开来源核验。 原报告存在百万倍金额展开错误，相关数值已按正确单位更正；事件事实、来源和资产单位保持不变。\n\n## 事件经过\n公开记录确认项目在该日附近发生安全事件，但未披露完整攻击路径。\n\n## 资金流向\n资产从受害项目或钱包转向攻击者或异常接收方；公开资料未披露完整逐跳路径。\n\n## 金额口径\n公开来源支持的损失额约为 $1,340,000；原报告中的“约 $1,340,000,000,000”存在百万倍单位展开错误，已按正确单位更正。\n\n## 地址与交易\n公开资料未披露完整攻击地址与 TxID。\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\nFake LP Mint Attack；事件依據 DeFiLlama 月度記錄及其他可檢索公開來源核驗。 原報告存在百萬倍金額展開錯誤，相關數值已按正確單位更正；事件事實、來源和資產單位保持不變。\n\n## 事件經過\n公開記錄確認專案在該日附近發生安全事件，但未披露完整攻擊路徑。\n\n## 資金流向\n資產從受害專案或錢包轉向攻擊者或異常接收方；公開資料未披露完整逐跳路徑。\n\n## 金額口徑\n公開來源支持的損失額約為 $1,340,000；原報告中的“約 $1,340,000,000,000”存在百萬倍單位展開錯誤，已按正確單位更正。\n\n## 地址與交易\n公開資料未披露完整攻擊地址與 TxID。\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nPublic sources classify the incident as Fake LP Mint Attack but do not disclose a complete exploit path.\n\n## Incident sequence\nPublic sources confirm a security incident near the stated date but do not disclose a complete exploit sequence, attribution, or downstream flow.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nPublic sources support a loss of approximately $1,340,000. The report contained a one-million-fold unit-expansion error, which has been corrected.\n\n## Addresses and transactions\nPublic sources do not disclose a complete address or transaction list.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "Solana" ], "chains": [ "Solana" ], "lossUsd": 1340000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开来源支持的损失额约为 $1,340,000；原报告中的“约 $1,340,000,000,000”存在百万倍单位展开错误，已按正确单位更正。", "tw": "公開來源支持的損失額約為 $1,340,000；原報告中的“約 $1,340,000,000,000”存在百萬倍單位展開錯誤，已按正確單位更正。", "en": "Public sources support a loss of approximately $1,340,000. The report contained a one-million-fold unit-expansion error, which has been corrected." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "公开安全预警或项目说明", "tw": "公開安全預警或專案說明", "en": "Public security alert or project statement" }, "url": "https://x.com/CertiKAlert/status/2064690768595206337", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-075", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-074", "status": "verified", "incidentDate": "2026-06-09", "datePrecision": "day", "title": { "zh": "Token of Power/TOP", "tw": "Token of Power/TOP", "en": "Token of Power/TOP — on-chain smart-contract exploit" }, "summary": { "zh": "公开来源确认 Token of Power/TOP 发生智能合约漏洞、链上攻击事件，损失约 $1,580,000。", "tw": "公開來源確認 Token of Power/TOP 發生智能合約漏洞、鏈上攻擊事件，損失約 $1,580,000。", "en": "Public sources report Token of Power/TOP — on-chain smart-contract exploit, with a loss of approximately $1,580,000." }, "details": { "zh": "## 事件背景\n链上复现确认合约逻辑、记账、权限或价格机制存在可被利用路径；具体步骤见攻击交易与复现源码。\n\n## 事件经过\n攻击者调用存在缺陷的合约路径，利用闪电流动性、储备/价格操纵、错误记账、权限或签名校验缺陷完成资产提取；交易已由 DeFiHackLabs 在历史状态上复现。\n\n## 资金流向\n受害合约或流动性池 → 攻击合约或攻击者地址。公开资料未披露后续兑换与资金转移路径。\n\n## 金额口径\n公开可核损失按 $1,580,000 记录；原报告资产口径为“944.20 WETH”。\n\n## 地址与交易\n- `0xff8ef7bc455a57e5893232203052ce0232b39fa2` — `[链：Ethereum] [攻击者] [身份：事件 17] [状态：公开来源确认]`\n- `0x25c68c44a96518294f5b47d758f98309c6729a21` — `[链：Ethereum] [攻击合约] [身份：事件 17] [状态：公开来源确认]`\n- `0xb935c3d80229d5d92f3761b17cd81dc2610e3a45` — `[链：Ethereum] [受害/漏洞合约] [身份：事件 17] [状态：公开来源确认]`\n- `0x967aa34c69b7775c718545c7f94d92e965eb5fc553c0f27f6f1a9c65c93ac156` — `[链：Ethereum] [攻击 Tx] [身份：事件 17] [状态：公开来源确认]`\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\n鏈上覆現確認合約邏輯、記賬、權限或價格機制存在可被利用路徑；具體步驟見攻擊交易與復現源碼。\n\n## 事件經過\n攻擊者調用存在缺陷的合約路徑，利用閃電流動性、儲備/價格操縱、錯誤記賬、權限或簽名校驗缺陷完成資產提取；交易已由 DeFiHackLabs 在歷史狀態上覆現。\n\n## 資金流向\n受害合約或流動性池 → 攻擊合約或攻擊者地址。公開資料未披露後續兌換與資金轉移路徑。\n\n## 金額口徑\n公開可核損失按 $1,580,000 記錄；原報告資產口徑為“944.20 WETH”。\n\n## 地址與交易\n- `0xff8ef7bc455a57e5893232203052ce0232b39fa2` — `[鏈：Ethereum] [攻擊者] [身份：事件 17] [狀態：公開來源確認]`\n- `0x25c68c44a96518294f5b47d758f98309c6729a21` — `[鏈：Ethereum] [攻擊合約] [身份：事件 17] [狀態：公開來源確認]`\n- `0xb935c3d80229d5d92f3761b17cd81dc2610e3a45` — `[鏈：Ethereum] [受害/漏洞合約] [身份：事件 17] [狀態：公開來源確認]`\n- `0x967aa34c69b7775c718545c7f94d92e965eb5fc553c0f27f6f1a9c65c93ac156` — `[鏈：Ethereum] [攻擊 Tx] [身份：事件 17] [狀態：公開來源確認]`\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nHistorical-state reproduction supports an exploitable contract, accounting, authorization, pricing, or signature-validation path. The exact evidence is preserved in the cited transaction and reproduction source.\n\n## Incident sequence\nThe attacker used the cited contract or infrastructure weakness to move assets from the affected contract, wallet or pool. Historical-state reproduction or the cited public alert supports the event; later movement remains undisclosed.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nVerified loss is recorded at $1,580,000. The report's underlying asset basis was: 944.20 WETH.\n\n## Addresses and transactions\n1. `0xff8ef7bc455a57e5893232203052ce0232b39fa2` — Ethereum; publicly identified attacker address.\n2. `0x25c68c44a96518294f5b47d758f98309c6729a21` — Ethereum; publicly identified attacker contract.\n3. `0xb935c3d80229d5d92f3761b17cd81dc2610e3a45` — Ethereum; affected or vulnerable contract (not an attacker).\n4. `0x967aa34c69b7775c718545c7f94d92e965eb5fc553c0f27f6f1a9c65c93ac156` — Ethereum; attack or execution transaction.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 1580000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开可核损失按 $1,580,000 记录；原报告资产口径为“944.20 WETH”。", "tw": "公開可核損失按 $1,580,000 記錄；原報告資產口徑為“944.20 WETH”。", "en": "Verified loss is recorded at $1,580,000. The report's underlying asset basis was: 944.20 WETH." }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0xff8ef7bc455a57e5893232203052ce0232b39fa2", "entity": { "zh": "公开攻击者地址", "tw": "公開攻擊者地址", "en": "publicly identified attacker address" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/DefimonAlerts/status/2064616112822583505", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [攻击者] [身份：事件 17] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：Ethereum] [攻擊者] [身份：事件 17] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker address. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x25c68c44a96518294f5b47d758f98309c6729a21", "entity": { "zh": "公开攻击合约", "tw": "公開攻擊合約", "en": "publicly identified attacker contract" }, "role": "attacker-contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/DefimonAlerts/status/2064616112822583505", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [攻击合约] [身份：事件 17] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：Ethereum] [攻擊合約] [身份：事件 17] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker contract. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xb935c3d80229d5d92f3761b17cd81dc2610e3a45", "entity": { "zh": "受影响或漏洞合约（非攻击者）", "tw": "受影響或漏洞合約（非攻擊者）", "en": "affected or vulnerable contract (not an attacker)" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/DefimonAlerts/status/2064616112822583505", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [受害/漏洞合约] [身份：事件 17] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：Ethereum] [受害/漏洞合約] [身份：事件 17] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "affected or vulnerable contract (not an attacker). The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "公开安全预警或项目说明", "tw": "公開安全預警或專案說明", "en": "Public security alert or project statement" }, "url": "https://x.com/DefimonAlerts/status/2064616112822583505", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-074", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-073", "status": "verified", "incidentDate": "2026-06-09", "datePrecision": "day", "title": { "zh": "NovaBox", "tw": "NovaBox", "en": "NovaBox — on-chain smart-contract exploit" }, "summary": { "zh": "公开来源确认 NovaBox 发生智能合约漏洞、链上攻击事件，损失约 $107,000。", "tw": "公開來源確認 NovaBox 發生智能合約漏洞、鏈上攻擊事件，損失約 $107,000。", "en": "Public sources report NovaBox — on-chain smart-contract exploit, with a loss of approximately $107,000." }, "details": { "zh": "## 事件背景\n链上复现确认合约逻辑、记账、权限或价格机制存在可被利用路径；具体步骤见攻击交易与复现源码。\n\n## 事件经过\n攻击者调用存在缺陷的合约路径，利用闪电流动性、储备/价格操纵、错误记账、权限或签名校验缺陷完成资产提取；交易已由 DeFiHackLabs 在历史状态上复现。\n\n## 资金流向\n受害合约或流动性池 → 攻击合约或攻击者地址。公开资料未披露后续兑换与资金转移路径。\n\n## 金额口径\n公开可核损失按 $107,000 记录；原报告资产口径为“56.73 ETH”。\n\n## 地址与交易\n- `0x3690c5efc63eea1167c4d92a3f2dd8afdb85c294` — `[链：Ethereum] [攻击者] [身份：事件 16] [状态：公开来源确认]`\n- `0xb50be385f6eb02ae379da3d3a1bb58a0dc260858` — `[链：Ethereum] [攻击合约] [身份：事件 16] [状态：公开来源确认]`\n- `0xbc4191167d4b0251cab5201a527daa8a7d3846b0` — `[链：Ethereum] [受害/漏洞合约] [身份：事件 16] [状态：公开来源确认]`\n- `0x0cfa357e9e4db1540246f17cb6bfa0634ff8727d7cf241b63fb22605021c8844` — `[链：Ethereum] [攻击 Tx] [身份：事件 16] [状态：公开来源确认]`\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\n鏈上覆現確認合約邏輯、記賬、權限或價格機制存在可被利用路徑；具體步驟見攻擊交易與復現源碼。\n\n## 事件經過\n攻擊者調用存在缺陷的合約路徑，利用閃電流動性、儲備/價格操縱、錯誤記賬、權限或簽名校驗缺陷完成資產提取；交易已由 DeFiHackLabs 在歷史狀態上覆現。\n\n## 資金流向\n受害合約或流動性池 → 攻擊合約或攻擊者地址。公開資料未披露後續兌換與資金轉移路徑。\n\n## 金額口徑\n公開可核損失按 $107,000 記錄；原報告資產口徑為“56.73 ETH”。\n\n## 地址與交易\n- `0x3690c5efc63eea1167c4d92a3f2dd8afdb85c294` — `[鏈：Ethereum] [攻擊者] [身份：事件 16] [狀態：公開來源確認]`\n- `0xb50be385f6eb02ae379da3d3a1bb58a0dc260858` — `[鏈：Ethereum] [攻擊合約] [身份：事件 16] [狀態：公開來源確認]`\n- `0xbc4191167d4b0251cab5201a527daa8a7d3846b0` — `[鏈：Ethereum] [受害/漏洞合約] [身份：事件 16] [狀態：公開來源確認]`\n- `0x0cfa357e9e4db1540246f17cb6bfa0634ff8727d7cf241b63fb22605021c8844` — `[鏈：Ethereum] [攻擊 Tx] [身份：事件 16] [狀態：公開來源確認]`\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nHistorical-state reproduction supports an exploitable contract, accounting, authorization, pricing, or signature-validation path. The exact evidence is preserved in the cited transaction and reproduction source.\n\n## Incident sequence\nThe attacker used the cited contract or infrastructure weakness to move assets from the affected contract, wallet or pool. Historical-state reproduction or the cited public alert supports the event; later movement remains undisclosed.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nVerified loss is recorded at $107,000. The report's underlying asset basis was: 56.73 ETH.\n\n## Addresses and transactions\n1. `0x3690c5efc63eea1167c4d92a3f2dd8afdb85c294` — Ethereum; publicly identified attacker address.\n2. `0xb50be385f6eb02ae379da3d3a1bb58a0dc260858` — Ethereum; publicly identified attacker contract.\n3. `0xbc4191167d4b0251cab5201a527daa8a7d3846b0` — Ethereum; affected or vulnerable contract (not an attacker).\n4. `0x0cfa357e9e4db1540246f17cb6bfa0634ff8727d7cf241b63fb22605021c8844` — Ethereum; attack or execution transaction.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "protocol-exploit", "severity": "medium", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 107000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开可核损失按 $107,000 记录；原报告资产口径为“56.73 ETH”。", "tw": "公開可核損失按 $107,000 記錄；原報告資產口徑為“56.73 ETH”。", "en": "Verified loss is recorded at $107,000. The report's underlying asset basis was: 56.73 ETH." }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0x3690c5efc63eea1167c4d92a3f2dd8afdb85c294", "entity": { "zh": "公开攻击者地址", "tw": "公開攻擊者地址", "en": "publicly identified attacker address" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/DefimonAlerts/status/2064616360466919793", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [攻击者] [身份：事件 16] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：Ethereum] [攻擊者] [身份：事件 16] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker address. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xb50be385f6eb02ae379da3d3a1bb58a0dc260858", "entity": { "zh": "公开攻击合约", "tw": "公開攻擊合約", "en": "publicly identified attacker contract" }, "role": "attacker-contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/DefimonAlerts/status/2064616360466919793", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [攻击合约] [身份：事件 16] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：Ethereum] [攻擊合約] [身份：事件 16] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker contract. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xbc4191167d4b0251cab5201a527daa8a7d3846b0", "entity": { "zh": "受影响或漏洞合约（非攻击者）", "tw": "受影響或漏洞合約（非攻擊者）", "en": "affected or vulnerable contract (not an attacker)" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/DefimonAlerts/status/2064616360466919793", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [受害/漏洞合约] [身份：事件 16] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：Ethereum] [受害/漏洞合約] [身份：事件 16] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "affected or vulnerable contract (not an attacker). The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "公开安全预警或项目说明", "tw": "公開安全預警或專案說明", "en": "Public security alert or project statement" }, "url": "https://x.com/DefimonAlerts/status/2064616360466919793", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-073", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-072", "status": "verified", "incidentDate": "2026-06-09", "datePrecision": "day", "title": { "zh": "Asterix", "tw": "Asterix", "en": "Asterix — DN404 Forge Loop" }, "summary": { "zh": "公开来源确认 Asterix 发生 DN404 Forge Loop 事件，损失约 $40,000。", "tw": "公開來源確認 Asterix 發生 DN404 Forge Loop 事件，損失約 $40,000。", "en": "Public sources report Asterix — DN404 Forge Loop, with a loss of approximately $40,000." }, "details": { "zh": "## 事件背景\nDN404 Forge Loop；事件依据 DeFiLlama 月度记录及其他可检索公开来源核验。 原报告存在百万倍金额展开错误，相关数值已按正确单位更正；事件事实、来源和资产单位保持不变。\n\n## 事件经过\n公开记录确认项目在该日附近发生安全事件，但未披露完整攻击路径。\n\n## 资金流向\n资产从受害项目或钱包转向攻击者或异常接收方；公开资料未披露完整逐跳路径。\n\n## 金额口径\n公开来源支持的损失额约为 $40,000；原报告中的“约 $40,000,000,000”存在百万倍单位展开错误，已按正确单位更正。\n\n## 地址与交易\n公开资料未披露完整攻击地址与 TxID。\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\nDN404 Forge Loop；事件依據 DeFiLlama 月度記錄及其他可檢索公開來源核驗。 原報告存在百萬倍金額展開錯誤，相關數值已按正確單位更正；事件事實、來源和資產單位保持不變。\n\n## 事件經過\n公開記錄確認專案在該日附近發生安全事件，但未披露完整攻擊路徑。\n\n## 資金流向\n資產從受害專案或錢包轉向攻擊者或異常接收方；公開資料未披露完整逐跳路徑。\n\n## 金額口徑\n公開來源支持的損失額約為 $40,000；原報告中的“約 $40,000,000,000”存在百萬倍單位展開錯誤，已按正確單位更正。\n\n## 地址與交易\n公開資料未披露完整攻擊地址與 TxID。\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nPublic sources classify the incident as DN404 Forge Loop but do not disclose a complete exploit path.\n\n## Incident sequence\nPublic sources confirm a security incident near the stated date but do not disclose a complete exploit sequence, attribution, or downstream flow.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nPublic sources support a loss of approximately $40,000. The report contained a one-million-fold unit-expansion error, which has been corrected.\n\n## Addresses and transactions\nPublic sources do not disclose a complete address or transaction list.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "protocol-exploit", "severity": "low", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 40000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开来源支持的损失额约为 $40,000；原报告中的“约 $40,000,000,000”存在百万倍单位展开错误，已按正确单位更正。", "tw": "公開來源支持的損失額約為 $40,000；原報告中的“約 $40,000,000,000”存在百萬倍單位展開錯誤，已按正確單位更正。", "en": "Public sources support a loss of approximately $40,000. The report contained a one-million-fold unit-expansion error, which has been corrected." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "DeFiLlama Hacks 事件数据库", "tw": "DeFiLlama Hacks 事件數據庫", "en": "DeFiLlama Hacks database" }, "url": "https://api.llama.fi/hacks", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-072", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-071", "status": "verified", "incidentDate": "2026-06-08", "datePrecision": "day", "title": { "zh": "Flooring Protocol", "tw": "Flooring Protocol", "en": "Flooring Protocol — DN404 Forge Loop" }, "summary": { "zh": "公开来源确认 Flooring Protocol 发生 DN404 Forge Loop 事件，但未披露统一可核的美元损失额。", "tw": "公開來源確認 Flooring Protocol 發生 DN404 Forge Loop 事件，但未披露統一可核的美元損失額。", "en": "Public sources identify Flooring Protocol — DN404 Forge Loop as a DN404 Forge Loop incident. No single verifiable USD loss amount was published." }, "details": { "zh": "## 事件背景\nDN404 Forge Loop；事件依据 DeFiLlama 月度记录及其他可检索公开来源核验。\n\n## 事件经过\n公开记录确认项目在该日附近发生安全事件，但未披露完整攻击路径。\n\n## 资金流向\n资产从受害项目或钱包转向攻击者或异常接收方；公开资料未披露完整逐跳路径。\n\n## 金额口径\n未公开统一可核损失额。\n\n## 地址与交易\n公开资料未披露完整攻击地址与 TxID。\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\nDN404 Forge Loop；事件依據 DeFiLlama 月度記錄及其他可檢索公開來源核驗。\n\n## 事件經過\n公開記錄確認專案在該日附近發生安全事件，但未披露完整攻擊路徑。\n\n## 資金流向\n資產從受害專案或錢包轉向攻擊者或異常接收方；公開資料未披露完整逐跳路徑。\n\n## 金額口徑\n未公開統一可核損失額。\n\n## 地址與交易\n公開資料未披露完整攻擊地址與 TxID。\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nPublic sources classify the incident as DN404 Forge Loop but do not disclose a complete exploit path.\n\n## Incident sequence\nPublic sources confirm a security incident near the stated date but do not disclose a complete exploit sequence, attribution, or downstream flow.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nNo single verified loss amount was published.\n\n## Addresses and transactions\nPublic sources do not disclose a complete address or transaction list.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "protocol-exploit", "severity": "low", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "未公开统一可核损失额。", "tw": "未公開統一可核損失額。", "en": "No single verified loss amount was published." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "DeFiLlama Hacks 事件数据库", "tw": "DeFiLlama Hacks 事件數據庫", "en": "DeFiLlama Hacks database" }, "url": "https://api.llama.fi/hacks", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-071", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-004", "status": "verified", "incidentDate": "2026-06-08", "datePrecision": "day", "title": { "zh": "Humanity Protocol 私钥失陷与 $H 非授权铸造", "tw": "Humanity Protocol 私鑰失陷與 $H 非授權鑄造", "en": "Humanity Protocol key compromise and unauthorized $H mint" }, "summary": { "zh": "Humanity Protocol 官方调查确认，攻击者通过钓鱼和远程控制恶意软件窃取项目密钥，在 Ethereum 与 BNB Chain 非授权转移、铸造并抛售 $H；统计采用后续约 3,600 万美元损失估值。", "tw": "Humanity Protocol 官方調查確認，攻擊者通過釣魚和遠程控制惡意軟件竊取項目密鑰，在 Ethereum 與 BNB Chain 非授權轉移、鑄造並拋售 $H；統計採用後續約 3,600 萬美元損失估值。", "en": "Humanity Protocol’s investigation says phishing and remote-access malware enabled the theft of project keys used for unauthorized transfers, minting, and sales of $H on Ethereum and BNB Chain; the aggregate uses the later loss estimate of approximately $36 million." }, "details": { "zh": "## 事件背景\n2026 年 6 月 8 日，Humanity Protocol 在 Ethereum 与 BNB Chain 发生 $H 代币非授权转移、铸造和抛售。Quantstamp 为项目编制的调查摘要确认，攻击者使用了从项目人员设备中窃取的密钥。\n\n## 事件经过\n攻击者先发送冒充 Bithumb 的钓鱼邮件并投放远程控制恶意软件，随后复制 MetaMask 数据和私钥。攻击者在 Ethereum 更换 Hyperlane 跨链代理的实现并转移约 1.4118 亿枚 $H；在 BNB Chain 则使用三个被盗 Safe 签名密钥取得 ProxyAdmin 控制权并铸造约 1 亿枚 $H。\n\n## 资金流向\n攻击者在约八小时内通过 Uniswap 与 PancakeSwap 卖出 $H 并归集 ETH 和 BNB，$H 公开市场价格一度下跌约 89%。官方调查摘要称，已知攻击者地址持有的 ETH 收益超过 2,100 万美元，BNB 侧收益当时仍在统计。\n\n## 金额口径\n事发初期链上追踪给出的损失估值约为 3,200 万美元，后续项目相关报道采用超过 3,600 万美元的估值。公开统计采用后续约 3,600 万美元口径；官方调查摘要单独确认已知地址中的 ETH 收益超过 2,100 万美元，并说明 BNB 收益尚未完成统计，因此这些数字代表不同统计时点和范围。\n\n## 地址与交易\n官方调查公布了受影响运营账户、代理管理合约、攻击者接收地址及关键 Safe 交易。地址标签仅描述调查摘要中明确列出的角色，不扩大为其他所有权或归因结论。\n\n## 证据边界\n现有证据支持钓鱼、远程控制恶意软件和密钥失陷，不支持将事件归因为智能合约代码漏洞。约 3,600 万美元是事件损失估值，不能与铸造代币的名义价值、价格下跌造成的市场损失或单一时点的攻击者余额相加。\n\n## 处置状态\n项目暂停受影响的跨链功能，并与安全机构、交易平台和执法部门合作调查。公开资料尚未确认被转移资产已经返还或重新由受害方控制。", "tw": "## 事件背景\n2026 年 6 月 8 日，Humanity Protocol 在 Ethereum 與 BNB Chain 發生 $H 代幣非授權轉移、鑄造和拋售。Quantstamp 為項目編制的調查摘要確認，攻擊者使用了從項目人員設備中竊取的密鑰。\n\n## 事件經過\n攻擊者先發送冒充 Bithumb 的釣魚郵件並投放遠程控制惡意軟件，隨後複製 MetaMask 數據和私鑰。攻擊者在 Ethereum 更換 Hyperlane 跨鏈代理的實現並轉移約 1.4118 億枚 $H；在 BNB Chain 則使用三個被盜 Safe 簽名密鑰取得 ProxyAdmin 控制權並鑄造約 1 億枚 $H。\n\n## 資金流向\n攻擊者在約八小時內通過 Uniswap 與 PancakeSwap 賣出 $H 並歸集 ETH 和 BNB，$H 公開市場價格一度下跌約 89%。官方調查摘要稱，已知攻擊者地址持有的 ETH 收益超過 2,100 萬美元，BNB 側收益當時仍在統計。\n\n## 金額口徑\n事發初期鏈上追蹤給出的損失估值約為 3,200 萬美元，後續項目相關報道採用超過 3,600 萬美元的估值。公開統計採用後續約 3,600 萬美元口徑；官方調查摘要單獨確認已知地址中的 ETH 收益超過 2,100 萬美元，並說明 BNB 收益尚未完成統計，因此這些數字代表不同統計時點和範圍。\n\n## 地址與交易\n官方調查公佈了受影響運營賬戶、代理管理合約、攻擊者接收地址及關鍵 Safe 交易。地址標籤僅描述調查摘要中明確列出的角色，不擴大為其他所有權或歸因結論。\n\n## 證據邊界\n現有證據支持釣魚、遠程控制惡意軟件和密鑰失陷，不支持將事件歸因為智能合約代碼漏洞。約 3,600 萬美元是事件損失估值，不能與鑄造代幣的名義價值、價格下跌造成的市場損失或單一時點的攻擊者餘額相加。\n\n## 處置狀態\n項目暫停受影響的跨鏈功能，並與安全機構、交易平台和執法部門合作調查。公開資料尚未確認被轉移資產已經返還或重新由受害方控制。", "en": "## Incident background\nOn June 8, 2026, unauthorized transfers, minting, and sales of the $H token occurred on Ethereum and BNB Chain. An investigation summary prepared by Quantstamp for Humanity Protocol confirms that the attacker used keys stolen from a project member’s device.\n\n## Incident sequence\nThe attacker sent a phishing email impersonating Bithumb and installed remote-access malware before copying MetaMask data and private keys. On Ethereum, the attacker replaced the implementation of a Hyperlane warp-route proxy and moved approximately 141.18 million $H. On BNB Chain, three stolen Safe signer keys were used to take control of a ProxyAdmin contract and mint approximately 100 million $H.\n\n## Fund flow\nOver roughly eight hours, the attacker sold $H through Uniswap and PancakeSwap and consolidated ETH and BNB proceeds, while the open-market price of $H fell by approximately 89%. The official investigation summary says known attacker addresses held more than $21 million in ETH proceeds and that BNB proceeds were still being tallied.\n\n## Amount basis\nEarly on-chain tracking estimated the loss at approximately $32 million, while later project-attributed reporting used a figure above $36 million. The public aggregate uses the later estimate of approximately $36 million. The official investigation separately confirms more than $21 million in ETH proceeds at known addresses and says BNB proceeds were still being tallied, so these figures represent different observation times and scopes.\n\n## Addresses and transactions\nThe official investigation identifies an affected operational account, a ProxyAdmin contract, attacker recipient addresses, and a key Safe transaction. Address labels are limited to the roles stated in that report and do not establish broader ownership or attribution.\n\n## Evidence boundary\nAvailable evidence supports phishing, remote-access malware, and key compromise, not a smart-contract code vulnerability. The approximately $36 million figure is an incident-loss estimate and must not be added to the nominal value of minted tokens, market losses from the price decline, or an attacker balance observed at one point in time.\n\n## Current status\nThe project paused affected bridge functions and worked with security firms, exchanges, and law enforcement. Public sources have not confirmed that the transferred assets were returned or restored to the affected party’s control." }, "category": "key-compromise", "severity": "critical", "ecosystems": [ "BNB Chain", "Ethereum" ], "chains": [ "BNB Chain", "Ethereum" ], "lossUsd": 36000000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开统计采用后续约 3,600 万美元损失估值；事发初期约 3,200 万美元及官方确认超过 2,100 万美元 ETH 收益分别代表较早估值和部分已知收益。", "tw": "公開統計採用後續約 3,600 萬美元損失估值；事發初期約 3,200 萬美元及官方確認超過 2,100 萬美元 ETH 收益分別代表較早估值和部分已知收益。", "en": "The aggregate uses the later loss estimate of approximately $36 million; the early $32 million estimate and the official confirmation of more than $21 million in ETH proceeds reflect an earlier estimate and a partial known-proceeds measure." }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0xe943dbD064Ec283bDc95c39FaEE6184E9D26d026", "entity": { "zh": "Humanity Protocol 受影响运营账户", "tw": "Humanity Protocol 受影響運營賬戶", "en": "Affected Humanity Protocol operational account" }, "role": "affected-account", "category": "unknown", "confidence": 1, "sourceUrl": "https://www.humanity.org/hincidentupdate", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "官方调查确认，攻击者使用从项目人员设备中窃取的账户密钥执行 Ethereum 侧操作。", "tw": "官方調查確認，攻擊者使用從項目人員設備中竊取的賬戶密鑰執行 Ethereum 側操作。", "en": "The official investigation says the attacker used the account key stolen from a project member’s device for the Ethereum-side operation." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xd1ea823d421e0c829ee11f772af487fd352678ea", "entity": { "zh": "Ethereum 侧攻击者接收地址", "tw": "Ethereum 側攻擊者接收地址", "en": "Ethereum-side attacker recipient" }, "role": "attacker-recipient", "category": "hack", "confidence": 1, "sourceUrl": "https://www.humanity.org/hincidentupdate", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "官方调查确认，约 1.4118 亿枚 $H 被非授权转移至该地址。", "tw": "官方調查確認，約 1.4118 億枚 $H 被非授權轉移至該地址。", "en": "The official investigation says approximately 141.18 million $H was transferred without authorization to this address." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xd73cd1117646625ffe23a55860035ac62fa8720d", "entity": { "zh": "Humanity Protocol 受影响 ProxyAdmin 合约", "tw": "Humanity Protocol 受影響 ProxyAdmin 合約", "en": "Affected Humanity Protocol ProxyAdmin contract" }, "role": "affected-contract", "category": "unknown", "confidence": 1, "sourceUrl": "https://www.humanity.org/hincidentupdate", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "官方调查确认，攻击者使用被盗 Safe 签名密钥取得该 ProxyAdmin 合约控制权。", "tw": "官方調查確認，攻擊者使用被盜 Safe 簽名密鑰取得該 ProxyAdmin 合約控制權。", "en": "The official investigation says stolen Safe signer keys were used to take control of this ProxyAdmin contract." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x6Aa22CB8420E94Fc2119364b4c7885710aE753bB", "entity": { "zh": "BNB Chain 侧攻击者接收地址", "tw": "BNB Chain 側攻擊者接收地址", "en": "BNB Chain-side attacker recipient" }, "role": "attacker-recipient", "category": "hack", "confidence": 1, "sourceUrl": "https://www.humanity.org/hincidentupdate", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "官方调查确认，约 1 亿枚非授权铸造的 $H 被发送至该新地址。", "tw": "官方調查確認，約 1 億枚非授權鑄造的 $H 被發送至該新地址。", "en": "The official investigation says approximately 100 million unauthorized $H was minted to this newly created address." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "Humanity Protocol 官方调查摘要", "tw": "Humanity Protocol 官方調查摘要", "en": "Humanity Protocol official investigation summary" }, "url": "https://www.humanity.org/hincidentupdate", "type": "official" }, { "label": { "zh": "后续 3,600 万美元损失报道", "tw": "後續 3,600 萬美元損失報道", "en": "Later $36 million loss report" }, "url": "https://www.coindesk.com/tech/2026/06/09/humanity-s-usd36-million-exploit-happened-because-a-multisig-wallet-lived-on-one-laptop", "type": "media" }, { "label": { "zh": "公开安全预警或项目说明", "tw": "公開安全預警或專案說明", "en": "Public security alert or project statement" }, "url": "https://x.com/PeckShieldAlert/status/2064274420166435222", "type": "research" }, { "label": { "zh": "公开事件报道", "tw": "公開事件報道", "en": "Public incident report" }, "url": "https://mp.weixin.qq.com/s/tbE-32A67dTEDKiWeIQt9A", "type": "media" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-004", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-070", "status": "verified", "incidentDate": "2026-06-07", "datePrecision": "day", "title": { "zh": "Syscoin Bridge", "tw": "Syscoin Bridge", "en": "Syscoin Bridge — Fake Proof Exploit" }, "summary": { "zh": "公开来源确认 Syscoin Bridge 发生 Fake Proof Exploit 事件，损失约 $8,000,000。", "tw": "公開來源確認 Syscoin Bridge 發生 Fake Proof Exploit 事件，損失約 $8,000,000。", "en": "Public sources report Syscoin Bridge — Fake Proof Exploit, with a loss of approximately $8,000,000." }, "details": { "zh": "## 事件背景\nFake Proof Exploit；事件依据 DeFiLlama 月度记录及其他可检索公开来源核验。 原报告存在百万倍金额展开错误，相关数值已按正确单位更正；事件事实、来源和资产单位保持不变。\n\n## 事件经过\n公开记录确认项目在该日附近发生安全事件，但未披露完整攻击路径。\n\n## 资金流向\n资产从受害项目或钱包转向攻击者或异常接收方；公开资料未披露完整逐跳路径。\n\n## 金额口径\n公开来源支持的损失额约为 $8,000,000；原报告中的“约 $8,000,000,000,000”存在百万倍单位展开错误，已按正确单位更正。\n\n## 地址与交易\n公开资料未披露完整攻击地址与 TxID。\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\nFake Proof Exploit；事件依據 DeFiLlama 月度記錄及其他可檢索公開來源核驗。 原報告存在百萬倍金額展開錯誤，相關數值已按正確單位更正；事件事實、來源和資產單位保持不變。\n\n## 事件經過\n公開記錄確認專案在該日附近發生安全事件，但未披露完整攻擊路徑。\n\n## 資金流向\n資產從受害專案或錢包轉向攻擊者或異常接收方；公開資料未披露完整逐跳路徑。\n\n## 金額口徑\n公開來源支持的損失額約為 $8,000,000；原報告中的“約 $8,000,000,000,000”存在百萬倍單位展開錯誤，已按正確單位更正。\n\n## 地址與交易\n公開資料未披露完整攻擊地址與 TxID。\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nPublic sources classify the incident as Fake Proof Exploit but do not disclose a complete exploit path.\n\n## Incident sequence\nPublic sources confirm a security incident near the stated date but do not disclose a complete exploit sequence, attribution, or downstream flow.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nPublic sources support a loss of approximately $8,000,000. The report contained a one-million-fold unit-expansion error, which has been corrected.\n\n## Addresses and transactions\nPublic sources do not disclose a complete address or transaction list.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "bridge-exploit", "severity": "high", "ecosystems": [ "Syscoin" ], "chains": [ "Syscoin" ], "lossUsd": 8000000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开来源支持的损失额约为 $8,000,000；原报告中的“约 $8,000,000,000,000”存在百万倍单位展开错误，已按正确单位更正。", "tw": "公開來源支持的損失額約為 $8,000,000；原報告中的“約 $8,000,000,000,000”存在百萬倍單位展開錯誤，已按正確單位更正。", "en": "Public sources support a loss of approximately $8,000,000. The report contained a one-million-fold unit-expansion error, which has been corrected." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "halborn.com 公开来源", "tw": "halborn.com 公開來源", "en": "halborn.com public source" }, "url": "https://www.halborn.com/blog/post/explained-the-syscoin-bridge-hack-june-2026", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-070", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-069", "status": "verified", "incidentDate": "2026-06-07", "datePrecision": "day", "title": { "zh": "Ambient CrocSwapDex", "tw": "Ambient CrocSwapDex", "en": "Ambient CrocSwapDex — on-chain smart-contract exploit" }, "summary": { "zh": "公开来源确认 Ambient CrocSwapDex 发生智能合约漏洞、链上攻击事件，损失约 $110,000。", "tw": "公開來源確認 Ambient CrocSwapDex 發生智能合約漏洞、鏈上攻擊事件，損失約 $110,000。", "en": "Public sources report Ambient CrocSwapDex — on-chain smart-contract exploit, with a loss of approximately $110,000." }, "details": { "zh": "## 事件背景\n链上复现确认合约逻辑、记账、权限或价格机制存在可被利用路径；具体步骤见攻击交易与复现源码。\n\n## 事件经过\n攻击者调用存在缺陷的合约路径，利用闪电流动性、储备/价格操纵、错误记账、权限或签名校验缺陷完成资产提取；交易已由 DeFiHackLabs 在历史状态上复现。\n\n## 资金流向\n受害合约或流动性池 → 攻击合约或攻击者地址。公开资料未披露后续兑换与资金转移路径。\n\n## 金额口径\n公开可核损失按 $110,000 记录；原报告资产口径为“~67.85 ETH after final USDC->WETH conversion and ETH forwarding”。\n\n## 地址与交易\n- `0x0000000000037e625b2502c26029aea237f102af` — `[链：Ethereum] [攻击者] [身份：事件 11] [状态：公开来源确认]`\n- `0xaac14d196a9e27923a92d8e87e3b6a5dcd4fec1b` — `[链：Ethereum] [攻击合约] [身份：事件 11] [状态：公开来源确认]`\n- `0xAaAaAAAaA24eEeb8d57D431224f73832bC34f688` — `[链：Ethereum] [受害/漏洞合约] [身份：事件 11] [状态：公开来源确认]`\n- `0xb2fc668c42623261074de6fc30d583efede2b0e20d7aded42b7b634f9322ff52` — `[链：Ethereum] [攻击 Tx] [身份：事件 11] [状态：公开来源确认]`\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\n鏈上覆現確認合約邏輯、記賬、權限或價格機制存在可被利用路徑；具體步驟見攻擊交易與復現源碼。\n\n## 事件經過\n攻擊者調用存在缺陷的合約路徑，利用閃電流動性、儲備/價格操縱、錯誤記賬、權限或簽名校驗缺陷完成資產提取；交易已由 DeFiHackLabs 在歷史狀態上覆現。\n\n## 資金流向\n受害合約或流動性池 → 攻擊合約或攻擊者地址。公開資料未披露後續兌換與資金轉移路徑。\n\n## 金額口徑\n公開可核損失按 $110,000 記錄；原報告資產口徑為“~67.85 ETH after final USDC->WETH conversion and ETH forwarding”。\n\n## 地址與交易\n- `0x0000000000037e625b2502c26029aea237f102af` — `[鏈：Ethereum] [攻擊者] [身份：事件 11] [狀態：公開來源確認]`\n- `0xaac14d196a9e27923a92d8e87e3b6a5dcd4fec1b` — `[鏈：Ethereum] [攻擊合約] [身份：事件 11] [狀態：公開來源確認]`\n- `0xAaAaAAAaA24eEeb8d57D431224f73832bC34f688` — `[鏈：Ethereum] [受害/漏洞合約] [身份：事件 11] [狀態：公開來源確認]`\n- `0xb2fc668c42623261074de6fc30d583efede2b0e20d7aded42b7b634f9322ff52` — `[鏈：Ethereum] [攻擊 Tx] [身份：事件 11] [狀態：公開來源確認]`\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nHistorical-state reproduction supports an exploitable contract, accounting, authorization, pricing, or signature-validation path. The exact evidence is preserved in the cited transaction and reproduction source.\n\n## Incident sequence\nThe attacker used the cited contract or infrastructure weakness to move assets from the affected contract, wallet or pool. Historical-state reproduction or the cited public alert supports the event; later movement remains undisclosed.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nVerified loss is recorded at $110,000. The report's underlying asset basis was: ~67.85 ETH after final USDC->WETH conversion and ETH forwarding.\n\n## Addresses and transactions\n1. `0x0000000000037e625b2502c26029aea237f102af` — Ethereum; publicly identified attacker address.\n2. `0xaac14d196a9e27923a92d8e87e3b6a5dcd4fec1b` — Ethereum; publicly identified attacker contract.\n3. `0xAaAaAAAaA24eEeb8d57D431224f73832bC34f688` — Ethereum; affected or vulnerable contract (not an attacker).\n4. `0xb2fc668c42623261074de6fc30d583efede2b0e20d7aded42b7b634f9322ff52` — Ethereum; attack or execution transaction.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "protocol-exploit", "severity": "medium", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 110000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开可核损失按 $110,000 记录；原报告资产口径为“~67.85 ETH after final USDC->WETH conversion and ETH forwarding”。", "tw": "公開可核損失按 $110,000 記錄；原報告資產口徑為“~67.85 ETH after final USDC->WETH conversion and ETH forwarding”。", "en": "Verified loss is recorded at $110,000. The report's underlying asset basis was: ~67.85 ETH after final USDC->WETH conversion and ETH forwarding." }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0x0000000000037e625b2502c26029aea237f102af", "entity": { "zh": "公开攻击者地址", "tw": "公開攻擊者地址", "en": "publicly identified attacker address" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/TenArmorAlert/status/2063816231023427861", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [攻击者] [身份：事件 11] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：Ethereum] [攻擊者] [身份：事件 11] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker address. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xaac14d196a9e27923a92d8e87e3b6a5dcd4fec1b", "entity": { "zh": "公开攻击合约", "tw": "公開攻擊合約", "en": "publicly identified attacker contract" }, "role": "attacker-contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/TenArmorAlert/status/2063816231023427861", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [攻击合约] [身份：事件 11] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：Ethereum] [攻擊合約] [身份：事件 11] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker contract. