Một Vụ "Tự Nổ" Được Thiết Kế Tinh Vi: Phân Tích Sự Kiện Tấn Công PGNLZ

marsbitPublished on 2026-01-28Last updated on 2026-01-28

Abstract

Phân tích sự kiện tấn công PGNLZ: Vào ngày 27/1/2026, tin tặc đã khai thác lỗ hổng trong dự án PGNLZ trên BNB Smart Chain, gây thiệt hại khoảng 100.000 USD. Tin tặc sử dụng flash loan từ Moolah Protocol để vay 1.059 BTCB, sau đó thế chấp trên Venus Protocol để vay 30.000.000 USDT. Tiếp theo, họ chuyển đổi 23.337.952 USDT lấy 982.506 PGNLZ trên PancakeSwap rồi chuyển số token này vào ví 0xdead (hủy token). Hành động này làm thay đổi tỷ lệ trong pool, đẩy giá PGNLZ từ 0,1 USDT lên 5.528 USDT. Tin tặc sau đó gọi hàm swapExactTokensForTokensSupportingFeeOnTransferTokens, kích hoạt cơ chế tính phí _handleSellTax và _executeBurnFromLP, khiến LP Pool bị đốt gần như toàn bộ token (chỉ còn 0,00000001 PGNLZ). Giá token tăng vọt 40 tỷ lần, cho phép tin tặc rút toàn bộ pool, trả lại flash loan và thu lợi 100.000 USD. Nguyên nhân lỗi đến từ mô hình kinh tế giảm phát không được kiểm tra kỹ, cho phép thao túng giá. Khuyến nghị dự án nên kiểm tra chéo hợp đồng với nhiều đơn vị audit trước khi triển khai.

Giới Thiệu Bối Cảnh

Vào ngày 27 tháng 1 năm 2026, chúng tôi đã giám sát được một sự kiện tấn công nhắm vào dự án PGNLZ trên BNB Smart Chain:

https://bscscan.com/tx/0xa7488ff4d6a85bf19994748837713c710650378383530ae709aec628023cd7cc

Sau khi phân tích chi tiết, kẻ tấn công đã liên tục phát động các cuộc tấn công vào dự án PGNLZ vào ngày 27 tháng 1 năm 2026, vụ tấn công đã gây thiệt hại khoảng 100.000 USD.

Phân Tích Sự Kiện và Cuộc Tấn Công

Kẻ tấn công đầu tiên đã vay flash loan 1.059 BTCB từ Moolah Protocol,

Sau đó, thế chấp 1.059 BTCB trong Venus Protocol, để vay 30.000.000 USDT.

Tiếp theo, kẻ tấn công đã gọi hàm swapTokensForExactTokens trên PancakeSwap, sử dụng 23.337.952 USDT để đổi lấy 982.506 PGNLZ, nhưng lại đốt (chuyển đến 0xdead) số PGNLZ này.

Trước khi hoán đổi, PancakeSwap Pool có 100.901 USDT và 982.506 PGNLZ, lúc này giá PGNLZ là 1 PGNLZ = 0,1 USDT. Sau khi hoán đổi, PancakeSwap Pool còn lại 23.438.853 USDT và 4.240 PGNLZ, lúc này, giá PGNLZ là 1 PGNLZ = 5.528 USDT.

Sau đó, kẻ tấn công gọi hàm swapExactTokensForTokensSupportingFeeOnTransferTokens, hàm này chủ yếu hỗ trợ Token có phí chuyển khoản (Fee-On Transfer Token). PGNLZ sử dụng _update để xử lý phí giao dịch, chuỗi gọi cụ thể là: transferFrom -> _spendAllowance -> _transfer -> _update

Vì lần này là bán (sell), nên sẽ gọi đến _handleSellTax.

Chúng ta hãy xem _executeBurnFromLP được triển khai như thế nào,

Có thể thấy, _executeBurnFromLP sẽ sử dụng _update để đốt số lượng PGNLZ pendingBurnFromLP. Ở block trước đó, truy vấn được pendingBurnFromLP là 4.240.113.074.578.781.194.669.

Sau khi đốt, LP Pool chỉ còn lại 0,00000001 PGNLZ, lúc này 1 PGNLZ = 234.385.300.000.000 USDT, đã tăng 40 Tỷ lần.

Cuối cùng, kẻ tấn công đã rút cạn LP Pool, trả hết flash loan và thu lợi 100 nghìn USDT.

