Протокол Balancer предотвратил новую атаку и спас $4,1 млн из уязвимых пулов

cryptonews.ruPublished on 2025-04-12Last updated on 2025-11-13

Разработчики Balancer сообщили о новой уязвимости, обнаруженной в пулах V2 meta-stable, после инцидента в их stable-пулах. Команда проекта совместно с Certora и SEAL начала экстренную операцию «белого хакерства» еще 7 ноября. В результате, специалистам удалось вернуть под контроль примерно $4,1 млн. Средства помещены в безопасное хранилище до завершения процесса сверки и возврата пользователям. Представители Balancer предупредили клиентов не взаимодействовать с указанными пулами до публикации официальных инструкций.

Под уязвимость попали пулы Balancer V2 на нескольких сетях. В частности, речь идет о Ethereum, Optimism и Arbitrum. Разработчики уточнили, что проблема касается только версии V2, а платформа Balancer V3 полностью защищена и функционирует в штатном режиме. Аналитическая команда BlockSec Phalcon, изучившая ситуацию, заявила: причиной инцидента, по предварительным данным, стала ошибка округления в функции _upscale, ранее известной разработчикам.

В отличие от прошлых атак, новый вектор эксплойта задействовал лишь 2 токена, к примеру, rETH и WETH. Исследователи отметили, что атака использовала специально подобранные значения для манипуляции потерями точности с целью получения прибыли.

Эксперты по безопасности блокчейнов подчеркнули, что операция по спасению цифровых средств стала одной из самых успешных «белых хакерских акций» последних месяцев. Благодаря скоординированным действиям команд удалось предотвратить утечку виртуальных активов пользователей и ограничить влияние уязвимости. Восстановленные токены теперь находятся под контролем Balancer.

Команда Balancer поблагодарила партнеров за оперативную помощь и предупредила пользователей о риске фишинговых атак, связанных с инцидентом. Представители подчеркнули: обновления по восстановлению средств будут публиковаться только через официальные каналы. В Balancer также отметили, что дальнейшие технические детали будут раскрыты после завершения анализа, чтобы предотвратить повторное использование эксплойта злоумышленниками.

Related Reads

Mysterious "Ox Alpha" Large Model Goes Viral with Limited-Time Free Access

A mysterious anonymous AI model named "Ox Alpha," nicknamed "Cow is Coming" by Chinese netizens, has appeared on OpenRouter, sparking widespread speculation. The model offers a 1 million token context, supports text, image, and video inputs, can call tools, and is currently free. Its standout feature is strong coding ability. Initial tests on the DeepSWE benchmark, which evaluates real-world software engineering tasks, showed an 80% pass rate on a subset of tasks, reportedly nearing top-tier code models. However, follow-up tests yielded a 63% score, with variations attributed to different task sets and configurations. The model's true developer is a major topic of debate. The prevailing theory points to Zhipu AI's unreleased GLM-5.3 Flash or its multimodal variant. Evidence cited includes identical visual token consumption patterns with GLM-5V-Turbo for videos, a consistent offset in text token counts compared to GLM-5.3, and similar behavioral traits like refusing audio processing. Zhipu has a precedent of anonymous testing. Simultaneously, another anonymous model, "korrine," appeared on Code Arena, with guesses ranging from Moonshot's Kimi K3.1 to models from Qwen or MiMo, adding to the industry's guessing game. This trend of anonymous "undercover" testing allows for unbiased performance evaluation in platforms like Arena and provides real-world, high-pressure testing through tools like OpenRouter before official release. It also serves as an effective marketing tactic, prolonging discussion through suspense. If Ox Alpha is indeed a "Flash" model, its performance raises expectations for the full-scale version's potential.

marsbit15m ago

Mysterious "Ox Alpha" Large Model Goes Viral with Limited-Time Free Access

marsbit15m ago

Bitwise CIO Matt Hougan: If You Have 0% Crypto Allocation Now, It's Equivalent to Actively Shorting the Market Outlook

Summary: In a podcast interview, Bitwise CIO Matt Hougan argues that a 0% allocation to crypto is not a neutral stance but an active bet against its future, despite the market being down 50% from its highs. He observes that major Wall Street institutions like BlackRock, Wells Fargo, UBS, and Morgan Stanley are proceeding with crypto and tokenization initiatives regardless of short-term price or regulatory delays like the CLARITY Act, which he sees as perpetually stalled. Hougan states that Bitcoin's resilience to recent bad news (AI stock volatility, large BTC sales, fading regulatory odds) signals the bear market is ending, as "bear markets die in apathy." He recommends a 5% crypto allocation for most portfolios, calling it a "magic number" that boosts returns without significantly increasing overall volatility. For absolute returns, he favors buying now over dollar-cost averaging, given compressed volatility and high upside potential. He remains bullish long-term, citing the vast growth potential of tokenizing real-world assets and setting an $8000 price target for Ethereum.

marsbit24m ago

Bitwise CIO Matt Hougan: If You Have 0% Crypto Allocation Now, It's Equivalent to Actively Shorting the Market Outlook

marsbit24m ago

Breaking News: DeepSeek Announces All-Day Off-Peak Pricing on Weekends, Making Weekend Work More Cost-Effective?