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xAaAaAAAaA24eEeb8d57D431224f73832bC34f688", "entity": { "zh": "受影响或漏洞合约（非攻击者）", "tw": "受影響或漏洞合約（非攻擊者）", "en": "affected or vulnerable contract (not an attacker)" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/TenArmorAlert/status/2063816231023427861", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：Ethereum] [受害/漏洞合约] [身份：事件 11] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：Ethereum] [受害/漏洞合約] [身份：事件 11] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "affected or vulnerable contract (not an attacker). The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "公开安全预警或项目说明", "tw": "公開安全預警或專案說明", "en": "Public security alert or project statement" }, "url": "https://x.com/TenArmorAlert/status/2063816231023427861", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-069", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-068", "status": "verified", "incidentDate": "2026-06-07", "datePrecision": "day", "title": { "zh": "ATOHook", "tw": "ATOHook", "en": "ATOHook — token-pool smart-contract exploit" }, "summary": { "zh": "公开来源确认 ATOHook 发生智能合约漏洞、代币池攻击事件，损失约 $2,100,000。", "tw": "公開來源確認 ATOHook 發生智能合約漏洞、代幣池攻擊事件，損失約 $2,100,000。", "en": "Public sources report ATOHook — token-pool smart-contract exploit, with a loss of approximately $2,100,000." }, "details": { "zh": "## 事件背景\n公开预警确认 ATOHook 相关合约/池出现可利用逻辑；项目方完整复盘未公开。\n\n## 事件经过\n攻击者利用合约机制抽取池中资产；该事件已由公开来源具名确认，地址与技术根因细节尚未完整披露。\n\n## 资金流向\nATOHook 相关池 → 攻击者 → 后续路径未完整披露。\n\n## 金额口径\n公开报道估计可核损失约为 210 万美元。\n\n## 地址与交易\n公开资料未披露完整攻击地址与 TxID。\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\n公開預警確認 ATOHook 相關合約/池出現可利用邏輯；專案方完整復盤未公開。\n\n## 事件經過\n攻擊者利用合約機制抽取池中資產；該事件已由公開來源具名確認，地址與技術根因細節尚未完整披露。\n\n## 資金流向\nATOHook 相關池 → 攻擊者 → 後續路徑未完整披露。\n\n## 金額口徑\n公開報道估計可核損失約為 210 萬美元。\n\n## 地址與交易\n公開資料未披露完整攻擊地址與 TxID。\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nPublic security alerts confirmed an exploitable path involving ATOHook-related contracts or liquidity pools, but no complete project postmortem was public.\n\n## Incident sequence\nThe attacker used the cited contract or infrastructure weakness to move assets from the affected contract, wallet or pool. Historical-state reproduction or the cited public alert supports the event; later movement remains undisclosed.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nPublic reporting estimated the verified loss at approximately $2.1 million.\n\n## Addresses and transactions\nPublic sources do not disclose a complete address or transaction list.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "BNB Chain" ], "chains": [ "BNB Chain" ], "lossUsd": 2100000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开报道估计可核损失约为 210 万美元。", "tw": "公開報道估計可核損失約為 210 萬美元。", "en": "Public reporting estimated the verified loss at approximately $2.1 million." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "公开安全预警或项目说明", "tw": "公開安全預警或專案說明", "en": "Public security alert or project statement" }, "url": "https://x.com/PeckShieldAlert", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-068", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-067", "status": "verified", "incidentDate": "2026-06-06", "datePrecision": "day", "title": { "zh": "BOSS", "tw": "BOSS", "en": "BOSS — on-chain smart-contract exploit" }, "summary": { "zh": "公开来源确认 BOSS 发生智能合约漏洞、链上攻击事件，损失约 $10,208。", "tw": "公開來源確認 BOSS 發生智能合約漏洞、鏈上攻擊事件，損失約 $10,208。", "en": "Public sources report BOSS — on-chain smart-contract exploit, with a loss of approximately $10,208." }, "details": { "zh": "## 事件背景\n链上复现确认合约逻辑、记账、权限或价格机制存在可被利用路径；具体步骤见攻击交易与复现源码。\n\n## 事件经过\n攻击者调用存在缺陷的合约路径，利用闪电流动性、储备/价格操纵、错误记账、权限或签名校验缺陷完成资产提取；交易已由 DeFiHackLabs 在历史状态上复现。\n\n## 资金流向\n受害合约或流动性池 → 攻击合约或攻击者地址。公开资料未披露后续兑换与资金转移路径。\n\n## 金额口径\n公开可核损失按 $10,208 记录；原报告资产口径为“10,207.54 USDT”。\n\n## 地址与交易\n- `0x618639fe719987153e0ec3fe494aa9a62ca02c91` — `[链：BNB Chain] [攻击者] [身份：事件 09] [状态：公开来源确认]`\n- `0x6a37e235f1a9823406c14d377870046419f9803d` — `[链：BNB Chain] [攻击合约] [身份：事件 09] [状态：公开来源确认]`\n- `0x876d4539b7f13dddea969190c9a231a4b91735cf` — `[链：BNB Chain] [受害/漏洞合约] [身份：事件 09] [状态：公开来源确认]`\n- `0x96d1a0175eb4a82585db62a374518391f6b575a07c25c0e2874ca82400b830c7` — `[链：BNB Chain] [攻击 Tx] [身份：事件 09] [状态：公开来源确认]`\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\n鏈上覆現確認合約邏輯、記賬、權限或價格機制存在可被利用路徑；具體步驟見攻擊交易與復現源碼。\n\n## 事件經過\n攻擊者調用存在缺陷的合約路徑，利用閃電流動性、儲備/價格操縱、錯誤記賬、權限或簽名校驗缺陷完成資產提取；交易已由 DeFiHackLabs 在歷史狀態上覆現。\n\n## 資金流向\n受害合約或流動性池 → 攻擊合約或攻擊者地址。公開資料未披露後續兌換與資金轉移路徑。\n\n## 金額口徑\n公開可核損失按 $10,208 記錄；原報告資產口徑為“10,207.54 USDT”。\n\n## 地址與交易\n- `0x618639fe719987153e0ec3fe494aa9a62ca02c91` — `[鏈：BNB Chain] [攻擊者] [身份：事件 09] [狀態：公開來源確認]`\n- `0x6a37e235f1a9823406c14d377870046419f9803d` — `[鏈：BNB Chain] [攻擊合約] [身份：事件 09] [狀態：公開來源確認]`\n- `0x876d4539b7f13dddea969190c9a231a4b91735cf` — `[鏈：BNB Chain] [受害/漏洞合約] [身份：事件 09] [狀態：公開來源確認]`\n- `0x96d1a0175eb4a82585db62a374518391f6b575a07c25c0e2874ca82400b830c7` — `[鏈：BNB Chain] [攻擊 Tx] [身份：事件 09] [狀態：公開來源確認]`\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nHistorical-state reproduction supports an exploitable contract, accounting, authorization, pricing, or signature-validation path. The exact evidence is preserved in the cited transaction and reproduction source.\n\n## Incident sequence\nThe attacker used the cited contract or infrastructure weakness to move assets from the affected contract, wallet or pool. Historical-state reproduction or the cited public alert supports the event; later movement remains undisclosed.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nVerified loss is recorded at $10,208. The report's underlying asset basis was: 10,207.54 USDT.\n\n## Addresses and transactions\n1. `0x618639fe719987153e0ec3fe494aa9a62ca02c91` — BNB Chain; publicly identified attacker address.\n2. `0x6a37e235f1a9823406c14d377870046419f9803d` — BNB Chain; publicly identified attacker contract.\n3. `0x876d4539b7f13dddea969190c9a231a4b91735cf` — BNB Chain; affected or vulnerable contract (not an attacker).\n4. `0x96d1a0175eb4a82585db62a374518391f6b575a07c25c0e2874ca82400b830c7` — BNB Chain; attack or execution transaction.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "protocol-exploit", "severity": "low", "ecosystems": [ "BNB Chain" ], "chains": [ "BNB Chain" ], "lossUsd": 10207.54, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开可核损失按 $10,208 记录；原报告资产口径为“10,207.54 USDT”。", "tw": "公開可核損失按 $10,208 記錄；原報告資產口徑為“10,207.54 USDT”。", "en": "Verified loss is recorded at $10,208. The report's underlying asset basis was: 10,207.54 USDT." }, "addressDisclosure": "published", "addresses": [ { "chain": "BNB Chain", "address": "0x618639fe719987153e0ec3fe494aa9a62ca02c91", "entity": { "zh": "公开攻击者地址", "tw": "公開攻擊者地址", "en": "publicly identified attacker address" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/audit_911/status/2063819348305985748", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [攻击者] [身份：事件 09] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [攻擊者] [身份：事件 09] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker address. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x6a37e235f1a9823406c14d377870046419f9803d", "entity": { "zh": "公开攻击合约", "tw": "公開攻擊合約", "en": "publicly identified attacker contract" }, "role": "attacker-contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/audit_911/status/2063819348305985748", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [攻击合约] [身份：事件 09] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [攻擊合約] [身份：事件 09] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker contract. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x876d4539b7f13dddea969190c9a231a4b91735cf", "entity": { "zh": "受影响或漏洞合约（非攻击者）", "tw": "受影響或漏洞合約（非攻擊者）", "en": "affected or vulnerable contract (not an attacker)" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/audit_911/status/2063819348305985748", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [受害/漏洞合约] [身份：事件 09] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [受害/漏洞合約] [身份：事件 09] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "affected or vulnerable contract (not an attacker). The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "公开安全预警或项目说明", "tw": "公開安全預警或專案說明", "en": "Public security alert or project statement" }, "url": "https://x.com/audit_911/status/2063819348305985748", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-067", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-066", "status": "verified", "incidentDate": "2026-06-05", "datePrecision": "day", "title": { "zh": "DTXT", "tw": "DTXT", "en": "DTXT — on-chain smart-contract exploit" }, "summary": { "zh": "公开来源确认 DTXT 发生智能合约漏洞、链上攻击事件，损失约 $35,041。", "tw": "公開來源確認 DTXT 發生智能合約漏洞、鏈上攻擊事件，損失約 $35,041。", "en": "Public sources report DTXT — on-chain smart-contract exploit, with a loss of approximately $35,041." }, "details": { "zh": "## 事件背景\n链上复现确认合约逻辑、记账、权限或价格机制存在可被利用路径；具体步骤见攻击交易与复现源码。\n\n## 事件经过\n攻击者调用存在缺陷的合约路径，利用闪电流动性、储备/价格操纵、错误记账、权限或签名校验缺陷完成资产提取；交易已由 DeFiHackLabs 在历史状态上复现。\n\n## 资金流向\n受害合约或流动性池 → 攻击合约或攻击者地址。公开资料未披露后续兑换与资金转移路径。\n\n## 金额口径\n公开可核损失按 $35,041 记录；原报告资产口径为“35,041.11 USDT”。\n\n## 地址与交易\n- `0xd304ea1592f733e0a46436a01fe54bd504009526` — `[链：BNB Chain] [攻击者] [身份：事件 08] [状态：公开来源确认]`\n- `0x3065bc8ed8bd53bdc3fd4633c3097c40726b5f5f` — `[链：BNB Chain] [攻击合约] [身份：事件 08] [状态：公开来源确认]`\n- `0xac9bf7c320d4ce2d0ac978b83955dd67351897d2` — `[链：BNB Chain] [受害/漏洞合约] [身份：事件 08] [状态：公开来源确认]`\n- `0x07ba2ccf2b5c1aaca4c017af4fe87762a73ef7177f6ea8bb569367e908a0671d` — `[链：BNB Chain] [攻击 Tx] [身份：事件 08] [状态：公开来源确认]`\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\n鏈上覆現確認合約邏輯、記賬、權限或價格機制存在可被利用路徑；具體步驟見攻擊交易與復現源碼。\n\n## 事件經過\n攻擊者調用存在缺陷的合約路徑，利用閃電流動性、儲備/價格操縱、錯誤記賬、權限或簽名校驗缺陷完成資產提取；交易已由 DeFiHackLabs 在歷史狀態上覆現。\n\n## 資金流向\n受害合約或流動性池 → 攻擊合約或攻擊者地址。公開資料未披露後續兌換與資金轉移路徑。\n\n## 金額口徑\n公開可核損失按 $35,041 記錄；原報告資產口徑為“35,041.11 USDT”。\n\n## 地址與交易\n- `0xd304ea1592f733e0a46436a01fe54bd504009526` — `[鏈：BNB Chain] [攻擊者] [身份：事件 08] [狀態：公開來源確認]`\n- `0x3065bc8ed8bd53bdc3fd4633c3097c40726b5f5f` — `[鏈：BNB Chain] [攻擊合約] [身份：事件 08] [狀態：公開來源確認]`\n- `0xac9bf7c320d4ce2d0ac978b83955dd67351897d2` — `[鏈：BNB Chain] [受害/漏洞合約] [身份：事件 08] [狀態：公開來源確認]`\n- `0x07ba2ccf2b5c1aaca4c017af4fe87762a73ef7177f6ea8bb569367e908a0671d` — `[鏈：BNB Chain] [攻擊 Tx] [身份：事件 08] [狀態：公開來源確認]`\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nHistorical-state reproduction supports an exploitable contract, accounting, authorization, pricing, or signature-validation path. The exact evidence is preserved in the cited transaction and reproduction source.\n\n## Incident sequence\nThe attacker used the cited contract or infrastructure weakness to move assets from the affected contract, wallet or pool. Historical-state reproduction or the cited public alert supports the event; later movement remains undisclosed.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nVerified loss is recorded at $35,041. The report's underlying asset basis was: 35,041.11 USDT.\n\n## Addresses and transactions\n1. `0xd304ea1592f733e0a46436a01fe54bd504009526` — BNB Chain; publicly identified attacker address.\n2. `0x3065bc8ed8bd53bdc3fd4633c3097c40726b5f5f` — BNB Chain; publicly identified attacker contract.\n3. `0xac9bf7c320d4ce2d0ac978b83955dd67351897d2` — BNB Chain; affected or vulnerable contract (not an attacker).\n4. `0x07ba2ccf2b5c1aaca4c017af4fe87762a73ef7177f6ea8bb569367e908a0671d` — BNB Chain; attack or execution transaction.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "protocol-exploit", "severity": "low", "ecosystems": [ "BNB Chain" ], "chains": [ "BNB Chain" ], "lossUsd": 35041.11, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开可核损失按 $35,041 记录；原报告资产口径为“35,041.11 USDT”。", "tw": "公開可核損失按 $35,041 記錄；原報告資產口徑為“35,041.11 USDT”。", "en": "Verified loss is recorded at $35,041. The report's underlying asset basis was: 35,041.11 USDT." }, "addressDisclosure": "published", "addresses": [ { "chain": "BNB Chain", "address": "0xd304ea1592f733e0a46436a01fe54bd504009526", "entity": { "zh": "公开攻击者地址", "tw": "公開攻擊者地址", "en": "publicly identified attacker address" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/audit_911/status/2063793931138347015", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [攻击者] [身份：事件 08] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [攻擊者] [身份：事件 08] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker address. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x3065bc8ed8bd53bdc3fd4633c3097c40726b5f5f", "entity": { "zh": "公开攻击合约", "tw": "公開攻擊合約", "en": "publicly identified attacker contract" }, "role": "attacker-contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/audit_911/status/2063793931138347015", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [攻击合约] [身份：事件 08] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [攻擊合約] [身份：事件 08] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker contract. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xac9bf7c320d4ce2d0ac978b83955dd67351897d2", "entity": { "zh": "受影响或漏洞合约（非攻击者）", "tw": "受影響或漏洞合約（非攻擊者）", "en": "affected or vulnerable contract (not an attacker)" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/audit_911/status/2063793931138347015", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [受害/漏洞合约] [身份：事件 08] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [受害/漏洞合約] [身份：事件 08] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "affected or vulnerable contract (not an attacker). The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "公开安全预警或项目说明", "tw": "公開安全預警或專案說明", "en": "Public security alert or project statement" }, "url": "https://x.com/audit_911/status/2063793931138347015", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-066", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-065", "status": "verified", "incidentDate": "2026-06-05", "datePrecision": "day", "title": { "zh": "AISO Presale", "tw": "AISO Presale", "en": "AISO Presale — on-chain smart-contract exploit" }, "summary": { "zh": "公开来源确认 AISO Presale 发生智能合约漏洞、链上攻击事件，损失约 $30,315。", "tw": "公開來源確認 AISO Presale 發生智能合約漏洞、鏈上攻擊事件，損失約 $30,315。", "en": "Public sources report AISO Presale — on-chain smart-contract exploit, with a loss of approximately $30,315." }, "details": { "zh": "## 事件背景\n链上复现确认合约逻辑、记账、权限或价格机制存在可被利用路径；具体步骤见攻击交易与复现源码。\n\n## 事件经过\n攻击者调用存在缺陷的合约路径，利用闪电流动性、储备/价格操纵、错误记账、权限或签名校验缺陷完成资产提取；交易已由 DeFiHackLabs 在历史状态上复现。\n\n## 资金流向\n受害合约或流动性池 → 攻击合约或攻击者地址。公开资料未披露后续兑换与资金转移路径。\n\n## 金额口径\n公开可核损失按 $30,315 记录；原报告资产口径为“30,314.76 USDT”。\n\n## 地址与交易\n- `0x627df72cc3fa38c475a414e65cdece09b2b177af` — `[链：BNB Chain] [攻击者] [身份：事件 07] [状态：公开来源确认]`\n- `0x2078b0d64ede277d65bdf0272f64aef2a954deab` — `[链：BNB Chain] [攻击合约] [身份：事件 07] [状态：公开来源确认]`\n- `0x796c5e8ca10010654dafaef096bd1f4a7ad87672` — `[链：BNB Chain] [受害/漏洞合约] [身份：事件 07] [状态：公开来源确认]`\n- `0x11462984d7f5663db9cf95c07c6cd9ff91f5b2d6616268e8dd6a3013e190248c` — `[链：BNB Chain] [攻击 Tx] [身份：事件 07] [状态：公开来源确认]`\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\n鏈上覆現確認合約邏輯、記賬、權限或價格機制存在可被利用路徑；具體步驟見攻擊交易與復現源碼。\n\n## 事件經過\n攻擊者調用存在缺陷的合約路徑，利用閃電流動性、儲備/價格操縱、錯誤記賬、權限或簽名校驗缺陷完成資產提取；交易已由 DeFiHackLabs 在歷史狀態上覆現。\n\n## 資金流向\n受害合約或流動性池 → 攻擊合約或攻擊者地址。公開資料未披露後續兌換與資金轉移路徑。\n\n## 金額口徑\n公開可核損失按 $30,315 記錄；原報告資產口徑為“30,314.76 USDT”。\n\n## 地址與交易\n- `0x627df72cc3fa38c475a414e65cdece09b2b177af` — `[鏈：BNB Chain] [攻擊者] [身份：事件 07] [狀態：公開來源確認]`\n- `0x2078b0d64ede277d65bdf0272f64aef2a954deab` — `[鏈：BNB Chain] [攻擊合約] [身份：事件 07] [狀態：公開來源確認]`\n- `0x796c5e8ca10010654dafaef096bd1f4a7ad87672` — `[鏈：BNB Chain] [受害/漏洞合約] [身份：事件 07] [狀態：公開來源確認]`\n- `0x11462984d7f5663db9cf95c07c6cd9ff91f5b2d6616268e8dd6a3013e190248c` — `[鏈：BNB Chain] [攻擊 Tx] [身份：事件 07] [狀態：公開來源確認]`\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nHistorical-state reproduction supports an exploitable contract, accounting, authorization, pricing, or signature-validation path. The exact evidence is preserved in the cited transaction and reproduction source.\n\n## Incident sequence\nThe attacker used the cited contract or infrastructure weakness to move assets from the affected contract, wallet or pool. Historical-state reproduction or the cited public alert supports the event; later movement remains undisclosed.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nVerified loss is recorded at $30,315. The report's underlying asset basis was: 30,314.76 USDT.\n\n## Addresses and transactions\n1. `0x627df72cc3fa38c475a414e65cdece09b2b177af` — BNB Chain; publicly identified attacker address.\n2. `0x2078b0d64ede277d65bdf0272f64aef2a954deab` — BNB Chain; publicly identified attacker contract.\n3. `0x796c5e8ca10010654dafaef096bd1f4a7ad87672` — BNB Chain; affected or vulnerable contract (not an attacker).\n4. `0x11462984d7f5663db9cf95c07c6cd9ff91f5b2d6616268e8dd6a3013e190248c` — BNB Chain; attack or execution transaction.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "protocol-exploit", "severity": "low", "ecosystems": [ "BNB Chain" ], "chains": [ "BNB Chain" ], "lossUsd": 30314.76, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开可核损失按 $30,315 记录；原报告资产口径为“30,314.76 USDT”。", "tw": "公開可核損失按 $30,315 記錄；原報告資產口徑為“30,314.76 USDT”。", "en": "Verified loss is recorded at $30,315. The report's underlying asset basis was: 30,314.76 USDT." }, "addressDisclosure": "published", "addresses": [ { "chain": "BNB Chain", "address": "0x627df72cc3fa38c475a414e65cdece09b2b177af", "entity": { "zh": "公开攻击者地址", "tw": "公開攻擊者地址", "en": "publicly identified attacker address" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/audit_911/status/2063565495073415618", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [攻击者] [身份：事件 07] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [攻擊者] [身份：事件 07] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker address. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x2078b0d64ede277d65bdf0272f64aef2a954deab", "entity": { "zh": "公开攻击合约", "tw": "公開攻擊合約", "en": "publicly identified attacker contract" }, "role": "attacker-contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/audit_911/status/2063565495073415618", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [攻击合约] [身份：事件 07] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [攻擊合約] [身份：事件 07] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker contract. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x796c5e8ca10010654dafaef096bd1f4a7ad87672", "entity": { "zh": "受影响或漏洞合约（非攻击者）", "tw": "受影響或漏洞合約（非攻擊者）", "en": "affected or vulnerable contract (not an attacker)" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/audit_911/status/2063565495073415618", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [受害/漏洞合约] [身份：事件 07] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [受害/漏洞合約] [身份：事件 07] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "affected or vulnerable contract (not an attacker). The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "公开安全预警或项目说明", "tw": "公開安全預警或專案說明", "en": "Public security alert or project statement" }, "url": "https://x.com/audit_911/status/2063565495073415618", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-065", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-064", "status": "verified", "incidentDate": "2026-06-04", "datePrecision": "day", "title": { "zh": "BY Token", "tw": "BY Token", "en": "BY Token — on-chain smart-contract exploit" }, "summary": { "zh": "公开来源确认 BY Token 发生智能合约漏洞、链上攻击事件，损失约 $87,402。", "tw": "公開來源確認 BY Token 發生智能合約漏洞、鏈上攻擊事件，損失約 $87,402。", "en": "Public sources report BY Token — on-chain smart-contract exploit, with a loss of approximately $87,402." }, "details": { "zh": "## 事件背景\ntriggerAutoBurn() is permissionless.\n\n## 事件经过\n攻击者调用存在缺陷的合约路径，利用闪电流动性、储备/价格操纵、错误记账、权限或签名校验缺陷完成资产提取；交易已由 DeFiHackLabs 在历史状态上复现。\n\n## 资金流向\n受害合约或流动性池 → 攻击合约或攻击者地址。公开资料未披露后续兑换与资金转移路径。\n\n## 金额口径\n公开可核损失按 $87,402 记录；原报告资产口径为“~$87,402 (146.60 WBNB drained from the BY/WBNB PancakeSwap pair)”。\n\n## 地址与交易\n- `0x047547A4fa4a67C1032d249B49EC1a79c0460BAD` — `[链：BNB Chain] [攻击者] [身份：事件 06] [状态：公开来源确认]`\n- `0xc08106a36BfA9CFad264F0d64fC45B93543485Ec` — `[链：BNB Chain] [攻击合约] [身份：事件 06] [状态：公开来源确认]`\n- `0x6f50cffEcd4e00EcF7E442774C08c089450B62Ca` — `[链：BNB Chain] [受害/漏洞合约] [身份：事件 06] [状态：公开来源确认]`\n- `0xe31c681eee764fb94b1b6bda3bbb0e4f25acb129c19040b9f58ad30541980979` — `[链：BNB Chain] [攻击 Tx] [身份：事件 06] [状态：公开来源确认]`\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\ntriggerAutoBurn() is permissionless.\n\n## 事件經過\n攻擊者調用存在缺陷的合約路徑，利用閃電流動性、儲備/價格操縱、錯誤記賬、權限或簽名校驗缺陷完成資產提取；交易已由 DeFiHackLabs 在歷史狀態上覆現。\n\n## 資金流向\n受害合約或流動性池 → 攻擊合約或攻擊者地址。公開資料未披露後續兌換與資金轉移路徑。\n\n## 金額口徑\n公開可核損失按 $87,402 記錄；原報告資產口徑為“~$87,402 (146.60 WBNB drained from the BY/WBNB PancakeSwap pair)”。\n\n## 地址與交易\n- `0x047547A4fa4a67C1032d249B49EC1a79c0460BAD` — `[鏈：BNB Chain] [攻擊者] [身份：事件 06] [狀態：公開來源確認]`\n- `0xc08106a36BfA9CFad264F0d64fC45B93543485Ec` — `[鏈：BNB Chain] [攻擊合約] [身份：事件 06] [狀態：公開來源確認]`\n- `0x6f50cffEcd4e00EcF7E442774C08c089450B62Ca` — `[鏈：BNB Chain] [受害/漏洞合約] [身份：事件 06] [狀態：公開來源確認]`\n- `0xe31c681eee764fb94b1b6bda3bbb0e4f25acb129c19040b9f58ad30541980979` — `[鏈：BNB Chain] [攻擊 Tx] [身份：事件 06] [狀態：公開來源確認]`\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\ntriggerAutoBurn() is permissionless.\n\n## Incident sequence\nThe attacker used the cited contract or infrastructure weakness to move assets from the affected contract, wallet or pool. Historical-state reproduction or the cited public alert supports the event; later movement remains undisclosed.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nVerified loss is recorded at $87,402. The report's underlying asset basis was: ~$87,402 (146.60 WBNB drained from the BY/WBNB PancakeSwap pair).\n\n## Addresses and transactions\n1. `0x047547A4fa4a67C1032d249B49EC1a79c0460BAD` — BNB Chain; publicly identified attacker address.\n2. `0xc08106a36BfA9CFad264F0d64fC45B93543485Ec` — BNB Chain; publicly identified attacker contract.\n3. `0x6f50cffEcd4e00EcF7E442774C08c089450B62Ca` — BNB Chain; affected or vulnerable contract (not an attacker).\n4. `0xe31c681eee764fb94b1b6bda3bbb0e4f25acb129c19040b9f58ad30541980979` — BNB Chain; attack or execution transaction.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "protocol-exploit", "severity": "low", "ecosystems": [ "BNB Chain" ], "chains": [ "BNB Chain" ], "lossUsd": 87402, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开可核损失按 $87,402 记录；原报告资产口径为“~$87,402 (146.60 WBNB drained from the BY/WBNB PancakeSwap pair)”。", "tw": "公開可核損失按 $87,402 記錄；原報告資產口徑為“~$87,402 (146.60 WBNB drained from the BY/WBNB PancakeSwap pair)”。", "en": "Verified loss is recorded at $87,402. The report's underlying asset basis was: ~$87,402 (146.60 WBNB drained from the BY/WBNB PancakeSwap pair)." }, "addressDisclosure": "published", "addresses": [ { "chain": "BNB Chain", "address": "0x047547A4fa4a67C1032d249B49EC1a79c0460BAD", "entity": { "zh": "公开攻击者地址", "tw": "公開攻擊者地址", "en": "publicly identified attacker address" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-06/BYToken_exp.sol", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [攻击者] [身份：事件 06] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [攻擊者] [身份：事件 06] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker address. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xc08106a36BfA9CFad264F0d64fC45B93543485Ec", "entity": { "zh": "公开攻击合约", "tw": "公開攻擊合約", "en": "publicly identified attacker contract" }, "role": "attacker-contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-06/BYToken_exp.sol", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [攻击合约] [身份：事件 06] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [攻擊合約] [身份：事件 06] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker contract. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x6f50cffEcd4e00EcF7E442774C08c089450B62Ca", "entity": { "zh": "受影响或漏洞合约（非攻击者）", "tw": "受影響或漏洞合約（非攻擊者）", "en": "affected or vulnerable contract (not an attacker)" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-06/BYToken_exp.sol", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [受害/漏洞合约] [身份：事件 06] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [受害/漏洞合約] [身份：事件 06] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "affected or vulnerable contract (not an attacker). The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "DeFiHackLabs 链上复现", "tw": "DeFiHackLabs 鏈上覆現", "en": "DeFiHackLabs on-chain reproduction" }, "url": "https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-06/BYToken_exp.sol", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-064", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-063", "status": "verified", "incidentDate": "2026-06-04", "datePrecision": "day", "title": { "zh": "ATM Token", "tw": "ATM Token", "en": "ATM Token — on-chain smart-contract exploit" }, "summary": { "zh": "公开来源确认 ATM Token 发生智能合约漏洞、链上攻击事件，损失约 $243,543。", "tw": "公開來源確認 ATM Token 發生智能合約漏洞、鏈上攻擊事件，損失約 $243,543。", "en": "Public sources report ATM Token — on-chain smart-contract exploit, with a loss of approximately $243,543." }, "details": { "zh": "## 事件背景\n链上复现确认合约逻辑、记账、权限或价格机制存在可被利用路径；具体步骤见攻击交易与复现源码。\n\n## 事件经过\n攻击者调用存在缺陷的合约路径，利用闪电流动性、储备/价格操纵、错误记账、权限或签名校验缺陷完成资产提取；交易已由 DeFiHackLabs 在历史状态上复现。\n\n## 资金流向\n受害合约或流动性池 → 攻击合约或攻击者地址。公开资料未披露后续兑换与资金转移路径。\n\n## 金额口径\n公开可核损失按 $243,543 记录；原报告资产口径为“~$243,543 USDT (gross drained from the ATM/USDT PancakeSwap pair)”。\n\n## 地址与交易\n- `0x7e7C1f0D567c0483f85e1d016718E44414CdBAFE` — `[链：BNB Chain] [攻击者] [身份：事件 05] [状态：公开来源确认]`\n- `0xeCe23b485c38110b7a50B5067B7D4B644f897Dc9` — `[链：BNB Chain] [攻击合约] [身份：事件 05] [状态：公开来源确认]`\n- `0x986058ec93756E57b4e55b406dD0BeE24bcD95e3` — `[链：BNB Chain] [受害/漏洞合约] [身份：事件 05] [状态：公开来源确认]`\n- `0x37b90a337075cd2feea93b12780abe9f953dad476e1c1418a02447aaa6dcfd86` — `[链：BNB Chain] [攻击 Tx] [身份：事件 05] [状态：公开来源确认]`\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\n鏈上覆現確認合約邏輯、記賬、權限或價格機制存在可被利用路徑；具體步驟見攻擊交易與復現源碼。\n\n## 事件經過\n攻擊者調用存在缺陷的合約路徑，利用閃電流動性、儲備/價格操縱、錯誤記賬、權限或簽名校驗缺陷完成資產提取；交易已由 DeFiHackLabs 在歷史狀態上覆現。\n\n## 資金流向\n受害合約或流動性池 → 攻擊合約或攻擊者地址。公開資料未披露後續兌換與資金轉移路徑。\n\n## 金額口徑\n公開可核損失按 $243,543 記錄；原報告資產口徑為“~$243,543 USDT (gross drained from the ATM/USDT PancakeSwap pair)”。\n\n## 地址與交易\n- `0x7e7C1f0D567c0483f85e1d016718E44414CdBAFE` — `[鏈：BNB Chain] [攻擊者] [身份：事件 05] [狀態：公開來源確認]`\n- `0xeCe23b485c38110b7a50B5067B7D4B644f897Dc9` — `[鏈：BNB Chain] [攻擊合約] [身份：事件 05] [狀態：公開來源確認]`\n- `0x986058ec93756E57b4e55b406dD0BeE24bcD95e3` — `[鏈：BNB Chain] [受害/漏洞合約] [身份：事件 05] [狀態：公開來源確認]`\n- `0x37b90a337075cd2feea93b12780abe9f953dad476e1c1418a02447aaa6dcfd86` — `[鏈：BNB Chain] [攻擊 Tx] [身份：事件 05] [狀態：公開來源確認]`\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nHistorical-state reproduction supports an exploitable contract, accounting, authorization, pricing, or signature-validation path. The exact evidence is preserved in the cited transaction and reproduction source.\n\n## Incident sequence\nThe attacker used the cited contract or infrastructure weakness to move assets from the affected contract, wallet or pool. Historical-state reproduction or the cited public alert supports the event; later movement remains undisclosed.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nVerified loss is recorded at $243,543. The report's underlying asset basis was: ~$243,543 USDT (gross drained from the ATM/USDT PancakeSwap pair).\n\n## Addresses and transactions\n1. `0x7e7C1f0D567c0483f85e1d016718E44414CdBAFE` — BNB Chain; publicly identified attacker address.\n2. `0xeCe23b485c38110b7a50B5067B7D4B644f897Dc9` — BNB Chain; publicly identified attacker contract.\n3. `0x986058ec93756E57b4e55b406dD0BeE24bcD95e3` — BNB Chain; affected or vulnerable contract (not an attacker).\n4. `0x37b90a337075cd2feea93b12780abe9f953dad476e1c1418a02447aaa6dcfd86` — BNB Chain; attack or execution transaction.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "protocol-exploit", "severity": "medium", "ecosystems": [ "BNB Chain" ], "chains": [ "BNB Chain" ], "lossUsd": 243543, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开可核损失按 $243,543 记录；原报告资产口径为“~$243,543 USDT (gross drained from the ATM/USDT PancakeSwap pair)”。", "tw": "公開可核損失按 $243,543 記錄；原報告資產口徑為“~$243,543 USDT (gross drained from the ATM/USDT PancakeSwap pair)”。", "en": "Verified loss is recorded at $243,543. The report's underlying asset basis was: ~$243,543 USDT (gross drained from the ATM/USDT PancakeSwap pair)." }, "addressDisclosure": "published", "addresses": [ { "chain": "BNB Chain", "address": "0x7e7C1f0D567c0483f85e1d016718E44414CdBAFE", "entity": { "zh": "公开攻击者地址", "tw": "公開攻擊者地址", "en": "publicly identified attacker address" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-06/ATM_exp.sol", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [攻击者] [身份：事件 05] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [攻擊者] [身份：事件 05] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker address. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0xeCe23b485c38110b7a50B5067B7D4B644f897Dc9", "entity": { "zh": "公开攻击合约", "tw": "公開攻擊合約", "en": "publicly identified attacker contract" }, "role": "attacker-contract", "category": "hack", "confidence": 0.9, "sourceUrl": "https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-06/ATM_exp.sol", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [攻击合约] [身份：事件 05] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [攻擊合約] [身份：事件 05] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "publicly identified attacker contract. The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true }, { "chain": "BNB Chain", "address": "0x986058ec93756E57b4e55b406dD0BeE24bcD95e3", "entity": { "zh": "受影响或漏洞合约（非攻击者）", "tw": "受影響或漏洞合約（非攻擊者）", "en": "affected or vulnerable contract (not an attacker)" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-06/ATM_exp.sol", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "[链：BNB Chain] [受害/漏洞合约] [身份：事件 05] [状态：公开来源确认]。该角色仅按所引公开来源记录，不扩大为所有权、案件或资金性质归因。", "tw": "[鏈：BNB Chain] [受害/漏洞合約] [身份：事件 05] [狀態：公開來源確認]。該角色僅按所引公開來源記錄，不擴大為所有權、案件或資金性質歸因。", "en": "affected or vulnerable contract (not an attacker). The role is limited to the cited public source and does not establish broader ownership, case, or fund-source attribution." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "DeFiHackLabs 链上复现", "tw": "DeFiHackLabs 鏈上覆現", "en": "DeFiHackLabs on-chain reproduction" }, "url": "https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-06/ATM_exp.sol", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-063", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-062", "status": "verified", "incidentDate": "2026-06-03", "datePrecision": "day", "title": { "zh": "GPU.NET", "tw": "GPU.NET", "en": "GPU.NET — Social Engineering" }, "summary": { "zh": "公开来源确认 GPU.NET 发生 Social Engineering 事件，损失约 $10,600。", "tw": "公開來源確認 GPU.NET 發生 Social Engineering 事件，損失約 $10,600。", "en": "Public sources report GPU.NET — Social Engineering, with a loss of approximately $10,600." }, "details": { "zh": "## 事件背景\nSocial Engineering；事件依据 DeFiLlama 月度记录及其他可检索公开来源核验。 原报告存在百万倍金额展开错误，相关数值已按正确单位更正；事件事实、来源和资产单位保持不变。\n\n## 事件经过\n公开记录确认项目在该日附近发生安全事件，但未披露完整攻击路径。\n\n## 资金流向\n资产从受害项目或钱包转向攻击者或异常接收方；公开资料未披露完整逐跳路径。\n\n## 金额口径\n公开来源支持的损失额约为 $10,600；原报告中的“约 $10,600,000,000”存在百万倍单位展开错误，已按正确单位更正。\n\n## 地址与交易\n公开资料未披露完整攻击地址与 TxID。\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\nSocial Engineering；事件依據 DeFiLlama 月度記錄及其他可檢索公開來源核驗。 原報告存在百萬倍金額展開錯誤，相關數值已按正確單位更正；事件事實、來源和資產單位保持不變。\n\n## 事件經過\n公開記錄確認專案在該日附近發生安全事件，但未披露完整攻擊路徑。\n\n## 資金流向\n資產從受害專案或錢包轉向攻擊者或異常接收方；公開資料未披露完整逐跳路徑。\n\n## 金額口徑\n公開來源支持的損失額約為 $10,600；原報告中的“約 $10,600,000,000”存在百萬倍單位展開錯誤，已按正確單位更正。\n\n## 地址與交易\n公開資料未披露完整攻擊地址與 TxID。\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nPublic sources classify the incident as Social Engineering but do not disclose a complete exploit path.\n\n## Incident sequence\nPublic sources confirm a security incident near the stated date but do not disclose a complete exploit sequence, attribution, or downstream flow.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nPublic sources support a loss of approximately $10,600. The report contained a one-million-fold unit-expansion error, which has been corrected.\n\n## Addresses and transactions\nPublic sources do not disclose a complete address or transaction list.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "social-engineering", "severity": "low", "ecosystems": [ "Ethereum" ], "chains": [ "Ethereum" ], "lossUsd": 10600, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开来源支持的损失额约为 $10,600；原报告中的“约 $10,600,000,000”存在百万倍单位展开错误，已按正确单位更正。", "tw": "公開來源支持的損失額約為 $10,600；原報告中的“約 $10,600,000,000”存在百萬倍單位展開錯誤，已按正確單位更正。", "en": "Public sources support a loss of approximately $10,600. The report contained a one-million-fold unit-expansion error, which has been corrected." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "DeFiLlama Hacks 事件数据库", "tw": "DeFiLlama Hacks 事件數據庫", "en": "DeFiLlama Hacks database" }, "url": "https://api.llama.fi/hacks", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-062", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-061", "status": "verified", "incidentDate": "2026-06-02", "datePrecision": "day", "title": { "zh": "Red Hat Cloud Services npm 供应链投毒", "tw": "Red Hat Cloud Services npm 供應鏈投毒", "en": "Red Hat Cloud Services npm supply-chain compromise" }, "summary": { "zh": "Red Hat Cloud Services 的 npm 发布链遭到污染，形成供应链安全事件；未披露统一可核损失金额。", "tw": "Red Hat Cloud Services 的 npm 發佈鏈遭到污染，形成供應鏈安全事件；未披露統一可核損失金額。", "en": "The Red Hat Cloud Services npm publishing chain was compromised; no verified aggregate loss amount was published." }, "details": { "zh": "## 事件背景\n被入侵组织/发布链向 npm 包植入多阶段恶意加载器。