Tổng Kết

Nguyên nhân của lỗ hổng này là do mô hình kinh tế giảm phát (deflationary economic model), khi trừ phí hoặc Đốt LP Pool đã không được xác minh. Điều này dẫn đến việc kẻ tấn công lợi dụng đặc tính giảm phát để thao túng giá Token. Khuyến nghị các dự án nên xác minh đa chiều khi thiết kế mô hình kinh tế và logic vận hành mã, và khi kiểm toán hợp đồng trước khi triển khai, nên chọn nhiều công ty kiểm toán để kiểm tra chéo.

Trending Cryptos

Related Questions

QSự kiện tấn công PGNLZ xảy ra vào ngày nào và trên blockchain nào?

ASự kiện tấn công xảy ra vào ngày 27 tháng 1 năm 2026 trên mạng BNB Smart Chain.

QKẻ tấn công đã sử dụng phương pháp gì để có được số vốn ban đầu?

AKẻ tấn công đã sử dụng flash loan từ Moolah Protocol để vay 1.059 BTCB.

QHành động chính nào cho phép kẻ tấn công thao túng giá của token PGNLZ?

AKẻ tấn công đã đốt (burn) một lượng lớn token PGNLZ vào địa chỉ 0xdead, làm giảm nguồn cung trong pool một cách đột ngột và đẩy giá token lên cao.

QLỗ hổng chính trong hợp đồng thông minh của PGNLZ là gì?

ALỗ hổng nằm ở mô hình kinh tế giảm phát (deflationary economic model), cụ thể là việc tính phí hoặc đốt token từ LP Pool mà không có cơ chế xác minh phù hợp, cho phép kẻ tấn công thao túng giá.

QThiệt hại ước tính của vụ tấn công này là bao nhiêu?

ACuộc tấn công đã gây ra thiệt hại ước tính khoảng 100.000 USD.

Related Reads

After Three Consecutive Quarters of Decline, Can the Crypto Market Find a Window for Stabilization in Q3?

The cryptocurrency market has just concluded its worst-performing quarter since 2022, with total capitalization dropping 12.6% to $2.1 trillion. All core metrics indicate capital is leaving the sector, not just rotating within it. Bitcoin fell 14.2% and Ethereum dropped 25.4% in Q2, breaking their previous correlation with US tech stocks. A key driver is the reversal in US spot Bitcoin ETF flows, which saw a net outflow of approximately $4.67 billion in Q2, including a record monthly outflow near $4.5 billion in June. While recent data suggests long-term holders are accumulating again, sustained ETF outflows mean continued selling pressure. Market focus is now singularly on the Federal Reserve. The upcoming July FOMC meeting is seen as the most critical event for Q3. A dovish signal could support Bitcoin reclaiming a $68,000-$84,000 range, while a hawkish stance might establish a new trading band around $50,000-$56,000. Additionally, regulatory uncertainty persists, with the progress of the crucial *CLARITY Act* stalling in the Senate, reducing its perceived 2026 passage probability to 40-45%. Despite the broad downturn, a few sectors showed growth. Prediction markets saw nominal volume surge 48.7% year-over-year to $113.8 billion, and tokenized collectibles transaction volume rose 143% quarterly to $1.4 billion. The Real-World Asset (RWA) tokenization sector also continued steady growth, now representing ~$28.1 billion in on-chain value. The market's foundation for an extreme crash appears limited, with Bitcoin price hovering near its 200-week moving average. However, the trading paradigm has shifted from narrative-driven speculation to decisions based on price action, policy developments, and interest rate expectations, making a broad sentiment-driven rally unlikely in the near term.

marsbit8h ago

After Three Consecutive Quarters of Decline, Can the Crypto Market Find a Window for Stabilization in Q3?

marsbit8h ago

BIT Trading Moment: BTC Still Suppressed by Weekly 200 EMA, Rejection May Restart Decline; Storage and Semiconductors that Surged Last Night Begin Falling in Evening Trading