DeepSeek has announced a significant change to its API pricing model, effective August 23. The new policy removes peak/off-peak distinctions on weekends (Saturdays and Sundays), charging the lower off-peak rate for the entire two-day period. This adjustment has sparked mixed reactions within the developer and professional communities. For developers and businesses heavily reliant on DeepSeek's V4-Flash and V4-Pro APIs, this is welcome news. It allows them to schedule bulk processing tasks on weekends without the higher peak-hour costs, potentially halving their API bills for such workloads. Some users have celebrated the move for making weekend work more cost-effective. However, the announcement has also raised concerns among employees. There is apprehension that companies, particularly in cost-sensitive sectors like AI-powered short drama production, might reorganize work schedules to align with these new cost incentives. Instances are already emerging where teams schedule high-token tasks during cheaper nighttime hours or adjust staff shifts. This has led to worries about a potential shift towards weekend workdays and weekday time-off, prioritizing cost savings over traditional work-life balance. Debate has ensued regarding the practicality of such schedule changes, with questions about increased communication overhead and overall efficiency. Speculation about DeepSeek's motives for the change includes theories that peak pricing correlates with internal model training schedules, though others counter that training is largely automated. The new pricing structure is now in effect, prompting users to reconsider their task scheduling strategies.

marsbit59m ago

Breaking News: DeepSeek Announces All-Day Off-Peak Pricing on Weekends, Making Weekend Work More Cost-Effective?

marsbit59m ago

Just Now, The World's First Human vs. Robot Tennis Match Begins, Robot's Desperate Save Leaves Zheng Jie Astonished

Just now, the world's first human vs. robot tennis match began, featuring stunning robotic saves that left tennis star Zheng Jie in awe. This historic event, part of the second World Humanoid Robot Games and broadcast live globally by China Media Group, marked a pivotal moment in Chinese technological innovation and embodied artificial intelligence. The match featured both mixed human-robot doubles and a groundbreaking singles match between Zheng Jie and the "Galaxy Xingzai" humanoid robot developed by Galaxy General. The robot demonstrated impressive skills including serving, forehands, backhands, and strategic court movement, with serves exceeding 100 km/h. It exhibited remarkable adaptability, recovering from a fall to continue play and handling slices and spins. The doubles match highlighted its ability to coordinate dynamically with a human partner. The event's significance extends far beyond a novelty match. Tennis represents an ultimate pressure test for embodied AI, demanding real-time integration of perception, decision-making, full-body motion control, and live博弈 within fractions of a second—a stark contrast to the discrete, contemplative environment of board games like Go mastered by AlphaGo. It directly confronts Moravec's paradox, showcasing AI's move from digital cognition to physical execution. This capability is powered by Galaxy General's proprietary "Galaxy Star Brain" (AstraBrain) model. Its key innovation is a unified architecture that integrates high-level task understanding/tactical decision-making ("brain") and dynamic whole-body motion control ("cerebellum") into a single model, eliminating latency and information loss between separate modules. The model was trained using a two-step process via the "Galaxy Star Workshop" platform. First, it learned foundational movement priors from "imperfect" human motion data (both amateur and professional). Second, it underwent massive-scale evolution in a virtual tennis simulator where multiple AI agents played millions of games against each other. Through this adversarial training, skills like极限救球and recovery from falls emerged autonomously without explicit programming, before being transferred to the physical robot. This "AstraTennis" moment symbolizes a major leap: a decade after AlphaGo conquered the digital world, embodied AI from China has now demonstrated it can operate under the extreme, unpredictable physical pressures of real-world competition.

marsbit59m ago

Just Now, The World's First Human vs. Robot Tennis Match Begins, Robot's Desperate Save Leaves Zheng Jie Astonished

marsbit59m ago

The Biggest Dark Horse in AI Payments Might Be Coinbase Giving Agents a Wallet

In the AI payments race, while most focus on traditional giants like Visa or AI platforms like OpenAI, Coinbase has quietly emerged as a key player. Data from 2026 shows over 90% of on-chain Agent transactions occur on Coinbase's Base network, with 99% settled in USDC and over 97% using the x402 protocol. Coinbase's pivotal move was launching "Agentic Wallets" in February 2026—a dedicated wallet infrastructure giving AI Agents their own financial identity. Unlike Visa or Stripe, which connect Agents to existing payment rails, Coinbase provides Agents with autonomous wallets to hold assets (like stablecoins), initiate transfers, and execute transactions under predefined rules. This solves core issues for machine-to-machine payments: high credit card fees for micropayments, the need for constant human authorization, and unclear transaction attribution. Coinbase's strength lies in its closed-loop ecosystem: the Base blockchain (low-cost, high-throughput), the x402 payment protocol, Agentic Wallets, and native assets like USDC. This integrated stack, built through years of infrastructure investment, positioned Coinbase to capture early Agent payment demand as the AI economy surged. The key insight is that AI payment adoption may depend less on whose standard wins and more on whose usable infrastructure is ready first. While debates over protocols and payment rails continue, real Agent transactions are already flowing—primarily through Coinbase's ecosystem. It may not be the ultimate winner, but for now, it's the frontrunner by being prepared.

marsbit1h ago

The Biggest Dark Horse in AI Payments Might Be Coinbase Giving Agents a Wallet

marsbit1h ago

Trading

Spot
活动图片