\n\n## 事件经过\n安全机构或媒体在窗口内公开披露该独立活动/受害项目；按不同受害发布链、项目或攻击面分别列项，避免把多个事件压成一个“供应链簇”。\n\n## 资金流向\n恶意包、伪仓库或被入侵前端 → 开发者/用户设备 → 凭据、钱包授权或资产风险；没有统一可核链上收款地址。\n\n## 金额口径\n32 个包、96 个版本受到影响，周下载暴露面约 116,282 次；未公开统一链上损失。\n\n## 地址与交易\n链上地址与 TxID 未公开（不适用）；事件属于链下供应链或前端安全。\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\n被入侵組織/發布鏈向 npm 包植入多階段惡意加載器。\n\n## 事件經過\n安全機構或媒體在窗口內公開披露該獨立活動/受害專案；按不同受害發布鏈、專案或攻擊面分別列項，避免把多個事件壓成一個“供應鏈簇”。\n\n## 資金流向\n惡意包、偽倉庫或被入侵前端 → 開發者/用戶設備 → 憑據、錢包授權或資產風險；沒有統一可核鏈上收款地址。\n\n## 金額口徑\n32 個包、96 個版本受到影響，周下載暴露面約 116,282 次；未公開統一鏈上損失。\n\n## 地址與交易\n鏈上地址與 TxID 未公開（不適用）；事件屬於鏈下供應鏈或前端安全。\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nAn intrusion into an organizational publishing chain inserted a multi-stage malicious loader into npm packages.\n\n## Incident sequence\nSecurity researchers or public reporting disclosed this distinct campaign or affected project during the June window. It is kept separate from other supply-chain incidents because the affected publishing chain, project or attack surface differs.\n\n## Fund flow\nA malicious package, repository or compromised front end exposed developer or user devices to credential, wallet-authorization or asset risk. No single verified receiving address was published.\n\n## Amount basis\n32 packages and 96 versions were affected, representing approximately 116,282 weekly downloads; no verified on-chain loss was published.\n\n## Addresses and transactions\nNo applicable blockchain address or transaction was published because this is an off-chain supply-chain, malware, front-end, or enforcement event.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "supply-chain", "severity": "medium", "ecosystems": [ "Other" ], "chains": [ "Other" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "32 个包、96 个版本受到影响，周下载暴露面约 116,282 次；未公开统一链上损失。", "tw": "32 個包、96 個版本受到影響，周下載暴露面約 116,282 次；未公開統一鏈上損失。", "en": "32 packages and 96 versions were affected, representing approximately 116,282 weekly downloads; no verified on-chain loss was published." }, "addressDisclosure": "not-applicable", "addresses": [], "references": [ { "label": { "zh": "公开安全预警或项目说明", "tw": "公開安全預警或專案說明", "en": "Public security alert or project statement" }, "url": "https://x.com/SlowMist_Team/status/2061704216306163909", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-061", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-060", "status": "verified", "incidentDate": "2026-06-01", "datePrecision": "day", "title": { "zh": "TSR", "tw": "TSR", "en": "TSR — Infinite Mint and Dump" }, "summary": { "zh": "公开来源确认 TSR 发生 Infinite Mint and Dump 事件，损失约 $2,500,000。", "tw": "公開來源確認 TSR 發生 Infinite Mint and Dump 事件，損失約 $2,500,000。", "en": "Public sources report TSR — Infinite Mint and Dump, with a loss of approximately $2,500,000." }, "details": { "zh": "## 事件背景\nInfinite Mint and Dump；事件依据 DeFiLlama 月度记录及其他可检索公开来源核验。 原报告存在百万倍金额展开错误，相关数值已按正确单位更正；事件事实、来源和资产单位保持不变。\n\n## 事件经过\n公开记录确认项目在该日附近发生安全事件，但未披露完整攻击路径。\n\n## 资金流向\n资产从受害项目或钱包转向攻击者或异常接收方；公开资料未披露完整逐跳路径。\n\n## 金额口径\n公开来源支持的损失额约为 $2,500,000；原报告中的“约 $2,500,000,000,000”存在百万倍单位展开错误，已按正确单位更正。\n\n## 地址与交易\n公开资料未披露完整攻击地址与 TxID。\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\nInfinite Mint and Dump；事件依據 DeFiLlama 月度記錄及其他可檢索公開來源核驗。 原報告存在百萬倍金額展開錯誤，相關數值已按正確單位更正；事件事實、來源和資產單位保持不變。\n\n## 事件經過\n公開記錄確認專案在該日附近發生安全事件，但未披露完整攻擊路徑。\n\n## 資金流向\n資產從受害專案或錢包轉向攻擊者或異常接收方；公開資料未披露完整逐跳路徑。\n\n## 金額口徑\n公開來源支持的損失額約為 $2,500,000；原報告中的“約 $2,500,000,000,000”存在百萬倍單位展開錯誤，已按正確單位更正。\n\n## 地址與交易\n公開資料未披露完整攻擊地址與 TxID。\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nPublic sources classify the incident as Infinite Mint and Dump but do not disclose a complete exploit path.\n\n## Incident sequence\nPublic sources confirm a security incident near the stated date but do not disclose a complete exploit sequence, attribution, or downstream flow.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nPublic sources support a loss of approximately $2,500,000. The report contained a one-million-fold unit-expansion error, which has been corrected.\n\n## Addresses and transactions\nPublic sources do not disclose a complete address or transaction list.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "protocol-exploit", "severity": "high", "ecosystems": [ "BNB Chain" ], "chains": [ "BNB Chain" ], "lossUsd": 2500000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开来源支持的损失额约为 $2,500,000；原报告中的“约 $2,500,000,000,000”存在百万倍单位展开错误，已按正确单位更正。", "tw": "公開來源支持的損失額約為 $2,500,000；原報告中的“約 $2,500,000,000,000”存在百萬倍單位展開錯誤，已按正確單位更正。", "en": "Public sources support a loss of approximately $2,500,000. The report contained a one-million-fold unit-expansion error, which has been corrected." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "公开安全预警或项目说明", "tw": "公開安全預警或專案說明", "en": "Public security alert or project statement" }, "url": "https://x.com/PeckShieldAlert/status/2061713210210988434", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-060", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-059", "status": "verified", "incidentDate": "2026-06-01", "datePrecision": "day", "title": { "zh": "Gnosis Pay", "tw": "Gnosis Pay", "en": "Gnosis Pay — Zodiac Delay Module Exploit" }, "summary": { "zh": "公开来源确认 Gnosis Pay 发生 Zodiac Delay Module Exploit 事件，但未披露统一可核的美元损失额。", "tw": "公開來源確認 Gnosis Pay 發生 Zodiac Delay Module Exploit 事件，但未披露統一可核的美元損失額。", "en": "Public sources identify Gnosis Pay — Zodiac Delay Module Exploit as a Zodiac Delay Module Exploit incident. No single verifiable USD loss amount was published." }, "details": { "zh": "## 事件背景\nZodiac Delay Module Exploit；事件依据 DeFiLlama 月度记录及其他可检索公开来源核验。\n\n## 事件经过\n公开记录确认项目在该日附近发生安全事件，但未披露完整攻击路径。\n\n## 资金流向\n资产从受害项目或钱包转向攻击者或异常接收方；公开资料未披露完整逐跳路径。\n\n## 金额口径\n未公开统一可核损失额。\n\n## 地址与交易\n公开资料未披露完整攻击地址与 TxID。\n\n## 证据边界\n公开金额可能分别代表首次估值、风险暴露或处置规模；攻击者获利、项目毛损失、冻结余额与历史处理量须分别理解。\n\n## 处置状态\n公开资料确认事件存在，但尚未披露最终归因、净损失和资产返还结果。冻结、黑名单、司法扣押或白帽介入仅代表处置进展，不等于受害者已收回资金。", "tw": "## 事件背景\nZodiac Delay Module Exploit；事件依據 DeFiLlama 月度記錄及其他可檢索公開來源核驗。\n\n## 事件經過\n公開記錄確認專案在該日附近發生安全事件，但未披露完整攻擊路徑。\n\n## 資金流向\n資產從受害專案或錢包轉向攻擊者或異常接收方；公開資料未披露完整逐跳路徑。\n\n## 金額口徑\n未公開統一可核損失額。\n\n## 地址與交易\n公開資料未披露完整攻擊地址與 TxID。\n\n## 證據邊界\n公開金額可能分別代表首次估值、風險暴露或處置規模；攻擊者獲利、專案毛損失、凍結餘額與歷史處理量須分別理解。\n\n## 處置狀態\n公開資料確認事件存在，但尚未披露最終歸因、淨損失和資產返還結果。凍結、黑名單、司法扣押或白帽介入僅代表處置進展，不等於受害者已收回資金。", "en": "## Incident background\nPublic sources classify the incident as Zodiac Delay Module Exploit but do not disclose a complete exploit path.\n\n## Incident sequence\nPublic sources confirm a security incident near the stated date but do not disclose a complete exploit sequence, attribution, or downstream flow.\n\n## Fund flow\nAssets moved from the affected contract, wallet, or liquidity pool toward an attacker-controlled or anomalous recipient. Public sources do not disclose a complete downstream route.\n\n## Amount basis\nNo single verified loss amount was published.\n\n## Addresses and transactions\nPublic sources do not disclose a complete address or transaction list.\n\n## Evidence boundary\nPublished figures may represent initial estimates, exposed value, frozen balances, historical volume, or intervention amounts; these measures remain distinct.\n\n## Current status\nPublic evidence confirms the incident. Final attribution, net loss, and return of assets remain unconfirmed. Freezing, blacklisting, seizure, or white-hat intervention indicates action taken, not verified return to victims." }, "category": "protocol-exploit", "severity": "low", "ecosystems": [ "Gnosis Chain" ], "chains": [ "Gnosis Chain" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "未公开统一可核损失额。", "tw": "未公開統一可核損失額。", "en": "No single verified loss amount was published." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "DeFiLlama Hacks 事件数据库", "tw": "DeFiLlama Hacks 事件數據庫", "en": "DeFiLlama Hacks database" }, "url": "https://api.llama.fi/hacks", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-059", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-177", "status": "verified", "incidentDate": "2026-05-31", "datePrecision": "day", "title": { "zh": "Fluid Lending 奖励列表运营密钥失陷", "tw": "Fluid Lending 獎勵列表運營密鑰失陷", "en": "Fluid Lending reward-list operational-key compromise" }, "summary": { "zh": "攻击者取得两个用于发起和批准 Fluid Merkle 奖励列表的运营私钥，得以提交并批准欺诈奖励列表。已核材料将影响限定在奖励机制，而不是 Fluid 核心借贷市场或 Vault 代码。 公开损失采用约 $215,000。", "tw": "攻擊者取得兩個用於發起和批准 Fluid Merkle 獎勵列表的運營私鑰，得以提交併批准欺詐獎勵列表。已核材料將影響限定在獎勵機制，而不是 Fluid 核心借貸市場或 Vault 代碼。 公開損失採用約 $215,000。", "en": "Fluid Lending reward-list operational-key compromise was reported on 2026-05-31. Evidence indicates that an operational key controlling the reward list was compromised. Reported loss is approximately $215,000." }, "details": { "zh": "## 事件背景\n攻击者取得两个用于发起和批准 Fluid Merkle 奖励列表的运营私钥，得以提交并批准欺诈奖励列表。已核材料将影响限定在奖励机制，而不是 Fluid 核心借贷市场或 Vault 代码。\n\n## 事件经过\n1. 两个运营私钥被攻击者控制。\n2. 攻击者利用双重运营权限提交并批准伪造的 Merkle 奖励列表。\n3. 约 112,883 FLUID、47,903 GHO 和少量 cbBTC 被提取。\n4. 资产被换成 ETH 并流入 Tornado Cash。\n5. Fluid 约 10 小时内轮换/替换相关 key 并保护剩余奖励资金。\n\n## 资金流向\n奖励资金合约/分发路径 → 攻击者接收 → 多资产换 ETH → Tornado Cash。完整攻击地址与 Tx 本轮未恢复。\n\n## 金额口径\n公开损失采用约 $215,000。 原始资产与金额说明为：约 215,000 美元；资产包含约 112,883 FLUID、47,903 GHO 及少量 cbBTC。\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n当前依赖结构化数据库、Fluid 治理材料索引和二级复盘；缺项目事件专属 X 原帖及完整交易，因此保持 C 级。\n\n## 处置状态\n运营 key 已替换；核心借贷市场、Vault 和用户存款据报未受影响；约 21.5 万美元仍按被盗处理。", "tw": "## 事件背景\n攻擊者取得兩個用於發起和批准 Fluid Merkle 獎勵列表的運營私鑰，得以提交併批准欺詐獎勵列表。已核材料將影響限定在獎勵機制，而不是 Fluid 核心借貸市場或 Vault 代碼。\n\n## 事件經過\n1. 兩個運營私鑰被攻擊者控制。\n2. 攻擊者利用雙重運營權限提交併批准偽造的 Merkle 獎勵列表。\n3. 約 112,883 FLUID、47,903 GHO 和少量 cbBTC 被提取。\n4. 資產被換成 ETH 並流入 Tornado Cash。\n5. Fluid 約 10 小時內輪換/替換相關 key 並保護剩餘獎勵資金。\n\n## 資金流向\n獎勵資金合約/分發路徑 → 攻擊者接收 → 多資產換 ETH → Tornado Cash。完整攻擊地址與 Tx 本輪未恢復。\n\n## 金額口徑\n公開損失採用約 $215,000。 原始資產與金額說明為：約 215,000 美元；資產包含約 112,883 FLUID、47,903 GHO 及少量 cbBTC。\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n當前依賴結構化數據庫、Fluid 治理材料索引和二級復盤；缺專案事件專屬 X 原帖及完整交易，因此保持 C 級。\n\n## 處置狀態\n運營 key 已替換；核心借貸市場、Vault 和用戶存款據報未受影響；約 21.5 萬美元仍按被盜處理。", "en": "## Incident background\nOn 2026-05-31, Fluid Lending reward-list operational-key compromise was reported. Available evidence indicates that an operational key controlling the reward list was compromised. The report assigns evidence level C.\n\n## Incident sequence\nPublic reporting describes an executed event affecting Fluid Lending reward-list operational-key compromise. The affected path involved Ethereum. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Ethereum. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $215,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n2 public sources support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "key-compromise", "severity": "medium", "chains": [ "Ethereum" ], "ecosystems": [ "Ethereum" ], "lossUsd": 215000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $215,000。 原始资产与金额说明为：约 215,000 美元；资产包含约 112,883 FLUID、47,903 GHO 及少量 cbBTC。", "tw": "公開損失採用約 $215,000。 原始資產與金額說明為：約 215,000 美元；資產包含約 112,883 FLUID、47,903 GHO 及少量 cbBTC。", "en": "Reported loss is recorded at approximately $215,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "Fluid 治理门户", "tw": "Fluid 治理門戶", "en": "fluid.io public source" }, "url": "https://fluid.io/governance", "type": "research" }, { "label": { "zh": "DeFiLlama Hacks 数据库", "tw": "DeFiLlama Hacks 數據庫", "en": "defillama.com public source" }, "url": "https://defillama.com/hacks", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-177", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-176", "status": "verified", "incidentDate": "2026-05-31", "datePrecision": "day", "title": { "zh": "AFI Protocol afiUSD Vault", "tw": "AFI Protocol afiUSD Vault", "en": "AFI Protocol afiUSD Vault theft" }, "summary": { "zh": "AFI 官方将其称为“复杂漏洞利用”，但截至所核官方帖尚未给出具体漏洞函数或最终根因；不得擅自把数据库的笼统分类改写成已确认私钥泄露。 公开损失采用约 $480,000。", "tw": "AFI 官方將其稱為“複雜漏洞利用”，但截至所核官方帖尚未給出具體漏洞函數或最終根因；不得擅自把數據庫的籠統分類改寫成已確認私鑰洩露。 公開損失採用約 $480,000。", "en": "AFI Protocol afiUSD Vault theft was reported on 2026-05-31. Evidence indicates that afiUSD Vault authority was used to transfer assets without authorization. Reported loss is approximately $480,000." }, "details": { "zh": "## 事件背景\nAFI 官方将其称为“复杂漏洞利用”，但截至所核官方帖尚未给出具体漏洞函数或最终根因；不得擅自把数据库的笼统分类改写成已确认私钥泄露。\n\n## 事件经过\n1. 攻击交易于北京时间 5 月 31 日 02:59:11 成功执行（receipt status=1）；AFI 官方按 UTC 日期称事件发生于 5 月 30 日，二者不是冲突。\n2. 攻击者将约 252,000 DAI 通过链上交换转换为 ETH。\n3. 向二级钱包发送 0.101 ETH 作为全面洗钱前的测试转账。\n4. 6 月 7 日，从主要攻击者钱包向 Tornado Cash 存入约 150 ETH。\n5. AFI 暂停受影响 Vault、轮换全部运营密钥并检查其他 Vault 和核心系统。\n6. 官方称其余约 2.25 亿美元 TVL 未受影响，并与 Quantstamp、Cantina、SEAL 911 合作追踪追回。\n\n## 资金流向\nafiUSD Vault → 主攻击钱包 0x64c9…B0f5 → 约 252,000 DAI 兑换 ETH → 0.101 ETH 测试转至 0x2715…7443 → 约 150 ETH 于 6 月 7 日进入 Tornado Cash。\n\n## 金额口径\n公开损失采用约 $480,000。 原始资产与金额说明为：官方称约 480,000 美元从 afiUSD Vault 被盗；其中约 252,000 DAI 换成 ETH。\n\n## 地址与交易\n1. 主要被盗资产接收地址：0x64c94CB6aA1ba9257Aad00Ff5DD5ec836533B0f5（Ethereum）。\n2. 次要测试或资金路径地址：0x2715e78fd65434c438ea3bbc06e6ea992fea7443（Ethereum）。\n3. 攻击交易发送地址：0x30262f5b369ab2d548a2adfbc0a69ab6a17a00d0（Ethereum）。\n4. 受影响 afiUSD Vault 合约：0xde9e75891f4c206b7a0477c683e78d2344920a4c（Ethereum）。\n\n## 证据边界\n官方确认事件、金额、地址、Tx 和后续动作，但未在该帖公布完整技术根因；“轮换运营密钥”是处置动作，不等于已经证明根因就是私钥泄露。\n\n## 处置状态\n受影响 Vault 已暂停；运营密钥已轮换；其他 Vault 未发现进一步泄露；赃款部分已进入 Tornado Cash，追回进行中。", "tw": "## 事件背景\nAFI 官方將其稱為“複雜漏洞利用”，但截至所核官方帖尚未給出具體漏洞函數或最終根因；不得擅自把數據庫的籠統分類改寫成已確認私鑰洩露。\n\n## 事件經過\n1. 攻擊交易於北京時間 5 月 31 日 02:59:11 成功執行（receipt status=1）；AFI 官方按 UTC 日期稱事件發生於 5 月 30 日，二者不是衝突。\n2. 攻擊者將約 252,000 DAI 通過鏈上交換轉換為 ETH。\n3. 向二級錢包發送 0.101 ETH 作為全面洗錢前的測試轉賬。\n4. 6 月 7 日，從主要攻擊者錢包向 Tornado Cash 存入約 150 ETH。\n5. AFI 暫停受影響 Vault、輪換全部運營密鑰並檢查其他 Vault 和核心繫統。\n6. 官方稱其餘約 2.25 億美元 TVL 未受影響，並與 Quantstamp、Cantina、SEAL 911 合作追蹤追回。\n\n## 資金流向\nafiUSD Vault → 主攻擊錢包 0x64c9…B0f5 → 約 252,000 DAI 兌換 ETH → 0.101 ETH 測試轉至 0x2715…7443 → 約 150 ETH 於 6 月 7 日進入 Tornado Cash。\n\n## 金額口徑\n公開損失採用約 $480,000。 原始資產與金額說明為：官方稱約 480,000 美元從 afiUSD Vault 被盜；其中約 252,000 DAI 換成 ETH。\n\n## 地址與交易\n1. 主要被盜資產接收地址：0x64c94CB6aA1ba9257Aad00Ff5DD5ec836533B0f5（Ethereum）。\n2. 次要測試或資金路徑地址：0x2715e78fd65434c438ea3bbc06e6ea992fea7443（Ethereum）。\n3. 攻擊交易發送地址：0x30262f5b369ab2d548a2adfbc0a69ab6a17a00d0（Ethereum）。\n4. 受影響 afiUSD Vault 合約：0xde9e75891f4c206b7a0477c683e78d2344920a4c（Ethereum）。\n\n## 證據邊界\n官方確認事件、金額、地址、Tx 和後續動作，但未在該帖公佈完整技術根因；“輪換運營密鑰”是處置動作，不等於已經證明根因就是私鑰洩露。\n\n## 處置狀態\n受影響 Vault 已暫停；運營密鑰已輪換；其他 Vault 未發現進一步洩露；贓款部分已進入 Tornado Cash，追回進行中。", "en": "## Incident background\nOn 2026-05-31, AFI Protocol afiUSD Vault theft was reported. Available evidence indicates that afiUSD Vault authority was used to transfer assets without authorization. The report assigns evidence level A.\n\n## Incident sequence\nPublic reporting describes an executed event affecting AFI Protocol afiUSD Vault theft. The affected path involved Ethereum. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Ethereum. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $480,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\n1. primary stolen-asset recipient: `0x64c94CB6aA1ba9257Aad00Ff5DD5ec836533B0f5` on Ethereum.\n2. secondary test or fund-flow address: `0x2715e78fd65434c438ea3bbc06e6ea992fea7443` on Ethereum.\n3. attack transaction sender: `0x30262f5b369ab2d548a2adfbc0a69ab6a17a00d0` on Ethereum.\n4. affected afiUSD Vault contract: `0xde9e75891f4c206b7a0477c683e78d2344920a4c` on Ethereum.\n\n## Evidence boundary\n3 public sources support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "access-control", "severity": "medium", "chains": [ "Ethereum" ], "ecosystems": [ "Ethereum" ], "lossUsd": 480000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $480,000。 原始资产与金额说明为：官方称约 480,000 美元从 afiUSD Vault 被盗；其中约 252,000 DAI 换成 ETH。", "tw": "公開損失採用約 $480,000。 原始資產與金額說明為：官方稱約 480,000 美元從 afiUSD Vault 被盜；其中約 252,000 DAI 換成 ETH。", "en": "Reported loss is recorded at approximately $480,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0x64c94CB6aA1ba9257Aad00Ff5DD5ec836533B0f5", "entity": { "zh": "主要被盗资产接收地址", "tw": "主要被盜資產接收地址", "en": "primary stolen-asset recipient" }, "role": "attacker", "category": "stolen_funds", "confidence": 0.9, "sourceUrl": "https://x.com/afiprotocol_xyz/status/2064070451610177680", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "主要被盗资产接收地址；角色来自所引公开来源，仅用于本次事件的证据标签。", "tw": "主要被盜資產接收地址；角色來自所引公開來源，僅用於本次事件的證據標籤。", "en": "primary stolen-asset recipient; the role is limited to the cited public evidence for this incident." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x2715e78fd65434c438ea3bbc06e6ea992fea7443", "entity": { "zh": "次要测试或资金路径地址", "tw": "次要測試或資金路徑地址", "en": "secondary test or fund-flow address" }, "role": "fund-flow", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/afiprotocol_xyz/status/2064070451610177680", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "次要测试或资金路径地址；角色来自所引公开来源，仅用于本次事件的证据标签。", "tw": "次要測試或資金路徑地址；角色來自所引公開來源，僅用於本次事件的證據標籤。", "en": "secondary test or fund-flow address; the role is limited to the cited public evidence for this incident." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x30262f5b369ab2d548a2adfbc0a69ab6a17a00d0", "entity": { "zh": "攻击交易发送地址", "tw": "攻擊交易發送地址", "en": "attack transaction sender" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/afiprotocol_xyz/status/2064070451610177680", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "攻击交易发送地址；角色来自所引公开来源，仅用于本次事件的证据标签。", "tw": "攻擊交易發送地址；角色來自所引公開來源，僅用於本次事件的證據標籤。", "en": "attack transaction sender; the role is limited to the cited public evidence for this incident." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xde9e75891f4c206b7a0477c683e78d2344920a4c", "entity": { "zh": "受影响 afiUSD Vault 合约", "tw": "受影響 afiUSD Vault 合約", "en": "affected afiUSD Vault contract" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/afiprotocol_xyz/status/2064070451610177680", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "受影响 afiUSD Vault 合约；角色来自所引公开来源，仅用于本次事件的证据标签。", "tw": "受影響 afiUSD Vault 合約；角色來自所引公開來源，僅用於本次事件的證據標籤。", "en": "affected afiUSD Vault contract; the role is limited to the cited public evidence for this incident." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "AFI 官方安全事件更新", "tw": "AFI 官方安全事件更新", "en": "x.com official statement" }, "url": "https://x.com/afiprotocol_xyz/status/2064070451610177680", "type": "official" }, { "label": { "zh": "Ethereum 攻击交易", "tw": "Ethereum 攻擊交易", "en": "etherscan.io public source" }, "url": "https://etherscan.io/tx/0x0851d24849587f2f2747f5261a0b97c096cc38a2e546bddef33bce619820b495", "type": "research" }, { "label": { "zh": "DeFiLlama Hacks 数据库", "tw": "DeFiLlama Hacks 數據庫", "en": "defillama.com public source" }, "url": "https://defillama.com/hacks", "type": "research" }, { "label": { "zh": "Etherscan：AFI Protocol 攻击交易", "tw": "Etherscan：AFI Protocol 攻擊交易", "en": "Etherscan: AFI Protocol attack transaction" }, "url": "https://etherscan.io/tx/0x0851d24849587f2f2747f5261a0b97c096cc38a2e546bddef33bce619820b495", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-176", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-174", "status": "verified", "incidentDate": "2026-05-31", "datePrecision": "day", "title": { "zh": "AROS 价格操纵", "tw": "AROS 價格操縱", "en": "AROS price-manipulation incident" }, "summary": { "zh": "结构化数据库将根因列为闪电贷价格操纵，但本轮没有恢复项目官方说明、技术安全机构原帖、完整攻击交易或受影响池地址。 公开损失采用约 $295,000。", "tw": "結構化數據庫將根因列為閃電貸價格操縱，但本輪沒有恢復專案官方說明、技術安全機構原帖、完整攻擊交易或受影響池地址。 公開損失採用約 $295,000。", "en": "AROS price-manipulation incident was reported on 2026-05-31. Evidence indicates that the AROS market was manipulated through a pricing or liquidity path. Reported loss is approximately $295,000." }, "details": { "zh": "## 事件背景\n结构化数据库将根因列为闪电贷价格操纵，但本轮没有恢复项目官方说明、技术安全机构原帖、完整攻击交易或受影响池地址。\n\n## 事件经过\n1. 数据库记录攻击发生于 5 月 31 日。\n2. 攻击者被描述为通过闪电贷放大可操纵资本。\n3. 价格源或流动性池被操纵后形成约 29.5 万美元损失。\n4. 具体调用序列、获利资产和归集路径待核。\n\n## 资金流向\n未公开可核完整路径；不能推断是否进入混币器或 CEX。\n\n## 金额口径\n公开损失采用约 $295,000。 原始资产与金额说明为：DeFiLlama 记录约 295,000 美元。\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n本项只作为结构化数据库补漏候选，不能提升为已完成一手法证的 B 级事件。\n\n## 处置状态\n项目暂停、修复、冻结、返还和赔付状态均待核。", "tw": "## 事件背景\n結構化數據庫將根因列為閃電貸價格操縱，但本輪沒有恢復專案官方說明、技術安全機構原帖、完整攻擊交易或受影響池地址。\n\n## 事件經過\n1. 數據庫記錄攻擊發生於 5 月 31 日。\n2. 攻擊者被描述為通過閃電貸放大可操縱資本。\n3. 價格源或流動性池被操縱後形成約 29.5 萬美元損失。\n4. 具體調用序列、獲利資產和歸集路徑待核。\n\n## 資金流向\n未公開可核完整路徑；不能推斷是否進入混幣器或 CEX。\n\n## 金額口徑\n公開損失採用約 $295,000。 原始資產與金額說明為：DeFiLlama 記錄約 295,000 美元。\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n本項只作為結構化數據庫補漏候選，不能提升為已完成一手法證的 B 級事件。\n\n## 處置狀態\n專案暫停、修復、凍結、返還和賠付狀態均待核。", "en": "## Incident background\nOn 2026-05-31, AROS price-manipulation incident was reported. Available evidence indicates that the AROS market was manipulated through a pricing or liquidity path. The report assigns evidence level D.\n\n## Incident sequence\nPublic reporting describes an executed event affecting AROS price-manipulation incident. The affected path involved BNB Chain. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved BNB Chain. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $295,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n1 public source support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "oracle-manipulation", "severity": "medium", "chains": [ "BNB Chain" ], "ecosystems": [ "BNB Chain" ], "lossUsd": 295000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $295,000。 原始资产与金额说明为：DeFiLlama 记录约 295,000 美元。", "tw": "公開損失採用約 $295,000。 原始資產與金額說明為：DeFiLlama 記錄約 295,000 美元。", "en": "Reported loss is recorded at approximately $295,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "DeFiLlama Hacks 数据库", "tw": "DeFiLlama Hacks 數據庫", "en": "defillama.com public source" }, "url": "https://defillama.com/hacks", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-174", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-123", "status": "verified", "incidentDate": "2026-05-30", "datePrecision": "day", "title": { "zh": "Gravity Bridge", "tw": "Gravity Bridge", "en": "Gravity Bridge compromise" }, "summary": { "zh": "验证者或签名私钥疑似泄露，使攻击者获得足以产生有效跨链提款授权的签名能力；具体密钥失陷位置尚无正式复盘。 公开损失采用约 $5,400,000。", "tw": "驗證者或簽名私鑰疑似洩露，使攻擊者獲得足以產生有效跨鏈提款授權的簽名能力；具體密鑰失陷位置尚無正式復盤。 公開損失採用約 $5,400,000。", "en": "Gravity Bridge compromise was reported on 2026-05-30. Evidence indicates that the bridge validator or signing path was compromised. Reported loss is approximately $5,400,000." }, "details": { "zh": "## 事件背景\n验证者或签名私钥疑似泄露，使攻击者获得足以产生有效跨链提款授权的签名能力；具体密钥失陷位置尚无正式复盘。\n\n## 事件经过\n1. 攻击者获得有效签名能力。\n2. 对 Ethereum–Cosmos 桥发起多资产提款。\n3. 桥按有效授权释放资产。\n4. 资产被兑换/归集。\n5. 部分进入 ChangeNOW 和 Binance。\n6. 项目暂停桥与界面。\n\n## 资金流向\n1. Ethereum 桥储备 → 攻击者 → ChangeNOW/Binance。\n2. 披露时仍持有约 2,102 ETH。\n\n## 金额口径\n公开损失采用约 $5,400,000。 原始资产与金额说明为：约 540 万美元：430 万 USDC、274 ETH 约 55.3 万美元、43.4 万 USDT、14.164 PAYG 约 6.4 万美元；披露时约 2,102 ETH 约 423 万美元仍持有\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n“私钥泄露”仍属疑似根因；完整攻击地址、交易、交易所入金地址未在源文件展示。\n\n## 处置状态\n桥暂停、界面离线，验证者被要求停止相关链活动；未见完整冻结或返还清单。", "tw": "## 事件背景\n驗證者或簽名私鑰疑似洩露，使攻擊者獲得足以產生有效跨鏈提款授權的簽名能力；具體密鑰失陷位置尚無正式復盤。\n\n## 事件經過\n1. 攻擊者獲得有效簽名能力。\n2. 對 Ethereum–Cosmos 橋發起多資產提款。\n3. 橋按有效授權釋放資產。\n4. 資產被兌換/歸集。\n5. 部分進入 ChangeNOW 和 Binance。\n6. 專案暫停橋與界面。\n\n## 資金流向\n1. Ethereum 橋儲備 → 攻擊者 → ChangeNOW/Binance。\n2. 披露時仍持有約 2,102 ETH。\n\n## 金額口徑\n公開損失採用約 $5,400,000。 原始資產與金額說明為：約 540 萬美元：430 萬 USDC、274 ETH 約 55.3 萬美元、43.4 萬 USDT、14.164 PAYG 約 6.4 萬美元；披露時約 2,102 ETH 約 423 萬美元仍持有\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n“私鑰洩露”仍屬疑似根因；完整攻擊地址、交易、交易所入金地址未在源文件展示。\n\n## 處置狀態\n橋暫停、界面離線，驗證者被要求停止相關鏈活動；未見完整凍結或返還清單。", "en": "## Incident background\nOn 2026-05-30, Gravity Bridge compromise was reported. Available evidence indicates that the bridge validator or signing path was compromised. The report assigns evidence level B.\n\n## Incident sequence\nPublic reporting describes an executed event affecting Gravity Bridge compromise. The affected path involved Ethereum, Cosmos. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Ethereum, Cosmos. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $5,400,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n2 public sources support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "bridge-exploit", "severity": "high", "chains": [ "Ethereum", "Cosmos" ], "ecosystems": [ "Ethereum", "Cosmos" ], "lossUsd": 5400000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $5,400,000。 原始资产与金额说明为：约 540 万美元：430 万 USDC、274 ETH 约 55.3 万美元、43.4 万 USDT、14.164 PAYG 约 6.4 万美元；披露时约 2,102 ETH 约 423 万美元仍持有", "tw": "公開損失採用約 $5,400,000。 原始資產與金額說明為：約 540 萬美元：430 萬 USDC、274 ETH 約 55.3 萬美元、43.4 萬 USDT、14.164 PAYG 約 6.4 萬美元；披露時約 2,102 ETH 約 423 萬美元仍持有", "en": "Reported loss is recorded at approximately $5,400,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "PeckShield 资金流", "tw": "PeckShield 資金流", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2060636956984594521", "type": "research" }, { "label": { "zh": "Halborn 月度复盘", "tw": "Halborn 月度復盤", "en": "halborn.com public source" }, "url": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-may-2026", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-123", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-180", "status": "verified", "incidentDate": "2026-05-29", "datePrecision": "day", "title": { "zh": "YSDAO 储备操纵", "tw": "YSDAO 儲備操縱", "en": "YSDAO reserve manipulation" }, "summary": { "zh": "慢雾档案称 Computility 关联的 YSDAO 项目在 PancakeSwap V2 池中遭合约调用与储备操纵。公开摘要没有给出具体被调用函数、储备更新缺陷或是否使用闪电贷，因此未作超出证据的推断机制。 公开损失采用约 $19,500.00。", "tw": "慢霧檔案稱 Computility 關聯的 YSDAO 專案在 PancakeSwap V2 池中遭合約調用與儲備操縱。公開摘要沒有給出具體被調用函數、儲備更新缺陷或是否使用閃電貸，因此未作超出證據的推斷機制。 公開損失採用約 $19,500.00。", "en": "YSDAO reserve manipulation was reported on 2026-05-29. Evidence indicates that reserve accounting was manipulated to extract value. Reported loss is approximately $19,500.00." }, "details": { "zh": "## 事件背景\n慢雾档案称 Computility 关联的 YSDAO 项目在 PancakeSwap V2 池中遭合约调用与储备操纵。公开摘要没有给出具体被调用函数、储备更新缺陷或是否使用闪电贷，因此未作超出证据的推断机制。\n\n## 事件经过\n1. 攻击者与 YSDAO 相关合约及 PancakeSwap V2 池交互。\n2. 通过合约调用改变或利用池内储备状态。\n3. 从流动性中提取价值约 19,500 美元的资产。\n4. 具体获利资产、归集路径和后续处置待核。\n\n## 资金流向\nYSDAO/PancakeSwap V2 池 → 攻击者初始接收 → 后续兑换或归集未公开恢复。\n\n## 金额口径\n公开损失采用约 $19,500.00。 原始资产与金额说明为：慢雾档案记录约 19,500 美元\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n目前只能确认攻击存在、链、池和损失级别；不能把“储备操纵”扩写成已确认预言机或闪电贷攻击。\n\n## 处置状态\n损失按 19,500 美元记录；项目暂停、补偿、返还或追踪状态未从慢雾条目恢复。", "tw": "## 事件背景\n慢霧檔案稱 Computility 關聯的 YSDAO 專案在 PancakeSwap V2 池中遭合約調用與儲備操縱。公開摘要沒有給出具體被調用函數、儲備更新缺陷或是否使用閃電貸，因此未作超出證據的推斷機制。\n\n## 事件經過\n1. 攻擊者與 YSDAO 相關合約及 PancakeSwap V2 池交互。\n2. 通過合約調用改變或利用池內儲備狀態。\n3. 從流動性中提取價值約 19,500 美元的資產。\n4. 具體獲利資產、歸集路徑和後續處置待核。\n\n## 資金流向\nYSDAO/PancakeSwap V2 池 → 攻擊者初始接收 → 後續兌換或歸集未公開恢復。\n\n## 金額口徑\n公開損失採用約 $19,500.00。 原始資產與金額說明為：慢霧檔案記錄約 19,500 美元\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n目前只能確認攻擊存在、鏈、池和損失級別；不能把“儲備操縱”擴寫成已確認預言機或閃電貸攻擊。\n\n## 處置狀態\n損失按 19,500 美元記錄；專案暫停、補償、返還或追蹤狀態未從慢霧條目恢復。", "en": "## Incident background\nOn 2026-05-29, YSDAO reserve manipulation was reported. Available evidence indicates that reserve accounting was manipulated to extract value. The report assigns evidence level C.\n\n## Incident sequence\nPublic reporting describes an executed event affecting YSDAO reserve manipulation. The affected path involved BNB Chain. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved BNB Chain. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $19,500.00. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n2 public sources support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "oracle-manipulation", "severity": "low", "chains": [ "BNB Chain" ], "ecosystems": [ "BNB Chain" ], "lossUsd": 19500, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $19,500.00。 原始资产与金额说明为：慢雾档案记录约 19,500 美元", "tw": "公開損失採用約 $19,500.00。 原始資產與金額說明為：慢霧檔案記錄約 19,500 美元", "en": "Reported loss is recorded at approximately $19,500.00. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "慢雾 Hacked Zone 2026 年 5 月档案", "tw": "慢霧 Hacked Zone 2026 年 5 月檔案", "en": "hacked.slowmist.io public source" }, "url": "https://hacked.slowmist.io/zh/?c=&page=4", "type": "research" }, { "label": { "zh": "TenArmor 监控帖", "tw": "TenArmor 監控帖", "en": "x.com public source" }, "url": "https://x.com/TenArmorAlert/status/2061278221497254013", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-180", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-179", "status": "verified", "incidentDate": "2026-05-29", "datePrecision": "day", "title": { "zh": "MoneyMon 签名验证绕过", "tw": "MoneyMon 簽名驗證繞過", "en": "MoneyMon signature-validation bypass" }, "summary": { "zh": "LegendaryMoneyMonNft 合约的 cliamRewred 函数依赖 recoverSigner 判断签名者是否为 admin，却没有正确处理 ecrecover 对无效签名返回 address(0)的情况。攻击者先把 admin 设置为零地址，再提供 r=0, s=0, v=27 的无效签名，使恢复地址同样为零地址，从而通过错误验证。 公开损失采用约 $85,519.47。", "tw": "LegendaryMoneyMonNft 合約的 cliamRewred 函數依賴 recoverSigner 判斷簽名者是否為 admin，卻沒有正確處理 ecrecover 對無效簽名返回 address(0)的情況。攻擊者先把 admin 設置為零地址，再提供 r=0, s=0, v=27 的無效簽名，使恢復地址同樣為零地址，從而通過錯誤驗證。 公開損失採用約 $85,519.47。", "en": "MoneyMon signature-validation bypass was reported on 2026-05-29. Evidence indicates that a signature-validation bypass allowed unauthorized execution. Reported loss is approximately $85,519.47." }, "details": { "zh": "## 事件背景\nLegendaryMoneyMonNft 合约的 cliamRewred 函数依赖 recoverSigner 判断签名者是否为 admin，却没有正确处理 ecrecover 对无效签名返回 address(0)的情况。攻击者先把 admin 设置为零地址，再提供 r=0, s=0, v=27 的无效签名，使恢复地址同样为零地址，从而通过错误验证。\n\n## 事件经过\n1. 攻击者把合约 admin 状态设为零地址。\n2. 构造 r=0, s=0, v=27 无效签名。\n3. ecrecover 返回零地址。\n4. 合约错误地把零地址与 admin 零地址判为匹配。\n5. 攻击者绕过授权，任意领取奖励。\n6. 合约内代币被提走并经 PancakeSwap 换成 USDT。\n\n## 资金流向\nMoneyMon 奖励合约 → 攻击者控制路径 → PancakeSwap → USDT。完整接收地址、兑换路由和最终归集地址未从慢雾网页正文恢复。\n\n## 金额口径\n公开损失采用约 $85,519.47。 原始资产与金额说明为：慢雾档案记录约 85,519.47 美元\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n函数名按慢雾档案原文保留；没有完整 Trace 前，不扩写成内部人或私钥泄露。\n\n## 处置状态\n约 85,519.47 美元按慢雾档案计为损失；项目暂停、返还、冻结和赔付结果待项目级后续补证。", "tw": "## 事件背景\nLegendaryMoneyMonNft 合約的 cliamRewred 函數依賴 recoverSigner 判斷簽名者是否為 admin，卻沒有正確處理 ecrecover 對無效簽名返回 address(0)的情況。攻擊者先把 admin 設置為零地址，再提供 r=0, s=0, v=27 的無效簽名，使恢復地址同樣為零地址，從而通過錯誤驗證。\n\n## 事件經過\n1. 攻擊者把合約 admin 狀態設為零地址。\n2. 構造 r=0, s=0, v=27 無效簽名。\n3. ecrecover 返回零地址。\n4. 合約錯誤地把零地址與 admin 零地址判為匹配。\n5. 攻擊者繞過授權，任意領取獎勵。\n6. 合約內代幣被提走並經 PancakeSwap 換成 USDT。\n\n## 資金流向\nMoneyMon 獎勵合約 → 攻擊者控制路徑 → PancakeSwap → USDT。完整接收地址、兌換路由和最終歸集地址未從慢霧網頁正文恢復。\n\n## 金額口徑\n公開損失採用約 $85,519.47。 原始資產與金額說明為：慢霧檔案記錄約 85,519.47 美元\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n函數名按慢霧檔案原文保留；沒有完整 Trace 前，不擴寫成內部人或私鑰洩露。\n\n## 處置狀態\n約 85,519.47 美元按慢霧檔案計為損失；專案暫停、返還、凍結和賠付結果待專案級後續補證。", "en": "## Incident background\nOn 2026-05-29, MoneyMon signature-validation bypass was reported. Available evidence indicates that a signature-validation bypass allowed unauthorized execution. The report assigns evidence level B.\n\n## Incident sequence\nPublic reporting describes an executed event affecting MoneyMon signature-validation bypass. The affected path involved BNB Chain. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved BNB Chain. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $85,519.47. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n2 public sources support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "protocol-exploit", "severity": "low", "chains": [ "BNB Chain" ], "ecosystems": [ "BNB Chain" ], "lossUsd": 85519.47, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $85,519.47。 原始资产与金额说明为：慢雾档案记录约 85,519.47 美元", "tw": "公開損失採用約 $85,519.47。 原始資產與金額說明為：慢霧檔案記錄約 85,519.47 美元", "en": "Reported loss is recorded at approximately $85,519.47. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "慢雾 Hacked Zone 2026 年 5 月档案", "tw": "慢霧 Hacked Zone 2026 年 5 月檔案", "en": "hacked.slowmist.io public source" }, "url": "https://hacked.slowmist.io/zh/?c=&page=4", "type": "research" }, { "label": { "zh": "SlowMist Team 技术披露", "tw": "SlowMist Team 技術披露", "en": "x.com public source" }, "url": "https://x.com/SlowMist_Team/status/2060205558687486441", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-179", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-003", "status": "verified", "incidentDate": "2026-05-29", "datePrecision": "day", "title": { "zh": "Alephium TokenBridge", "tw": "Alephium TokenBridge", "en": "Alephium TokenBridge off-chain guardian exploit" }, "summary": { "zh": "攻击者伪造链下 guardian 消息，桥验证层错误接受该消息，并在 Ethereum 与 BNB Chain 铸造无抵押映射资产。 公开损失采用约 $815,000。", "tw": "攻擊者偽造鏈下 guardian 消息，橋驗證層錯誤接受該消息，並在 Ethereum 與 BNB Chain 鑄造無抵押映射資產。 公開損失採用約 $815,000。", "en": "Alephium TokenBridge off-chain guardian exploit was reported on 2026-05-29. Evidence indicates that false off-chain bridge messages bypassed guardian validation. Reported loss is approximately $815,000." }, "details": { "zh": "## 事件背景\n攻击者伪造链下 guardian 消息，桥验证层错误接受该消息，并在 Ethereum 与 BNB Chain 铸造无抵押映射资产。\n\n## 事件经过\n1. 攻击者构造伪 guardian 消息。\n2. 桥验证错误通过。\n3. Ethereum 和 BNB Chain 侧铸造映射资产。\n4. 攻击者用虚假映射资产套取真实流动性。\n5. 项目暂停桥并调查。\n\n## 资金流向\n1. 伪造 guardian 消息 → Ethereum/BNB Chain 映射资产 → 真实流动性被换出。\n2. 后续归集待核。\n\n## 金额口径\n公开损失采用约 $815,000。 原始资产与金额说明为：约 81.5 万美元实际套取口径；无抵押映射资产名义量未单列\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n源文件未保存完整消息、地址与 Tx；不能把名义铸币量等同实际套取额。\n\n## 处置状态\n桥暂停并调查；未见返还。", "tw": "## 事件背景\n攻擊者偽造鏈下 guardian 消息，橋驗證層錯誤接受該消息，並在 Ethereum 與 BNB Chain 鑄造無抵押映射資產。\n\n## 事件經過\n1. 攻擊者構造偽 guardian 消息。\n2. 橋驗證錯誤通過。\n3. Ethereum 和 BNB Chain 側鑄造映射資產。\n4. 攻擊者用虛假映射資產套取真實流動性。\n5. 專案暫停橋並調查。\n\n## 資金流向\n1. 偽造 guardian 消息 → Ethereum/BNB Chain 映射資產 → 真實流動性被換出。\n2. 後續歸集待核。\n\n## 金額口徑\n公開損失採用約 $815,000。 原始資產與金額說明為：約 81.5 萬美元實際套取口徑；無抵押映射資產名義量未單列\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n源文件未保存完整消息、地址與 Tx；不能把名義鑄幣量等同實際套取額。\n\n## 處置狀態\n橋暫停並調查；未見返還。", "en": "## Incident background\nOn 2026-05-29, Alephium TokenBridge off-chain guardian exploit was reported. Available evidence indicates that false off-chain bridge messages bypassed guardian validation. The report assigns evidence level B.