**Crypto & Stock Market Wrap: Bitcoin Tests Resistance, Stocks Retreat After AI Surge** Bitcoin consolidates around $66,000, facing key resistance near $68,000—an area seen as a major psychological and technical hurdle where previous rallies have failed. Analysts note the cryptocurrency is caught between its 200-week moving average (~$63,333) and 200-week EMA (~$68,328). A clear break above $68k is needed to signal a stronger bullish trend, while a rejection could lead to a retest of $63k support. Market sentiment remains cautious, with low futures open interest pointing to a low-liquidity rebound rather than a full bull market. Bitcoin spot ETFs saw another $203 million inflow. US stock futures pointed lower after a strong Tuesday session led by a massive rebound in semiconductors and memory stocks. The rally was fueled by renewed optimism about AI-driven hardware demand, with Micron, SanDisk, and SK Hynix surging. However, those gains reversed in pre-market trading. Super Micro Computer (SMCI) soared over 20% after hours on strong guidance and a record backlog. Other standouts included Rocket Lab and nuclear energy plays Oklo and X-Energy. Rising oil prices (Brent above $91) and climbing Treasury yields (10-year near 4.64%), however, are reigniting inflation concerns and acting as a headwind for equities. In Asia, markets were mixed. South Korea's KOSPI pared early gains to close slightly higher as semiconductor stocks like SK Hynix gave back initial surges. Japan's Nikkei edged lower as the yen hit a fresh 38-year low against the dollar, raising fears of potential market intervention. Key events to watch include the Samsung Galaxy launch, AMD's AI event, and a slew of major tech earnings from Alphabet, Tesla, and IBM after the close on Wednesday, followed by the ECB meeting and Intel's earnings on Thursday.

marsbit9h ago

BIT Trading Moment: BTC Still Suppressed by Weekly 200 EMA, Rejection May Restart Decline; Storage and Semiconductors that Surged Last Night Begin Falling in Evening Trading

marsbit9h ago

Former CFTC Chairman, Circle President Tarbert: Preaching Long-Termism While Cashing Out $30 Million Himself

Former CFTC Chairman and Circle President Heath Tarbert has consistently advocated for a long-term vision in public, urging patience from investors as Circle’s stock price has fallen significantly from its peak. However, it has been revealed that since Circle’s IPO, Tarbert has continuously sold his CRCL shares through pre-arranged trading plans, cashing out approximately $30 million, without making any public market purchases. This contrast between his public messaging and personal actions has drawn criticism. Tarbert joined Circle in July 2023 as Chief Legal Officer, leveraging his regulatory experience to help guide the company through its IPO and expansion. Despite promoting stablecoins as long-term infrastructure, he established a 10b5-1 trading plan just before Circle went public, leading to substantial stock sales over the following year. In March 2026, he initiated another plan to sell more shares. His career trajectory highlights a pattern of moving between high-level regulatory roles and influential positions in the financial sector. After resigning as CFTC Chairman in early 2021, he joined Citadel Securities as Chief Legal Officer just 27 days later, during a period of intense regulatory scrutiny for the firm. He later joined Circle, aiding its efforts to navigate regulatory challenges for its public listing. While Tarbert's expertise in policy and compliance is valuable to companies like Circle, his actions—advocating long-term confidence while personally divesting—raise questions about the alignment between his public statements and his private financial decisions, leaving investors who followed his advice to bear the market risks.

marsbit9h ago

Former CFTC Chairman, Circle President Tarbert: Preaching Long-Termism While Cashing Out $30 Million Himself

marsbit9h ago

Gate Research Institute: The 'Wall Street-ization' Wave of Crypto Financial Products – Competition or Integration?

The article titled "Gate Research Institute: Are Crypto Financial Products Sparking a 'Wall Street' Wave—Competition or Convergence?" explores the evolving relationship between the crypto ecosystem and traditional finance (TradFi). The piece begins by reflecting on Bitcoin's original 2009 vision of decentralization, disintermediation, and moving away from banks. It then contrasts this with the 2024 landscape, where key crypto assets like Bitcoin are increasingly held through Wall Street products like ETFs issued by giants like BlackRock. The article questions whether this signifies that TradFi is systematically taking over the rights to issue, price, custody, and distribute crypto financial assets. The core argument is that this is not a zero-sum takeover but rather a bidirectional convergence where each side addresses the other's weaknesses. Crypto offers 24/7 global markets, programmable settlement, and open access but lacks compliant channels, institutional-grade custody, deep fiat liquidity, and mainstream distribution. TradFi possesses these but is constrained by legacy systems, limited operating hours, and slow settlement. Two primary convergence paths are highlighted: * **Path A (CEX to TradFi):** Exemplified by Gate, which has progressed from offering tokenized stocks and CFDs to providing direct, real stock trading (US, Hong Kong, South Korea) within its platform, using USDT. * **Path B (TradFi to Crypto):** Exemplified by Robinhood, which has integrated crypto trading, acquired exchanges like Bitstamp, and is moving traditional assets like stocks onto the blockchain via tokenization and its own Layer 2. Both paths are ultimately competing to become the next-generation, unified financial account—a "super account" where users can seamlessly trade cryptocurrencies, stocks, ETFs, RWA (Real World Assets), and tokenized treasury products in one interface. The growth of RWA and tokenized treasuries (e.g., BlackRock's BUIDL) is presented as the asset-layer fusion, providing stable, yield-bearing assets on-chain and acting as a bridge between the two worlds. In conclusion, the "Wall Street-ization" of crypto is framed as a mutual transformation. Decentralized ideals persist in the protocol layer, while at the application layer, a more efficient, global, and accessible unified capital market is emerging from this convergence. The future competition lies not between crypto exchanges and stockbrokers, but between platforms vying to offer the most comprehensive asset coverage, liquidity, and user experience within a single account.

marsbit9h ago

Gate Research Institute: The 'Wall Street-ization' Wave of Crypto Financial Products – Competition or Integration?

marsbit9h ago

Trading

Spot

Hot Articles

How to Buy WELL

Welcome to HTX.com! We've made purchasing Moonwell Artemis (WELL) simple and convenient. Follow our step-by-step guide to embark on your crypto journey.Step 1: Create Your HTX AccountUse your email or phone number to sign up for a free account on HTX. Experience a hassle-free registration journey and unlock all features.Get My AccountStep 2: Go to Buy Crypto and Choose Your Payment MethodCredit/Debit Card: Use your Visa or Mastercard to buy Moonwell Artemis (WELL) instantly.Balance: Use funds from your HTX account balance to trade seamlessly.Third Parties: We've added popular payment methods such as Google Pay and Apple Pay to enhance convenience.P2P: Trade directly with other users on HTX.Over-the-Counter (OTC): We offer tailor-made services and competitive exchange rates for traders.Step 3: Store Your Moonwell Artemis (WELL)After purchasing your Moonwell Artemis (WELL), store it in your HTX account. Alternatively, you can send it elsewhere via blockchain transfer or use it to trade other cryptocurrencies.Step 4: Trade Moonwell Artemis (WELL)Easily trade Moonwell Artemis (WELL) on HTX's spot market. Simply access your account, select your trading pair, execute your trades, and monitor in real-time. We offer a user-friendly experience for both beginners and seasoned traders.