\n\n## Incident sequence\nPublic reporting describes an executed event affecting Alephium TokenBridge off-chain guardian exploit. The affected path involved Alephium, Ethereum, BNB Chain. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Alephium, Ethereum, BNB Chain. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $815,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n2 public sources support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "bridge-exploit", "severity": "medium", "chains": [ "Alephium", "Ethereum", "BNB Chain" ], "ecosystems": [ "Alephium", "Ethereum", "BNB Chain" ], "lossUsd": 815000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $815,000。 原始资产与金额说明为：约 81.5 万美元实际套取口径；无抵押映射资产名义量未单列", "tw": "公開損失採用約 $815,000。 原始資產與金額說明為：約 81.5 萬美元實際套取口徑；無抵押映射資產名義量未單列", "en": "Reported loss is recorded at approximately $815,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "PeckShield 月报", "tw": "PeckShield 月報", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2061353830437249033", "type": "research" }, { "label": { "zh": "Cecuro 复盘", "tw": "Cecuro 復盤", "en": "cecuro.ai public source" }, "url": "https://cecuro.ai/blog/may-2026-hack-recap", "type": "research" }, { "label": { "zh": "公开事件分析", "tw": "公開事件分析", "en": "Public incident analysis" }, "url": "https://mp.weixin.qq.com/s/DtNcJYh27TBoDwHaEj2RDw", "type": "analysis" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-003", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-182", "status": "verified", "incidentDate": "2026-05-28", "datePrecision": "day", "title": { "zh": "ONTR 零地址所有权恢复与隐藏余额授予", "tw": "ONTR 零地址所有權恢復與隱藏餘額授予", "en": "ONTR zero-address ownership and hidden-balance exploit" }, "summary": { "zh": "ONTR 合约的 onlyOwner 逻辑允许 owner == address(0)的特殊状态。项目 renounce 后，攻击者仍能重新取得所有权，并通过隐藏余额授予逻辑制造巨额 ONTR 余额；该过程不产生正常 totalSupply 或 mint 日志。 公开损失采用约 $98,200.00。", "tw": "ONTR 合約的 onlyOwner 邏輯允許 owner == address(0)的特殊狀態。專案 renounce 後，攻擊者仍能重新取得所有權，並通過隱藏餘額授予邏輯製造鉅額 ONTR 餘額；該過程不產生正常 totalSupply 或 mint 日誌。 公開損失採用約 $98,200.00。", "en": "ONTR zero-address ownership and hidden-balance exploit was reported on 2026-05-28. Evidence indicates that zero-address ownership and hidden-balance logic enabled unauthorized control. Reported loss is approximately $98,200.00." }, "details": { "zh": "## 事件背景\nONTR 合约的 onlyOwner 逻辑允许 owner == address(0)的特殊状态。项目 renounce 后，攻击者仍能重新取得所有权，并通过隐藏余额授予逻辑制造巨额 ONTR 余额；该过程不产生正常 totalSupply 或 mint 日志。\n\n## 事件经过\n1. 项目所有权此前被 renounce，owner 成为零地址。\n2. 攻击者利用错误 onlyOwner 逻辑重新获得控制权。\n3. 通过隐藏余额授予机制制造大额 ONTR 余额。\n4. 把异常代币注入流动性池。\n5. 从池中换出 WETH 并实现约 98,200 美元获利。\n\n## 资金流向\n异常 ONTR 余额 → 流动性池 → WETH → 攻击者；后续归集、跨链或 CEX 路线待核。\n\n## 金额口径\n公开损失采用约 $98,200.00。 原始资产与金额说明为：慢雾档案记录约 98,200 美元\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n具体 EVM 网络尚未从一手链上证据闭环，报告不得把 EVM 形态或 WETH 自动归为 Ethereum。\n\n## 处置状态\n攻击损失约 98,200 美元；项目修复、冻结、返还与 LP 处置状态未从慢雾网页正文恢复。", "tw": "## 事件背景\nONTR 合約的 onlyOwner 邏輯允許 owner == address(0)的特殊狀態。專案 renounce 後，攻擊者仍能重新取得所有權，並通過隱藏餘額授予邏輯製造鉅額 ONTR 餘額；該過程不產生正常 totalSupply 或 mint 日誌。\n\n## 事件經過\n1. 專案所有權此前被 renounce，owner 成為零地址。\n2. 攻擊者利用錯誤 onlyOwner 邏輯重新獲得控制權。\n3. 通過隱藏餘額授予機制製造大額 ONTR 餘額。\n4. 把異常代幣注入流動性池。\n5. 從池中換出 WETH 並實現約 98,200 美元獲利。\n\n## 資金流向\n異常 ONTR 餘額 → 流動性池 → WETH → 攻擊者；後續歸集、跨鏈或 CEX 路線待核。\n\n## 金額口徑\n公開損失採用約 $98,200.00。 原始資產與金額說明為：慢霧檔案記錄約 98,200 美元\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n具體 EVM 網絡尚未從一手鍊上證據閉環，報告不得把 EVM 形態或 WETH 自動歸為 Ethereum。\n\n## 處置狀態\n攻擊損失約 98,200 美元；專案修復、凍結、返還與 LP 處置狀態未從慢霧網頁正文恢復。", "en": "## Incident background\nOn 2026-05-28, ONTR zero-address ownership and hidden-balance exploit was reported. Available evidence indicates that zero-address ownership and hidden-balance logic enabled unauthorized control. The report assigns evidence level C.\n\n## Incident sequence\nPublic reporting describes an executed event affecting ONTR zero-address ownership and hidden-balance exploit. The affected path involved Other. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Other. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $98,200.00. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n2 public sources support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "access-control", "severity": "low", "chains": [ "Other" ], "ecosystems": [ "Other" ], "lossUsd": 98200, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $98,200.00。 原始资产与金额说明为：慢雾档案记录约 98,200 美元", "tw": "公開損失採用約 $98,200.00。 原始資產與金額說明為：慢霧檔案記錄約 98,200 美元", "en": "Reported loss is recorded at approximately $98,200.00. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "慢雾 Hacked Zone 2026 年 5 月档案", "tw": "慢霧 Hacked Zone 2026 年 5 月檔案", "en": "hacked.slowmist.io public source" }, "url": "https://hacked.slowmist.io/zh/?c=&page=4", "type": "research" }, { "label": { "zh": "TenArmor 监控帖", "tw": "TenArmor 監控帖", "en": "x.com public source" }, "url": "https://x.com/TenArmorAlert/status/2060190914547449936", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-182", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-181", "status": "verified", "incidentDate": "2026-05-28", "datePrecision": "day", "title": { "zh": "Joe Agent 重入攻击", "tw": "Joe Agent 重入攻擊", "en": "Joe Agent reentrancy exploit" }, "summary": { "zh": "_removeLiquidityViaContract 函数在向外发送 BNB 之后才更新内部状态，违反 Checks-Effects-Interactions 顺序。攻击者可在状态尚未扣减时回调同一路径，重复提款。 公开损失采用约 $45,000.00。", "tw": "_removeLiquidityViaContract 函數在向外發送 BNB 之後才更新內部狀態，違反 Checks-Effects-Interactions 順序。攻擊者可在狀態尚未扣減時回調同一路徑，重複提款。 公開損失採用約 $45,000.00。", "en": "Joe Agent reentrancy exploit was reported on 2026-05-28. Evidence indicates that a reentrancy weakness allowed repeated execution. Reported loss is approximately $45,000.00." }, "details": { "zh": "## 事件背景\n_removeLiquidityViaContract 函数在向外发送 BNB 之后才更新内部状态，违反 Checks-Effects-Interactions 顺序。攻击者可在状态尚未扣减时回调同一路径，重复提款。\n\n## 事件经过\n1. 攻击者触发移除流动性/资金释放路径。\n2. 合约先向外发送 BNB。\n3. 攻击者在状态更新前重入目标函数。\n4. 约 25 次循环重复提取。\n5. 最终获得 62.5 BNB 和约 119.6 万 JOE。\n\n## 资金流向\nJoe Agent 合约/流动性路径 → 攻击者重入接收 → BNB 与 JOE 归集；后续 DEX 或 CEX 路径未公开恢复。\n\n## 金额口径\n公开损失采用约 $45,000.00。 原始资产与金额说明为：62.5 BNB 及约 1,196,000 JOE；慢雾归档折合约 45,000 美元\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n慢雾已给出核心函数、顺序缺陷与重入次数，但未从官网正文提供完整攻击地址和 Tx。\n\n## 处置状态\n约 45,000 美元按慢雾口径计损；修复、退款和追回状态待项目后续。", "tw": "## 事件背景\n_removeLiquidityViaContract 函數在向外發送 BNB 之後才更新內部狀態，違反 Checks-Effects-Interactions 順序。攻擊者可在狀態尚未扣減時回調同一路徑，重複提款。\n\n## 事件經過\n1. 攻擊者觸發移除流動性/資金釋放路徑。\n2. 合約先向外發送 BNB。\n3. 攻擊者在狀態更新前重入目標函數。\n4. 約 25 次循環重複提取。\n5. 最終獲得 62.5 BNB 和約 119.6 萬 JOE。\n\n## 資金流向\nJoe Agent 合約/流動性路徑 → 攻擊者重入接收 → BNB 與 JOE 歸集；後續 DEX 或 CEX 路徑未公開恢復。\n\n## 金額口徑\n公開損失採用約 $45,000.00。 原始資產與金額說明為：62.5 BNB 及約 1,196,000 JOE；慢霧歸檔摺合約 45,000 美元\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n慢霧已給出核心函數、順序缺陷與重入次數，但未從官網正文提供完整攻擊地址和 Tx。\n\n## 處置狀態\n約 45,000 美元按慢霧口徑計損；修復、退款和追回狀態待專案後續。", "en": "## Incident background\nOn 2026-05-28, Joe Agent reentrancy exploit was reported. Available evidence indicates that a reentrancy weakness allowed repeated execution. The report assigns evidence level B.\n\n## Incident sequence\nPublic reporting describes an executed event affecting Joe Agent reentrancy exploit. The affected path involved BNB Chain. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved BNB Chain. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $45,000.00. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n2 public sources support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "protocol-exploit", "severity": "low", "chains": [ "BNB Chain" ], "ecosystems": [ "BNB Chain" ], "lossUsd": 45000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $45,000.00。 原始资产与金额说明为：62.5 BNB 及约 1,196,000 JOE；慢雾归档折合约 45,000 美元", "tw": "公開損失採用約 $45,000.00。 原始資產與金額說明為：62.5 BNB 及約 1,196,000 JOE；慢霧歸檔摺合約 45,000 美元", "en": "Reported loss is recorded at approximately $45,000.00. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "慢雾 Hacked Zone 2026 年 5 月档案", "tw": "慢霧 Hacked Zone 2026 年 5 月檔案", "en": "hacked.slowmist.io public source" }, "url": "https://hacked.slowmist.io/zh/?c=&page=4", "type": "research" }, { "label": { "zh": "SlowMist Team 技术披露", "tw": "SlowMist Team 技術披露", "en": "x.com public source" }, "url": "https://x.com/SlowMist_Team/status/2059887450663551352", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-181", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-155", "status": "verified", "incidentDate": "2026-05-28", "datePrecision": "day", "title": { "zh": "JINX-0164 macOS 恶意软件", "tw": "JINX-0164 macOS 惡意軟件", "en": "JINX-0164 macOS malware campaign" }, "summary": { "zh": "攻击者伪装招聘人员/面试机会诱导员工下载 macOS 载荷；属于链下基础设施或终端威胁，不应因影响钱包而猜作某条链的协议漏洞。 现有资料没有提供稳定可核的美元损失值。", "tw": "攻擊者偽裝招聘人員/面試機會誘導員工下載 macOS 載荷；屬於鏈下基礎設施或終端威脅，不應因影響錢包而猜作某條鏈的協議漏洞。 現有資料沒有提供穩定可核的美元損失值。", "en": "JINX-0164 macOS malware campaign was reported on 2026-05-28. Evidence indicates that a macOS information-stealing malware family targeted credentials and wallet material. No stable verified USD loss amount was published." }, "details": { "zh": "## 事件背景\n攻击者伪装招聘人员/面试机会诱导员工下载 macOS 载荷；属于链下基础设施或终端威胁，不应因影响钱包而猜作某条链的协议漏洞。\n\n## 事件经过\n1. 攻击者准备仿冒内容、包、网站或载荷。\n2. 通过对应渠道触达开发者/员工/用户。\n3. 受害者下载、运行、授权或提交秘密后，凭据与会话面临泄露。\n4. 公开材料未逐一证明后续链上盗币。\n5. 防守方披露并给出隔离建议。\n\n## 资金流向\n1. 链下投递基础设施 → 受害终端/浏览器/开发环境 → 潜在钱包或企业凭据。\n2. 无已确认统一链上转移路径。\n\n## 金额口径\n现有资料没有提供可稳定核验的美元损失值。 原始资产与金额说明为：未确认统一链上损失\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n源文件未保存事件级原帖 URL、样本 hash、C2、受害地址或链上 Tx；不得把披露日冒充所有感染发生日，也不得把潜在影响计为已盗金额。\n\n## 处置状态\n作为威胁活动簇保留；目标包括浏览器会话、钱包资料、系统凭据和企业访问权。", "tw": "## 事件背景\n攻擊者偽裝招聘人員/面試機會誘導員工下載 macOS 載荷；屬於鏈下基礎設施或終端威脅，不應因影響錢包而猜作某條鏈的協議漏洞。\n\n## 事件經過\n1. 攻擊者準備仿冒內容、包、網站或載荷。\n2. 通過對應渠道觸達開發者/員工/用戶。\n3. 受害者下載、運行、授權或提交秘密後，憑據與會話面臨洩露。\n4. 公開材料未逐一證明後續鏈上盜幣。\n5. 防守方披露並給出隔離建議。\n\n## 資金流向\n1. 鏈下投遞基礎設施 → 受害終端/瀏覽器/開發環境 → 潛在錢包或企業憑據。\n2. 無已確認統一鏈上轉移路徑。\n\n## 金額口徑\n現有資料沒有提供可穩定核驗的美元損失值。 原始資產與金額說明為：未確認統一鏈上損失\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n源文件未保存事件級原帖 URL、樣本 hash、C2、受害地址或鏈上 Tx；不得把披露日冒充所有感染髮生日，也不得把潛在影響計為已盜金額。\n\n## 處置狀態\n作為威脅活動簇保留；目標包括瀏覽器會話、錢包資料、系統憑據和企業訪問權。", "en": "## Incident background\nOn 2026-05-28, JINX-0164 macOS malware campaign was reported. Available evidence indicates that a macOS information-stealing malware family targeted credentials and wallet material. The report assigns evidence level C.\n\n## Incident sequence\nPublic reporting describes an executed event affecting JINX-0164 macOS malware campaign. The affected path involved Other. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Other. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nAvailable material does not provide a stable verified USD loss amount. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n1 public source support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "supply-chain", "severity": "medium", "chains": [ "Other" ], "ecosystems": [ "Other" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "现有资料没有提供可稳定核验的美元损失值。 原始资产与金额说明为：未确认统一链上损失", "tw": "現有資料沒有提供可穩定核驗的美元損失值。 原始資產與金額說明為：未確認統一鏈上損失", "en": "Available material does not provide a stable verified USD loss amount. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-applicable", "addresses": [], "references": [ { "label": { "zh": "原报告保存的月度发现入口；事件级直接 URL 待补", "tw": "原報告保存的月度發現入口；事件級直接 URL 待補", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2061353830437249033", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-155", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-121", "status": "verified", "incidentDate": "2026-05-28", "datePrecision": "day", "title": { "zh": "DxSale", "tw": "DxSale", "en": "DxSale legacy LP-locker compromise" }, "summary": { "zh": "约 80 个地址组成的链条此前逐步接管旧 locker 所有权；攻击阶段将解锁时间回拨至 1970 年并把费用清零，批量抽走 LP。疑似内部人员仅是线索，未获证实。 公开损失采用约 $7,300,000。", "tw": "約 80 個地址組成的鏈條此前逐步接管舊 locker 所有權；攻擊階段將解鎖時間回撥至 1970 年並把費用清零，批量抽走 LP。疑似內部人員僅是線索，未獲證實。 公開損失採用約 $7,300,000。", "en": "DxSale legacy LP-locker compromise was reported on 2026-05-28. Evidence indicates that legacy administrative authority over the LP-locker path was compromised. Reported loss is approximately $7,300,000." }, "details": { "zh": "## 事件背景\n约 80 个地址组成的链条此前逐步接管旧 locker 所有权；攻击阶段将解锁时间回拨至 1970 年并把费用清零，批量抽走 LP。疑似内部人员仅是线索，未获证实。\n\n## 事件经过\n1. 攻击者长期准备并接管旧 locker 所有权。\n2. 修改约 1,400 个 LP 仓位参数。\n3. 把解锁时间回拨到 1970 年。\n4. 将费用清零。\n5. 批量提走自 2021 年起锁定的 LP。\n6. 资金分拆进入主要钱包和 Binance。\n\n## 资金流向\n1. 约 1,400 个 BNB Chain LP locker → 线索地址 → 两个主要钱包 → 多个 Binance 充值地址。\n2. 是否被冻结未核实。\n\n## 金额口径\n公开损失采用约 $7,300,000。 原始资产与金额说明为：约 730 万美元；涉及约 1,400 个 LP 仓位；线索地址向主钱包转出约 2,958 BNB、当时约 187 万美元\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n不能凭接管历史直接定性内部人员；源文件只保存截断地址，禁止猜补。\n\n## 处置状态\n部分资金进入 CEX；是否冻结、追回与用户赔付未核实。", "tw": "## 事件背景\n約 80 個地址組成的鏈條此前逐步接管舊 locker 所有權；攻擊階段將解鎖時間回撥至 1970 年並把費用清零，批量抽走 LP。疑似內部人員僅是線索，未獲證實。\n\n## 事件經過\n1. 攻擊者長期準備並接管舊 locker 所有權。\n2. 修改約 1,400 個 LP 倉位參數。\n3. 把解鎖時間回撥到 1970 年。\n4. 將費用清零。\n5. 批量提走自 2021 年起鎖定的 LP。\n6. 資金分拆進入主要錢包和 Binance。\n\n## 資金流向\n1. 約 1,400 個 BNB Chain LP locker → 線索地址 → 兩個主要錢包 → 多個 Binance 充值地址。\n2. 是否被凍結未核實。\n\n## 金額口徑\n公開損失採用約 $7,300,000。 原始資產與金額說明為：約 730 萬美元；涉及約 1,400 個 LP 倉位；線索地址向主錢包轉出約 2,958 BNB、當時約 187 萬美元\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n不能憑接管歷史直接定性內部人員；源文件只保存截斷地址，禁止猜補。\n\n## 處置狀態\n部分資金進入 CEX；是否凍結、追回與用戶賠付未核實。", "en": "## Incident background\nOn 2026-05-28, DxSale legacy LP-locker compromise was reported. Available evidence indicates that legacy administrative authority over the LP-locker path was compromised. The report assigns evidence level B.\n\n## Incident sequence\nPublic reporting describes an executed event affecting DxSale legacy LP-locker compromise. The affected path involved BNB Chain. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved BNB Chain. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $7,300,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n2 public sources support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "access-control", "severity": "high", "chains": [ "BNB Chain" ], "ecosystems": [ "BNB Chain" ], "lossUsd": 7300000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $7,300,000。 原始资产与金额说明为：约 730 万美元；涉及约 1,400 个 LP 仓位；线索地址向主钱包转出约 2,958 BNB、当时约 187 万美元", "tw": "公開損失採用約 $7,300,000。 原始資產與金額說明為：約 730 萬美元；涉及約 1,400 個 LP 倉位；線索地址向主錢包轉出約 2,958 BNB、當時約 187 萬美元", "en": "Reported loss is recorded at approximately $7,300,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "PeckShield 报警", "tw": "PeckShield 報警", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2060188553079054351", "type": "research" }, { "label": { "zh": "Halborn 月度复盘", "tw": "Halborn 月度復盤", "en": "halborn.com public source" }, "url": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-may-2026", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-121", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-163", "status": "verified", "incidentDate": "2026-05-27", "datePrecision": "day", "title": { "zh": "AI 聊天推荐/搜索投毒引流挖矿木马", "tw": "AI 聊天推薦/搜索投毒引流挖礦木馬", "en": "AI and search-poisoning mining-malware campaign" }, "summary": { "zh": "通过 SEO 和可能被模型引用的恶意页面让 AI 推荐指向挖矿或恶意软件站点；属于链下基础设施或终端威胁，不应因影响钱包而猜作某条链的协议漏洞。 现有资料没有提供稳定可核的美元损失值。", "tw": "通過 SEO 和可能被模型引用的惡意頁面讓 AI 推薦指向挖礦或惡意軟件站點；屬於鏈下基礎設施或終端威脅，不應因影響錢包而猜作某條鏈的協議漏洞。 現有資料沒有提供穩定可核的美元損失值。", "en": "AI and search-poisoning mining-malware campaign was reported on 2026-05-27. Evidence indicates that search and AI-answer poisoning redirected users to mining malware. No stable verified USD loss amount was published." }, "details": { "zh": "## 事件背景\n通过 SEO 和可能被模型引用的恶意页面让 AI 推荐指向挖矿或恶意软件站点；属于链下基础设施或终端威胁，不应因影响钱包而猜作某条链的协议漏洞。\n\n## 事件经过\n1. 攻击者准备仿冒内容、包、网站或载荷。\n2. 通过对应渠道触达开发者/员工/用户。\n3. 受害者下载、运行、授权或提交秘密后，凭据与会话面临泄露。\n4. 公开材料未逐一证明后续链上盗币。\n5. 防守方披露并给出隔离建议。\n\n## 资金流向\n1. 链下投递基础设施 → 受害终端/浏览器/开发环境 → 潜在钱包或企业凭据。\n2. 无已确认统一链上转移路径。\n\n## 金额口径\n现有资料没有提供可稳定核验的美元损失值。 原始资产与金额说明为：未确认链上盗币金额\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n源文件未保存事件级原帖 URL、样本 hash、C2、受害地址或链上 Tx；不得把披露日冒充所有感染发生日，也不得把潜在影响计为已盗金额。\n\n## 处置状态\n作为威胁活动簇保留；AI 下载链接不能替代官方域名、签名和 hash 核验。", "tw": "## 事件背景\n通過 SEO 和可能被模型引用的惡意頁面讓 AI 推薦指向挖礦或惡意軟件站點；屬於鏈下基礎設施或終端威脅，不應因影響錢包而猜作某條鏈的協議漏洞。\n\n## 事件經過\n1. 攻擊者準備仿冒內容、包、網站或載荷。\n2. 通過對應渠道觸達開發者/員工/用戶。\n3. 受害者下載、運行、授權或提交秘密後，憑據與會話面臨洩露。\n4. 公開材料未逐一證明後續鏈上盜幣。\n5. 防守方披露並給出隔離建議。\n\n## 資金流向\n1. 鏈下投遞基礎設施 → 受害終端/瀏覽器/開發環境 → 潛在錢包或企業憑據。\n2. 無已確認統一鏈上轉移路徑。\n\n## 金額口徑\n現有資料沒有提供可穩定核驗的美元損失值。 原始資產與金額說明為：未確認鏈上盜幣金額\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n源文件未保存事件級原帖 URL、樣本 hash、C2、受害地址或鏈上 Tx；不得把披露日冒充所有感染髮生日，也不得把潛在影響計為已盜金額。\n\n## 處置狀態\n作為威脅活動簇保留；AI 下載鏈接不能替代官方域名、簽名和 hash 核驗。", "en": "## Incident background\nOn 2026-05-27, AI and search-poisoning mining-malware campaign was reported. Available evidence indicates that search and AI-answer poisoning redirected users to mining malware. The report assigns evidence level C.\n\n## Incident sequence\nPublic reporting describes an executed event affecting AI and search-poisoning mining-malware campaign. The affected path involved Other. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Other. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nAvailable material does not provide a stable verified USD loss amount. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n1 public source support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "supply-chain", "severity": "medium", "chains": [ "Other" ], "ecosystems": [ "Other" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "现有资料没有提供可稳定核验的美元损失值。 原始资产与金额说明为：未确认链上盗币金额", "tw": "現有資料沒有提供可穩定核驗的美元損失值。 原始資產與金額說明為：未確認鏈上盜幣金額", "en": "Available material does not provide a stable verified USD loss amount. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-applicable", "addresses": [], "references": [ { "label": { "zh": "原报告保存的月度发现入口；事件级直接 URL 待补", "tw": "原報告保存的月度發現入口；事件級直接 URL 待補", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2061353830437249033", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-163", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-151", "status": "verified", "incidentDate": "2026-05-27", "datePrecision": "day", "title": { "zh": "StakeDAO vsdCRV 异常铸造", "tw": "StakeDAO vsdCRV 異常鑄造", "en": "StakeDAO vsdCRV unauthorized mint" }, "summary": { "zh": "可确认异常铸造、兑换和跨链资金路径；DeFiLlama 将技术归因列为私钥泄露，但哪一个 owner key、权限阈值和具体函数被利用尚无项目完整复盘。 公开损失采用约 $91,170.00。", "tw": "可確認異常鑄造、兌換和跨鏈資金路徑；DeFiLlama 將技術歸因列為私鑰洩露，但哪一個 owner key、權限閾值和具體函數被利用尚無專案完整復盤。 公開損失採用約 $91,170.00。", "en": "StakeDAO vsdCRV unauthorized mint was reported on 2026-05-27. Evidence indicates that unauthorized authority was used to mint vsdCRV. Reported loss is approximately $91,170.00." }, "details": { "zh": "## 事件背景\n可确认异常铸造、兑换和跨链资金路径；DeFiLlama 将技术归因列为私钥泄露，但哪一个 owner key、权限阈值和具体函数被利用尚无项目完整复盘。\n\n## 事件经过\n1. Arbitrum 出现约 5.4 万亿 vsdCRV 铸造。\n2. 执行者兑换约 43.781 ETH。\n3. 资产桥接到 Ethereum 截断地址。\n4. 事件是否计入月报 40 起取决于名义铸造与实现损失口径。\n\n## 资金流向\n1. Arbitrum 异常铸造 → 43.781 ETH → 桥接 → Ethereum 截断出口地址。\n\n## 金额口径\n公开损失采用约 $91,170.00。 原始资产与金额说明为：Arbitrum 铸造约 5.4 万亿 vsdCRV；兑换约 43.781 ETH、当时约 9.117 万美元并桥接 Ethereum\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n名义铸造量与实现兑换额不同；私钥泄露只到结构化数据库归因层，不能继续推断内部人、具体 owner 或签名阈值。\n\n## 处置状态\n按已实现约 43.781 ETH 的攻击资金流纳入命名新攻击；不把约 5.4 万亿 vsdCRV 名义铸币量当作真实损失。", "tw": "## 事件背景\n可確認異常鑄造、兌換和跨鏈資金路徑；DeFiLlama 將技術歸因列為私鑰洩露，但哪一個 owner key、權限閾值和具體函數被利用尚無專案完整復盤。\n\n## 事件經過\n1. Arbitrum 出現約 5.4 萬億 vsdCRV 鑄造。\n2. 執行者兌換約 43.781 ETH。\n3. 資產橋接到 Ethereum 截斷地址。\n4. 事件是否計入月報 40 起取決於名義鑄造與實現損失口徑。\n\n## 資金流向\n1. Arbitrum 異常鑄造 → 43.781 ETH → 橋接 → Ethereum 截斷出口地址。\n\n## 金額口徑\n公開損失採用約 $91,170.00。 原始資產與金額說明為：Arbitrum 鑄造約 5.4 萬億 vsdCRV；兌換約 43.781 ETH、當時約 9.117 萬美元並橋接 Ethereum\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n名義鑄造量與實現兌換額不同；私鑰洩露只到結構化數據庫歸因層，不能繼續推斷內部人、具體 owner 或簽名閾值。\n\n## 處置狀態\n按已實現約 43.781 ETH 的攻擊資金流納入命名新攻擊；不把約 5.4 萬億 vsdCRV 名義鑄幣量當作真實損失。", "en": "## Incident background\nOn 2026-05-27, StakeDAO vsdCRV unauthorized mint was reported. Available evidence indicates that unauthorized authority was used to mint vsdCRV. The report assigns evidence level B.\n\n## Incident sequence\nPublic reporting describes an executed event affecting StakeDAO vsdCRV unauthorized mint. The affected path involved Arbitrum, Ethereum. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Arbitrum, Ethereum. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $91,170.00. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n2 public sources support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "access-control", "severity": "low", "chains": [ "Arbitrum", "Ethereum" ], "ecosystems": [ "Arbitrum", "Ethereum" ], "lossUsd": 91170, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $91,170.00。 原始资产与金额说明为：Arbitrum 铸造约 5.4 万亿 vsdCRV；兑换约 43.781 ETH、当时约 9.117 万美元并桥接 Ethereum", "tw": "公開損失採用約 $91,170.00。 原始資產與金額說明為：Arbitrum 鑄造約 5.4 萬億 vsdCRV；兌換約 43.781 ETH、當時約 9.117 萬美元並橋接 Ethereum", "en": "Reported loss is recorded at approximately $91,170.00. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "PeckShield 原帖", "tw": "PeckShield 原帖", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2059578749352640679", "type": "research" }, { "label": { "zh": "DeFiLlama Hacks 数据库", "tw": "DeFiLlama Hacks 數據庫", "en": "defillama.com public source" }, "url": "https://defillama.com/hacks", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-151", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-136", "status": "verified", "incidentDate": "2026-05-27", "datePrecision": "day", "title": { "zh": "SKP Token", "tw": "SKP Token", "en": "SKP Token liquidity-pool exploit" }, "summary": { "zh": "攻击者操纵 LP 储备并用闪电贷放大交易规模，造成价格或兑换比例失衡。 公开损失采用约 $213,000。", "tw": "攻擊者操縱 LP 儲備並用閃電貸放大交易規模，造成價格或兌換比例失衡。 公開損失採用約 $213,000。", "en": "SKP Token liquidity-pool exploit was reported on 2026-05-27. Evidence indicates that an abnormal liquidity-pool operation affected SKP Token. Reported loss is approximately $213,000." }, "details": { "zh": "## 事件背景\n攻击者操纵 LP 储备并用闪电贷放大交易规模，造成价格或兑换比例失衡。\n\n## 事件经过\n1. 攻击者取得闪电贷流动性。\n2. 对 SKP 池执行储备操纵。\n3. 在失衡价格下兑换资产。\n4. 偿还闪电贷。\n5. 保留差额。\n\n## 资金流向\n1. BNB Chain 闪电贷来源 → SKP 池 → 攻击者获利。\n2. 后续归集待核。\n\n## 金额口径\n公开损失采用约 $213,000。 原始资产与金额说明为：约 21.3 万美元\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n源文件未保存池、Token 合约、攻击交易和逐笔利润；21.3 万美元为汇总损失。\n\n## 处置状态\n未见追回信息。", "tw": "## 事件背景\n攻擊者操縱 LP 儲備並用閃電貸放大交易規模，造成價格或兌換比例失衡。\n\n## 事件經過\n1. 攻擊者取得閃電貸流動性。\n2. 對 SKP 池執行儲備操縱。\n3. 在失衡價格下兌換資產。\n4. 償還閃電貸。\n5. 保留差額。\n\n## 資金流向\n1. BNB Chain 閃電貸來源 → SKP 池 → 攻擊者獲利。\n2. 後續歸集待核。\n\n## 金額口徑\n公開損失採用約 $213,000。 原始資產與金額說明為：約 21.3 萬美元\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n源文件未保存池、Token 合約、攻擊交易和逐筆利潤；21.3 萬美元為彙總損失。\n\n## 處置狀態\n未見追回資訊。", "en": "## Incident background\nOn 2026-05-27, SKP Token liquidity-pool exploit was reported. Available evidence indicates that an abnormal liquidity-pool operation affected SKP Token. The report assigns evidence level B.\n\n## Incident sequence\nPublic reporting describes an executed event affecting SKP Token liquidity-pool exploit. The affected path involved BNB Chain. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved BNB Chain. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $213,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n2 public sources support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "protocol-exploit", "severity": "medium", "chains": [ "BNB Chain" ], "ecosystems": [ "BNB Chain" ], "lossUsd": 213000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $213,000。 原始资产与金额说明为：约 21.3 万美元", "tw": "公開損失採用約 $213,000。 原始資產與金額說明為：約 21.3 萬美元", "en": "Reported loss is recorded at approximately $213,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "PeckShield 月报", "tw": "PeckShield 月報", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2061353830437249033", "type": "research" }, { "label": { "zh": "Cecuro 复盘", "tw": "Cecuro 復盤", "en": "cecuro.ai public source" }, "url": "https://cecuro.ai/blog/may-2026-hack-recap", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-136", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-119", "status": "verified", "incidentDate": "2026-05-27", "datePrecision": "day", "title": { "zh": "SUPERFORTUNE AI", "tw": "SUPERFORTUNE AI", "en": "SUPERFORTUNE AI multisig transaction-target substitution" }, "summary": { "zh": "团队多签构建空投分配交易时，领取合约目标地址被替换成攻击者控制的相似地址；现有材料更支持签名、交易构建工具或人工核验流程失陷，不能写成已确认合约漏洞。 公开损失采用约 $15,180,000。", "tw": "團隊多籤構建空投分配交易時，領取合約目標地址被替換成攻擊者控制的相似地址；現有材料更支持簽名、交易構建工具或人工核驗流程失陷，不能寫成已確認合約漏洞。 公開損失採用約 $15,180,000。", "en": "SUPERFORTUNE AI multisig transaction-target substitution was reported on 2026-05-27. Evidence indicates that a multisig transaction target was replaced with a lookalike recipient during transaction construction. Reported loss is approximately $15,180,000." }, "details": { "zh": "## 事件背景\n团队多签构建空投分配交易时，领取合约目标地址被替换成攻击者控制的相似地址；现有材料更支持签名、交易构建工具或人工核验流程失陷，不能写成已确认合约漏洞。\n\n## 事件经过\n1. 团队准备把 GUA 空投资产发送至领取合约。\n2. 目标地址在签名前后被相似地址替换。\n3. 多签完成了指向错误目标的交易。\n4. 攻击者取得代币。\n5. 代币价格下跌限制其可实现收益。\n\n## 资金流向\n1. 团队分配钱包 → 相似目标地址。\n2. 后续具体兑换、归集、跨链或 CEX 路线未从源文件恢复。\n\n## 金额口径\n公开损失采用约 $15,180,000。 原始资产与金额说明为：约 1,518 万美元为 GUA 转移时名义价值；非已套现现金；代币随后下跌约 60%，实际变现仅为其中一部分\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n1,518 万美元是转移时名义估值，不等于攻击者现金获利；具体网络、完整地址、TxID 和套现金额均未公开恢复。\n\n## 处置状态\n未见全额返还；根因仍聚焦于多签操作流程、签名界面或交易构建工具链。", "tw": "## 事件背景\n團隊多籤構建空投分配交易時，領取合約目標地址被替換成攻擊者控制的相似地址；現有材料更支持簽名、交易構建工具或人工核驗流程失陷，不能寫成已確認合約漏洞。\n\n## 事件經過\n1. 團隊準備把 GUA 空投資產發送至領取合約。\n2. 目標地址在簽名前後被相似地址替換。\n3. 多簽完成了指向錯誤目標的交易。\n4. 攻擊者取得代幣。\n5. 代幣價格下跌限制其可實現收益。\n\n## 資金流向\n1. 團隊分配錢包 → 相似目標地址。\n2. 後續具體兌換、歸集、跨鏈或 CEX 路線未從源文件恢復。\n\n## 金額口徑\n公開損失採用約 $15,180,000。 原始資產與金額說明為：約 1,518 萬美元為 GUA 轉移時名義價值；非已套現現金；代幣隨後下跌約 60%，實際變現僅為其中一部分\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n1,518 萬美元是轉移時名義估值，不等於攻擊者現金獲利；具體網絡、完整地址、TxID 和套現金額均未公開恢復。\n\n## 處置狀態\n未見全額返還；根因仍聚焦於多籤操作流程、簽名界面或交易構建工具鏈。", "en": "## Incident background\nOn 2026-05-27, SUPERFORTUNE AI multisig transaction-target substitution was reported. Available evidence indicates that a multisig transaction target was replaced with a lookalike recipient during transaction construction. The report assigns evidence level B.\n\n## Incident sequence\nPublic reporting describes an executed event affecting SUPERFORTUNE AI multisig transaction-target substitution. The affected path involved Other. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Other. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $15,180,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n2 public sources support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "access-control", "severity": "critical", "chains": [ "Other" ], "ecosystems": [ "Other" ], "lossUsd": 15180000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $15,180,000。 原始资产与金额说明为：约 1,518 万美元为 GUA 转移时名义价值；非已套现现金；代币随后下跌约 60%，实际变现仅为其中一部分", "tw": "公開損失採用約 $15,180,000。 原始資產與金額說明為：約 1,518 萬美元為 GUA 轉移時名義價值；非已套現現金；代幣隨後下跌約 60%，實際變現僅為其中一部分", "en": "Reported loss is recorded at approximately $15,180,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "PeckShield 5 月月报", "tw": "PeckShield 5 月月報", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2061353830437249033", "type": "research" }, { "label": { "zh": "Cecuro 5 月复盘", "tw": "Cecuro 5 月復盤", "en": "cecuro.ai public source" }, "url": "https://cecuro.ai/blog/may-2026-hack-recap", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-119", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-006", "status": "verified", "incidentDate": "2026-05-27", "datePrecision": "day", "title": { "zh": "Ill Bloom 钱包弱随机数漏洞", "tw": "Ill Bloom 錢包弱隨機數漏洞", "en": "Ill Bloom weak-randomness wallet vulnerability" }, "summary": { "zh": "部分钱包助记词生成使用弱随机源，攻击者可枚举私钥，公开披露多链损失超过 500 万美元。", "tw": "部分錢包助記詞生成使用弱隨機源，攻擊者可枚舉私鑰，公開披露多鏈損失超過 500 萬美元。", "en": "Weak randomness in wallet seed generation enabled private-key enumeration, with more than $5 million in reported multi-chain losses." }, "details": { "zh": "## 事件背景\n部分软件钱包使用弱伪随机数生成助记词，显著压缩真实密钥空间。公开资料显示，受影响钱包最早可追溯至 2018 年，涉及 Bitcoin、Ethereum、TRON 和 Solana 等网络。\n\n## 事件经过\n攻击者利用可预测的随机数枚举候选助记词和私钥，识别仍有余额的钱包后跨链转走资产。问题源于钱包生成密钥时的随机性不足，不是相关公链共识机制失陷。\n\n## 资金流向\n资产从受影响钱包转向攻击者控制地址。公开资料未提供覆盖全部受害钱包和后续流向的完整地址与交易清单。\n\n## 金额口径\n公开披露的多链损失超过 500 万美元。\n\n## 地址与交易\n公开资料未披露可覆盖全部受影响钱包的完整地址和交易列表。\n\n## 证据边界\n现有证据支持弱随机数、私钥可枚举和多链盗币风险；受影响钱包总数、完整地址集合及最终净损失仍可能随调查更新。\n\n## 处置状态\n受影响用户需要把资产迁移至由可靠随机源新建的钱包。公开资料尚未确认被盗资产已经返还。", "tw": "## 事件背景\n部分軟件錢包使用弱偽隨機數生成助記詞，顯著壓縮真實密鑰空間。公開資料顯示，受影響錢包最早可追溯至 2018 年，涉及 Bitcoin、Ethereum、TRON 和 Solana 等網絡。\n\n## 事件經過\n攻擊者利用可預測的隨機數枚舉候選助記詞和私鑰，識別仍有餘額的錢包後跨鏈轉走資產。問題源於錢包生成密鑰時的隨機性不足，不是相關公鏈共識機制失陷。\n\n## 資金流向\n資產從受影響錢包轉向攻擊者控制地址。公開資料未提供覆蓋全部受害錢包和後續流向的完整地址與交易清單。\n\n## 金額口徑\n公開披露的多鏈損失超過 500 萬美元。\n\n## 地址與交易\n公開資料未披露可覆蓋全部受影響錢包的完整地址和交易列表。\n\n## 證據邊界\n現有證據支持弱隨機數、私鑰可枚舉和多鏈盜幣風險；受影響錢包總數、完整地址集合及最終淨損失仍可能隨調查更新。\n\n## 處置狀態\n受影響用戶需要把資產遷移至由可靠隨機源新建的錢包。公開資料尚未確認被盜資產已經返還。", "en": "## Incident background\nSome software wallets generated seed phrases with weak pseudo-randomness, sharply reducing the effective key space. Public reporting traces affected wallets back to 2018 across Bitcoin, Ethereum, TRON, and Solana.\n\n## Incident sequence\nAttackers enumerated candidate seed phrases and private keys from the predictable random source, identified wallets with balances, and moved assets across chains. The failure was in wallet key generation, not in the consensus systems of the affected blockchains.\n\n## Fund flow\nAssets moved from affected wallets to attacker-controlled addresses. Public sources do not provide a complete address and transaction set covering every victim wallet and downstream route.\n\n## Amount basis\nReported multi-chain losses exceed $5 million.\n\n## Addresses and transactions\nPublic sources do not disclose a complete list covering all affected wallets and transactions.\n\n## Evidence boundary\nAvailable evidence supports weak randomness, enumerable private keys, and multi-chain theft risk. The total number of affected wallets, complete address set, and final net loss may change as investigations continue.\n\n## Current status\nAffected users need to move assets to wallets created with a trustworthy random source. Public reporting has not confirmed that stolen assets were returned." }, "category": "wallet-vulnerability", "severity": "critical", "ecosystems": [ "Bitcoin", "Ethereum", "TRON", "Solana" ], "chains": [ "Bitcoin", "Ethereum", "TRON", "Solana" ], "lossUsd": 5000000, "frozenUsd": 0, "recoveredUsd": 0, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "第二金融网报道", "tw": "第二金融網報道", "en": "Second Finance media report" }, "url": "http://two.xa1288.com/chuangtou/730262.html", "type": "media" } ], "sourceUrl": "press-defi-ill-bloom-wallet-vulnerability", "sourceLabel": "德尔泰公开事件分析" }, { "id": "DCI-2026-175", "status": "verified", "incidentDate": "2026-05-25", "datePrecision": "day", "title": { "zh": "Bitmor DCA 合约授权盗币", "tw": "Bitmor DCA 合約授權盜幣", "en": "Bitmor DCA approval theft" }, "summary": { "zh": "Bitmor DCA 合约存在访问控制缺陷，攻击者可利用用户仍然有效的 token approval 从钱包划转资产。风险并不因前端下线自动消失，授权未撤销的交互用户仍可能暴露。 公开损失采用约 $10,000.00。", "tw": "Bitmor DCA 合約存在訪問控制缺陷，攻擊者可利用用戶仍然有效的 token approval 從錢包劃轉資產。風險並不因前端下線自動消失，授權未撤銷的交互用戶仍可能暴露。 公開損失採用約 $10,000.00。", "en": "Bitmor DCA approval theft was reported on 2026-05-25. Evidence indicates that a malicious approval was used to steal assets from a Bitmor DCA user. Reported loss is approximately $10,000.00." }, "details": { "zh": "## 事件背景\nBitmor DCA 合约存在访问控制缺陷，攻击者可利用用户仍然有效的 token approval 从钱包划转资产。风险并不因前端下线自动消失，授权未撤销的交互用户仍可能暴露。\n\n## 事件经过\n1. 用户此前向 Bitmor DCA 合约授予 token 支出权限。\n2. 攻击者利用 DCA 合约的访问控制缺陷调用资产转移路径。\n3. 有效 approval 使资金可直接从受影响钱包离开。\n4. 安全服务发布受影响检查与撤销授权提示。\n\n## 资金流向\n受影响用户钱包 → 漏洞 DCA 合约授权路径 → 攻击者接收地址；完整地址和交易本轮未恢复。\n\n## 金额口径\n公开损失采用约 $10,000.00。 原始资产与金额说明为：DeFiLlama 记录 10,000 美元；Revoke.cash 风险材料给出约 6,000—10,000 美元范围。\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n不能把所有与 Bitmor 交互过的钱包都写成已受害，只能称存在授权暴露。\n\n## 处置状态\n用户需撤销旧 approval；实际总受害人数、最终损失和项目补偿待核。", "tw": "## 事件背景\nBitmor DCA 合約存在訪問控制缺陷，攻擊者可利用用戶仍然有效的 token approval 從錢包劃轉資產。風險並不因前端下線自動消失，授權未撤銷的交互用戶仍可能暴露。\n\n## 事件經過\n1. 用戶此前向 Bitmor DCA 合約授予 token 支出權限。\n2. 攻擊者利用 DCA 合約的訪問控制缺陷調用資產轉移路徑。\n3. 有效 approval 使資金可直接從受影響錢包離開。\n4. 安全服務發布受影響檢查與撤銷授權提示。\n\n## 資金流向\n受影響用戶錢包 → 漏洞 DCA 合約授權路徑 → 攻擊者接收地址；完整地址和交易本輪未恢復。\n\n## 金額口徑\n公開損失採用約 $10,000.00。 原始資產與金額說明為：DeFiLlama 記錄 10,000 美元；Revoke.cash 風險材料給出約 6,000—10,000 美元範圍。\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n不能把所有與 Bitmor 交互過的錢包都寫成已受害，只能稱存在授權暴露。\n\n## 處置狀態\n用戶需撤銷舊 approval；實際總受害人數、最終損失和專案補償待核。", "en": "## Incident background\nOn 2026-05-25, Bitmor DCA approval theft was reported. Available evidence indicates that a malicious approval was used to steal assets from a Bitmor DCA user. The report assigns evidence level C.\n\n## Incident sequence\nPublic reporting describes an executed event affecting Bitmor DCA approval theft. The affected path involved Base. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Base. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $10,000.00. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n2 public sources support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "phishing-approval", "severity": "low", "chains": [ "Base" ], "ecosystems": [ "Base" ], "lossUsd": 10000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $10,000.00。 原始资产与金额说明为：DeFiLlama 记录 10,000 美元；Revoke.cash 风险材料给出约 6,000—10,000 美元范围。", "tw": "公開損失採用約 $10,000.00。 原始資產與金額說明為：DeFiLlama 記錄 10,000 美元；Revoke.cash 風險材料給出約 6,000—10,000 美元範圍。", "en": "Reported loss is recorded at approximately $10,000.00. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "Revoke.cash Bitmor 事件页", "tw": "Revoke.cash Bitmor 事件頁", "en": "revoke.cash public source" }, "url": "https://revoke.cash/exploits/bitmor", "type": "research" }, { "label": { "zh": "DeFiLlama Hacks 数据库", "tw": "DeFiLlama Hacks 數據庫", "en": "defillama.com public source" }, "url": "https://defillama.com/hacks", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-175", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-156", "status": "verified", "incidentDate": "2026-05-25", "datePrecision": "day", "title": { "zh": "Lazarus RemotePE 内存型 RAT", "tw": "Lazarus RemotePE 內存型 RAT", "en": "Lazarus RemotePE in-memory RAT campaign" }, "summary": { "zh": "使用仅驻留内存或远程加载方式降低磁盘检测概率；属于链下基础设施或终端威胁，不应因影响钱包而猜作某条链的协议漏洞。 现有资料没有提供稳定可核的美元损失值。", "tw": "使用僅駐留內存或遠程加載方式降低磁盤檢測概率；屬於鏈下基礎設施或終端威脅，不應因影響錢包而猜作某條鏈的協議漏洞。 現有資料沒有提供穩定可核的美元損失值。", "en": "Lazarus RemotePE in-memory RAT campaign was reported on 2026-05-25. Evidence indicates that Lazarus-linked RemotePE malware executed an in-memory remote-access payload. No stable verified USD loss amount was published." }, "details": { "zh": "## 事件背景\n使用仅驻留内存或远程加载方式降低磁盘检测概率；属于链下基础设施或终端威胁，不应因影响钱包而猜作某条链的协议漏洞。\n\n## 事件经过\n1. 攻击者准备仿冒内容、包、网站或载荷。\n2. 通过对应渠道触达开发者/员工/用户。\n3. 受害者下载、运行、授权或提交秘密后，凭据与会话面临泄露。\n4. 公开材料未逐一证明后续链上盗币。\n5. 防守方披露并给出隔离建议。\n\n## 资金流向\n1. 链下投递基础设施 → 受害终端/浏览器/开发环境 → 潜在钱包或企业凭据。\n2. 无已确认统一链上转移路径。\n\n## 金额口径\n现有资料没有提供可稳定核验的美元损失值。 原始资产与金额说明为：未确认本月链上损失\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n源文件未保存事件级原帖 URL、样本 hash、C2、受害地址或链上 Tx；不得把披露日冒充所有感染发生日，也不得把潜在影响计为已盗金额。\n\n## 处置状态\n作为威胁活动簇保留；研究报告发布日期不是所有受害事件发生时间。", "tw": "## 事件背景\n使用僅駐留內存或遠程加載方式降低磁盤檢測概率；屬於鏈下基礎設施或終端威脅，不應因影響錢包而猜作某條鏈的協議漏洞。\n\n## 事件經過\n1. 攻擊者準備仿冒內容、包、網站或載荷。\n2. 通過對應渠道觸達開發者/員工/用戶。\n3. 受害者下載、運行、授權或提交秘密後，憑據與會話面臨洩露。\n4. 公開材料未逐一證明後續鏈上盜幣。\n5. 防守方披露並給出隔離建議。\n\n## 資金流向\n1. 鏈下投遞基礎設施 → 受害終端/瀏覽器/開發環境 → 潛在錢包或企業憑據。\n2. 無已確認統一鏈上轉移路徑。\n\n## 金額口徑\n現有資料沒有提供可穩定核驗的美元損失值。 原始資產與金額說明為：未確認本月鏈上損失\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n源文件未保存事件級原帖 URL、樣本 hash、C2、受害地址或鏈上 Tx；不得把披露日冒充所有感染髮生日，也不得把潛在影響計為已盜金額。\n\n## 處置狀態\n作為威脅活動簇保留；研究報告發布日期不是所有受害事件發生時間。", "en": "## Incident background\nOn 2026-05-25, Lazarus RemotePE in-memory RAT campaign was reported. Available evidence indicates that Lazarus-linked RemotePE malware executed an in-memory remote-access payload. The report assigns evidence level C.\n\n## Incident sequence\nPublic reporting describes an executed event affecting Lazarus RemotePE in-memory RAT campaign. The affected path involved Other. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Other. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nAvailable material does not provide a stable verified USD loss amount. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n1 public source support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "supply-chain", "severity": "medium", "chains": [ "Other" ], "ecosystems": [ "Other" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "现有资料没有提供可稳定核验的美元损失值。 原始资产与金额说明为：未确认本月链上损失", "tw": "現有資料沒有提供可穩定核驗的美元損失值。 原始資產與金額說明為：未確認本月鏈上損失", "en": "Available material does not provide a stable verified USD loss amount. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-applicable", "addresses": [], "references": [ { "label": { "zh": "原报告保存的月度发现入口；事件级直接 URL 待补", "tw": "原報告保存的月度發現入口；事件級直接 URL 待補", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2061353830437249033", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-156", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-150", "status": "verified", "incidentDate": "2026-05-25", "datePrecision": "day", "title": { "zh": "New Market Trading", "tw": "New Market Trading", "en": "New Market Trading security incident" }, "summary": { "zh": "现有公开证据仅为月度追踪清单；受影响合约、链、攻击地址和资金流均未恢复。不得猜函数名、攻击方式、私钥归因或内部人员。 公开损失采用约 $3,980,000。", "tw": "現有公開證據僅為月度追蹤清單；受影響合約、鏈、攻擊地址和資金流均未恢復。不得猜函數名、攻擊方式、私鑰歸因或內部人員。 公開損失採用約 $3,980,000。", "en": "New Market Trading security incident was reported on 2026-05-25. Evidence indicates that an executed trading-platform incident moved assets without authorization. Reported loss is approximately $3,980,000." }, "details": { "zh": "## 事件背景\n现有公开证据仅为月度追踪清单；受影响合约、链、攻击地址和资金流均未恢复。不得猜函数名、攻击方式、私钥归因或内部人员。\n\n## 事件经过\n1. 追踪清单记录项目名、日期和金额。\n2. 本轮未恢复项目官方或安全机构事件原帖。\n3. 攻击准备、触发、资产离开与处置步骤均保持待核。\n4. 后续需用项目身份、链和交易逐项闭环。\n\n## 资金流向\n1. 受影响地址/合约 → 初始接收 → 兑换/归集/跨链/混币/CEX：各段均未公开恢复。\n\n## 金额口径\n公开损失采用约 $3,980,000。 原始资产与金额说明为：约 398 万美元\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n证据等级 C 按用户要求保留；只有汇总清单，缺少完整地址、TxID、具体链与技术复盘。不能把缺口写成否定事件，也不能填造细节。\n\n## 处置状态\n调查/补证中；重点待核；不与 TrustedVolumes 等关联推断", "tw": "## 事件背景\n現有公開證據僅為月度追蹤清單；受影響合約、鏈、攻擊地址和資金流均未恢復。不得猜函數名、攻擊方式、私鑰歸因或內部人員。\n\n## 事件經過\n1. 追蹤清單記錄專案名、日期和金額。\n2. 本輪未恢復專案官方或安全機構事件原帖。\n3. 攻擊準備、觸發、資產離開與處置步驟均保持待核。\n4. 後續需用專案身份、鏈和交易逐項閉環。\n\n## 資金流向\n1. 受影響地址/合約 → 初始接收 → 兌換/歸集/跨鏈/混幣/CEX：各段均未公開恢復。\n\n## 金額口徑\n公開損失採用約 $3,980,000。 原始資產與金額說明為：約 398 萬美元\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n證據等級 C 按用戶要求保留；只有彙總清單，缺少完整地址、TxID、具體鏈與技術復盤。不能把缺口寫成否定事件，也不能填造細節。\n\n## 處置狀態\n調查/補證中；重點待核；不與 TrustedVolumes 等關聯推斷", "en": "## Incident background\nOn 2026-05-25, New Market Trading security incident was reported. Available evidence indicates that an executed trading-platform incident moved assets without authorization. The report assigns evidence level C.\n\n## Incident sequence\nPublic reporting describes an executed event affecting New Market Trading security incident. The affected path involved Other. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Other. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $3,980,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n1 public source support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "protocol-exploit", "severity": "high", "chains": [ "Other" ], "ecosystems": [ "Other" ], "lossUsd": 3980000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $3,980,000。 原始资产与金额说明为：约 398 万美元", "tw": "公開損失採用約 $3,980,000。 原始資產與金額說明為：約 398 萬美元", "en": "Reported loss is recorded at approximately $3,980,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "Nathan 5 月 31 日起事件追踪清单", "tw": "Nathan 5 月 31 日起事件追蹤清單", "en": "x.com public source" }, "url": "https://x.com/0xxNathan/status/2061459771400827312", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-150", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-135", "status": "verified", "incidentDate": "2026-05-25", "datePrecision": "day", "title": { "zh": "WUSD/GLOVE", "tw": "WUSD/GLOVE", "en": "WUSD / GLOVE exploit" }, "summary": { "zh": "源文件未恢复具体漏洞或权限失陷原因；仅能确认事件与资金转换、进入 Railgun 的路径。 公开损失采用约 $207,000。", "tw": "源文件未恢復具體漏洞或權限失陷原因；僅能確認事件與資金轉換、進入 Railgun 的路徑。 公開損失採用約 $207,000。", "en": "WUSD / GLOVE exploit was reported on 2026-05-25. Evidence indicates that a smart-contract weakness affected WUSD / GLOVE liquidity. Reported loss is approximately $207,000." }, "details": { "zh": "## 事件背景\n源文件未恢复具体漏洞或权限失陷原因；仅能确认事件与资金转换、进入 Railgun 的路径。\n\n## 事件经过\n1. 事件造成约 20.7 万美元资产流失。\n2. 攻击者把赃款兑换为约 98 ETH。\n3. 随后存入 Railgun。\n4. 根因和初始执行过程待技术复盘补齐。\n\n## 资金流向\n1. Ethereum 受影响资产 → 攻击者 → 约 98 ETH → Railgun。\n\n## 金额口径\n公开损失采用约 $207,000。 原始资产与金额说明为：约 20.7 万美元；后兑换为约 98 ETH\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n不能把 Railgun 协议本身写成攻击方；完整地址和 Tx 未公开恢复。\n\n## 处置状态\n资金进入隐私协议；未见追回。", "tw": "## 事件背景\n源文件未恢復具體漏洞或權限失陷原因；僅能確認事件與資金轉換、進入 Railgun 的路徑。\n\n## 事件經過\n1. 事件造成約 20.7 萬美元資產流失。\n2. 攻擊者把贓款兌換為約 98 ETH。\n3. 隨後存入 Railgun。\n4. 根因和初始執行過程待技術復盤補齊。\n\n## 資金流向\n1. Ethereum 受影響資產 → 攻擊者 → 約 98 ETH → Railgun。\n\n## 金額口徑\n公開損失採用約 $207,000。 原始資產與金額說明為：約 20.7 萬美元；後兌換為約 98 ETH\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n不能把 Railgun 協議本身寫成攻擊方；完整地址和 Tx 未公開恢復。\n\n## 處置狀態\n資金進入隱私協議；未見追回。", "en": "## Incident background\nOn 2026-05-25, WUSD / GLOVE exploit was reported. Available evidence indicates that a smart-contract weakness affected WUSD / GLOVE liquidity. The report assigns evidence level C.\n\n## Incident sequence\nPublic reporting describes an executed event affecting WUSD / GLOVE exploit. The affected path involved Ethereum. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Ethereum. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $207,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n1 public source support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "protocol-exploit", "severity": "medium", "chains": [ "Ethereum" ], "ecosystems": [ "Ethereum" ], "lossUsd": 207000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $207,000。 原始资产与金额说明为：约 20.7 万美元；后兑换为约 98 ETH", "tw": "公開損失採用約 $207,000。 原始資產與金額說明為：約 20.7 萬美元；後兌換為約 98 ETH", "en": "Reported loss is recorded at approximately $207,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "PeckShield 报警", "tw": "PeckShield 報警", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2058865446984802630", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-135", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-134", "status": "verified", "incidentDate": "2026-05-25", "datePrecision": "day", "title": { "zh": "Fake Uniswap / Google Ads 钓鱼站", "tw": "Fake Uniswap / Google Ads 釣魚站", "en": "Fake Uniswap Google Ads phishing campaign" }, "summary": { "zh": "攻击者通过 Google Ads 投放假 Uniswap 站点，诱导用户连接钱包并签署恶意授权；不是 Uniswap 官方前端或合约被攻破。 公开损失采用约 $400,000。", "tw": "攻擊者通過 Google Ads 投放假 Uniswap 站點，誘導用戶連接錢包並簽署惡意授權；不是 Uniswap 官方前端或合約被攻破。 公開損失採用約 $400,000。", "en": "Fake Uniswap Google Ads phishing campaign was reported on 2026-05-25. Evidence indicates that a paid-search advertisement led users to a fake Uniswap phishing page. Reported loss is approximately $400,000." }, "details": { "zh": "## 事件背景\n攻击者通过 Google Ads 投放假 Uniswap 站点，诱导用户连接钱包并签署恶意授权；不是 Uniswap 官方前端或合约被攻破。\n\n## 事件经过\n1. 攻击者购买搜索广告。\n2. 仿冒站模仿 Uniswap 界面。\n3. 用户从广告进入并连接钱包。\n4. 恶意签名赋予资产转移权限。\n5. 多个钱包资产被转走。\n\n## 资金流向\n1. 受害钱包 → 恶意授权/Permit 执行者 → 钓鱼收款地址。\n2. 具体链和后续洗钱路径未恢复。\n\n## 金额口径\n公开损失采用约 $400,000。 原始资产与金额说明为：多个钱包合计约 40 万美元\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n披露跨两天，具体受害交易时间、链、地址与 Tx 均未保存；不能据品牌名推断只发生在 Ethereum。\n\n## 处置状态\n合计约 40 万美元损失；未见冻结或返还汇总。", "tw": "## 事件背景\n攻擊者通過 Google Ads 投放假 Uniswap 站點，誘導用戶連接錢包並簽署惡意授權；不是 Uniswap 官方前端或合約被攻破。\n\n## 事件經過\n1. 攻擊者購買搜索廣告。\n2. 仿冒站模仿 Uniswap 界面。\n3. 用戶從廣告進入並連接錢包。\n4. 惡意簽名賦予資產轉移權限。\n5. 多個錢包資產被轉走。\n\n## 資金流向\n1. 受害錢包 → 惡意授權/Permit 執行者 → 釣魚收款地址。\n2. 具體鏈和後續洗錢路徑未恢復。\n\n## 金額口徑\n公開損失採用約 $400,000。 原始資產與金額說明為：多個錢包合計約 40 萬美元\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n披露跨兩天，具體受害交易時間、鏈、地址與 Tx 均未保存；不能據品牌名推斷只發生在 Ethereum。\n\n## 處置狀態\n合計約 40 萬美元損失；未見凍結或返還彙總。", "en": "## Incident background\nOn 2026-05-25, Fake Uniswap Google Ads phishing campaign was reported. Available evidence indicates that a paid-search advertisement led users to a fake Uniswap phishing page. The report assigns evidence level C.\n\n## Incident sequence\nPublic reporting describes an executed event affecting Fake Uniswap Google Ads phishing campaign. The affected path involved Other. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Other. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $400,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n2 public sources support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "phishing-approval", "severity": "medium", "chains": [ "Other" ], "ecosystems": [ "Other" ], "lossUsd": 400000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $400,000。 原始资产与金额说明为：多个钱包合计约 40 万美元", "tw": "公開損失採用約 $400,000。 原始資產與金額說明為：多個錢包合計約 40 萬美元", "en": "Reported loss is recorded at approximately $400,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "PeckShield 月报", "tw": "PeckShield 月報", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2061353830437249033", "type": "research" }, { "label": { "zh": "Cecuro 复盘", "tw": "Cecuro 復盤", "en": "cecuro.ai public source" }, "url": "https://cecuro.ai/blog/may-2026-hack-recap", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-134", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-124", "status": "verified", "incidentDate": "2026-05-25", "datePrecision": "day", "title": { "zh": "SquidRouterModule", "tw": "SquidRouterModule", "en": "SquidRouterModule third-party module compromise" }, "summary": { "zh": "第三方 Gnosis Safe 模块在源码中使用固定认证字符串；该秘密泄露或可预测后，攻击者可伪造有效消息。并非 Squid 核心协议本身被攻破。 公开损失采用约 $3,100,000。", "tw": "第三方 Gnosis Safe 模塊在源碼中使用固定認證字符串；該秘密洩露或可預測後，攻擊者可偽造有效消息。並非 Squid 核心協議本身被攻破。 公開損失採用約 $3,100,000。", "en": "SquidRouterModule third-party module compromise was reported on 2026-05-25. Evidence indicates that a third-party router module was compromised and used against connected liquidity. Reported loss is approximately $3,100,000." }, "details": { "zh": "## 事件背景\n第三方 Gnosis Safe 模块在源码中使用固定认证字符串；该秘密泄露或可预测后，攻击者可伪造有效消息。并非 Squid 核心协议本身被攻破。\n\n## 事件经过\n1. 攻击者先从 Tornado Cash 取得 2.1 ETH 启动资金。\n2. 利用固定认证字符串生成可接受消息。\n3. 对约 86 个使用该模块的钱包执行转出。\n4. 将赃款主要兑换为 DAI。\n5. 资金停留在截断线索地址。\n\n## 资金流向\n1. Tornado Cash → 2.1 ETH 启动资金 → 86 个 Safe 钱包 → 攻击钱包 → 约 300 万 DAI 停留。\n\n## 金额口径\n公开损失采用约 $3,100,000。 原始资产与金额说明为：约 300 万—320 万美元；赃款主要换成约 300 万 DAI\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n源文件只有攻击钱包截断值；不能据此生成正式地址账本。\n\n## 处置状态\nSquid 与第三方模块切割；未见全额返还。", "tw": "## 事件背景\n第三方 Gnosis Safe 模塊在源碼中使用固定認證字符串；該秘密洩露或可預測後，攻擊者可偽造有效消息。並非 Squid 核心協議本身被攻破。\n\n## 事件經過\n1. 攻擊者先從 Tornado Cash 取得 2.1 ETH 啟動資金。\n2. 利用固定認證字符串生成可接受消息。\n3. 對約 86 個使用該模塊的錢包執行轉出。\n4. 將贓款主要兌換為 DAI。\n5. 資金停留在截斷線索地址。\n\n## 資金流向\n1. Tornado Cash → 2.1 ETH 啟動資金 → 86 個 Safe 錢包 → 攻擊錢包 → 約 300 萬 DAI 停留。\n\n## 金額口徑\n公開損失採用約 $3,100,000。 原始資產與金額說明為：約 300 萬—320 萬美元；贓款主要換成約 300 萬 DAI\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n源文件只有攻擊錢包截斷值；不能據此生成正式地址賬本。\n\n## 處置狀態\nSquid 與第三方模塊切割；未見全額返還。", "en": "## Incident background\nOn 2026-05-25, SquidRouterModule third-party module compromise was reported. Available evidence indicates that a third-party router module was compromised and used against connected liquidity. The report assigns evidence level B.\n\n## Incident sequence\nPublic reporting describes an executed event affecting SquidRouterModule third-party module compromise. The affected path involved Ethereum. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Ethereum. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $3,100,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n2 public sources support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "access-control", "severity": "high", "chains": [ "Ethereum" ], "ecosystems": [ "Ethereum" ], "lossUsd": 3100000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $3,100,000。 原始资产与金额说明为：约 300 万—320 万美元；赃款主要换成约 300 万 DAI", "tw": "公開損失採用約 $3,100,000。 原始資產與金額說明為：約 300 萬—320 萬美元；贓款主要換成約 300 萬 DAI", "en": "Reported loss is recorded at approximately $3,100,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "PeckShield 报警", "tw": "PeckShield 報警", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2058887446268645747", "type": "research" }, { "label": { "zh": "Halborn 月度复盘", "tw": "Halborn 月度復盤", "en": "halborn.com public source" }, "url": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-may-2026", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-124", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-154", "status": "verified", "incidentDate": "2026-05-24", "datePrecision": "day", "title": { "zh": "TrapDoor 供应链攻击", "tw": "TrapDoor 供應鏈攻擊", "en": "TrapDoor supply-chain campaign" }, "summary": { "zh": "伪造开发工具和多语言包生态投递凭据窃取恶意软件；属于链下基础设施或终端威胁，不应因影响钱包而猜作某条链的协议漏洞。 现有资料没有提供稳定可核的美元损失值。", "tw": "偽造開發工具和多語言包生態投遞憑據竊取惡意軟件；屬於鏈下基礎設施或終端威脅，不應因影響錢包而猜作某條鏈的協議漏洞。 現有資料沒有提供穩定可核的美元損失值。", "en": "TrapDoor supply-chain campaign was reported on 2026-05-24. Evidence indicates that malicious code was distributed through a software supply-chain campaign. No stable verified USD loss amount was published." }, "details": { "zh": "## 事件背景\n伪造开发工具和多语言包生态投递凭据窃取恶意软件；属于链下基础设施或终端威胁，不应因影响钱包而猜作某条链的协议漏洞。\n\n## 事件经过\n1. 攻击者准备仿冒内容、包、网站或载荷。\n2. 通过对应渠道触达开发者/员工/用户。\n3. 受害者下载、运行、授权或提交秘密后，凭据与会话面临泄露。\n4. 公开材料未逐一证明后续链上盗币。\n5. 防守方披露并给出隔离建议。\n\n## 资金流向\n1. 链下投递基础设施 → 受害终端/浏览器/开发环境 → 潜在钱包或企业凭据。\n2. 无已确认统一链上转移路径。\n\n## 金额口径\n现有资料没有提供可稳定核验的美元损失值。 原始资产与金额说明为：未确认统一链上损失\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n源文件未保存事件级原帖 URL、样本 hash、C2、受害地址或链上 Tx；不得把披露日冒充所有感染发生日，也不得把潜在影响计为已盗金额。\n\n## 处置状态\n作为威胁活动簇保留；瞄准钱包数据、开发者 token 和云凭据；每个下载包不等于已造成资产损失。", "tw": "## 事件背景\n偽造開發工具和多語言包生態投遞憑據竊取惡意軟件；屬於鏈下基礎設施或終端威脅，不應因影響錢包而猜作某條鏈的協議漏洞。\n\n## 事件經過\n1. 攻擊者準備仿冒內容、包、網站或載荷。\n2. 通過對應渠道觸達開發者/員工/用戶。\n3. 受害者下載、運行、授權或提交秘密後，憑據與會話面臨洩露。\n4. 公開材料未逐一證明後續鏈上盜幣。\n5. 防守方披露並給出隔離建議。\n\n## 資金流向\n1. 鏈下投遞基礎設施 → 受害終端/瀏覽器/開發環境 → 潛在錢包或企業憑據。\n2. 無已確認統一鏈上轉移路徑。\n\n## 金額口徑\n現有資料沒有提供可穩定核驗的美元損失值。 原始資產與金額說明為：未確認統一鏈上損失\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n源文件未保存事件級原帖 URL、樣本 hash、C2、受害地址或鏈上 Tx；不得把披露日冒充所有感染髮生日，也不得把潛在影響計為已盜金額。\n\n## 處置狀態\n作為威脅活動簇保留；瞄準錢包數據、開發者 token 和雲憑據；每個下載包不等於已造成資產損失。", "en": "## Incident background\nOn 2026-05-24, TrapDoor supply-chain campaign was reported. Available evidence indicates that malicious code was distributed through a software supply-chain campaign. The report assigns evidence level C.\n\n## Incident sequence\nPublic reporting describes an executed event affecting TrapDoor supply-chain campaign. The affected path involved Other. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Other. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nAvailable material does not provide a stable verified USD loss amount. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n1 public source support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "supply-chain", "severity": "medium", "chains": [ "Other" ], "ecosystems": [ "Other" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "现有资料没有提供可稳定核验的美元损失值。 原始资产与金额说明为：未确认统一链上损失", "tw": "現有資料沒有提供可穩定核驗的美元損失值。 原始資產與金額說明為：未確認統一鏈上損失", "en": "Available material does not provide a stable verified USD loss amount. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-applicable", "addresses": [], "references": [ { "label": { "zh": "原报告保存的月度发现入口；事件级直接 URL 待补", "tw": "原報告保存的月度發現入口；事件級直接 URL 待補", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2061353830437249033", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-154", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-149", "status": "verified", "incidentDate": "2026-05-24", "datePrecision": "day", "title": { "zh": "Fractal Protocol", "tw": "Fractal Protocol", "en": "Fractal Protocol security incident" }, "summary": { "zh": "现有公开证据仅为月度追踪清单；同名项目可能混淆；链、根因、资金流未恢复。不得猜函数名、攻击方式、私钥归因或内部人员。 公开损失采用约 $13,700.00。", "tw": "現有公開證據僅為月度追蹤清單；同名專案可能混淆；鏈、根因、資金流未恢復。不得猜函數名、攻擊方式、私鑰歸因或內部人員。 公開損失採用約 $13,700.00。", "en": "Fractal Protocol security incident was reported on 2026-05-24. Evidence indicates that public monitoring confirmed an executed protocol exploit but did not establish a complete root cause. Reported loss is approximately $13,700.00." }, "details": { "zh": "## 事件背景\n现有公开证据仅为月度追踪清单；同名项目可能混淆；链、根因、资金流未恢复。不得猜函数名、攻击方式、私钥归因或内部人员。\n\n## 事件经过\n1. 追踪清单记录项目名、日期和金额。\n2. 本轮未恢复项目官方或安全机构事件原帖。\n3. 攻击准备、触发、资产离开与处置步骤均保持待核。\n4. 后续需用项目身份、链和交易逐项闭环。\n\n## 资金流向\n1. 受影响地址/合约 → 初始接收 → 兑换/归集/跨链/混币/CEX：各段均未公开恢复。\n\n## 金额口径\n公开损失采用约 $13,700.00。 原始资产与金额说明为：约 13,700 美元\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n证据等级 C 按用户要求保留；只有汇总清单，缺少完整地址、TxID、具体链与技术复盘。不能把缺口写成否定事件，也不能填造细节。\n\n## 处置状态\n调查/补证中；不补写项目身份或链", "tw": "## 事件背景\n現有公開證據僅為月度追蹤清單；同名專案可能混淆；鏈、根因、資金流未恢復。不得猜函數名、攻擊方式、私鑰歸因或內部人員。\n\n## 事件經過\n1. 追蹤清單記錄專案名、日期和金額。\n2. 本輪未恢復專案官方或安全機構事件原帖。\n3. 攻擊準備、觸發、資產離開與處置步驟均保持待核。\n4. 後續需用專案身份、鏈和交易逐項閉環。\n\n## 資金流向\n1. 受影響地址/合約 → 初始接收 → 兌換/歸集/跨鏈/混幣/CEX：各段均未公開恢復。\n\n## 金額口徑\n公開損失採用約 $13,700.00。 原始資產與金額說明為：約 13,700 美元\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n證據等級 C 按用戶要求保留；只有彙總清單，缺少完整地址、TxID、具體鏈與技術復盤。不能把缺口寫成否定事件，也不能填造細節。\n\n## 處置狀態\n調查/補證中；不補寫專案身份或鏈", "en": "## Incident background\nOn 2026-05-24, Fractal Protocol security incident was reported. Available evidence indicates that public monitoring confirmed an executed protocol exploit but did not establish a complete root cause. The report assigns evidence level C.\n\n## Incident sequence\nPublic reporting describes an executed event affecting Fractal Protocol security incident. The affected path involved Other. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Other. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $13,700.00. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n1 public source support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "protocol-exploit", "severity": "low", "chains": [ "Other" ], "ecosystems": [ "Other" ], "lossUsd": 13700, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $13,700.00。 原始资产与金额说明为：约 13,700 美元", "tw": "公開損失採用約 $13,700.00。 原始資產與金額說明為：約 13,700 美元", "en": "Reported loss is recorded at approximately $13,700.00. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "Nathan 5 月 31 日起事件追踪清单", "tw": "Nathan 5 月 31 日起事件追蹤清單", "en": "x.com public source" }, "url": "https://x.com/0xxNathan/status/2061459771400827312", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-149", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-148", "status": "verified", "incidentDate": "2026-05-23", "datePrecision": "day", "title": { "zh": "Mure", "tw": "Mure", "en": "Mure security incident" }, "summary": { "zh": "现有公开证据仅为月度追踪清单；链、根因、资金流与处置未恢复。不得猜函数名、攻击方式、私钥归因或内部人员。 公开损失采用约 $11,700.00。", "tw": "現有公開證據僅為月度追蹤清單；鏈、根因、資金流與處置未恢復。不得猜函數名、攻擊方式、私鑰歸因或內部人員。 公開損失採用約 $11,700.00。", "en": "Mure security incident was reported on 2026-05-23. Evidence indicates that public monitoring confirmed an executed protocol exploit but did not establish a complete root cause. Reported loss is approximately $11,700.00." }, "details": { "zh": "## 事件背景\n现有公开证据仅为月度追踪清单；链、根因、资金流与处置未恢复。不得猜函数名、攻击方式、私钥归因或内部人员。\n\n## 事件经过\n1. 追踪清单记录项目名、日期和金额。\n2. 本轮未恢复项目官方或安全机构事件原帖。\n3. 攻击准备、触发、资产离开与处置步骤均保持待核。\n4. 后续需用项目身份、链和交易逐项闭环。\n\n## 资金流向\n1. 受影响地址/合约 → 初始接收 → 兑换/归集/跨链/混币/CEX：各段均未公开恢复。\n\n## 金额口径\n公开损失采用约 $11,700.00。 原始资产与金额说明为：约 11,700 美元\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n证据等级 C 按用户要求保留；只有汇总清单，缺少完整地址、TxID、具体链与技术复盘。不能把缺口写成否定事件，也不能填造细节。\n\n## 处置状态\n调查/补证中；小额攻击线索", "tw": "## 事件背景\n現有公開證據僅為月度追蹤清單；鏈、根因、資金流與處置未恢復。不得猜函數名、攻擊方式、私鑰歸因或內部人員。\n\n## 事件經過\n1. 追蹤清單記錄專案名、日期和金額。\n2. 本輪未恢復專案官方或安全機構事件原帖。\n3. 攻擊準備、觸發、資產離開與處置步驟均保持待核。\n4. 後續需用專案身份、鏈和交易逐項閉環。\n\n## 資金流向\n1. 受影響地址/合約 → 初始接收 → 兌換/歸集/跨鏈/混幣/CEX：各段均未公開恢復。\n\n## 金額口徑\n公開損失採用約 $11,700.00。 原始資產與金額說明為：約 11,700 美元\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n證據等級 C 按用戶要求保留；只有彙總清單，缺少完整地址、TxID、具體鏈與技術復盤。不能把缺口寫成否定事件，也不能填造細節。\n\n## 處置狀態\n調查/補證中；小額攻擊線索", "en": "## Incident background\nOn 2026-05-23, Mure security incident was reported. Available evidence indicates that public monitoring confirmed an executed protocol exploit but did not establish a complete root cause. The report assigns evidence level C.\n\n## Incident sequence\nPublic reporting describes an executed event affecting Mure security incident. The affected path involved Other. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Other. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $11,700.00. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n1 public source support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "protocol-exploit", "severity": "low", "chains": [ "Other" ], "ecosystems": [ "Other" ], "lossUsd": 11700, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $11,700.00。 原始资产与金额说明为：约 11,700 美元", "tw": "公開損失採用約 $11,700.00。 原始資產與金額說明為：約 11,700 美元", "en": "Reported loss is recorded at approximately $11,700.00. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "Nathan 5 月 31 日起事件追踪清单", "tw": "Nathan 5 月 31 日起事件追蹤清單", "en": "x.com public source" }, "url": "https://x.com/0xxNathan/status/2061459771400827312", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-148", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-125", "status": "verified", "incidentDate": "2026-05-23", "datePrecision": "day", "title": { "zh": "StablR", "tw": "StablR", "en": "StablR stablecoin mint-authority compromise" }, "summary": { "zh": "1-of-3 多签或铸币管理密钥泄露；单个被盗 key 足以增加管理员、替换其他 owner 并行使高风险铸币权限。 公开损失采用约 $2,800,000。", "tw": "1-of-3 多籤或鑄幣管理密鑰洩露；單個被盜 key 足以增加管理員、替換其他 owner 並行使高風險鑄幣權限。 公開損失採用約 $2,800,000。", "en": "StablR stablecoin mint-authority compromise was reported on 2026-05-23. Evidence indicates that stablecoin mint authority was used without authorization. Reported loss is approximately $2,800,000." }, "details": { "zh": "## 事件背景\n1-of-3 多签或铸币管理密钥泄露；单个被盗 key 足以增加管理员、替换其他 owner 并行使高风险铸币权限。\n\n## 事件经过\n1. 攻击者取得单一管理 key。\n2. 把自己增加为管理员。\n3. 替换其他 owner。\n4. 铸造大量无抵押 USDR/EURR。\n5. 在 DEX 抛售。\n6. 项目暂停铸造和赎回。\n\n## 资金流向\n1. 无抵押 USDR/EURR → 攻击者 → DEX 抛售 → 约 280 万美元实现流失。\n2. 后续归集待核。\n\n## 金额口径\n公开损失采用约 $2,800,000。 原始资产与金额说明为：无抵押铸造名义约 1,040 万—1,350 万美元；实际从池子套出约 280 万美元；USDR/EURR 一度脱锚约 20%\n\n## 地址与交易\n1. EURR 铸币多签合约：0x8278D2881dBF8F6Fc01c98d196c4b16F1aade5Bc（Ethereum）。\n2. USDR 铸币多签合约：0xF45392bd2D6e6b8C5Dc26BA6c8a12889419B82F3（Ethereum）。\n3. 攻击者新增的所有者地址：0xD4677B5A8B1b97EA213Fdb876b0FcBAB3f9F6CD1（Ethereum）。\n4. 公开资料标记的受影响所有者地址：0xC73fD562de86d7860EE636C20813Bcb2cF4D550d（Ethereum）。\n\n## 证据边界\n铸币名义量不能与实际套现金额混写；四个完整 Ethereum 标识符来自 Beosin 复盘并经 RPC 做合约/EOA 类型检查，具体攻击 Tx 仍未恢复。\n\n## 处置状态\n项目紧急暂停，稳定币一度脱锚约 20%；追回不明。", "tw": "## 事件背景\n1-of-3 多籤或鑄幣管理密鑰洩露；單個被盜 key 足以增加管理員、替換其他 owner 並行使高風險鑄幣權限。\n\n## 事件經過\n1. 攻擊者取得單一管理 key。\n2. 把自己增加為管理員。\n3. 替換其他 owner。\n4. 鑄造大量無抵押 USDR/EURR。\n5. 在 DEX 拋售。\n6. 專案暫停鑄造和贖回。\n\n## 資金流向\n1. 無抵押 USDR/EURR → 攻擊者 → DEX 拋售 → 約 280 萬美元實現流失。\n2. 後續歸集待核。\n\n## 金額口徑\n公開損失採用約 $2,800,000。 原始資產與金額說明為：無抵押鑄造名義約 1,040 萬—1,350 萬美元；實際從池子套出約 280 萬美元；USDR/EURR 一度脫錨約 20%\n\n## 地址與交易\n1. EURR 鑄幣多籤合約：0x8278D2881dBF8F6Fc01c98d196c4b16F1aade5Bc（Ethereum）。\n2. USDR 鑄幣多籤合約：0xF45392bd2D6e6b8C5Dc26BA6c8a12889419B82F3（Ethereum）。\n3. 攻擊者新增的所有者地址：0xD4677B5A8B1b97EA213Fdb876b0FcBAB3f9F6CD1（Ethereum）。\n4. 公開資料標記的受影響所有者地址：0xC73fD562de86d7860EE636C20813Bcb2cF4D550d（Ethereum）。\n\n## 證據邊界\n鑄幣名義量不能與實際套現金額混寫；四個完整 Ethereum 標識符來自 Beosin 復盤並經 RPC 做合約/EOA 類型檢查，具體攻擊 Tx 仍未恢復。\n\n## 處置狀態\n專案緊急暫停，穩定幣一度脫錨約 20%；追回不明。", "en": "## Incident background\nOn 2026-05-23, StablR stablecoin mint-authority compromise was reported. Available evidence indicates that stablecoin mint authority was used without authorization. The report assigns evidence level B.\n\n## Incident sequence\nPublic reporting describes an executed event affecting StablR stablecoin mint-authority compromise. The affected path involved Ethereum. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Ethereum. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $2,800,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\n1. EURR mint multisig contract: `0x8278D2881dBF8F6Fc01c98d196c4b16F1aade5Bc` on Ethereum.\n2. USDR mint multisig contract: `0xF45392bd2D6e6b8C5Dc26BA6c8a12889419B82F3` on Ethereum.\n3. attacker-added owner address: `0xD4677B5A8B1b97EA213Fdb876b0FcBAB3f9F6CD1` on Ethereum.\n4. affected owner address identified by public reporting: `0xC73fD562de86d7860EE636C20813Bcb2cF4D550d` on Ethereum.\n\n## Evidence boundary\n3 public sources support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "access-control", "severity": "high", "chains": [ "Ethereum" ], "ecosystems": [ "Ethereum" ], "lossUsd": 2800000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $2,800,000。 原始资产与金额说明为：无抵押铸造名义约 1,040 万—1,350 万美元；实际从池子套出约 280 万美元；USDR/EURR 一度脱锚约 20%", "tw": "公開損失採用約 $2,800,000。 原始資產與金額說明為：無抵押鑄造名義約 1,040 萬—1,350 萬美元；實際從池子套出約 280 萬美元；USDR/EURR 一度脫錨約 20%", "en": "Reported loss is recorded at approximately $2,800,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0x8278D2881dBF8F6Fc01c98d196c4b16F1aade5Bc", "entity": { "zh": "EURR 铸币多签合约", "tw": "EURR 鑄幣多籤合約", "en": "EURR mint multisig contract" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/PeckShieldAlert/status/2058388005585551633", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "EURR 铸币多签合约；角色来自所引公开来源，仅用于本次事件的证据标签。", "tw": "EURR 鑄幣多籤合約；角色來自所引公開來源，僅用於本次事件的證據標籤。", "en": "EURR mint multisig contract; the role is limited to the cited public evidence for this incident." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xF45392bd2D6e6b8C5Dc26BA6c8a12889419B82F3", "entity": { "zh": "USDR 铸币多签合约", "tw": "USDR 鑄幣多籤合約", "en": "USDR mint multisig contract" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/PeckShieldAlert/status/2058388005585551633", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "USDR 铸币多签合约；角色来自所引公开来源，仅用于本次事件的证据标签。", "tw": "USDR 鑄幣多籤合約；角色來自所引公開來源，僅用於本次事件的證據標籤。", "en": "USDR mint multisig contract; the role is limited to the cited public evidence for this incident." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xD4677B5A8B1b97EA213Fdb876b0FcBAB3f9F6CD1", "entity": { "zh": "攻击者新增的所有者地址", "tw": "攻擊者新增的所有者地址", "en": "attacker-added owner address" }, "role": "attacker", "category": "hack", "confidence": 0.9, "sourceUrl": "https://x.com/PeckShieldAlert/status/2058388005585551633", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "攻击者新增的所有者地址；角色来自所引公开来源，仅用于本次事件的证据标签。", "tw": "攻擊者新增的所有者地址；角色來自所引公開來源，僅用於本次事件的證據標籤。", "en": "attacker-added owner address; the role is limited to the cited public evidence for this incident." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0xC73fD562de86d7860EE636C20813Bcb2cF4D550d", "entity": { "zh": "公开资料标记的受影响所有者地址", "tw": "公開資料標記的受影響所有者地址", "en": "affected owner address identified by public reporting" }, "role": "other", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/PeckShieldAlert/status/2058388005585551633", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "公开资料标记的受影响所有者地址；角色来自所引公开来源，仅用于本次事件的证据标签。", "tw": "公開資料標記的受影響所有者地址；角色來自所引公開來源，僅用於本次事件的證據標籤。", "en": "affected owner address identified by public reporting; the role is limited to the cited public evidence for this incident." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "PeckShield 脱锚报警", "tw": "PeckShield 脫錨報警", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2058388005585551633", "type": "research" }, { "label": { "zh": "Halborn 月度复盘", "tw": "Halborn 月度復盤", "en": "halborn.com public source" }, "url": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-may-2026", "type": "research" }, { "label": { "zh": "Beosin StablR 多签地址与权限路径", "tw": "Beosin StablR 多籤地址與權限路徑", "en": "x.com public source" }, "url": "https://x.com/Beosin_com/status/2062115685728407706", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-125", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-160", "status": "verified", "incidentDate": "2026-05-22", "datePrecision": "day", "title": { "zh": "Based Apparel 网站钱包窃取恶意代码", "tw": "Based Apparel 網站錢包竊取惡意代碼", "en": "Based Apparel website wallet-drainer injection" }, "summary": { "zh": "网站被发现向访问者推送面向加密钱包的恶意载荷；属于链下基础设施或终端威胁，不应因影响钱包而猜作某条链的协议漏洞。 现有资料没有提供稳定可核的美元损失值。", "tw": "網站被發現向訪問者推送面向加密錢包的惡意載荷；屬於鏈下基礎設施或終端威脅，不應因影響錢包而猜作某條鏈的協議漏洞。 現有資料沒有提供穩定可核的美元損失值。", "en": "Based Apparel website wallet-drainer injection was reported on 2026-05-22. Evidence indicates that wallet-draining code was injected into the Based Apparel website. No stable verified USD loss amount was published." }, "details": { "zh": "## 事件背景\n网站被发现向访问者推送面向加密钱包的恶意载荷；属于链下基础设施或终端威胁，不应因影响钱包而猜作某条链的协议漏洞。\n\n## 事件经过\n1. 攻击者准备仿冒内容、包、网站或载荷。\n2. 通过对应渠道触达开发者/员工/用户。\n3. 受害者下载、运行、授权或提交秘密后，凭据与会话面临泄露。\n4. 公开材料未逐一证明后续链上盗币。\n5. 防守方披露并给出隔离建议。\n\n## 资金流向\n1. 链下投递基础设施 → 受害终端/浏览器/开发环境 → 潜在钱包或企业凭据。\n2. 无已确认统一链上转移路径。\n\n## 金额口径\n现有资料没有提供可稳定核验的美元损失值。 原始资产与金额说明为：未确认汇总损失\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n源文件未保存事件级原帖 URL、样本 hash、C2、受害地址或链上 Tx；不得把披露日冒充所有感染发生日，也不得把潜在影响计为已盗金额。\n\n## 处置状态\n作为威胁活动簇保留；站点随后下线；不代表每名购买者均已损失。", "tw": "## 事件背景\n網站被發現向訪問者推送面向加密錢包的惡意載荷；屬於鏈下基礎設施或終端威脅，不應因影響錢包而猜作某條鏈的協議漏洞。\n\n## 事件經過\n1. 攻擊者準備仿冒內容、包、網站或載荷。\n2. 通過對應渠道觸達開發者/員工/用戶。\n3. 受害者下載、運行、授權或提交秘密後，憑據與會話面臨洩露。\n4. 公開材料未逐一證明後續鏈上盜幣。\n5. 防守方披露並給出隔離建議。\n\n## 資金流向\n1. 鏈下投遞基礎設施 → 受害終端/瀏覽器/開發環境 → 潛在錢包或企業憑據。\n2. 無已確認統一鏈上轉移路徑。\n\n## 金額口徑\n現有資料沒有提供可穩定核驗的美元損失值。 原始資產與金額說明為：未確認彙總損失\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n源文件未保存事件級原帖 URL、樣本 hash、C2、受害地址或鏈上 Tx；不得把披露日冒充所有感染髮生日，也不得把潛在影響計為已盜金額。\n\n## 處置狀態\n作為威脅活動簇保留；站點隨後下線；不代表每名購買者均已損失。", "en": "## Incident background\nOn 2026-05-22, Based Apparel website wallet-drainer injection was reported. Available evidence indicates that wallet-draining code was injected into the Based Apparel website. The report assigns evidence level C.\n\n## Incident sequence\nPublic reporting describes an executed event affecting Based Apparel website wallet-drainer injection. The affected path involved Other. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Other. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nAvailable material does not provide a stable verified USD loss amount. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n1 public source support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "supply-chain", "severity": "medium", "chains": [ "Other" ], "ecosystems": [ "Other" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "现有资料没有提供可稳定核验的美元损失值。 原始资产与金额说明为：未确认汇总损失", "tw": "現有資料沒有提供可穩定核驗的美元損失值。 原始資產與金額說明為：未確認彙總損失", "en": "Available material does not provide a stable verified USD loss amount. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-applicable", "addresses": [], "references": [ { "label": { "zh": "原报告保存的月度发现入口；事件级直接 URL 待补", "tw": "原報告保存的月度發現入口；事件級直接 URL 待補", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2061353830437249033", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-160", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-131", "status": "verified", "incidentDate": "2026-05-22", "datePrecision": "day", "title": { "zh": "Polymarket UMA CTF Adapter", "tw": "Polymarket UMA CTF Adapter", "en": "Polymarket UMA CTF Adapter operational-key compromise" }, "summary": { "zh": "约六年前的运营 key 仍保有有效权限，长期未轮换或撤销，成为可被滥用的遗留权限面。 公开损失采用约 $520,000。", "tw": "約六年前的運營 key 仍保有有效權限，長期未輪換或撤銷，成為可被濫用的遺留權限面。 公開損失採用約 $520,000。", "en": "Polymarket UMA CTF Adapter operational-key compromise was reported on 2026-05-22. Evidence indicates that an operational key used by the UMA CTF Adapter was compromised. Reported loss is approximately $520,000." }, "details": { "zh": "## 事件背景\n约六年前的运营 key 仍保有有效权限，长期未轮换或撤销，成为可被滥用的遗留权限面。\n\n## 事件经过\n1. 攻击者取得或使用旧运营 key。\n2. 调用仍有效的权限。\n3. 从两个相关地址抽走资产。\n4. 部分资金进入 ChangeNOW。\n\n## 资金流向\n1. Polygon 两个截断相关地址 → 攻击者 → 部分 ChangeNOW。\n2. 其余余额与路径待核。\n\n## 金额口径\n公开损失采用约 $520,000。 原始资产与金额说明为：约 52 万—70 万美元\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n两个地址仅有截断值，角色只能按源帖描述为受害/相关地址；不可进入地址记录。\n\n## 处置状态\n未见全额追回。", "tw": "## 事件背景\n約六年前的運營 key 仍保有有效權限，長期未輪換或撤銷，成為可被濫用的遺留權限面。\n\n## 事件經過\n1. 攻擊者取得或使用舊運營 key。\n2. 調用仍有效的權限。\n3. 從兩個相關地址抽走資產。\n4. 部分資金進入 ChangeNOW。\n\n## 資金流向\n1. Polygon 兩個截斷相關地址 → 攻擊者 → 部分 ChangeNOW。\n2. 其餘餘額與路徑待核。\n\n## 金額口徑\n公開損失採用約 $520,000。 原始資產與金額說明為：約 52 萬—70 萬美元\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n兩個地址僅有截斷值，角色只能按源帖描述為受害/相關地址；不可進入地址記錄。\n\n## 處置狀態\n未見全額追回。", "en": "## Incident background\nOn 2026-05-22, Polymarket UMA CTF Adapter operational-key compromise was reported. Available evidence indicates that an operational key used by the UMA CTF Adapter was compromised. The report assigns evidence level B.\n\n## Incident sequence\nPublic reporting describes an executed event affecting Polymarket UMA CTF Adapter operational-key compromise. The affected path involved Polygon. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Polygon. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $520,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n2 public sources support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "key-compromise", "severity": "medium", "chains": [ "Polygon" ], "ecosystems": [ "Polygon" ], "lossUsd": 520000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $520,000。 原始资产与金额说明为：约 52 万—70 万美元", "tw": "公開損失採用約 $520,000。 原始資產與金額說明為：約 52 萬—70 萬美元", "en": "Reported loss is recorded at approximately $520,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "PeckShield 报警", "tw": "PeckShield 報警", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2057745696674218049", "type": "research" }, { "label": { "zh": "Halborn 复盘", "tw": "Halborn 復盤", "en": "halborn.com public source" }, "url": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-may-2026", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-131", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-140", "status": "verified", "incidentDate": "2026-05-20", "datePrecision": "day", "title": { "zh": "MAP / Butter Bridge", "tw": "MAP / Butter Bridge", "en": "MAP / Butter Bridge exploit" }, "summary": { "zh": "retry 验证流程用 abi.encodePacked 组合多个动态或可歧义字段，产生哈希碰撞，使伪造消息与合法消息命中同一 hash。 公开损失采用约 $110,000。", "tw": "retry 驗證流程用 abi.encodePacked 組合多個動態或可歧義字段，產生哈希碰撞，使偽造消息與合法消息命中同一 hash。 公開損失採用約 $110,000。", "en": "MAP / Butter Bridge exploit was reported on 2026-05-20. Evidence indicates that a bridge contract or message-validation path was exploited. Reported loss is approximately $110,000." }, "details": { "zh": "## 事件背景\nretry 验证流程用 abi.encodePacked 组合多个动态或可歧义字段，产生哈希碰撞，使伪造消息与合法消息命中同一 hash。\n\n## 事件经过\n1. 攻击者观察合法消息 hash。\n2. 构造字段边界不同但 encodePacked 结果碰撞的伪造消息。\n3. retry 流程接受伪造消息。\n4. 在目标链铸造映射代币。\n5. 套取至少 11 万美元真实流动性。\n\n## 资金流向\n1. Ethereum/BNB Chain 合法消息上下文 → 伪造碰撞消息 → 目标链映射代币 → 流动性套现。\n\n## 金额口径\n公开损失采用约 $110,000。 原始资产与金额说明为：已实现损失至少 11 万美元；可铸造映射代币名义量接近无限，远高于实际套现\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n“接近无限铸币能力”是权限/名义敞口，不是现金损失；完整 Tx 与合约未保存。\n\n## 处置状态\n已实现损失至少 11 万美元；修复与返还状态未从源文件恢复。", "tw": "## 事件背景\nretry 驗證流程用 abi.encodePacked 組合多個動態或可歧義字段，產生哈希碰撞，使偽造消息與合法消息命中同一 hash。\n\n## 事件經過\n1. 攻擊者觀察合法消息 hash。\n2. 構造字段邊界不同但 encodePacked 結果碰撞的偽造消息。\n3. retry 流程接受偽造消息。\n4. 在目標鏈鑄造映射代幣。\n5. 套取至少 11 萬美元真實流動性。\n\n## 資金流向\n1. Ethereum/BNB Chain 合法消息上下文 → 偽造碰撞消息 → 目標鏈映射代幣 → 流動性套現。\n\n## 金額口徑\n公開損失採用約 $110,000。 原始資產與金額說明為：已實現損失至少 11 萬美元；可鑄造映射代幣名義量接近無限，遠高於實際套現\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n“接近無限鑄幣能力”是權限/名義敞口，不是現金損失；完整 Tx 與合約未保存。\n\n## 處置狀態\n已實現損失至少 11 萬美元；修復與返還狀態未從源文件恢復。", "en": "## Incident background\nOn 2026-05-20, MAP / Butter Bridge exploit was reported. Available evidence indicates that a bridge contract or message-validation path was exploited. The report assigns evidence level B.\n\n## Incident sequence\nPublic reporting describes an executed event affecting MAP / Butter Bridge exploit. The affected path involved Ethereum, BNB Chain. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Ethereum, BNB Chain. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $110,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n2 public sources support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "bridge-exploit", "severity": "medium", "chains": [ "Ethereum", "BNB Chain" ], "ecosystems": [ "Ethereum", "BNB Chain" ], "lossUsd": 110000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $110,000。 原始资产与金额说明为：已实现损失至少 11 万美元；可铸造映射代币名义量接近无限，远高于实际套现", "tw": "公開損失採用約 $110,000。 原始資產與金額說明為：已實現損失至少 11 萬美元；可鑄造映射代幣名義量接近無限，遠高於實際套現", "en": "Reported loss is recorded at approximately $110,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "PeckShield 月报", "tw": "PeckShield 月報", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2061353830437249033", "type": "research" }, { "label": { "zh": "Halborn 月度复盘", "tw": "Halborn 月度復盤", "en": "halborn.com public source" }, "url": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-may-2026", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-140", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-127", "status": "verified", "incidentDate": "2026-05-20", "datePrecision": "day", "title": { "zh": "RetoSwap / Haveno", "tw": "RetoSwap / Haveno", "en": "RetoSwap / Haveno multisig-path exploit" }, "summary": { "zh": "Haveno 交易协议对 ACK 乱序处理存在缺陷，攻击者能够伪造或利用仲裁人身份，成为临时多签的第二签名者。 公开损失采用约 $2,700,000。", "tw": "Haveno 交易協議對 ACK 亂序處理存在缺陷，攻擊者能夠偽造或利用仲裁人身份，成為臨時多籤的第二簽名者。 公開損失採用約 $2,700,000。", "en": "RetoSwap / Haveno multisig-path exploit was reported on 2026-05-20. Evidence indicates that the RetoSwap / Haveno multisig path was exploited. Reported loss is approximately $2,700,000." }, "details": { "zh": "## 事件背景\nHaveno 交易协议对 ACK 乱序处理存在缺陷，攻击者能够伪造或利用仲裁人身份，成为临时多签的第二签名者。\n\n## 事件经过\n1. 攻击者操纵或伪造确认消息顺序。\n2. 把自己注册为交易仲裁人/第二多签签名者。\n3. 取得足以单方面支配临时 Monero 多签的权限。\n4. 转走约 7,000 XMR。\n\n## 资金流向\n1. Haveno 临时 Monero 多签 → 攻击者 XMR 地址。\n2. Monero 隐私特性使后续公开追踪和冻结极弱。\n\n## 金额口径\n公开损失采用约 $2,700,000。 原始资产与金额说明为：约 270 万美元、约 7,000 XMR\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\nMonero 地址与交易未公开恢复；约 270 万美元是 XMR 事件时估值。\n\n## 处置状态\n基本不可公开追踪，未见追回。", "tw": "## 事件背景\nHaveno 交易協議對 ACK 亂序處理存在缺陷，攻擊者能夠偽造或利用仲裁人身份，成為臨時多籤的第二簽名者。\n\n## 事件經過\n1. 攻擊者操縱或偽造確認消息順序。\n2. 把自己註冊為交易仲裁人/第二多籤簽名者。\n3. 取得足以單方面支配臨時 Monero 多籤的權限。\n4. 轉走約 7,000 XMR。\n\n## 資金流向\n1. Haveno 臨時 Monero 多籤 → 攻擊者 XMR 地址。\n2. Monero 隱私特性使後續公開追蹤和凍結極弱。\n\n## 金額口徑\n公開損失採用約 $2,700,000。 原始資產與金額說明為：約 270 萬美元、約 7,000 XMR\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\nMonero 地址與交易未公開恢復；約 270 萬美元是 XMR 事件時估值。\n\n## 處置狀態\n基本不可公開追蹤，未見追回。", "en": "## Incident background\nOn 2026-05-20, RetoSwap / Haveno multisig-path exploit was reported. Available evidence indicates that the RetoSwap / Haveno multisig path was exploited. The report assigns evidence level B.\n\n## Incident sequence\nPublic reporting describes an executed event affecting RetoSwap / Haveno multisig-path exploit. The affected path involved Monero. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Monero. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $2,700,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n2 public sources support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "protocol-exploit", "severity": "high", "chains": [ "Monero" ], "ecosystems": [ "Monero" ], "lossUsd": 2700000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $2,700,000。 原始资产与金额说明为：约 270 万美元、约 7,000 XMR", "tw": "公開損失採用約 $2,700,000。 原始資產與金額說明為：約 270 萬美元、約 7,000 XMR", "en": "Reported loss is recorded at approximately $2,700,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "PeckShield 月报", "tw": "PeckShield 月報", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2061353830437249033", "type": "research" }, { "label": { "zh": "Halborn 月度复盘", "tw": "Halborn 月度復盤", "en": "halborn.com public source" }, "url": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-may-2026", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-127", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-147", "status": "verified", "incidentDate": "2026-05-19", "datePrecision": "day", "title": { "zh": "HermesVault", "tw": "HermesVault", "en": "HermesVault security incident" }, "summary": { "zh": "现有公开证据仅为月度追踪清单；链、根因和完整返还交易待核。不得猜函数名、攻击方式、私钥归因或内部人员。 公开损失采用约 $4,000.00。", "tw": "現有公開證據僅為月度追蹤清單；鏈、根因和完整返還交易待核。不得猜函數名、攻擊方式、私鑰歸因或內部人員。 公開損失採用約 $4,000.00。", "en": "HermesVault security incident was reported on 2026-05-19. Evidence indicates that a vault weakness was exploited before most assets were returned. Reported loss is approximately $4,000.00." }, "details": { "zh": "## 事件背景\n现有公开证据仅为月度追踪清单；链、根因和完整返还交易待核。不得猜函数名、攻击方式、私钥归因或内部人员。\n\n## 事件经过\n1. 追踪清单记录项目名、日期和金额。\n2. 本轮未恢复项目官方或安全机构事件原帖。\n3. 攻击准备、触发、资产离开与处置步骤均保持待核。\n4. 后续需用项目身份、链和交易逐项闭环。\n\n## 资金流向\n1. 受影响地址/合约 → 初始接收 → 兑换/归集/跨链/混币/CEX：各段均未公开恢复。\n\n## 金额口径\n初始损失约为 3 万美元，公开资料称约 2.6 万美元返还，净损失约为 4,000 美元；公开损失采用净损失口径。\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n证据等级 C 按用户要求保留；只有汇总清单，缺少完整地址、TxID、具体链与技术复盘。不能把缺口写成否定事件，也不能填造细节。\n\n## 处置状态\n调查/补证中；汇总称部分返还", "tw": "## 事件背景\n現有公開證據僅為月度追蹤清單；鏈、根因和完整返還交易待核。不得猜函數名、攻擊方式、私鑰歸因或內部人員。\n\n## 事件經過\n1. 追蹤清單記錄專案名、日期和金額。\n2. 本輪未恢復專案官方或安全機構事件原帖。\n3. 攻擊準備、觸發、資產離開與處置步驟均保持待核。\n4. 後續需用專案身份、鏈和交易逐項閉環。\n\n## 資金流向\n1. 受影響地址/合約 → 初始接收 → 兌換/歸集/跨鏈/混幣/CEX：各段均未公開恢復。\n\n## 金額口徑\n初始損失約為 3 萬美元，公開資料稱約 2.6 萬美元返還，淨損失約為 4,000 美元；公開損失採用淨損失口徑。\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n證據等級 C 按用戶要求保留；只有彙總清單，缺少完整地址、TxID、具體鏈與技術復盤。不能把缺口寫成否定事件，也不能填造細節。\n\n## 處置狀態\n調查/補證中；彙總稱部分返還", "en": "## Incident background\nOn 2026-05-19, HermesVault security incident was reported. Available evidence indicates that a vault weakness was exploited before most assets were returned. The report assigns evidence level C.\n\n## Incident sequence\nPublic reporting describes an executed event affecting HermesVault security incident. The affected path involved Other. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Other. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nInitial loss was approximately $30,000, approximately $26,000 was reported returned, and net loss was about $4,000. The public loss uses the net amount.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n1 public source support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "protocol-exploit", "severity": "low", "chains": [ "Other" ], "ecosystems": [ "Other" ], "lossUsd": 4000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "初始损失约为 3 万美元，公开资料称约 2.6 万美元返还，净损失约为 4,000 美元；公开损失采用净损失口径。", "tw": "初始損失約為 3 萬美元，公開資料稱約 2.6 萬美元返還，淨損失約為 4,000 美元；公開損失採用淨損失口徑。", "en": "Initial loss was approximately $30,000, approximately $26,000 was reported returned, and net loss was about $4,000. The public loss uses the net amount." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "Nathan 5 月 31 日起事件追踪清单", "tw": "Nathan 5 月 31 日起事件追蹤清單", "en": "x.com public source" }, "url": "https://x.com/0xxNathan/status/2061459771400827312", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-147", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-141", "status": "verified", "incidentDate": "2026-05-19", "datePrecision": "day", "title": { "zh": "Echo Protocol / eBTC", "tw": "Echo Protocol / eBTC", "en": "Echo Protocol / eBTC admin-key compromise" }, "summary": { "zh": "管理员私钥泄露或被接管，且管理员拥有过度铸币权限；攻击者可无抵押铸造 eBTC。 公开损失采用约 $5,130,000。", "tw": "管理員私鑰洩露或被接管，且管理員擁有過度鑄幣權限；攻擊者可無抵押鑄造 eBTC。 公開損失採用約 $5,130,000。", "en": "Echo Protocol / eBTC admin-key compromise was reported on 2026-05-19. Evidence indicates that administrative signing authority was compromised. Reported loss is approximately $5,130,000." }, "details": { "zh": "## 事件背景\n管理员私钥泄露或被接管，且管理员拥有过度铸币权限；攻击者可无抵押铸造 eBTC。\n\n## 事件经过\n1. 攻击者取得管理员权限。\n2. 铸造 1,000 eBTC。\n3. 把其中 45 eBTC 存入 Curvance。\n4. 借出约 11.29 WBTC。\n5. 兑换为 ETH。\n6. 向 Tornado Cash 发送 384 ETH。\n7. Beosin 后续统计更广路径获利约 513 万美元。\n\n## 资金流向\n1. Monad 无抵押 eBTC → Curvance 存入 45 eBTC → 借出 11.29 WBTC 约 86.77 万美元 → ETH → Tornado Cash 384 ETH 约 82.17 万美元。\n2. 其他使总获利达到约 513 万美元的路径尚无完整账本。\n\n## 金额口径\n公开损失采用约 $5,130,000。 原始资产与金额说明为：名义铸造 1,000 eBTC 约 7,670 万美元；PeckShield 初始可核路径实际约 82.17 万美元（384 ETH；另借出 11.29 WBTC 约 86.77 万美元）；Beosin 最终实际获利约 513 万美元；两种实现口径并列\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n7,670 万美元是纸面铸币名义量，不是现金损失；82.17 万美元与 513 万美元必须并列，前者是初始已披露路径，后者可能覆盖后续/其他路径。\n\n## 处置状态\n管理密钥和铸币权限失陷；等待项目正式复盘与全路径追踪。", "tw": "## 事件背景\n管理員私鑰洩露或被接管，且管理員擁有過度鑄幣權限；攻擊者可無抵押鑄造 eBTC。\n\n## 事件經過\n1. 攻擊者取得管理員權限。\n2. 鑄造 1,000 eBTC。\n3. 把其中 45 eBTC 存入 Curvance。\n4. 借出約 11.29 WBTC。\n5. 兌換為 ETH。\n6. 向 Tornado Cash 發送 384 ETH。\n7. Beosin 後續統計更廣路徑獲利約 513 萬美元。\n\n## 資金流向\n1. Monad 無抵押 eBTC → Curvance 存入 45 eBTC → 借出 11.29 WBTC 約 86.77 萬美元 → ETH → Tornado Cash 384 ETH 約 82.17 萬美元。\n2. 其他使總獲利達到約 513 萬美元的路徑尚無完整賬本。\n\n## 金額口徑\n公開損失採用約 $5,130,000。 原始資產與金額說明為：名義鑄造 1,000 eBTC 約 7,670 萬美元；PeckShield 初始可核路徑實際約 82.17 萬美元（384 ETH；另借出 11.29 WBTC 約 86.77 萬美元）；Beosin 最終實際獲利約 513 萬美元；兩種實現口徑並列\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n7,670 萬美元是紙面鑄幣名義量，不是現金損失；82.17 萬美元與 513 萬美元必須並列，前者是初始已披露路徑，後者可能覆蓋後續/其他路徑。\n\n## 處置狀態\n管理密鑰和鑄幣權限失陷；等待專案正式復盤與全路徑追蹤。", "en": "## Incident background\nOn 2026-05-19, Echo Protocol / eBTC admin-key compromise was reported. Available evidence indicates that administrative signing authority was compromised. The report assigns evidence level B.\n\n## Incident sequence\nPublic reporting describes an executed event affecting Echo Protocol / eBTC admin-key compromise. The affected path involved Monad, Ethereum. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Monad, Ethereum. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $5,130,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n2 public sources support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "key-compromise", "severity": "high", "chains": [ "Monad", "Ethereum" ], "ecosystems": [ "Monad", "Ethereum" ], "lossUsd": 5130000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $5,130,000。 原始资产与金额说明为：名义铸造 1,000 eBTC 约 7,670 万美元；PeckShield 初始可核路径实际约 82.17 万美元（384 ETH；另借出 11.29 WBTC 约 86.77 万美元）；Beosin 最终实际获利约 513 万美元；两种实现口径并列", "tw": "公開損失採用約 $5,130,000。 原始資產與金額說明為：名義鑄造 1,000 eBTC 約 7,670 萬美元；PeckShield 初始可核路徑實際約 82.17 萬美元（384 ETH；另借出 11.29 WBTC 約 86.77 萬美元）；Beosin 最終實際獲利約 513 萬美元；兩種實現口徑並列", "en": "Reported loss is recorded at approximately $5,130,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "PeckShield 资金路径", "tw": "PeckShield 資金路徑", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2056519415211192670", "type": "research" }, { "label": { "zh": "Beosin 月报正文", "tw": "Beosin 月報正文", "en": "x.com public source" }, "url": "https://x.com/Beosin_com/status/2062115685728407706", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-141", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-052", "status": "verified", "incidentDate": "2026-05-18", "datePrecision": "day", "title": { "zh": "Verus–Ethereum Bridge 第一次价值守恒漏洞攻击", "tw": "Verus–Ethereum Bridge 第一次價值守恆漏洞攻擊", "en": "First Verus–Ethereum Bridge value-conservation exploit" }, "summary": { "zh": "2026 年 5 月 18 日，Verus–Ethereum Bridge 的跨链验证未确保源侧输入与目标侧输出价值相等，攻击者以低价值输入释放高价值储备。初始风险敞口约 1,158 万美元，后续返还约 4,052.4 ETH，公开估值约 850 万美元。", "tw": "2026 年 5 月 18 日，Verus–Ethereum Bridge 的跨鏈驗證未確保源側輸入與目標側輸出價值相等，攻擊者以低價值輸入釋放高價值儲備。初始風險敞口約 1,158 萬美元，後續返還約 4,052.4 ETH，公開估值約 850 萬美元。", "en": "On May 18, 2026, Verus–Ethereum Bridge validation failed to enforce value equality between source-side input and destination-side output, allowing low-value input to release high-value reserves. Initial exposure was approximately $11.58 million, and about 4,052.4 ETH, publicly valued near $8.5 million, was later returned." }, "details": { "zh": "## 事件背景\n2026 年 5 月 18 日，Verus–Ethereum Bridge 首次遭利用。跨链验证接受了签名、状态根和消息结构，却没有确保 Verus 侧输入价值与 Ethereum 侧输出价值相等。\n\n## 事件经过\n攻击者在 Verus 侧构造低价值输入，生成可通过验证的跨链消息，并在 Ethereum 侧释放 1,625 ETH、103.6 tBTC 与约 147,000 USDC。团队暂停网络与桥并开展谈判。\n\n## 资金流向\n释放资产被兑换并归集为约 5,402 ETH。后续约 4,052.4 ETH 返还团队，约 1,350 ETH 按协商由攻击者保留。\n\n## 金额口径\n初始风险敞口约为 1,158 万美元。返还的 4,052.4 ETH 按公开估值约 850 万美元，初始损失与返还金额分列，不重复相加。\n\n## 证据边界\nPeckShield 和 Halborn 的公开材料支持首次攻击日期、价值守恒缺陷、初始资产规模及返还安排。7 月发生的再次攻击属于独立重复事件，另行建档。\n\n## 处置状态\n第一次攻击完成谈判并返还约 75% 资产，剩余约 25% 被作为协商赏金。桥的价值守恒逻辑仍需在后续修复中验证。", "tw": "## 事件背景\n2026 年 5 月 18 日，Verus–Ethereum Bridge 首次遭利用。跨鏈驗證接受了簽名、狀態根和消息結構，卻沒有確保 Verus 側輸入價值與 Ethereum 側輸出價值相等。\n\n## 事件經過\n攻擊者在 Verus 側構造低價值輸入，生成可通過驗證的跨鏈消息，並在 Ethereum 側釋放 1,625 ETH、103.6 tBTC 與約 147,000 USDC。團隊暫停網路與橋並開展談判。\n\n## 資金流向\n釋放資產被兌換並歸集為約 5,402 ETH。後續約 4,052.4 ETH 返還團隊，約 1,350 ETH 按協商由攻擊者保留。\n\n## 金額口徑\n初始風險敞口約為 1,158 萬美元。返還的 4,052.4 ETH 按公開估值約 850 萬美元，初始損失與返還金額分列，不重複相加。\n\n## 證據邊界\nPeckShield 和 Halborn 的公開材料支援首次攻擊日期、價值守恆缺陷、初始資產規模及返還安排。7 月發生的再次攻擊屬於獨立重複事件，另行建檔。\n\n## 處置狀態\n第一次攻擊完成談判並返還約 75% 資產，剩餘約 25% 被作為協商賞金。橋的價值守恆邏輯仍需在後續修復中驗證。", "en": "## Incident overview\nOn May 18, 2026, Verus–Ethereum Bridge suffered its first exploit. Cross-chain validation accepted signatures, state roots, and message structure without enforcing equal value between Verus-side input and Ethereum-side output.\n\n## Incident sequence\nThe attacker constructed low-value input on Verus, produced a message that passed validation, and released 1,625 ETH, 103.6 tBTC, and approximately 147,000 USDC on Ethereum. The team paused the network and bridge and entered negotiations.\n\n## Fund flow\nReleased assets were swapped and consolidated into approximately 5,402 ETH. About 4,052.4 ETH was later returned to the team, while approximately 1,350 ETH remained with the attacker under the negotiated arrangement.\n\n## Amount basis\nInitial exposure was approximately $11.58 million. The returned 4,052.4 ETH was publicly valued near $8.5 million. Initial loss and returned value are reported separately and are not additive.\n\n## Evidence boundary\nPublic material from PeckShield and Halborn supports the first attack date, value-conservation defect, initial asset scale, and return arrangement. The repeat attack in July is a separate executed incident and has its own record.\n\n## Current status\nThe first event concluded with approximately 75% of assets returned and about 25% retained as a negotiated bounty. Remediation of the bridge’s value-conservation logic remains relevant to later review." }, "category": "bridge-exploit", "severity": "critical", "chains": [ "Ethereum" ], "ecosystems": [ "Ethereum" ], "lossUsd": 11580000, "frozenUsd": 0, "recoveredUsd": 8500000, "assetLoss": { "zh": "初始风险敞口约为 1,158 万美元，包括 1,625 ETH、103.6 tBTC 和约 147,000 USDC。团队确认 4,052.4 ETH、约 850 万美元已经返还，攻击者保留约 1,350 ETH、约 280 万美元作为协商赏金；初始损失与返还金额分列，不重复相加。", "tw": "初始風險敞口約為 1,158 萬美元，包括 1,625 ETH、103.6 tBTC 和約 147,000 USDC。團隊確認 4,052.4 ETH、約 850 萬美元已經返還，攻擊者保留約 1,350 ETH、約 280 萬美元作為協商賞金；初始損失與返還金額分列，不重複相加。", "en": "Initial exposure was approximately $11.58 million, including 1,625 ETH, 103.6 tBTC, and approximately 147,000 USDC. The team confirmed the return of 4,052.4 ETH, valued near $8.5 million, while approximately 1,350 ETH, valued near $2.8 million, remained with the attacker as a negotiated bounty. Initial loss and returned assets are presented separately." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "PeckShield 返还跟踪", "tw": "PeckShield 返還跟蹤", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2057638728890536262", "type": "research" }, { "label": { "zh": "Halborn 月度复盘", "tw": "Halborn 月度復盤", "en": "halborn.com public source" }, "url": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-may-2026", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-052", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-159", "status": "verified", "incidentDate": "2026-05-17", "datePrecision": "day", "title": { "zh": "Ledger 实体信件助记词钓鱼", "tw": "Ledger 實體信件助記詞釣魚", "en": "Ledger physical-letter seed phishing campaign" }, "summary": { "zh": "邮寄假安全迁移/验证信件诱导用户在假网站输入助记词；属于链下基础设施或终端威胁，不应因影响钱包而猜作某条链的协议漏洞。 现有资料没有提供稳定可核的美元损失值。", "tw": "郵寄假安全遷移/驗證信件誘導用戶在假網站輸入助記詞；屬於鏈下基礎設施或終端威脅，不應因影響錢包而猜作某條鏈的協議漏洞。 現有資料沒有提供穩定可核的美元損失值。", "en": "Ledger physical-letter seed phishing campaign was reported on 2026-05-17. Evidence indicates that physical letters impersonating Ledger attempted to steal wallet seed phrases. No stable verified USD loss amount was published." }, "details": { "zh": "## 事件背景\n邮寄假安全迁移/验证信件诱导用户在假网站输入助记词；属于链下基础设施或终端威胁，不应因影响钱包而猜作某条链的协议漏洞。\n\n## 事件经过\n1. 攻击者准备仿冒内容、包、网站或载荷。\n2. 通过对应渠道触达开发者/员工/用户。\n3. 受害者下载、运行、授权或提交秘密后，凭据与会话面临泄露。\n4. 公开材料未逐一证明后续链上盗币。\n5. 防守方披露并给出隔离建议。\n\n## 资金流向\n1. 链下投递基础设施 → 受害终端/浏览器/开发环境 → 潜在钱包或企业凭据。\n2. 无已确认统一链上转移路径。\n\n## 金额口径\n现有资料没有提供可稳定核验的美元损失值。 原始资产与金额说明为：未确认汇总损失\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n源文件未保存事件级原帖 URL、样本 hash、C2、受害地址或链上 Tx；不得把披露日冒充所有感染发生日，也不得把潜在影响计为已盗金额。\n\n## 处置状态\n作为威胁活动簇保留；Ledger 不会要求用户通过信件、二维码或网页输入 seed phrase。", "tw": "## 事件背景\n郵寄假安全遷移/驗證信件誘導用戶在假網站輸入助記詞；屬於鏈下基礎設施或終端威脅，不應因影響錢包而猜作某條鏈的協議漏洞。\n\n## 事件經過\n1. 攻擊者準備仿冒內容、包、網站或載荷。\n2. 通過對應渠道觸達開發者/員工/用戶。\n3. 受害者下載、運行、授權或提交秘密後，憑據與會話面臨洩露。\n4. 公開材料未逐一證明後續鏈上盜幣。\n5. 防守方披露並給出隔離建議。\n\n## 資金流向\n1. 鏈下投遞基礎設施 → 受害終端/瀏覽器/開發環境 → 潛在錢包或企業憑據。\n2. 無已確認統一鏈上轉移路徑。\n\n## 金額口徑\n現有資料沒有提供可穩定核驗的美元損失值。 原始資產與金額說明為：未確認彙總損失\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n源文件未保存事件級原帖 URL、樣本 hash、C2、受害地址或鏈上 Tx；不得把披露日冒充所有感染髮生日，也不得把潛在影響計為已盜金額。\n\n## 處置狀態\n作為威脅活動簇保留；Ledger 不會要求用戶通過信件、二維碼或網頁輸入 seed phrase。", "en": "## Incident background\nOn 2026-05-17, Ledger physical-letter seed phishing campaign was reported. Available evidence indicates that physical letters impersonating Ledger attempted to steal wallet seed phrases. The report assigns evidence level C.\n\n## Incident sequence\nPublic reporting describes an executed event affecting Ledger physical-letter seed phishing campaign. The affected path involved Other. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Other. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nAvailable material does not provide a stable verified USD loss amount. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n1 public source support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "phishing-approval", "severity": "medium", "chains": [ "Other" ], "ecosystems": [ "Other" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "现有资料没有提供可稳定核验的美元损失值。 原始资产与金额说明为：未确认汇总损失", "tw": "現有資料沒有提供可穩定核驗的美元損失值。 原始資產與金額說明為：未確認彙總損失", "en": "Available material does not provide a stable verified USD loss amount. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-applicable", "addresses": [], "references": [ { "label": { "zh": "原报告保存的月度发现入口；事件级直接 URL 待补", "tw": "原報告保存的月度發現入口；事件級直接 URL 待補", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2061353830437249033", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-159", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-146", "status": "verified", "incidentDate": "2026-05-17", "datePrecision": "day", "title": { "zh": "SEA Token", "tw": "SEA Token", "en": "SEA Token security incident" }, "summary": { "zh": "现有公开证据仅为月度追踪清单；链、根因、资金流与处置未恢复。不得猜函数名、攻击方式、私钥归因或内部人员。 公开损失采用约 $153,000。", "tw": "現有公開證據僅為月度追蹤清單；鏈、根因、資金流與處置未恢復。不得猜函數名、攻擊方式、私鑰歸因或內部人員。 公開損失採用約 $153,000。", "en": "SEA Token security incident was reported on 2026-05-17. Evidence indicates that public monitoring confirmed an executed protocol exploit but did not establish a complete root cause. Reported loss is approximately $153,000." }, "details": { "zh": "## 事件背景\n现有公开证据仅为月度追踪清单；链、根因、资金流与处置未恢复。不得猜函数名、攻击方式、私钥归因或内部人员。\n\n## 事件经过\n1. 追踪清单记录项目名、日期和金额。\n2. 本轮未恢复项目官方或安全机构事件原帖。\n3. 攻击准备、触发、资产离开与处置步骤均保持待核。\n4. 后续需用项目身份、链和交易逐项闭环。\n\n## 资金流向\n1. 受影响地址/合约 → 初始接收 → 兑换/归集/跨链/混币/CEX：各段均未公开恢复。\n\n## 金额口径\n公开损失采用约 $153,000。 原始资产与金额说明为：约 153,000 美元\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n证据等级 C 按用户要求保留；只有汇总清单，缺少完整地址、TxID、具体链与技术复盘。不能把缺口写成否定事件，也不能填造细节。\n\n## 处置状态\n调查/补证中；不推断为闪电贷、私钥或 LP 操纵", "tw": "## 事件背景\n現有公開證據僅為月度追蹤清單；鏈、根因、資金流與處置未恢復。不得猜函數名、攻擊方式、私鑰歸因或內部人員。\n\n## 事件經過\n1. 追蹤清單記錄專案名、日期和金額。\n2. 本輪未恢復專案官方或安全機構事件原帖。\n3. 攻擊準備、觸發、資產離開與處置步驟均保持待核。\n4. 後續需用專案身份、鏈和交易逐項閉環。\n\n## 資金流向\n1. 受影響地址/合約 → 初始接收 → 兌換/歸集/跨鏈/混幣/CEX：各段均未公開恢復。\n\n## 金額口徑\n公開損失採用約 $153,000。 原始資產與金額說明為：約 153,000 美元\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n證據等級 C 按用戶要求保留；只有彙總清單，缺少完整地址、TxID、具體鏈與技術復盤。不能把缺口寫成否定事件，也不能填造細節。\n\n## 處置狀態\n調查/補證中；不推斷為閃電貸、私鑰或 LP 操縱", "en": "## Incident background\nOn 2026-05-17, SEA Token security incident was reported. Available evidence indicates that public monitoring confirmed an executed protocol exploit but did not establish a complete root cause. The report assigns evidence level C.\n\n## Incident sequence\nPublic reporting describes an executed event affecting SEA Token security incident. The affected path involved Other. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Other. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $153,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n1 public source support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "protocol-exploit", "severity": "medium", "chains": [ "Other" ], "ecosystems": [ "Other" ], "lossUsd": 153000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $153,000。 原始资产与金额说明为：约 153,000 美元", "tw": "公開損失採用約 $153,000。 原始資產與金額說明為：約 153,000 美元", "en": "Reported loss is recorded at approximately $153,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "Nathan 5 月 31 日起事件追踪清单", "tw": "Nathan 5 月 31 日起事件追蹤清單", "en": "x.com public source" }, "url": "https://x.com/0xxNathan/status/2061459771400827312", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-146", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-132", "status": "verified", "incidentDate": "2026-05-17", "datePrecision": "day", "title": { "zh": "Adshares Bridge", "tw": "Adshares Bridge", "en": "Adshares Bridge exploit" }, "summary": { "zh": "桥验证流程可被绕过；具体签名、消息或函数缺陷未从源文件恢复。 公开损失采用约 $88,000.00。", "tw": "橋驗證流程可被繞過；具體簽名、消息或函數缺陷未從源文件恢復。 公開損失採用約 $88,000.00。", "en": "Adshares Bridge exploit was reported on 2026-05-17. Evidence indicates that the Adshares bridge validation path was exploited. Reported loss is approximately $88,000.00." }, "details": { "zh": "## 事件背景\n桥验证流程可被绕过；具体签名、消息或函数缺陷未从源文件恢复。\n\n## 事件经过\n1. 攻击者触发验证绕过。\n2. Ethereum 桥释放约 62.8 万美元资产。\n3. 项目追踪并协调。\n4. 约 86% 资产后续返还。\n\n## 资金流向\n1. Ethereum 桥 → 攻击者 → 约 86% 返还。\n2. 剩余约 14% 去向待核。\n\n## 金额口径\n初始损失约为 62.8 万美元，公开资料称约 86% 已返还。因缺少精确返还美元值，公开损失采用约 8.8 万美元净口径。\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n返还比例来自跟踪口径，完整返还地址/Tx 未保存；不能把初始暴露继续写成最终净损失。\n\n## 处置状态\n大部分返还；净损失需按最终清算确认。", "tw": "## 事件背景\n橋驗證流程可被繞過；具體簽名、消息或函數缺陷未從源文件恢復。\n\n## 事件經過\n1. 攻擊者觸發驗證繞過。\n2. Ethereum 橋釋放約 62.8 萬美元資產。\n3. 專案追蹤並協調。\n4. 約 86% 資產後續返還。\n\n## 資金流向\n1. Ethereum 橋 → 攻擊者 → 約 86% 返還。\n2. 剩餘約 14% 去向待核。\n\n## 金額口徑\n初始損失約為 62.8 萬美元，公開資料稱約 86% 已返還。因缺少精確返還美元值，公開損失採用約 8.8 萬美元淨口徑。\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n返還比例來自跟蹤口徑，完整返還地址/Tx 未保存；不能把初始暴露繼續寫成最終淨損失。\n\n## 處置狀態\n大部分返還；淨損失需按最終清算確認。", "en": "## Incident background\nOn 2026-05-17, Adshares Bridge exploit was reported. Available evidence indicates that the Adshares bridge validation path was exploited. The report assigns evidence level B.\n\n## Incident sequence\nPublic reporting describes an executed event affecting Adshares Bridge exploit. The affected path involved Ethereum. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Ethereum. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nInitial loss was approximately $628,000 and public reporting said about 86% was returned. Because no exact returned USD amount was published, the public loss uses an approximately $88,000 net basis.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n2 public sources support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "bridge-exploit", "severity": "low", "chains": [ "Ethereum" ], "ecosystems": [ "Ethereum" ], "lossUsd": 88000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "初始损失约为 62.8 万美元，公开资料称约 86% 已返还。因缺少精确返还美元值，公开损失采用约 8.8 万美元净口径。", "tw": "初始損失約為 62.8 萬美元，公開資料稱約 86% 已返還。因缺少精確返還美元值，公開損失採用約 8.8 萬美元淨口徑。", "en": "Initial loss was approximately $628,000 and public reporting said about 86% was returned. Because no exact returned USD amount was published, the public loss uses an approximately $88,000 net basis." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "PeckShield 返还跟踪", "tw": "PeckShield 返還跟蹤", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2056335190709223428", "type": "research" }, { "label": { "zh": "PeckShield 月报", "tw": "PeckShield 月報", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2061353830437249033", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-132", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-120", "status": "verified", "incidentDate": "2026-05-15", "datePrecision": "day", "title": { "zh": "THORChain", "tw": "THORChain", "en": "THORChain multichain vault theft" }, "summary": { "zh": "攻击者先质押使恶意节点进入签名集，在 GG18/GG20 阈值签名多轮交互中发送畸形证明，逐步收集其他参与者密钥份额并离线重建 vault 完整私钥。 公开损失采用约 $10,350,000。", "tw": "攻擊者先質押使惡意節點進入簽名集，在 GG18/GG20 閾值簽名多輪交互中發送畸形證明，逐步收集其他參與者密鑰份額並離線重建 vault 完整私鑰。 公開損失採用約 $10,350,000。", "en": "THORChain multichain vault theft was reported on 2026-05-15. Evidence indicates that a malicious validator used threshold-signing interactions to recover vault signing material. Reported loss is approximately $10,350,000." }, "details": { "zh": "## 事件背景\n攻击者先质押使恶意节点进入签名集，在 GG18/GG20 阈值签名多轮交互中发送畸形证明，逐步收集其他参与者密钥份额并离线重建 vault 完整私钥。\n\n## 事件经过\n1. 攻击者准备 bond 并进入验证者签名集。\n2. 在多轮 TSS 交互中投递畸形证明。\n3. 密钥份额逐步泄露。\n4. 攻击者离线恢复 vault 私钥。\n5. 协调扫走多链协议资产。\n6. 自动防护发现异常并停机。\n\n## 资金流向\n1. 至少 9 条链协议 vault → 攻击者各链地址。\n2. 恶意节点 bond 后被 slash。\n3. 具体桥接、兑换、CEX 路径未从源文件恢复。\n\n## 金额口径\n公开损失采用约 $10,350,000。 原始资产与金额说明为：约 1,000 万—1,070 万美元；主要由协议流动性承担，个人用户 swap 未被直接盗取\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n“至少 9 条链”与列举的 Bitcoin、Ethereum、BNB Chain、Base 并不等于其余网络已逐条恢复；完整多链地址和 Tx 账本未公开恢复。\n\n## 处置状态\n交易与签名暂停约 12—13 小时；恶意节点 bond 被 slash；暂停 churn 并审查签名实现。", "tw": "## 事件背景\n攻擊者先質押使惡意節點進入簽名集，在 GG18/GG20 閾值簽名多輪交互中發送畸形證明，逐步收集其他參與者密鑰份額並離線重建 vault 完整私鑰。\n\n## 事件經過\n1. 攻擊者準備 bond 並進入驗證者簽名集。\n2. 在多輪 TSS 交互中投遞畸形證明。\n3. 密鑰份額逐步洩露。\n4. 攻擊者離線恢復 vault 私鑰。\n5. 協調掃走多鏈協議資產。\n6. 自動防護髮現異常並停機。\n\n## 資金流向\n1. 至少 9 條鏈協議 vault → 攻擊者各鏈地址。\n2. 惡意節點 bond 後被 slash。\n3. 具體橋接、兌換、CEX 路徑未從源文件恢復。\n\n## 金額口徑\n公開損失採用約 $10,350,000。 原始資產與金額說明為：約 1,000 萬—1,070 萬美元；主要由協議流動性承擔，個人用戶 swap 未被直接盜取\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n“至少 9 條鏈”與列舉的 Bitcoin、Ethereum、BNB Chain、Base 並不等於其餘網絡已逐條恢復；完整多鏈地址和 Tx 賬本未公開恢復。\n\n## 處置狀態\n交易與簽名暫停約 12—13 小時；惡意節點 bond 被 slash；暫停 churn 並審查簽名實現。", "en": "## Incident background\nOn 2026-05-15, THORChain multichain vault theft was reported. Available evidence indicates that a malicious validator used threshold-signing interactions to recover vault signing material. The report assigns evidence level B.\n\n## Incident sequence\nPublic reporting describes an executed event affecting THORChain multichain vault theft. The affected path involved Bitcoin, Ethereum, BNB Chain, Base. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Bitcoin, Ethereum, BNB Chain, Base. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $10,350,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n2 public sources support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "key-compromise", "severity": "critical", "chains": [ "Bitcoin", "Ethereum", "BNB Chain", "Base" ], "ecosystems": [ "Bitcoin", "Ethereum", "BNB Chain", "Base" ], "lossUsd": 10350000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $10,350,000。 原始资产与金额说明为：约 1,000 万—1,070 万美元；主要由协议流动性承担，个人用户 swap 未被直接盗取", "tw": "公開損失採用約 $10,350,000。 原始資產與金額說明為：約 1,000 萬—1,070 萬美元；主要由協議流動性承擔，個人用戶 swap 未被直接盜取", "en": "Reported loss is recorded at approximately $10,350,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "PeckShield 报警", "tw": "PeckShield 報警", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2055226411125027171", "type": "research" }, { "label": { "zh": "Halborn 月度复盘", "tw": "Halborn 月度復盤", "en": "halborn.com public source" }, "url": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-may-2026", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-120", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-161", "status": "verified", "incidentDate": "2026-05-14", "datePrecision": "day", "title": { "zh": "假工作面试 JobStealer", "tw": "假工作面試 JobStealer", "en": "Fake job-interview JobStealer campaign" }, "summary": { "zh": "以招聘、代码测试和视频面试诱饵投递信息窃取程序；属于链下基础设施或终端威胁，不应因影响钱包而猜作某条链的协议漏洞。 现有资料没有提供稳定可核的美元损失值。", "tw": "以招聘、代碼測試和視頻面試誘餌投遞資訊竊取程序；屬於鏈下基礎設施或終端威脅，不應因影響錢包而猜作某條鏈的協議漏洞。 現有資料沒有提供穩定可核的美元損失值。", "en": "Fake job-interview JobStealer campaign was reported on 2026-05-14. Evidence indicates that fake job interviews delivered credential and wallet-stealing malware. No stable verified USD loss amount was published." }, "details": { "zh": "## 事件背景\n以招聘、代码测试和视频面试诱饵投递信息窃取程序；属于链下基础设施或终端威胁，不应因影响钱包而猜作某条链的协议漏洞。\n\n## 事件经过\n1. 攻击者准备仿冒内容、包、网站或载荷。\n2. 通过对应渠道触达开发者/员工/用户。\n3. 受害者下载、运行、授权或提交秘密后，凭据与会话面临泄露。\n4. 公开材料未逐一证明后续链上盗币。\n5. 防守方披露并给出隔离建议。\n\n## 资金流向\n1. 链下投递基础设施 → 受害终端/浏览器/开发环境 → 潜在钱包或企业凭据。\n2. 无已确认统一链上转移路径。\n\n## 金额口径\n现有资料没有提供可稳定核验的美元损失值。 原始资产与金额说明为：未确认统一链上损失\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n源文件未保存事件级原帖 URL、样本 hash、C2、受害地址或链上 Tx；不得把披露日冒充所有感染发生日，也不得把潜在影响计为已盗金额。\n\n## 处置状态\n作为威胁活动簇保留；陌生招聘代码不应在持有生产密钥的设备运行。", "tw": "## 事件背景\n以招聘、代碼測試和視頻面試誘餌投遞資訊竊取程序；屬於鏈下基礎設施或終端威脅，不應因影響錢包而猜作某條鏈的協議漏洞。\n\n## 事件經過\n1. 攻擊者準備仿冒內容、包、網站或載荷。\n2. 通過對應渠道觸達開發者/員工/用戶。\n3. 受害者下載、運行、授權或提交秘密後，憑據與會話面臨洩露。\n4. 公開材料未逐一證明後續鏈上盜幣。\n5. 防守方披露並給出隔離建議。\n\n## 資金流向\n1. 鏈下投遞基礎設施 → 受害終端/瀏覽器/開發環境 → 潛在錢包或企業憑據。\n2. 無已確認統一鏈上轉移路徑。\n\n## 金額口徑\n現有資料沒有提供可穩定核驗的美元損失值。 原始資產與金額說明為：未確認統一鏈上損失\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n源文件未保存事件級原帖 URL、樣本 hash、C2、受害地址或鏈上 Tx；不得把披露日冒充所有感染髮生日，也不得把潛在影響計為已盜金額。