2.7k Total ViewsPublished 2024.03.29Updated 2026.06.02

How to Buy WELL

What is $WELL

WELL3, $$WELL: Revolutionizing Health and Wellness with DePIN and AI Introduction In the rapidly evolving landscape of digital technology, the health and wellness sector stands at the forefront of innovation, striving to enhance patient care and promote healthier lifestyles. A groundbreaking player in this domain is WELL3, a pioneering Web3 project that seeks to revolutionize how individuals engage with their health. By leveraging technologies such as Decentralized Physical Infrastructure Network (DePIN), Decentralized Identity (DID), and Artificial Intelligence (AI), WELL3 aims to foster secure, data-empowered health journeys. This comprehensive article delves deep into the core aspects of WELL3, $$WELL, exploring its functionalities, creators, investors, and unique features. What is WELL3, $$WELL? WELL3 serves as an innovative platform set to redefine the approach towards health and wellness. Focused on integrating DePIN and DID alongside AI systems, the project is designed to create personalized user experiences while ensuring the safety and privacy of individuals' health data. With an impressive figure of over one million pre-registered users, the primary mission of WELL3 revolves around enhancing well-being through secure, data-driven health journeys. At its core, WELL3 employs advanced blockchain technologies to ensure that users have complete control over their personal information. This project not only addresses the challenges of data security and accessibility but also aspires to create a vibrant community connected by a shared commitment to better health. Key Features of WELL3: DePIN and DID: These technologies enable secure ownership and authentication of data, giving users full control over their information. AI Integration: Utilizing AI analytics, WELL3 offers personalized insights and solutions tailored to individual health needs. Community Engagement: Facilitates a supportive environment where users can connect, share experiences, and motivate each other toward healthier living. Creator of WELL3, $$WELL The identity of the creator of WELL3 remains unspecified in the available information. As the project progresses, further details may emerge, shedding light on the visionary minds behind this transformative initiative. Investors of WELL3, $$WELL WELL3 has garnered support from a myriad of influential investment entities, highlighting its credibility and potential in the health and wellness space. Notable investors include: Animoca Brands AWS Samsung The Spartan Group Blocore Fenbushi Capital Newman Group Soul Capital XY Finance Lumoz The backing from these established organizations demonstrates a strong belief in WELL3's mission, providing it with the necessary resources to innovate and expand its offerings. How Does WELL3, $$WELL Work? WELL3 operates by melding cutting-edge technologies in a multichain framework, ensuring a seamless and innovative user experience. Below are some factors that uniquely position WELL3 in the wellness market: 1. Secure Data Ownership With the integration of DePIN and DID, users can maintain complete control over their personal health information. This layer of security is paramount in today's digital age, where data breaches and unauthorized access are rampant. Through WELL3, data ownership is decentralised, enabling users to manage their information proactively. 2. Personalization through AI WELL3 implements AI-driven analytics to provide users with tailored health insights. By harnessing the power of AI, the platform can offer individualised recommendations and solutions, encouraging users to achieve their health goals more effectively. 3. Multichain Framework The WELL3 project is designed to work across multiple blockchain platforms, including Bitcoin, Ethereum, Polygon, Solana, Blast, and TON. This multichain capability ensures that users can interact with the platform seamlessly across different networks, enhancing accessibility and usability. 4. WELL Token Central to the WELL3 ecosystem is the WELL Token, which serves multiple functions including utility, governance, and rewards. The token allows for ecosystem participation, supports health data sharing, and incentivizes users based on their engagement with the platform. Timeline of WELL3, $$WELL The trajectory of WELL3 showcases significant milestones in its development, each contributing to the project's overall success. Here is a brief timeline of critical events in the history of WELL3: February 10, 2024: WELL3 launched its NFT project, quickly rising to prominence as the largest NFT collection on the opBNB chain with over 324,000 owners and reaching 8 million NFTs created by April 27, 2024. Public Sale: The project achieved a remarkable total value locked (TVL) of approximately 15,237.2 ETH within just seven days, indicating robust market interest and backing. WELL ID Launch: The platform saw over 900,000 users sign up for the WELL ID and its corresponding NFT Ring whitelist, marking a significant adoption phase within the ecosystem. Partnership Development: WELL3 established partnerships with leading entities including Animoca Brands, AWS, Samsung, and others to enhance its ecosystem and expand its reach. Transaction Volume: WELL3 has facilitated over $17 million in transactions, reflecting its growing utility and engagement within the health and wellness community. Key Points About WELL3, $$WELL As a progressive initiative shifting towards the wellness market, WELL3 has identified several vital elements that will contribute to its ongoing success. Here are some key takeaways to note: Tokenomics The $$WELL token has a maximum supply of 42 billion, with a significant 71% earmarked for community initiatives. This distribution strategy emphasises the project's commitment to its user base and long-term sustainability. Lock-Up Period To ensure stability within the ecosystem, tokens are released in batches over a 24-month lock-up period, promoting trust and confidence among users. Ecosystem Development WELL3's vision extends toward creating a comprehensive and sustainable ecosystem to encourage thriving community engagement, health-enhancing behaviors, and digital solutions that address the pressing needs of the wellness domain. Market Fit The wellness industry, valued at $5.6 trillion, presents a lucrative opportunity that WELL3 aims to tap into. With an anticipated annual growth rate of 5-10%, the project is ideally positioned amid a rising trend towards health-conscious living. Wearables Introducing the WELL3 Ring, a crypto-incentivized wearable, aligns with the growing demand for personalized health data. This device not only enhances user experience but also redefines what it means to be engaged with one’s health in the context of Web3. Conclusion WELL3 represents a significant advancement in the integration of blockchain technology within the health and wellness sector. By addressing crucial issues around data ownership, personalization, and community engagement, this innovative platform offers a forward-thinking solution to enhance individual well-being. With robust backing from notable investors and a commitment to pioneering technologies, WELL3 stands poised to make a lasting impact in the wellness landscape. For those seeking to navigate the complexities of health in the digital age, WELL3 is certainly one to watch as it continues to evolve and grow.

816 Total ViewsPublished 2024.07.14Updated 2024.12.03

What is $WELL

Discussions

Welcome to the HTX Community. Here, you can stay informed about the latest platform developments and gain access to professional market insights. Users' opinions on the price of WELL (WELL) are presented below.

活动图片