\n\n## 處置狀態\n作為威脅活動簇保留；陌生招聘代碼不應在持有生產密鑰的設備運行。", "en": "## Incident background\nOn 2026-05-14, Fake job-interview JobStealer campaign was reported. Available evidence indicates that fake job interviews delivered credential and wallet-stealing malware. The report assigns evidence level C.\n\n## Incident sequence\nPublic reporting describes an executed event affecting Fake job-interview JobStealer campaign. The affected path involved Other. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Other. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nAvailable material does not provide a stable verified USD loss amount. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n1 public source support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "supply-chain", "severity": "medium", "chains": [ "Other" ], "ecosystems": [ "Other" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "现有资料没有提供可稳定核验的美元损失值。 原始资产与金额说明为：未确认统一链上损失", "tw": "現有資料沒有提供可穩定核驗的美元損失值。 原始資產與金額說明為：未確認統一鏈上損失", "en": "Available material does not provide a stable verified USD loss amount. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-applicable", "addresses": [], "references": [ { "label": { "zh": "原报告保存的月度发现入口；事件级直接 URL 待补", "tw": "原報告保存的月度發現入口；事件級直接 URL 待補", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2061353830437249033", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-161", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-139", "status": "verified", "incidentDate": "2026-05-13", "datePrecision": "day", "title": { "zh": "ShapeShift Colony", "tw": "ShapeShift Colony", "en": "ShapeShift Colony meta-transaction exploit" }, "summary": { "zh": "meta-transaction 路径允许在受信执行上下文中发生 delegatecall 劫持，攻击者据此运行恶意逻辑。 公开损失采用约 $132,000。", "tw": "meta-transaction 路徑允許在受信執行上下文中發生 delegatecall 劫持，攻擊者據此運行惡意邏輯。 公開損失採用約 $132,000。", "en": "ShapeShift Colony meta-transaction exploit was reported on 2026-05-13. Evidence indicates that a meta-transaction validation weakness allowed unauthorized execution. Reported loss is approximately $132,000." }, "details": { "zh": "## 事件背景\nmeta-transaction 路径允许在受信执行上下文中发生 delegatecall 劫持，攻击者据此运行恶意逻辑。\n\n## 事件经过\n1. 攻击者构造 meta-transaction。\n2. 诱导或触发受信执行上下文。\n3. delegatecall 进入恶意逻辑。\n4. 资产在受信权限下被转走。\n\n## 资金流向\n1. Arbitrum 受影响合约/钱包 → 攻击者。\n2. 后续路径待核。\n\n## 金额口径\n公开损失采用约 $132,000。 原始资产与金额说明为：约 13.2 万美元\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n源文件未保存具体合约、calldata、攻击地址和 Tx；不能扩展到 ShapeShift 其他产品。\n\n## 处置状态\n未见追回信息。", "tw": "## 事件背景\nmeta-transaction 路徑允許在受信執行上下文中發生 delegatecall 劫持，攻擊者據此運行惡意邏輯。\n\n## 事件經過\n1. 攻擊者構造 meta-transaction。\n2. 誘導或觸發受信執行上下文。\n3. delegatecall 進入惡意邏輯。\n4. 資產在受信權限下被轉走。\n\n## 資金流向\n1. Arbitrum 受影響合約/錢包 → 攻擊者。\n2. 後續路徑待核。\n\n## 金額口徑\n公開損失採用約 $132,000。 原始資產與金額說明為：約 13.2 萬美元\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n源文件未保存具體合約、calldata、攻擊地址和 Tx；不能擴展到 ShapeShift 其他產品。\n\n## 處置狀態\n未見追回資訊。", "en": "## Incident background\nOn 2026-05-13, ShapeShift Colony meta-transaction exploit was reported. Available evidence indicates that a meta-transaction validation weakness allowed unauthorized execution. The report assigns evidence level B.\n\n## Incident sequence\nPublic reporting describes an executed event affecting ShapeShift Colony meta-transaction exploit. The affected path involved Arbitrum. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Arbitrum. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $132,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n2 public sources support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "protocol-exploit", "severity": "medium", "chains": [ "Arbitrum" ], "ecosystems": [ "Arbitrum" ], "lossUsd": 132000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $132,000。 原始资产与金额说明为：约 13.2 万美元", "tw": "公開損失採用約 $132,000。 原始資產與金額說明為：約 13.2 萬美元", "en": "Reported loss is recorded at approximately $132,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "PeckShield 月报", "tw": "PeckShield 月報", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2061353830437249033", "type": "research" }, { "label": { "zh": "Cecuro 复盘", "tw": "Cecuro 復盤", "en": "cecuro.ai public source" }, "url": "https://cecuro.ai/blog/may-2026-hack-recap", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-139", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-128", "status": "verified", "incidentDate": "2026-05-13", "datePrecision": "day", "title": { "zh": "Transit Finance", "tw": "Transit Finance", "en": "Transit Finance legacy-contract exploit" }, "summary": { "zh": "2022 年已在前端/产品层弃用的旧合约仍可链上调用，且输入验证不足；旧余额与授权并未随前端下线而失效。 公开损失采用约 $1,880,000。", "tw": "2022 年已在前端/產品層棄用的舊合約仍可鏈上調用，且輸入驗證不足；舊餘額與授權並未隨前端下線而失效。 公開損失採用約 $1,880,000。", "en": "Transit Finance legacy-contract exploit was reported on 2026-05-13. Evidence indicates that a legacy Transit Finance contract path remained exploitable. Reported loss is approximately $1,880,000." }, "details": { "zh": "## 事件背景\n2022 年已在前端/产品层弃用的旧合约仍可链上调用，且输入验证不足；旧余额与授权并未随前端下线而失效。\n\n## 事件经过\n1. 攻击者定位仍可调用的 legacy 合约。\n2. 构造可通过不足验证的输入。\n3. 提取仍存余额或授权资产。\n4. 约 188 万 DAI 进入初始地址。\n5. 兑换为约 832.9 ETH。\n6. 由后续 EOA 存入 Tornado Cash。\n\n## 资金流向\n1. 旧合约 → 0x8a634DfA2609358849D7D65FFA270C8A57a8abA5 — [链：Ethereum] [被盗资产接收] [约 188 万 DAI] → 兑换 832.9 ETH → 0x9db82d911328196d50C36450B1Ef5985DF15732B — [链：Ethereum] [混币前置] [Tornado 存款 EOA] → Tornado Cash。\n\n## 金额口径\n公开损失采用约 $1,880,000。 原始资产与金额说明为：初始约 188 万 DAI；后换为约 832.9 ETH 并存入 Tornado Cash\n\n## 地址与交易\n1. 被盗资产接收与归集地址：0x8a634DfA2609358849D7D65FFA270C8A57a8abA5（Ethereum）。\n2. Tornado Cash 存款前置地址：0x9db82d911328196d50C36450B1Ef5985DF15732B（Ethereum）。\n\n## 证据边界\n完整地址来自源文件，但未附具体浏览器 Tx；不能据地址位置进一步推断控制主体。\n\n## 处置状态\n团队承诺全额赔付用户并向攻击者发链上赏金邀约；最终赔付执行待核。", "tw": "## 事件背景\n2022 年已在前端/產品層棄用的舊合約仍可鏈上調用，且輸入驗證不足；舊餘額與授權並未隨前端下線而失效。\n\n## 事件經過\n1. 攻擊者定位仍可調用的 legacy 合約。\n2. 構造可通過不足驗證的輸入。\n3. 提取仍存餘額或授權資產。\n4. 約 188 萬 DAI 進入初始地址。\n5. 兌換為約 832.9 ETH。\n6. 由後續 EOA 存入 Tornado Cash。\n\n## 資金流向\n1. 舊合約 → 0x8a634DfA2609358849D7D65FFA270C8A57a8abA5 — [鏈：Ethereum] [被盜資產接收] [約 188 萬 DAI] → 兌換 832.9 ETH → 0x9db82d911328196d50C36450B1Ef5985DF15732B — [鏈：Ethereum] [混幣前置] [Tornado 存款 EOA] → Tornado Cash。\n\n## 金額口徑\n公開損失採用約 $1,880,000。 原始資產與金額說明為：初始約 188 萬 DAI；後換為約 832.9 ETH 並存入 Tornado Cash\n\n## 地址與交易\n1. 被盜資產接收與歸集地址：0x8a634DfA2609358849D7D65FFA270C8A57a8abA5（Ethereum）。\n2. Tornado Cash 存款前置地址：0x9db82d911328196d50C36450B1Ef5985DF15732B（Ethereum）。\n\n## 證據邊界\n完整地址來自源文件，但未附具體瀏覽器 Tx；不能據地址位置進一步推斷控制主體。\n\n## 處置狀態\n團隊承諾全額賠付用戶並向攻擊者發鏈上賞金邀約；最終賠付執行待核。", "en": "## Incident background\nOn 2026-05-13, Transit Finance legacy-contract exploit was reported. Available evidence indicates that a legacy Transit Finance contract path remained exploitable. The report assigns evidence level B.\n\n## Incident sequence\nPublic reporting describes an executed event affecting Transit Finance legacy-contract exploit. The affected path involved Ethereum. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Ethereum. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $1,880,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\n1. stolen-asset recipient and consolidation address: `0x8a634DfA2609358849D7D65FFA270C8A57a8abA5` on Ethereum.\n2. Tornado Cash pre-deposit address: `0x9db82d911328196d50C36450B1Ef5985DF15732B` on Ethereum.\n\n## Evidence boundary\n2 public sources support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "protocol-exploit", "severity": "high", "chains": [ "Ethereum" ], "ecosystems": [ "Ethereum" ], "lossUsd": 1880000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $1,880,000。 原始资产与金额说明为：初始约 188 万 DAI；后换为约 832.9 ETH 并存入 Tornado Cash", "tw": "公開損失採用約 $1,880,000。 原始資產與金額說明為：初始約 188 萬 DAI；後換為約 832.9 ETH 並存入 Tornado Cash", "en": "Reported loss is recorded at approximately $1,880,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "published", "addresses": [ { "chain": "Ethereum", "address": "0x8a634DfA2609358849D7D65FFA270C8A57a8abA5", "entity": { "zh": "被盗资产接收与归集地址", "tw": "被盜資產接收與歸集地址", "en": "stolen-asset recipient and consolidation address" }, "role": "attacker", "category": "stolen_funds", "confidence": 0.9, "sourceUrl": "https://x.com/PeckShieldAlert/status/2054537423405933016", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "被盗资产接收与归集地址；角色来自所引公开来源，仅用于本次事件的证据标签。", "tw": "被盜資產接收與歸集地址；角色來自所引公開來源，僅用於本次事件的證據標籤。", "en": "stolen-asset recipient and consolidation address; the role is limited to the cited public evidence for this incident." }, "reviewRequired": true }, { "chain": "Ethereum", "address": "0x9db82d911328196d50C36450B1Ef5985DF15732B", "entity": { "zh": "Tornado Cash 存款前置地址", "tw": "Tornado Cash 存款前置地址", "en": "Tornado Cash pre-deposit address" }, "role": "fund-flow", "category": "mixer", "confidence": 0.9, "sourceUrl": "https://x.com/PeckShieldAlert/status/2054537423405933016", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "Tornado Cash 存款前置地址；角色来自所引公开来源，仅用于本次事件的证据标签。", "tw": "Tornado Cash 存款前置地址；角色來自所引公開來源，僅用於本次事件的證據標籤。", "en": "Tornado Cash pre-deposit address; the role is limited to the cited public evidence for this incident." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "PeckShield 初报", "tw": "PeckShield 初報", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2054537423405933016", "type": "research" }, { "label": { "zh": "Halborn 月度复盘", "tw": "Halborn 月度復盤", "en": "halborn.com public source" }, "url": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-may-2026", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-128", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-145", "status": "verified", "incidentDate": "2026-05-12", "datePrecision": "day", "title": { "zh": "SQ Protocol", "tw": "SQ Protocol", "en": "SQ Protocol ownership compromise" }, "summary": { "zh": "SQ Protocol 已验证的 Staking 合约存在硬编码 owner 后门。攻击者通过 type-0x4 交易及 authorizationList 取得权限，接管所有权后制造虚假质押凭证，从协议赎回 USDT，并把 SQi 代币抛向流动性池。 公开损失采用约 $346,100。", "tw": "SQ Protocol 已驗證的 Staking 合約存在硬編碼 owner 後門。攻擊者通過 type-0x4 交易及 authorizationList 取得權限，接管所有權後製造虛假質押憑證，從協議贖回 USDT，並把 SQi 代幣拋向流動性池。 公開損失採用約 $346,100。", "en": "SQ Protocol ownership compromise was reported on 2026-05-12. Evidence indicates that contract ownership was taken over and used against the staking contract. Reported loss is approximately $346,100." }, "details": { "zh": "## 事件背景\nSQ Protocol 已验证的 Staking 合约存在硬编码 owner 后门。攻击者通过 type-0x4 交易及 authorizationList 取得权限，接管所有权后制造虚假质押凭证，从协议赎回 USDT，并把 SQi 代币抛向流动性池。\n\n## 事件经过\n1. 攻击者构造包含 authorizationList 的 type-0x4 交易。\n2. 利用硬编码 owner 权限路径接管 Staking 合约所有权。\n3. 铸造或生成无真实抵押支持的质押凭证。\n4. 使用凭证赎回 USDT。\n5. 同时抛售 SQi 代币，从流动性中实现获利。\n6. 慢雾档案合计损失约 346,100 美元。\n\n## 资金流向\nBNB Chain Staking 合约 → 假质押凭证 → USDT 赎回/SQi 流动性池抛售 → 攻击者。完整获利地址、后续归集与 CEX 路径未恢复。\n\n## 金额口径\n公开损失采用约 $346,100。 原始资产与金额说明为：慢雾档案记录约 346,100 美元\n\n## 地址与交易\n1. 受影响质押合约：0x404404a845fff0201f3a4d419b4839fc419c99f7（BNB Chain）。\n\n## 证据边界\n完整受影响合约已恢复，但攻击者地址与 TxID 尚未从官网正文恢复；不能把合约地址误标为黑客地址。\n\n## 处置状态\n约 346,100 美元按慢雾口径计损；完整暂停、补偿、返还和执法状态仍待项目方后续。", "tw": "## 事件背景\nSQ Protocol 已驗證的 Staking 合約存在硬編碼 owner 後門。攻擊者通過 type-0x4 交易及 authorizationList 取得權限，接管所有權後製造虛假質押憑證，從協議贖回 USDT，並把 SQi 代幣拋向流動性池。\n\n## 事件經過\n1. 攻擊者構造包含 authorizationList 的 type-0x4 交易。\n2. 利用硬編碼 owner 權限路徑接管 Staking 合約所有權。\n3. 鑄造或生成無真實抵押支持的質押憑證。\n4. 使用憑證贖回 USDT。\n5. 同時拋售 SQi 代幣，從流動性中實現獲利。\n6. 慢霧檔案合計損失約 346,100 美元。\n\n## 資金流向\nBNB Chain Staking 合約 → 假質押憑證 → USDT 贖回/SQi 流動性池拋售 → 攻擊者。完整獲利地址、後續歸集與 CEX 路徑未恢復。\n\n## 金額口徑\n公開損失採用約 $346,100。 原始資產與金額說明為：慢霧檔案記錄約 346,100 美元\n\n## 地址與交易\n1. 受影響質押合約：0x404404a845fff0201f3a4d419b4839fc419c99f7（BNB Chain）。\n\n## 證據邊界\n完整受影響合約已恢復，但攻擊者地址與 TxID 尚未從官網正文恢復；不能把合約地址誤標為黑客地址。\n\n## 處置狀態\n約 346,100 美元按慢霧口徑計損；完整暫停、補償、返還和執法狀態仍待專案方後續。", "en": "## Incident background\nOn 2026-05-12, SQ Protocol ownership compromise was reported. Available evidence indicates that contract ownership was taken over and used against the staking contract. The report assigns evidence level B.\n\n## Incident sequence\nPublic reporting describes an executed event affecting SQ Protocol ownership compromise. The affected path involved BNB Chain. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved BNB Chain. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $346,100. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\n1. affected staking contract: `0x404404a845fff0201f3a4d419b4839fc419c99f7` on BNB Chain.\n\n## Evidence boundary\n3 public sources support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "access-control", "severity": "medium", "chains": [ "BNB Chain" ], "ecosystems": [ "BNB Chain" ], "lossUsd": 346100, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $346,100。 原始资产与金额说明为：慢雾档案记录约 346,100 美元", "tw": "公開損失採用約 $346,100。 原始資產與金額說明為：慢霧檔案記錄約 346,100 美元", "en": "Reported loss is recorded at approximately $346,100. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "published", "addresses": [ { "chain": "BNB Chain", "address": "0x404404a845fff0201f3a4d419b4839fc419c99f7", "entity": { "zh": "受影响质押合约", "tw": "受影響質押合約", "en": "affected staking contract" }, "role": "contract", "category": "unknown", "confidence": 0.9, "sourceUrl": "https://x.com/Defi_Nerd_sec/status/2054425936746148148", "evidenceStatus": "verified_public_source", "evidenceSummary": { "zh": "受影响质押合约；角色来自所引公开来源，仅用于本次事件的证据标签。", "tw": "受影響質押合約；角色來自所引公開來源，僅用於本次事件的證據標籤。", "en": "affected staking contract; the role is limited to the cited public evidence for this incident." }, "reviewRequired": true } ], "references": [ { "label": { "zh": "Defi_Nerd_sec 技术披露", "tw": "Defi_Nerd_sec 技術披露", "en": "x.com public source" }, "url": "https://x.com/Defi_Nerd_sec/status/2054425936746148148", "type": "research" }, { "label": { "zh": "慢雾 Hacked Zone 5 月档案", "tw": "慢霧 Hacked Zone 5 月檔案", "en": "hacked.slowmist.io public source" }, "url": "https://hacked.slowmist.io/zh/?c=&page=5", "type": "research" }, { "label": { "zh": "Nathan 5 月 31 日起事件追踪清单", "tw": "Nathan 5 月 31 日起事件追蹤清單", "en": "x.com public source" }, "url": "https://x.com/0xxNathan/status/2061459771400827312", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-145", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-133", "status": "verified", "incidentDate": "2026-05-12", "datePrecision": "day", "title": { "zh": "Aurellion Labs", "tw": "Aurellion Labs", "en": "Aurellion Labs Diamond-proxy malicious-facet exploit" }, "summary": { "zh": "Diamond 代理未正确初始化，未保护的 initialize 可被外部调用取得 owner 权限，随后注入恶意 facet。 公开损失采用约 $456,000。", "tw": "Diamond 代理未正確初始化，未保護的 initialize 可被外部調用取得 owner 權限，隨後注入惡意 facet。 公開損失採用約 $456,000。", "en": "Aurellion Labs Diamond-proxy malicious-facet exploit was reported on 2026-05-12. Evidence indicates that a malicious Diamond proxy facet was installed through administrative authority. Reported loss is approximately $456,000." }, "details": { "zh": "## 事件背景\nDiamond 代理未正确初始化，未保护的 initialize 可被外部调用取得 owner 权限，随后注入恶意 facet。\n\n## 事件经过\n1. 攻击者调用未保护 initialize。\n2. 取得代理 owner。\n3. 加入恶意 facet。\n4. 在受信代理上下文调用恶意逻辑。\n5. 扫走授权资产。\n\n## 资金流向\n1. Arbitrum 受影响代理/授权来源 → 恶意 facet 控制路径 → 攻击者。\n\n2. 后续资金去向待核。\n\n## 金额口径\n公开损失采用约 $456,000。 原始资产与金额说明为：约 45.6 万美元\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n源文件未保存完整代理、facet、攻击地址和 Tx；函数级描述来自技术复盘口径。\n\n## 处置状态\n未见追回信息。", "tw": "## 事件背景\nDiamond 代理未正確初始化，未保護的 initialize 可被外部調用取得 owner 權限，隨後注入惡意 facet。\n\n## 事件經過\n1. 攻擊者調用未保護 initialize。\n2. 取得代理 owner。\n3. 加入惡意 facet。\n4. 在受信代理上下文調用惡意邏輯。\n5. 掃走授權資產。\n\n## 資金流向\n1. Arbitrum 受影響代理/授權來源 → 惡意 facet 控制路徑 → 攻擊者。\n\n2. 後續資金去向待核。\n\n## 金額口徑\n公開損失採用約 $456,000。 原始資產與金額說明為：約 45.6 萬美元\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n源文件未保存完整代理、facet、攻擊地址和 Tx；函數級描述來自技術復盤口徑。\n\n## 處置狀態\n未見追回資訊。", "en": "## Incident background\nOn 2026-05-12, Aurellion Labs Diamond-proxy malicious-facet exploit was reported. Available evidence indicates that a malicious Diamond proxy facet was installed through administrative authority. The report assigns evidence level B.\n\n## Incident sequence\nPublic reporting describes an executed event affecting Aurellion Labs Diamond-proxy malicious-facet exploit. The affected path involved Arbitrum. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Arbitrum. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $456,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n2 public sources support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "access-control", "severity": "medium", "chains": [ "Arbitrum" ], "ecosystems": [ "Arbitrum" ], "lossUsd": 456000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $456,000。 原始资产与金额说明为：约 45.6 万美元", "tw": "公開損失採用約 $456,000。 原始資產與金額說明為：約 45.6 萬美元", "en": "Reported loss is recorded at approximately $456,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "Halborn 月度复盘", "tw": "Halborn 月度復盤", "en": "halborn.com public source" }, "url": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-may-2026", "type": "research" }, { "label": { "zh": "PeckShield 月报", "tw": "PeckShield 月報", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2061353830437249033", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-133", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-126", "status": "verified", "incidentDate": "2026-05-12", "datePrecision": "day", "title": { "zh": "TAC Protocol TON–EVM 桥", "tw": "TAC Protocol TON–EVM 橋", "en": "TAC Protocol TON–EVM bridge incident" }, "summary": { "zh": "TON Jetton 桥路径中，TON 侧与 EVM 侧消息或资产映射逻辑存在缺陷；具体函数未从源文件恢复。 公开损失采用约 $280,000。", "tw": "TON Jetton 橋路徑中，TON 側與 EVM 側消息或資產映射邏輯存在缺陷；具體函數未從源文件恢復。 公開損失採用約 $280,000。", "en": "TAC Protocol TON–EVM bridge incident was reported on 2026-05-12. Evidence indicates that a TON–EVM bridge path was exploited and later handled through a negotiated return. Reported loss is approximately $280,000." }, "details": { "zh": "## 事件背景\nTON Jetton 桥路径中，TON 侧与 EVM 侧消息或资产映射逻辑存在缺陷；具体函数未从源文件恢复。\n\n## 事件经过\n1. 白帽利用 TON 侧桥路径逻辑错误。\n2. 目标侧释放资产。\n3. 事件最初被作为攻击暴露。\n4. 项目与执行者协调。\n5. 约 90% 在两天内返还。\n6. 约 10% 作为赏金。\n\n## 资金流向\n1. TON 侧桥路径 → EVM 目标网络 → 白帽控制地址 → 约 90% 返还项目。\n2. 10% 留作赏金。\n\n## 金额口径\n初始风险敞口约为 280 万美元。公开资料称约九成资产返还、约一成作为赏金；因未披露精确返还美元值，公开损失采用约 28 万美元净口径，返还金额不另行估算。\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\nEVM 目标具体网络、完整地址和返还 Tx 未恢复；不能猜作 Ethereum。\n\n## 处置状态\n后续重新归类为白帽事件；不按恶意盗窃净损失统计。", "tw": "## 事件背景\nTON Jetton 橋路徑中，TON 側與 EVM 側消息或資產映射邏輯存在缺陷；具體函數未從源文件恢復。\n\n## 事件經過\n1. 白帽利用 TON 側橋路徑邏輯錯誤。\n2. 目標側釋放資產。\n3. 事件最初被作為攻擊暴露。\n4. 專案與執行者協調。\n5. 約 90% 在兩天內返還。\n6. 約 10% 作為賞金。\n\n## 資金流向\n1. TON 側橋路徑 → EVM 目標網絡 → 白帽控制地址 → 約 90% 返還專案。\n2. 10% 留作賞金。\n\n## 金額口徑\n初始風險敞口約為 280 萬美元。公開資料稱約九成資產返還、約一成作為賞金；因未披露精確返還美元值，公開損失採用約 28 萬美元淨口徑，返還金額不另行估算。\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\nEVM 目標具體網絡、完整地址和返還 Tx 未恢復；不能猜作 Ethereum。\n\n## 處置狀態\n後續重新歸類為白帽事件；不按惡意盜竊淨損失統計。", "en": "## Incident background\nOn 2026-05-12, TAC Protocol TON–EVM bridge incident was reported. Available evidence indicates that a TON–EVM bridge path was exploited and later handled through a negotiated return. The report assigns evidence level A.\n\n## Incident sequence\nPublic reporting describes an executed event affecting TAC Protocol TON–EVM bridge incident. The affected path involved TON. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved TON. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nInitial exposure was approximately $2.8 million. Public reporting said about 90% was returned and about 10% remained as a bounty. Because no exact returned USD amount was published, the public loss uses an approximately $280,000 net basis and does not estimate a separate recovery value.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n2 public sources support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "bridge-exploit", "severity": "medium", "chains": [ "TON" ], "ecosystems": [ "TON" ], "lossUsd": 280000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "初始风险敞口约为 280 万美元。公开资料称约九成资产返还、约一成作为赏金；因未披露精确返还美元值，公开损失采用约 28 万美元净口径，返还金额不另行估算。", "tw": "初始風險敞口約為 280 萬美元。公開資料稱約九成資產返還、約一成作為賞金；因未披露精確返還美元值，公開損失採用約 28 萬美元淨口徑，返還金額不另行估算。", "en": "Initial exposure was approximately $2.8 million. Public reporting said about 90% was returned and about 10% remained as a bounty. Because no exact returned USD amount was published, the public loss uses an approximately $280,000 net basis and does not estimate a separate recovery value." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "PeckShield 月报", "tw": "PeckShield 月報", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2061353830437249033", "type": "research" }, { "label": { "zh": "Halborn 月度复盘", "tw": "Halborn 月度復盤", "en": "halborn.com public source" }, "url": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-may-2026", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-126", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-183", "status": "verified", "incidentDate": "2026-05-11", "datePrecision": "day", "title": { "zh": "Huma Finance V1 BaseCreditPool", "tw": "Huma Finance V1 BaseCreditPool", "en": "Huma Finance V1 BaseCreditPool legacy-contract exploit" }, "summary": { "zh": "已弃用并处于下线过程中的 Polygon V1 BaseCreditPool 存在逻辑缺陷。公开摘要没有给出漏洞函数和完整调用序列，因此只保留“V1 逻辑漏洞”的官方边界。 公开损失采用约 $101,400。", "tw": "已棄用並處於下線過程中的 Polygon V1 BaseCreditPool 存在邏輯缺陷。公開摘要沒有給出漏洞函數和完整調用序列，因此只保留“V1 邏輯漏洞”的官方邊界。 公開損失採用約 $101,400。", "en": "Huma Finance V1 BaseCreditPool legacy-contract exploit was reported on 2026-05-11. Evidence indicates that a legacy BaseCreditPool contract path remained exploitable. Reported loss is approximately $101,400." }, "details": { "zh": "## 事件背景\n已弃用并处于下线过程中的 Polygon V1 BaseCreditPool 存在逻辑缺陷。公开摘要没有给出漏洞函数和完整调用序列，因此只保留“V1 逻辑漏洞”的官方边界。\n\n## 事件经过\n1. 攻击者利用 Polygon 上的 V1 BaseCreditPool 逻辑漏洞。\n2. 从协议费用和资金池所有者费用中转出约 101,400 USDC/USDC.e。\n3. Huma 确认用户本金和 PST 代币未受影响。\n4. 团队立即完全暂停所有 V1 合约。\n5. Solana 上的 V2 为完全重写版本，官方称不受影响。\n\n## 资金流向\nPolygon V1 BaseCreditPool 费用路径 → 攻击者初始接收；后续兑换、跨链或 CEX 路径未公开恢复。\n\n## 金额口径\n公开损失采用约 $101,400。 原始资产与金额说明为：约 101,400 枚 USDC 与 USDC.e，来自协议费用及 pool owner 费用；官方称用户资金无风险\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n不能把“用户资金无风险”误写成“没有损失”；101,400 枚稳定币属于协议费用/池所有者费用损失。\n\n## 处置状态\nV1 已完全暂停；用户资金据官方声明安全。被转出的协议/池所有者费用是否追回或补足待后续披露。", "tw": "## 事件背景\n已棄用並處於下線過程中的 Polygon V1 BaseCreditPool 存在邏輯缺陷。公開摘要沒有給出漏洞函數和完整調用序列，因此只保留“V1 邏輯漏洞”的官方邊界。\n\n## 事件經過\n1. 攻擊者利用 Polygon 上的 V1 BaseCreditPool 邏輯漏洞。\n2. 從協議費用和資金池所有者費用中轉出約 101,400 USDC/USDC.e。\n3. Huma 確認用戶本金和 PST 代幣未受影響。\n4. 團隊立即完全暫停所有 V1 合約。\n5. Solana 上的 V2 為完全重寫版本，官方稱不受影響。\n\n## 資金流向\nPolygon V1 BaseCreditPool 費用路徑 → 攻擊者初始接收；後續兌換、跨鏈或 CEX 路徑未公開恢復。\n\n## 金額口徑\n公開損失採用約 $101,400。 原始資產與金額說明為：約 101,400 枚 USDC 與 USDC.e，來自協議費用及 pool owner 費用；官方稱用戶資金無風險\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n不能把“用戶資金無風險”誤寫成“沒有損失”；101,400 枚穩定幣屬於協議費用/池所有者費用損失。\n\n## 處置狀態\nV1 已完全暫停；用戶資金據官方聲明安全。被轉出的協議/池所有者費用是否追回或補足待後續披露。", "en": "## Incident background\nOn 2026-05-11, Huma Finance V1 BaseCreditPool legacy-contract exploit was reported. Available evidence indicates that a legacy BaseCreditPool contract path remained exploitable. The report assigns evidence level A.\n\n## Incident sequence\nPublic reporting describes an executed event affecting Huma Finance V1 BaseCreditPool legacy-contract exploit. The affected path involved Polygon. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Polygon. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $101,400. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n2 public sources support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "protocol-exploit", "severity": "medium", "chains": [ "Polygon" ], "ecosystems": [ "Polygon" ], "lossUsd": 101400, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $101,400。 原始资产与金额说明为：约 101,400 枚 USDC 与 USDC.e，来自协议费用及 pool owner 费用；官方称用户资金无风险", "tw": "公開損失採用約 $101,400。 原始資產與金額說明為：約 101,400 枚 USDC 與 USDC.e，來自協議費用及 pool owner 費用；官方稱用戶資金無風險", "en": "Reported loss is recorded at approximately $101,400. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "慢雾 Hacked Zone 2026 年 5 月档案", "tw": "慢霧 Hacked Zone 2026 年 5 月檔案", "en": "hacked.slowmist.io public source" }, "url": "https://hacked.slowmist.io/zh/?c=&page=5", "type": "research" }, { "label": { "zh": "Huma Finance 官方披露", "tw": "Huma Finance 官方披露", "en": "x.com official statement" }, "url": "https://x.com/humafinance/status/2053858499378258198", "type": "official" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-183", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-157", "status": "verified", "incidentDate": "2026-05-11", "datePrecision": "day", "title": { "zh": "TrickMo 新变种", "tw": "TrickMo 新變種", "en": "TrickMo Android malware variant" }, "summary": { "zh": "滥用辅助功能、界面覆盖与远程控制接管 Android 设备；属于链下基础设施或终端威胁，不应因影响钱包而猜作某条链的协议漏洞。 现有资料没有提供稳定可核的美元损失值。", "tw": "濫用輔助功能、界面覆蓋與遠程控制接管 Android 設備；屬於鏈下基礎設施或終端威脅，不應因影響錢包而猜作某條鏈的協議漏洞。 現有資料沒有提供穩定可核的美元損失值。", "en": "TrickMo Android malware variant was reported on 2026-05-11. Evidence indicates that a TrickMo Android malware variant targeted financial and authentication data. No stable verified USD loss amount was published." }, "details": { "zh": "## 事件背景\n滥用辅助功能、界面覆盖与远程控制接管 Android 设备；属于链下基础设施或终端威胁，不应因影响钱包而猜作某条链的协议漏洞。\n\n## 事件经过\n1. 攻击者准备仿冒内容、包、网站或载荷。\n2. 通过对应渠道触达开发者/员工/用户。\n3. 受害者下载、运行、授权或提交秘密后，凭据与会话面临泄露。\n4. 公开材料未逐一证明后续链上盗币。\n5. 防守方披露并给出隔离建议。\n\n## 资金流向\n1. 链下投递基础设施 → 受害终端/浏览器/开发环境 → 潜在钱包或企业凭据。\n2. 无已确认统一链上转移路径。\n\n## 金额口径\n现有资料没有提供可稳定核验的美元损失值。 原始资产与金额说明为：未确认统一链上损失\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n源文件未保存事件级原帖 URL、样本 hash、C2、受害地址或链上 Tx；不得把披露日冒充所有感染发生日，也不得把潜在影响计为已盗金额。\n\n## 处置状态\n作为威胁活动簇保留；能力包括通知/短信窃取、界面覆盖和远程操作。", "tw": "## 事件背景\n濫用輔助功能、界面覆蓋與遠程控制接管 Android 設備；屬於鏈下基礎設施或終端威脅，不應因影響錢包而猜作某條鏈的協議漏洞。\n\n## 事件經過\n1. 攻擊者準備仿冒內容、包、網站或載荷。\n2. 通過對應渠道觸達開發者/員工/用戶。\n3. 受害者下載、運行、授權或提交秘密後，憑據與會話面臨洩露。\n4. 公開材料未逐一證明後續鏈上盜幣。\n5. 防守方披露並給出隔離建議。\n\n## 資金流向\n1. 鏈下投遞基礎設施 → 受害終端/瀏覽器/開發環境 → 潛在錢包或企業憑據。\n2. 無已確認統一鏈上轉移路徑。\n\n## 金額口徑\n現有資料沒有提供可穩定核驗的美元損失值。 原始資產與金額說明為：未確認統一鏈上損失\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n源文件未保存事件級原帖 URL、樣本 hash、C2、受害地址或鏈上 Tx；不得把披露日冒充所有感染髮生日，也不得把潛在影響計為已盜金額。\n\n## 處置狀態\n作為威脅活動簇保留；能力包括通知/短信竊取、界面覆蓋和遠程操作。", "en": "## Incident background\nOn 2026-05-11, TrickMo Android malware variant was reported. Available evidence indicates that a TrickMo Android malware variant targeted financial and authentication data. The report assigns evidence level C.\n\n## Incident sequence\nPublic reporting describes an executed event affecting TrickMo Android malware variant. The affected path involved Other. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Other. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nAvailable material does not provide a stable verified USD loss amount. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n1 public source support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "supply-chain", "severity": "medium", "chains": [ "Other" ], "ecosystems": [ "Other" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "现有资料没有提供可稳定核验的美元损失值。 原始资产与金额说明为：未确认统一链上损失", "tw": "現有資料沒有提供可穩定核驗的美元損失值。 原始資產與金額說明為：未確認統一鏈上損失", "en": "Available material does not provide a stable verified USD loss amount. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-applicable", "addresses": [], "references": [ { "label": { "zh": "原报告保存的月度发现入口；事件级直接 URL 待补", "tw": "原報告保存的月度發現入口；事件級直接 URL 待補", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2061353830437249033", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-157", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-138", "status": "verified", "incidentDate": "2026-05-11", "datePrecision": "day", "title": { "zh": "INK Finance", "tw": "INK Finance", "en": "INK Finance treasury privilege compromise" }, "summary": { "zh": "Treasury whitelist 缺陷与闪电贷结合，且旧代理/权限面未被彻底关闭。 公开损失采用约 $140,000。", "tw": "Treasury whitelist 缺陷與閃電貸結合，且舊代理/權限面未被徹底關閉。 公開損失採用約 $140,000。", "en": "INK Finance treasury privilege compromise was reported on 2026-05-11. Evidence indicates that treasury privileges were used without authorization. Reported loss is approximately $140,000." }, "details": { "zh": "## 事件背景\nTreasury whitelist 缺陷与闪电贷结合，且旧代理/权限面未被彻底关闭。\n\n## 事件经过\n1. 攻击者取得闪电贷。\n2. 利用 Treasury 白名单逻辑缺陷。\n3. 通过仍有效的旧代理或权限面执行操作。\n4. 提取约 14 万美元。\n5. 偿还闪电贷。\n\n## 资金流向\n1. Polygon 闪电贷来源 → Treasury/旧代理 → 攻击者。\n2. 后续资金去向待核。\n\n## 金额口径\n公开损失采用约 $140,000。 原始资产与金额说明为：约 14 万美元\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n具体白名单函数、代理地址、Tx 和利润拆分未从源文件恢复。\n\n## 处置状态\n未见追回信息。", "tw": "## 事件背景\nTreasury whitelist 缺陷與閃電貸結合，且舊代理/權限面未被徹底關閉。\n\n## 事件經過\n1. 攻擊者取得閃電貸。\n2. 利用 Treasury 白名單邏輯缺陷。\n3. 通過仍有效的舊代理或權限面執行操作。\n4. 提取約 14 萬美元。\n5. 償還閃電貸。\n\n## 資金流向\n1. Polygon 閃電貸來源 → Treasury/舊代理 → 攻擊者。\n2. 後續資金去向待核。\n\n## 金額口徑\n公開損失採用約 $140,000。 原始資產與金額說明為：約 14 萬美元\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n具體白名單函數、代理地址、Tx 和利潤拆分未從源文件恢復。\n\n## 處置狀態\n未見追回資訊。", "en": "## Incident background\nOn 2026-05-11, INK Finance treasury privilege compromise was reported. Available evidence indicates that treasury privileges were used without authorization. The report assigns evidence level B.\n\n## Incident sequence\nPublic reporting describes an executed event affecting INK Finance treasury privilege compromise. The affected path involved Polygon. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Polygon. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $140,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n2 public sources support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "access-control", "severity": "medium", "chains": [ "Polygon" ], "ecosystems": [ "Polygon" ], "lossUsd": 140000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $140,000。 原始资产与金额说明为：约 14 万美元", "tw": "公開損失採用約 $140,000。 原始資產與金額說明為：約 14 萬美元", "en": "Reported loss is recorded at approximately $140,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "PeckShield 月报", "tw": "PeckShield 月報", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2061353830437249033", "type": "research" }, { "label": { "zh": "Cecuro 复盘", "tw": "Cecuro 復盤", "en": "cecuro.ai public source" }, "url": "https://cecuro.ai/blog/may-2026-hack-recap", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-138", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-144", "status": "verified", "incidentDate": "2026-05-10", "datePrecision": "day", "title": { "zh": "Renegade", "tw": "Renegade", "en": "Renegade security incident" }, "summary": { "zh": "现有公开证据仅为月度追踪清单；根因、链和返还交易待一手材料。不得猜函数名、攻击方式、私钥归因或内部人员。 公开损失采用约 $209,000。", "tw": "現有公開證據僅為月度追蹤清單；根因、鏈和返還交易待一手材料。不得猜函數名、攻擊方式、私鑰歸因或內部人員。 公開損失採用約 $209,000。", "en": "Renegade security incident was reported on 2026-05-10. Evidence indicates that public monitoring confirmed an executed protocol exploit and later reported returned funds. Reported loss is approximately $209,000." }, "details": { "zh": "## 事件背景\n现有公开证据仅为月度追踪清单；根因、链和返还交易待一手材料。不得猜函数名、攻击方式、私钥归因或内部人员。\n\n## 事件经过\n1. 追踪清单记录项目名、日期和金额。\n2. 本轮未恢复项目官方或安全机构事件原帖。\n3. 攻击准备、触发、资产离开与处置步骤均保持待核。\n4. 后续需用项目身份、链和交易逐项闭环。\n\n## 资金流向\n1. 受影响地址/合约 → 初始接收 → 兑换/归集/跨链/混币/CEX：各段均未公开恢复。\n\n## 金额口径\n公开损失采用约 $209,000。 原始资产与金额说明为：约 209,000 美元；汇总称资金已追回\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n证据等级 C 按用户要求保留；只有汇总清单，缺少完整地址、TxID、具体链与技术复盘。不能把缺口写成否定事件，也不能填造细节。\n\n## 处置状态\n调查/补证中；汇总口径称全额追回", "tw": "## 事件背景\n現有公開證據僅為月度追蹤清單；根因、鏈和返還交易待一手材料。不得猜函數名、攻擊方式、私鑰歸因或內部人員。\n\n## 事件經過\n1. 追蹤清單記錄專案名、日期和金額。\n2. 本輪未恢復專案官方或安全機構事件原帖。\n3. 攻擊準備、觸發、資產離開與處置步驟均保持待核。\n4. 後續需用專案身份、鏈和交易逐項閉環。\n\n## 資金流向\n1. 受影響地址/合約 → 初始接收 → 兌換/歸集/跨鏈/混幣/CEX：各段均未公開恢復。\n\n## 金額口徑\n公開損失採用約 $209,000。 原始資產與金額說明為：約 209,000 美元；彙總稱資金已追回\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n證據等級 C 按用戶要求保留；只有彙總清單，缺少完整地址、TxID、具體鏈與技術復盤。不能把缺口寫成否定事件，也不能填造細節。\n\n## 處置狀態\n調查/補證中；彙總口徑稱全額追回", "en": "## Incident background\nOn 2026-05-10, Renegade security incident was reported. Available evidence indicates that public monitoring confirmed an executed protocol exploit and later reported returned funds. The report assigns evidence level C.\n\n## Incident sequence\nPublic reporting describes an executed event affecting Renegade security incident. The affected path involved Other. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Other. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $209,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n1 public source support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "protocol-exploit", "severity": "medium", "chains": [ "Other" ], "ecosystems": [ "Other" ], "lossUsd": 209000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $209,000。 原始资产与金额说明为：约 209,000 美元；汇总称资金已追回", "tw": "公開損失採用約 $209,000。 原始資產與金額說明為：約 209,000 美元；彙總稱資金已追回", "en": "Reported loss is recorded at approximately $209,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "Nathan 5 月 31 日起事件追踪清单", "tw": "Nathan 5 月 31 日起事件追蹤清單", "en": "x.com public source" }, "url": "https://x.com/0xxNathan/status/2061459771400827312", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-144", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-122", "status": "verified", "incidentDate": "2026-05-07", "datePrecision": "day", "title": { "zh": "TrustedVolumes", "tw": "TrustedVolumes", "en": "TrustedVolumes RFQ proxy exploit" }, "summary": { "zh": "RFQ 代理关键签名者注册函数无访问控制；订单校验绑定 receiver 而实际资金来自 inventory；订单消费状态读写不同存储槽，导致订单可重放。 公开损失采用约 $6,300,000。", "tw": "RFQ 代理關鍵簽名者註冊函數無訪問控制；訂單校驗綁定 receiver 而實際資金來自 inventory；訂單消費狀態讀寫不同存儲槽，導致訂單可重放。 公開損失採用約 $6,300,000。", "en": "TrustedVolumes RFQ proxy exploit was reported on 2026-05-07. Evidence indicates that an RFQ proxy authorization path allowed unauthorized asset movement. Reported loss is approximately $6,300,000." }, "details": { "zh": "## 事件背景\nRFQ 代理关键签名者注册函数无访问控制；订单校验绑定 receiver 而实际资金来自 inventory；订单消费状态读写不同存储槽，导致订单可重放。\n\n## 事件经过\n1. 攻击者调用无权限注册函数将自己加入 allowlist。\n2. 构造 receiver 校验可过的订单。\n3. 资金却从 inventory 扣除。\n4. 利用消费状态槽错位重复执行。\n5. 约 85 笔 Ethereum 交易抽走多类资产。\n\n## 资金流向\n1. TrustedVolumes 自有 RFQ inventory → 攻击者。\n2. 后续兑换、跨链与提现路径未在源文件恢复。\n\n## 金额口径\n公开损失采用约 $6,300,000。 原始资产与金额说明为：约 590 万—670 万美元；约 1,291 WETH、16.9 WBTC 及超过 140 万美元 USDT/USDC；约 85 笔交易\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n被攻击对象是 TrustedVolumes 自有 RFQ 代理，不代表其集成的 DEX 聚合器被攻破；金额区间反映不同统计口径。\n\n## 处置状态\n未见可核全额返还。", "tw": "## 事件背景\nRFQ 代理關鍵簽名者註冊函數無訪問控制；訂單校驗綁定 receiver 而實際資金來自 inventory；訂單消費狀態讀寫不同存儲槽，導致訂單可重放。\n\n## 事件經過\n1. 攻擊者調用無權限註冊函數將自己加入 allowlist。\n2. 構造 receiver 校驗可過的訂單。\n3. 資金卻從 inventory 扣除。\n4. 利用消費狀態槽錯位重複執行。\n5. 約 85 筆 Ethereum 交易抽走多類資產。\n\n## 資金流向\n1. TrustedVolumes 自有 RFQ inventory → 攻擊者。\n2. 後續兌換、跨鏈與提現路徑未在源文件恢復。\n\n## 金額口徑\n公開損失採用約 $6,300,000。 原始資產與金額說明為：約 590 萬—670 萬美元；約 1,291 WETH、16.9 WBTC 及超過 140 萬美元 USDT/USDC；約 85 筆交易\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n被攻擊對象是 TrustedVolumes 自有 RFQ 代理，不代表其集成的 DEX 聚合器被攻破；金額區間反映不同統計口徑。\n\n## 處置狀態\n未見可核全額返還。", "en": "## Incident background\nOn 2026-05-07, TrustedVolumes RFQ proxy exploit was reported. Available evidence indicates that an RFQ proxy authorization path allowed unauthorized asset movement. The report assigns evidence level B.\n\n## Incident sequence\nPublic reporting describes an executed event affecting TrustedVolumes RFQ proxy exploit. The affected path involved Ethereum. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Ethereum. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $6,300,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n2 public sources support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "protocol-exploit", "severity": "high", "chains": [ "Ethereum" ], "ecosystems": [ "Ethereum" ], "lossUsd": 6300000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $6,300,000。 原始资产与金额说明为：约 590 万—670 万美元；约 1,291 WETH、16.9 WBTC 及超过 140 万美元 USDT/USDC；约 85 笔交易", "tw": "公開損失採用約 $6,300,000。 原始資產與金額說明為：約 590 萬—670 萬美元；約 1,291 WETH、16.9 WBTC 及超過 140 萬美元 USDT/USDC；約 85 筆交易", "en": "Reported loss is recorded at approximately $6,300,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "PeckShield 初报", "tw": "PeckShield 初報", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2052211288068198848", "type": "research" }, { "label": { "zh": "PeckShield 后续", "tw": "PeckShield 後續", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2053726382061195737", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-122", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-162", "status": "verified", "incidentDate": "2026-05-06", "datePrecision": "day", "title": { "zh": "ClickFix 假 macOS 工具", "tw": "ClickFix 假 macOS 工具", "en": "ClickFix fake macOS tool campaign" }, "summary": { "zh": "伪装系统修复或安装命令，诱导用户把恶意 shell 粘贴到终端；属于链下基础设施或终端威胁，不应因影响钱包而猜作某条链的协议漏洞。 现有资料没有提供稳定可核的美元损失值。", "tw": "偽裝系統修復或安裝命令，誘導用戶把惡意 shell 粘貼到終端；屬於鏈下基礎設施或終端威脅，不應因影響錢包而猜作某條鏈的協議漏洞。 現有資料沒有提供穩定可核的美元損失值。", "en": "ClickFix fake macOS tool campaign was reported on 2026-05-06. Evidence indicates that a ClickFix social-engineering flow delivered a fake macOS tool. No stable verified USD loss amount was published." }, "details": { "zh": "## 事件背景\n伪装系统修复或安装命令，诱导用户把恶意 shell 粘贴到终端；属于链下基础设施或终端威胁，不应因影响钱包而猜作某条链的协议漏洞。\n\n## 事件经过\n1. 攻击者准备仿冒内容、包、网站或载荷。\n2. 通过对应渠道触达开发者/员工/用户。\n3. 受害者下载、运行、授权或提交秘密后，凭据与会话面临泄露。\n4. 公开材料未逐一证明后续链上盗币。\n5. 防守方披露并给出隔离建议。\n\n## 资金流向\n1. 链下投递基础设施 → 受害终端/浏览器/开发环境 → 潜在钱包或企业凭据。\n2. 无已确认统一链上转移路径。\n\n## 金额口径\n现有资料没有提供可稳定核验的美元损失值。 原始资产与金额说明为：未确认统一链上损失\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n源文件未保存事件级原帖 URL、样本 hash、C2、受害地址或链上 Tx；不得把披露日冒充所有感染发生日，也不得把潜在影响计为已盗金额。\n\n## 处置状态\n作为威胁活动簇保留；要求复制命令修复浏览器或会议软件本身是高风险信号。", "tw": "## 事件背景\n偽裝系統修復或安裝命令，誘導用戶把惡意 shell 粘貼到終端；屬於鏈下基礎設施或終端威脅，不應因影響錢包而猜作某條鏈的協議漏洞。\n\n## 事件經過\n1. 攻擊者準備仿冒內容、包、網站或載荷。\n2. 通過對應渠道觸達開發者/員工/用戶。\n3. 受害者下載、運行、授權或提交秘密後，憑據與會話面臨洩露。\n4. 公開材料未逐一證明後續鏈上盜幣。\n5. 防守方披露並給出隔離建議。\n\n## 資金流向\n1. 鏈下投遞基礎設施 → 受害終端/瀏覽器/開發環境 → 潛在錢包或企業憑據。\n2. 無已確認統一鏈上轉移路徑。\n\n## 金額口徑\n現有資料沒有提供可穩定核驗的美元損失值。 原始資產與金額說明為：未確認統一鏈上損失\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n源文件未保存事件級原帖 URL、樣本 hash、C2、受害地址或鏈上 Tx；不得把披露日冒充所有感染髮生日，也不得把潛在影響計為已盜金額。\n\n## 處置狀態\n作為威脅活動簇保留；要求複製命令修復瀏覽器或會議軟件本身是高風險信號。", "en": "## Incident background\nOn 2026-05-06, ClickFix fake macOS tool campaign was reported. Available evidence indicates that a ClickFix social-engineering flow delivered a fake macOS tool. The report assigns evidence level C.\n\n## Incident sequence\nPublic reporting describes an executed event affecting ClickFix fake macOS tool campaign. The affected path involved Other. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Other. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nAvailable material does not provide a stable verified USD loss amount. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n1 public source support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "supply-chain", "severity": "medium", "chains": [ "Other" ], "ecosystems": [ "Other" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "现有资料没有提供可稳定核验的美元损失值。 原始资产与金额说明为：未确认统一链上损失", "tw": "現有資料沒有提供可穩定核驗的美元損失值。 原始資產與金額說明為：未確認統一鏈上損失", "en": "Available material does not provide a stable verified USD loss amount. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-applicable", "addresses": [], "references": [ { "label": { "zh": "原报告保存的月度发现入口；事件级直接 URL 待补", "tw": "原報告保存的月度發現入口；事件級直接 URL 待補", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2061353830437249033", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-162", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-129", "status": "verified", "incidentDate": "2026-05-05", "datePrecision": "day", "title": { "zh": "Ekubo Protocol", "tw": "Ekubo Protocol", "en": "Ekubo Protocol extension callback exploit" }, "summary": { "zh": "自定义 extension 合约支付回调验证错误，允许攻击者滥用用户此前授予的 ERC-20 approval，从受害资金来源转走资产。 公开损失采用约 $1,400,000。", "tw": "自定義 extension 合約支付回調驗證錯誤，允許攻擊者濫用用戶此前授予的 ERC-20 approval，從受害資金來源轉走資產。 公開損失採用約 $1,400,000。", "en": "Ekubo Protocol extension callback exploit was reported on 2026-05-05. Evidence indicates that an extension callback path allowed reentrant or unauthorized execution. Reported loss is approximately $1,400,000." }, "details": { "zh": "## 事件背景\n自定义 extension 合约支付回调验证错误，允许攻击者滥用用户此前授予的 ERC-20 approval，从受害资金来源转走资产。\n\n## 事件经过\n1. 攻击者识别错误支付回调。\n2. 调用受害者既有 approval。\n3. 资产从 Ethereum 和 Arbitrum 资金来源转出。\n4. 团队调查。\n5. 5 月 9 日执行白帽操作保护额外资产。\n\n## 资金流向\n1. Ethereum/Arbitrum 受害资金来源 → 攻击者。\n2. 团队白帽保护最多约 28.4 万美元。\n3. 具体返还路径待核。\n\n## 金额口径\n公开损失采用约 $1,400,000。 原始资产与金额说明为：初始损失约 140 万美元；团队白帽额外保护最多约 28.4 万美元，属于避免的追加损失而非返还\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n源文件未保存完整地址与 Tx；白帽保护额与已追回额语义不同。\n\n## 处置状态\n未见初始约 140 万美元全额追回；28.4 万美元不能从初始损失中当作返还冲减。", "tw": "## 事件背景\n自定義 extension 合約支付回調驗證錯誤，允許攻擊者濫用用戶此前授予的 ERC-20 approval，從受害資金來源轉走資產。\n\n## 事件經過\n1. 攻擊者識別錯誤支付回調。\n2. 調用受害者既有 approval。\n3. 資產從 Ethereum 和 Arbitrum 資金來源轉出。\n4. 團隊調查。\n5. 5 月 9 日執行白帽操作保護額外資產。\n\n## 資金流向\n1. Ethereum/Arbitrum 受害資金來源 → 攻擊者。\n2. 團隊白帽保護最多約 28.4 萬美元。\n3. 具體返還路徑待核。\n\n## 金額口徑\n公開損失採用約 $1,400,000。 原始資產與金額說明為：初始損失約 140 萬美元；團隊白帽額外保護最多約 28.4 萬美元，屬於避免的追加損失而非返還\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n源文件未保存完整地址與 Tx；白帽保護額與已追回額語義不同。\n\n## 處置狀態\n未見初始約 140 萬美元全額追回；28.4 萬美元不能從初始損失中當作返還衝減。", "en": "## Incident background\nOn 2026-05-05, Ekubo Protocol extension callback exploit was reported. Available evidence indicates that an extension callback path allowed reentrant or unauthorized execution. The report assigns evidence level A.\n\n## Incident sequence\nPublic reporting describes an executed event affecting Ekubo Protocol extension callback exploit. The affected path involved Ethereum, Arbitrum. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Ethereum, Arbitrum. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $1,400,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n2 public sources support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "protocol-exploit", "severity": "high", "chains": [ "Ethereum", "Arbitrum" ], "ecosystems": [ "Ethereum", "Arbitrum" ], "lossUsd": 1400000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $1,400,000。 原始资产与金额说明为：初始损失约 140 万美元；团队白帽额外保护最多约 28.4 万美元，属于避免的追加损失而非返还", "tw": "公開損失採用約 $1,400,000。 原始資產與金額說明為：初始損失約 140 萬美元；團隊白帽額外保護最多約 28.4 萬美元，屬於避免的追加損失而非返還", "en": "Reported loss is recorded at approximately $1,400,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "PeckShield 月报", "tw": "PeckShield 月報", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2061353830437249033", "type": "research" }, { "label": { "zh": "Halborn 月度复盘", "tw": "Halborn 月度復盤", "en": "halborn.com public source" }, "url": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-may-2026", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-129", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-143", "status": "verified", "incidentDate": "2026-05-04", "datePrecision": "day", "title": { "zh": "SmartCredit", "tw": "SmartCredit", "en": "SmartCredit security incident" }, "summary": { "zh": "现有公开证据仅为月度追踪清单；链、根因、资金流与处置未恢复。不得猜函数名、攻击方式、私钥归因或内部人员。 公开损失采用约 $72,000.00。", "tw": "現有公開證據僅為月度追蹤清單；鏈、根因、資金流與處置未恢復。不得猜函數名、攻擊方式、私鑰歸因或內部人員。 公開損失採用約 $72,000.00。", "en": "SmartCredit security incident was reported on 2026-05-04. Evidence indicates that public monitoring confirmed an executed protocol exploit but did not establish a complete root cause. Reported loss is approximately $72,000.00." }, "details": { "zh": "## 事件背景\n现有公开证据仅为月度追踪清单；链、根因、资金流与处置未恢复。不得猜函数名、攻击方式、私钥归因或内部人员。\n\n## 事件经过\n1. 追踪清单记录项目名、日期和金额。\n2. 本轮未恢复项目官方或安全机构事件原帖。\n3. 攻击准备、触发、资产离开与处置步骤均保持待核。\n4. 后续需用项目身份、链和交易逐项闭环。\n\n## 资金流向\n1. 受影响地址/合约 → 初始接收 → 兑换/归集/跨链/混币/CEX：各段均未公开恢复。\n\n## 金额口径\n公开损失采用约 $72,000.00。 原始资产与金额说明为：约 72,000 美元\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n证据等级 C 按用户要求保留；只有汇总清单，缺少完整地址、TxID、具体链与技术复盘。不能把缺口写成否定事件，也不能填造细节。\n\n## 处置状态\n调查/补证中；不把市场损失、坏账或普通清算推定为漏洞", "tw": "## 事件背景\n現有公開證據僅為月度追蹤清單；鏈、根因、資金流與處置未恢復。不得猜函數名、攻擊方式、私鑰歸因或內部人員。\n\n## 事件經過\n1. 追蹤清單記錄專案名、日期和金額。\n2. 本輪未恢復專案官方或安全機構事件原帖。\n3. 攻擊準備、觸發、資產離開與處置步驟均保持待核。\n4. 後續需用專案身份、鏈和交易逐項閉環。\n\n## 資金流向\n1. 受影響地址/合約 → 初始接收 → 兌換/歸集/跨鏈/混幣/CEX：各段均未公開恢復。\n\n## 金額口徑\n公開損失採用約 $72,000.00。 原始資產與金額說明為：約 72,000 美元\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n證據等級 C 按用戶要求保留；只有彙總清單，缺少完整地址、TxID、具體鏈與技術復盤。不能把缺口寫成否定事件，也不能填造細節。\n\n## 處置狀態\n調查/補證中；不把市場損失、壞賬或普通清算推定為漏洞", "en": "## Incident background\nOn 2026-05-04, SmartCredit security incident was reported. Available evidence indicates that public monitoring confirmed an executed protocol exploit but did not establish a complete root cause. The report assigns evidence level C.\n\n## Incident sequence\nPublic reporting describes an executed event affecting SmartCredit security incident. The affected path involved Other. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Other. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $72,000.00. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n1 public source support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "protocol-exploit", "severity": "low", "chains": [ "Other" ], "ecosystems": [ "Other" ], "lossUsd": 72000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $72,000.00。 原始资产与金额说明为：约 72,000 美元", "tw": "公開損失採用約 $72,000.00。 原始資產與金額說明為：約 72,000 美元", "en": "Reported loss is recorded at approximately $72,000.00. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "Nathan 5 月 31 日起事件追踪清单", "tw": "Nathan 5 月 31 日起事件追蹤清單", "en": "x.com public source" }, "url": "https://x.com/0xxNathan/status/2061459771400827312", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-143", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-137", "status": "verified", "incidentDate": "2026-05-04", "datePrecision": "day", "title": { "zh": "Bankr/Grok 钱包", "tw": "Bankr/Grok 錢包", "en": "Bankr / Grok wallet AI-agent attack" }, "summary": { "zh": "AI 推理层与资金执行层缺乏硬隔离。攻击者先激活可调用转账工具的会员层级，再用 Morse 编码等方式绕过提示词过滤，引导代理输出可执行转账命令。 公开损失采用约 $175,000。", "tw": "AI 推理層與資金執行層缺乏硬隔離。攻擊者先激活可調用轉賬工具的會員層級，再用 Morse 編碼等方式繞過提示詞過濾，引導代理輸出可執行轉賬命令。 公開損失採用約 $175,000。", "en": "Bankr / Grok wallet AI-agent attack was reported on 2026-05-04. Evidence indicates that an AI-agent wallet workflow was manipulated to authorize asset movement. Reported loss is approximately $175,000." }, "details": { "zh": "## 事件背景\nAI 推理层与资金执行层缺乏硬隔离。攻击者先激活可调用转账工具的会员层级，再用 Morse 编码等方式绕过提示词过滤，引导代理输出可执行转账命令。\n\n## 事件经过\n1. 攻击者取得或触发会员层级。\n2. 获得调用转账工具能力。\n3. 构造 Morse 编码等提示词注入。\n4. 模型输出可执行资金命令。\n5. 钱包自动执行 Base 转账。\n\n## 资金流向\n1. Base AI 代理钱包 → 攻击者地址。\n2. 后续兑换、跨链或 CEX 路径待核。\n\n## 金额口径\n公开损失采用约 $175,000。 原始资产与金额说明为：约 17.5 万美元\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n不是 Grok 模型本体被链上攻破；关键失败是权限设计与执行隔离。完整地址/Tx 未恢复。\n\n## 处置状态\n约 17.5 万美元被转走；未见追回。", "tw": "## 事件背景\nAI 推理層與資金執行層缺乏硬隔離。攻擊者先激活可調用轉賬工具的會員層級，再用 Morse 編碼等方式繞過提示詞過濾，引導代理輸出可執行轉賬命令。\n\n## 事件經過\n1. 攻擊者取得或觸發會員層級。\n2. 獲得調用轉賬工具能力。\n3. 構造 Morse 編碼等提示詞注入。\n4. 模型輸出可執行資金命令。\n5. 錢包自動執行 Base 轉賬。\n\n## 資金流向\n1. Base AI 代理錢包 → 攻擊者地址。\n2. 後續兌換、跨鏈或 CEX 路徑待核。\n\n## 金額口徑\n公開損失採用約 $175,000。 原始資產與金額說明為：約 17.5 萬美元\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n不是 Grok 模型本體被鏈上攻破；關鍵失敗是權限設計與執行隔離。完整地址/Tx 未恢復。\n\n## 處置狀態\n約 17.5 萬美元被轉走；未見追回。", "en": "## Incident background\nOn 2026-05-04, Bankr / Grok wallet AI-agent attack was reported. Available evidence indicates that an AI-agent wallet workflow was manipulated to authorize asset movement. The report assigns evidence level B.\n\n## Incident sequence\nPublic reporting describes an executed event affecting Bankr / Grok wallet AI-agent attack. The affected path involved Base. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Base. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $175,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n2 public sources support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "access-control", "severity": "medium", "chains": [ "Base" ], "ecosystems": [ "Base" ], "lossUsd": 175000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $175,000。 原始资产与金额说明为：约 17.5 万美元", "tw": "公開損失採用約 $175,000。 原始資產與金額說明為：約 17.5 萬美元", "en": "Reported loss is recorded at approximately $175,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "PeckShield 月报", "tw": "PeckShield 月報", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2061353830437249033", "type": "research" }, { "label": { "zh": "Cecuro 复盘", "tw": "Cecuro 復盤", "en": "cecuro.ai public source" }, "url": "https://cecuro.ai/blog/may-2026-hack-recap", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-137", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-158", "status": "verified", "incidentDate": "2026-05-03", "datePrecision": "day", "title": { "zh": "FEMITBOT 滥用 Telegram Mini Apps", "tw": "FEMITBOT 濫用 Telegram Mini Apps", "en": "FEMITBOT Telegram Mini Apps malware campaign" }, "summary": { "zh": "大规模假空投、投资页面与 Android 恶意软件投递；属于链下基础设施或终端威胁，不应因影响钱包而猜作某条链的协议漏洞。 现有资料没有提供稳定可核的美元损失值。", "tw": "大規模假空投、投資頁面與 Android 惡意軟件投遞；屬於鏈下基礎設施或終端威脅，不應因影響錢包而猜作某條鏈的協議漏洞。 現有資料沒有提供穩定可核的美元損失值。", "en": "FEMITBOT Telegram Mini Apps malware campaign was reported on 2026-05-03. Evidence indicates that malicious Telegram Mini Apps distributed the FEMITBOT payload. No stable verified USD loss amount was published." }, "details": { "zh": "## 事件背景\n大规模假空投、投资页面与 Android 恶意软件投递；属于链下基础设施或终端威胁，不应因影响钱包而猜作某条链的协议漏洞。\n\n## 事件经过\n1. 攻击者准备仿冒内容、包、网站或载荷。\n2. 通过对应渠道触达开发者/员工/用户。\n3. 受害者下载、运行、授权或提交秘密后，凭据与会话面临泄露。\n4. 公开材料未逐一证明后续链上盗币。\n5. 防守方披露并给出隔离建议。\n\n## 资金流向\n1. 链下投递基础设施 → 受害终端/浏览器/开发环境 → 潜在钱包或企业凭据。\n2. 无已确认统一链上转移路径。\n\n## 金额口径\n现有资料没有提供可稳定核验的美元损失值。 原始资产与金额说明为：未确认统一链上损失\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n源文件未保存事件级原帖 URL、样本 hash、C2、受害地址或链上 Tx；不得把披露日冒充所有感染发生日，也不得把潜在影响计为已盗金额。\n\n## 处置状态\n作为威胁活动簇保留；Mini App 在 Telegram 内展示不代表外部域名、APK 或签名请求可信。", "tw": "## 事件背景\n大規模假空投、投資頁面與 Android 惡意軟件投遞；屬於鏈下基礎設施或終端威脅，不應因影響錢包而猜作某條鏈的協議漏洞。\n\n## 事件經過\n1. 攻擊者準備仿冒內容、包、網站或載荷。\n2. 通過對應渠道觸達開發者/員工/用戶。\n3. 受害者下載、運行、授權或提交秘密後，憑據與會話面臨洩露。\n4. 公開材料未逐一證明後續鏈上盜幣。\n5. 防守方披露並給出隔離建議。\n\n## 資金流向\n1. 鏈下投遞基礎設施 → 受害終端/瀏覽器/開發環境 → 潛在錢包或企業憑據。\n2. 無已確認統一鏈上轉移路徑。\n\n## 金額口徑\n現有資料沒有提供可穩定核驗的美元損失值。 原始資產與金額說明為：未確認統一鏈上損失\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n源文件未保存事件級原帖 URL、樣本 hash、C2、受害地址或鏈上 Tx；不得把披露日冒充所有感染髮生日，也不得把潛在影響計為已盜金額。\n\n## 處置狀態\n作為威脅活動簇保留；Mini App 在 Telegram 內展示不代表外部域名、APK 或簽名請求可信。", "en": "## Incident background\nOn 2026-05-03, FEMITBOT Telegram Mini Apps malware campaign was reported. Available evidence indicates that malicious Telegram Mini Apps distributed the FEMITBOT payload. The report assigns evidence level C.\n\n## Incident sequence\nPublic reporting describes an executed event affecting FEMITBOT Telegram Mini Apps malware campaign. The affected path involved Other. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Other. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nAvailable material does not provide a stable verified USD loss amount. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n1 public source support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "supply-chain", "severity": "medium", "chains": [ "Other" ], "ecosystems": [ "Other" ], "lossUsd": null, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "现有资料没有提供可稳定核验的美元损失值。 原始资产与金额说明为：未确认统一链上损失", "tw": "現有資料沒有提供可穩定核驗的美元損失值。 原始資產與金額說明為：未確認統一鏈上損失", "en": "Available material does not provide a stable verified USD loss amount. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-applicable", "addresses": [], "references": [ { "label": { "zh": "原报告保存的月度发现入口；事件级直接 URL 待补", "tw": "原報告保存的月度發現入口；事件級直接 URL 待補", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2061353830437249033", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-158", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-142", "status": "verified", "incidentDate": "2026-05-01", "datePrecision": "day", "title": { "zh": "Sharwa Finance", "tw": "Sharwa Finance", "en": "Sharwa Finance security incident" }, "summary": { "zh": "现有公开证据仅为月度追踪清单；链、根因、资金流及处置未恢复。不得猜函数名、攻击方式、私钥归因或内部人员。 公开损失采用约 $32,850.00。", "tw": "現有公開證據僅為月度追蹤清單；鏈、根因、資金流及處置未恢復。不得猜函數名、攻擊方式、私鑰歸因或內部人員。 公開損失採用約 $32,850.00。", "en": "Sharwa Finance security incident was reported on 2026-05-01. Evidence indicates that public monitoring confirmed an executed protocol exploit but did not establish a complete root cause. Reported loss is approximately $32,850.00." }, "details": { "zh": "## 事件背景\n现有公开证据仅为月度追踪清单；链、根因、资金流及处置未恢复。不得猜函数名、攻击方式、私钥归因或内部人员。\n\n## 事件经过\n1. 追踪清单记录项目名、日期和金额。\n2. 本轮未恢复项目官方或安全机构事件原帖。\n3. 攻击准备、触发、资产离开与处置步骤均保持待核。\n4. 后续需用项目身份、链和交易逐项闭环。\n\n## 资金流向\n1. 受影响地址/合约 → 初始接收 → 兑换/归集/跨链/混币/CEX：各段均未公开恢复。\n\n## 金额口径\n公开损失采用约 $32,850.00。 原始资产与金额说明为：约 32,850 美元\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n证据等级 C 按用户要求保留；只有汇总清单，缺少完整地址、TxID、具体链与技术复盘。不能把缺口写成否定事件，也不能填造细节。\n\n## 处置状态\n调查/补证中；X 月度追踪帖列为新攻击", "tw": "## 事件背景\n現有公開證據僅為月度追蹤清單；鏈、根因、資金流及處置未恢復。不得猜函數名、攻擊方式、私鑰歸因或內部人員。\n\n## 事件經過\n1. 追蹤清單記錄專案名、日期和金額。\n2. 本輪未恢復專案官方或安全機構事件原帖。\n3. 攻擊準備、觸發、資產離開與處置步驟均保持待核。\n4. 後續需用專案身份、鏈和交易逐項閉環。\n\n## 資金流向\n1. 受影響地址/合約 → 初始接收 → 兌換/歸集/跨鏈/混幣/CEX：各段均未公開恢復。\n\n## 金額口徑\n公開損失採用約 $32,850.00。 原始資產與金額說明為：約 32,850 美元\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n證據等級 C 按用戶要求保留；只有彙總清單，缺少完整地址、TxID、具體鏈與技術復盤。不能把缺口寫成否定事件，也不能填造細節。\n\n## 處置狀態\n調查/補證中；X 月度追蹤帖列為新攻擊", "en": "## Incident background\nOn 2026-05-01, Sharwa Finance security incident was reported. Available evidence indicates that public monitoring confirmed an executed protocol exploit but did not establish a complete root cause. The report assigns evidence level C.\n\n## Incident sequence\nPublic reporting describes an executed event affecting Sharwa Finance security incident. The affected path involved Other. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Other. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $32,850.00. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n1 public source support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "protocol-exploit", "severity": "low", "chains": [ "Other" ], "ecosystems": [ "Other" ], "lossUsd": 32850, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $32,850.00。 原始资产与金额说明为：约 32,850 美元", "tw": "公開損失採用約 $32,850.00。 原始資產與金額說明為：約 32,850 美元", "en": "Reported loss is recorded at approximately $32,850.00. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "Nathan 5 月 31 日起事件追踪清单", "tw": "Nathan 5 月 31 日起事件追蹤清單", "en": "x.com public source" }, "url": "https://x.com/0xxNathan/status/2061459771400827312", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-142", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-130", "status": "verified", "incidentDate": "2026-05-01", "datePrecision": "day", "title": { "zh": "Bisq v1", "tw": "Bisq v1", "en": "Bisq v1 client attack" }, "summary": { "zh": "攻击者使用修改后的客户端针对旧版交易协议；技术复盘怀疑 AI 辅助，但现有证据不足以完成 AI 归因。 公开损失采用约 $858,000。", "tw": "攻擊者使用修改後的客戶端針對舊版交易協議；技術復盤懷疑 AI 輔助，但現有證據不足以完成 AI 歸因。 公開損失採用約 $858,000。", "en": "Bisq v1 client attack was reported on 2026-05-01. Evidence indicates that a weakness in the Bisq v1 client or trade workflow enabled theft. Reported loss is approximately $858,000." }, "details": { "zh": "## 事件背景\n攻击者使用修改后的客户端针对旧版交易协议；技术复盘怀疑 AI 辅助，但现有证据不足以完成 AI 归因。\n\n## 事件经过\n1. 攻击者制作修改版客户端。\n2. 针对 Bisq v1 旧交易流程交互。\n3. 利用协议/客户端处理弱点转移 BTC。\n4. 事件后被安全复盘收录。\n\n## 资金流向\n1. Bisq v1 交易路径中的 BTC → 攻击者。\n2. 后续 Bitcoin 地址、交易和资金去向未恢复。\n\n## 金额口径\n公开损失采用约 $858,000。 原始资产与金额说明为：约 85.8 万美元 BTC\n\n## 地址与交易\n公开资料未披露完整地址与交易记录。\n\n## 证据边界\n不是 Bitcoin 协议漏洞；AI 辅助仅为怀疑，不能写成确认归因。\n\n## 处置状态\n未见追回信息。", "tw": "## 事件背景\n攻擊者使用修改後的客戶端針對舊版交易協議；技術復盤懷疑 AI 輔助，但現有證據不足以完成 AI 歸因。\n\n## 事件經過\n1. 攻擊者製作修改版客戶端。\n2. 針對 Bisq v1 舊交易流程交互。\n3. 利用協議/客戶端處理弱點轉移 BTC。\n4. 事件後被安全復盤收錄。\n\n## 資金流向\n1. Bisq v1 交易路徑中的 BTC → 攻擊者。\n2. 後續 Bitcoin 地址、交易和資金去向未恢復。\n\n## 金額口徑\n公開損失採用約 $858,000。 原始資產與金額說明為：約 85.8 萬美元 BTC\n\n## 地址與交易\n公開資料未披露完整地址與交易記錄。\n\n## 證據邊界\n不是 Bitcoin 協議漏洞；AI 輔助僅為懷疑，不能寫成確認歸因。\n\n## 處置狀態\n未見追回資訊。", "en": "## Incident background\nOn 2026-05-01, Bisq v1 client attack was reported. Available evidence indicates that a weakness in the Bisq v1 client or trade workflow enabled theft. The report assigns evidence level B.\n\n## Incident sequence\nPublic reporting describes an executed event affecting Bisq v1 client attack. The affected path involved Bitcoin. The distinct target, date, and attack surface separate it from other records in the reporting window.\n\n## Fund flow\nThe published path involved Bitcoin. Asset movement is described only to the extent supported by the cited sources; nominal token value, realized proceeds, frozen balances, and returned assets are kept separate.\n\n## Amount basis\nReported loss is recorded at approximately $858,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable.\n\n## Addresses and transactions\nPublic sources did not publish a complete address or transaction list.\n\n## Evidence boundary\n2 public sources support the event classification and the stated amount basis. Unpublished attribution, downstream transfers, and final liability remain unresolved.\n\n## Current status\nThe incident remains classified according to the cited public evidence. Later restrictions, returns, or investigative updates are attached to the same root event." }, "category": "wallet-vulnerability", "severity": "medium", "chains": [ "Bitcoin" ], "ecosystems": [ "Bitcoin" ], "lossUsd": 858000, "frozenUsd": 0, "recoveredUsd": 0, "assetLoss": { "zh": "公开损失采用约 $858,000。 原始资产与金额说明为：约 85.8 万美元 BTC", "tw": "公開損失採用約 $858,000。 原始資產與金額說明為：約 85.8 萬美元 BTC", "en": "Reported loss is recorded at approximately $858,000. The source distinguishes nominal exposure, realized proceeds, restrictions, and later disposition where applicable." }, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "Halborn 月度复盘", "tw": "Halborn 月度復盤", "en": "halborn.com public source" }, "url": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-may-2026", "type": "research" }, { "label": { "zh": "PeckShield 月报", "tw": "PeckShield 月報", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2061353830437249033", "type": "research" } ], "sourceUrl": "security-archive.html?incident=DCI-2026-130", "sourceLabel": "德尔泰公开安全情报档案" }, { "id": "DCI-2026-002", "status": "verified", "incidentDate": "2026-04-18", "datePrecision": "day", "title": { "zh": "KelpDAO rsETH 跨链桥 RPC 基础设施入侵", "tw": "KelpDAO rsETH 跨鏈橋 RPC 基礎設施入侵", "en": "KelpDAO rsETH bridge RPC infrastructure compromise" }, "summary": { "zh": "LayerZero 最终报告确认，攻击者入侵 RPC 云环境并伪造跨链消息，造成 116,500 rsETH、约 2.92 亿美元损失；单一 DVN 配置使伪造证明被目标合约接受。 五月新增诉讼与资产限制进展已并入同一事件。", "tw": "LayerZero 最終報告確認，攻擊者入侵 RPC 雲環境並偽造跨鏈消息，造成 116,500 rsETH、約 2.92 億美元損失；單一 DVN 配置使偽造證明被目標合約接受。 五月新增訴訟與資產限制進展已併入同一事件。", "en": "LayerZero’s final report says compromised RPC infrastructure enabled a forged cross-chain message, resulting in the loss of 116,500 rsETH, approximately $292 million; KelpDAO’s single-DVN configuration allowed the destination contract to accept the attestation. May litigation and asset-restriction developments are attached to the same incident." }, "details": { "zh": "## 事件背景\n2026 年 4 月 18 日，KelpDAO 的 rsETH 跨链桥遭到攻击。LayerZero 最终报告确认损失为 116,500 rsETH，事发时估值约 2.92 亿美元。\n\n## 事件经过\n攻击链始于 3 月 6 日针对 LayerZero 开发人员的社会工程。攻击者取得会话密钥后进入 RPC 云环境，污染内部 RPC 节点，并对外部 RPC 提供方发动拒绝服务攻击，使验证服务依赖遭篡改的节点并为伪造跨链消息生成有效证明。KelpDAO 当时采用单一 DVN 配置，目标合约因此接受证明并释放 rsETH。\n\n## 资金流向\n伪造消息触发 116,500 rsETH 被释放。早期公开分析称约 7,100 万美元相关资产受到限制，其余资产继续经过拆分和跨链路径流转；公开来源没有提供覆盖全部下游交易的完整清单。\n\n## 金额口径\n最终调查采用 116,500 rsETH、约 2.92 亿美元作为事件损失。事发初期的约 2.90 亿美元属于初步估值。约 7,100 万美元受限资产单独记为冻结状态，不等于已经返还。\n\n## 地址与交易\n现有公开来源没有提供可覆盖攻击、跨链释放及全部下游流向的完整地址与交易清单。\n\n## 证据边界\nLayerZero 最终报告将入侵归因于 TraderTraitor，也称 UNC4899，并说明 LayerZero 链上协议本身没有发现漏洞。影响被限定在采用单一验证方配置的 KelpDAO rsETH 应用，没有证据表明其他应用或通道受到同一攻击。\n\n## 处置状态\nLayerZero 更换了受影响的云环境和 RPC 基础设施，并停止为仅依赖单一验证方的通道签名。公开资料尚未确认受害方收回被冻结或继续流转的资产。\n\n## 五月后续进展\n1. 原始攻击或钓鱼发生在本月前或公开资料其他编号。\n2. 5 月出现诉讼、冻结争议或返还确认。\n3. 本节记录状态变化。\n4. 不把更新重新计成 5 月新攻击。\n\n作为旧案更新单列；攻击发生早于 5 月；本月只记录诉讼与归责更新。", "tw": "## 事件背景\n2026 年 4 月 18 日，KelpDAO 的 rsETH 跨鏈橋遭到攻擊。LayerZero 最終報告確認損失為 116,500 rsETH，事發時估值約 2.92 億美元。\n\n## 事件經過\n攻擊鏈始於 3 月 6 日針對 LayerZero 開發人員的社會工程。攻擊者取得會話密鑰後進入 RPC 雲環境，污染內部 RPC 節點，並對外部 RPC 提供方發動拒絕服務攻擊，使驗證服務依賴遭篡改的節點並為偽造跨鏈消息生成有效證明。KelpDAO 當時採用單一 DVN 配置，目標合約因此接受證明並釋放 rsETH。\n\n## 資金流向\n偽造消息觸發 116,500 rsETH 被釋放。早期公開分析稱約 7,100 萬美元相關資產受到限制，其餘資產繼續經過拆分和跨鏈路徑流轉；公開來源沒有提供覆蓋全部下游交易的完整清單。\n\n## 金額口徑\n最終調查採用 116,500 rsETH、約 2.92 億美元作為事件損失。事發初期的約 2.90 億美元屬於初步估值。約 7,100 萬美元受限資產單獨記為凍結狀態，不等於已經返還。\n\n## 地址與交易\n現有公開來源沒有提供可覆蓋攻擊、跨鏈釋放及全部下游流向的完整地址與交易清單。\n\n## 證據邊界\nLayerZero 最終報告將入侵歸因於 TraderTraitor，也稱 UNC4899，並說明 LayerZero 鏈上協議本身沒有發現漏洞。影響被限定在採用單一驗證方配置的 KelpDAO rsETH 應用，沒有證據表明其他應用或通道受到同一攻擊。\n\n## 處置狀態\nLayerZero 更換了受影響的雲環境和 RPC 基礎設施，並停止為僅依賴單一驗證方的通道簽名。公開資料尚未確認受害方收回被凍結或繼續流轉的資產。\n\n## 五月後續進展\n1. 原始攻擊或釣魚發生在本月前或公開資料其他編號。\n2. 5 月出現訴訟、凍結爭議或返還確認。\n3. 本節記錄狀態變化。\n4. 不把更新重新計成 5 月新攻擊。\n\n作為舊案更新單列；攻擊發生早於 5 月；本月只記錄訴訟與歸責更新。", "en": "## Incident background\nOn April 18, 2026, the KelpDAO rsETH bridge was attacked. LayerZero’s final report records a loss of 116,500 rsETH, valued at approximately $292 million at the time.\n\n## Incident sequence\nThe intrusion began with social engineering against a LayerZero developer on March 6. After harvesting session keys, the attacker entered the RPC cloud environment, poisoned internal RPC nodes, and launched a denial-of-service attack against an external RPC provider. This forced the verification service to rely on tampered nodes and produce a valid attestation for a forged cross-chain message. KelpDAO’s single-DVN configuration allowed the destination contract to accept that attestation and release rsETH.\n\n## Fund flow\nThe forged message released 116,500 rsETH. Early public analysis reported that approximately $71 million in related assets was restricted, while other assets continued through splitting and cross-chain routes. Public sources do not provide a complete downstream transaction list.\n\n## Amount basis\nThe final investigation uses 116,500 rsETH, approximately $292 million, as the incident loss. The earlier figure of approximately $290 million was a preliminary estimate. Approximately $71 million in restricted assets is recorded separately as frozen, not returned.\n\n## Addresses and transactions\nAvailable public sources do not provide a complete list covering the attack, cross-chain release, and all downstream transfers.\n\n## Evidence boundary\nLayerZero’s final report attributes the intrusion to TraderTraitor, also known as UNC4899, and states that no vulnerability was identified in the LayerZero on-chain protocol. The impact was limited to the KelpDAO rsETH application using a single-verifier configuration; no evidence indicates that another application or channel was affected by the same attack.\n\n## Current status\nLayerZero replaced the affected cloud and RPC infrastructure and stopped signing for channels that rely on it as the sole verifier. Public sources have not confirmed the return of the frozen or downstream assets to the affected party.\n\n## May 2026 update\nDuring May 2026, public reporting added litigation and asset-restriction developments connected to the April 18 KelpDAO attack. These developments update the original case and do not create a second attack or an additional loss amount." }, "category": "bridge-exploit", "severity": "critical", "ecosystems": [ "Ethereum", "Cross-chain" ], "chains": [ "Ethereum", "Arbitrum", "Bitcoin" ], "lossUsd": 292000000, "frozenUsd": 71000000, "recoveredUsd": 0, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "LayerZero 最终事件报告", "tw": "LayerZero 最終事件報告", "en": "LayerZero final incident report" }, "url": "https://layerzero.network/blog/layerzero-labs-kelpdao-incident-report", "type": "official" }, { "label": { "zh": "LayerZero 初步事件声明", "tw": "LayerZero 初步事件聲明", "en": "LayerZero preliminary incident statement" }, "url": "https://layerzero.network/blog/kelpdao-incident-statement", "type": "official" }, { "label": { "zh": "公开事件分析", "tw": "公開事件分析", "en": "Public incident analysis" }, "url": "https://mp.weixin.qq.com/s/LXCcmLNypTSNNgSiZc6HDA", "type": "analysis" }, { "label": { "zh": "原报告保存的月度/返还来源", "tw": "原報告保存的月度/返還來源", "en": "x.com public source" }, "url": "https://x.com/PeckShieldAlert/status/2061353830437249033", "type": "research" } ], "sourceUrl": "press-kelp-dao-bridge-hack", "sourceLabel": "德尔泰公开事件分析", "assetLoss": { "zh": "最终调查确认损失为 116,500 rsETH，事发时估值约 2.92 亿美元；约 7,100 万美元受限资产单独记录为冻结状态。", "tw": "最終調查確認損失為 116,500 rsETH，事發時估值約 2.92 億美元；約 7,100 萬美元受限資產單獨記錄為凍結狀態。", "en": "The final investigation records a loss of 116,500 rsETH, approximately $292 million at the time; approximately $71 million in restricted assets is recorded separately as frozen." } }, { "id": "DCI-2024-001", "status": "verified", "incidentDate": "2024-10-16", "datePrecision": "day", "title": { "zh": "Radiant Capital 多签运维环境入侵", "tw": "Radiant Capital 多簽運維環境入侵", "en": "Radiant Capital multisig operations compromise" }, "summary": { "zh": "攻击者控制多签人员终端并篡改 Safe Wallet 交易界面，公开披露约 5,000 万美元资产损失。", "tw": "攻擊者控制多簽人員終端並篡改 Safe Wallet 交易介面，公開披露約 5,000 萬美元資產損失。", "en": "Attackers compromised multisig operators and tampered with the Safe Wallet transaction interface, causing about $50 million in reported losses." }, "details": { "zh": "## 事件背景\n攻击者控制 Radiant Capital 多签成员的运维终端，并篡改 Safe Wallet 前端显示与实际交易载荷。受影响范围包括 Arbitrum 与 BNB Chain 市场。\n\n## 事件经过\n攻击者先入侵多签人员终端，再让界面显示与底层交易内容不一致，诱导成员签署恶意交易。恶意交易取得协议管理员权限后，攻击者从相关市场转走资产。\n\n## 资金流向\n资产从 Radiant Capital 在 Arbitrum 与 BNB Chain 的相关市场转向攻击者控制地址。公开资料未在现有记录中提供完整后续流向。\n\n## 金额口径\n公开披露损失约 5,000 万美元。\n\n## 地址与交易\n现有核验来源未提供可覆盖全部攻击步骤与后续流向的完整地址和交易清单。\n\n## 证据边界\n公开资料支持终端失陷、Safe Wallet 显示与交易载荷被篡改、管理员权限被夺取及约 5,000 万美元损失。完整入侵链和后续资金路径仍受公开证据范围限制。\n\n## 处置状态\n事件影响 Arbitrum 与 BNB Chain 市场。公开资料尚未确认全部损失资产已经返还。", "tw": "## 事件背景\n攻擊者控制 Radiant Capital 多籤成員的運維終端，並篡改 Safe Wallet 前端顯示與實際交易載荷。受影響範圍包括 Arbitrum 與 BNB Chain 市場。\n\n## 事件經過\n攻擊者先入侵多籤人員終端，再讓界面顯示與底層交易內容不一致，誘導成員簽署惡意交易。惡意交易取得協議管理員權限後，攻擊者從相關市場轉走資產。\n\n## 資金流向\n資產從 Radiant Capital 在 Arbitrum 與 BNB Chain 的相關市場轉向攻擊者控制地址。公開資料未在現有記錄中提供完整後續流向。\n\n## 金額口徑\n公開披露損失約 5,000 萬美元。\n\n## 地址與交易\n現有核驗來源未提供可覆蓋全部攻擊步驟與後續流向的完整地址和交易清單。\n\n## 證據邊界\n公開資料支持終端失陷、Safe Wallet 顯示與交易載荷被篡改、管理員權限被奪取及約 5,000 萬美元損失。完整入侵鏈和後續資金路徑仍受公開證據範圍限制。\n\n## 處置狀態\n事件影響 Arbitrum 與 BNB Chain 市場。公開資料尚未確認全部損失資產已經返還。", "en": "## Incident background\nAttackers compromised Radiant Capital multisig operators' endpoints and altered the Safe Wallet interface and underlying transaction payloads. Markets on Arbitrum and BNB Chain were affected.\n\n## Incident sequence\nThe attackers first compromised multisig operators' endpoints, then made the interface display content that differed from the underlying transaction. The operators were induced to sign malicious transactions, which granted protocol administrator privileges and enabled asset transfers from the affected markets.\n\n## Fund flow\nAssets moved from Radiant Capital markets on Arbitrum and BNB Chain to attacker-controlled addresses. The currently cited material does not provide a complete downstream route.\n\n## Amount basis\nPublic reporting places the loss at approximately $50 million.\n\n## Addresses and transactions\nThe cited sources do not provide a complete address and transaction list covering every attack step and downstream transfer.\n\n## Evidence boundary\nPublic material supports endpoint compromise, tampering between the Safe Wallet display and transaction payload, loss of administrator control, and an estimated $50 million loss. The complete intrusion chain and downstream movement remain limited by the available evidence.\n\n## Current status\nThe incident affected markets on Arbitrum and BNB Chain. Public sources have not confirmed that all lost assets were returned." }, "category": "key-compromise", "severity": "critical", "ecosystems": [ "Arbitrum", "BNB Chain" ], "chains": [ "Arbitrum", "BNB Chain" ], "lossUsd": 50000000, "frozenUsd": 0, "recoveredUsd": 0, "addressDisclosure": "not-published", "addresses": [], "references": [ { "label": { "zh": "公开事件复盘", "tw": "公開事件復盤", "en": "Public incident post-mortem" }, "url": "https://mp.weixin.qq.com/s/Jwd8u4dnPORcB1uDECxx8g", "type": "analysis" } ], "sourceUrl": "press-radiant-capital-end", "sourceLabel": "德尔泰公开事件分析" } ] }