Beosin：5 月主要安全事件 36 起，共计损失超 7600 万美元

marsbitPublished on 2026-06-10Last updated on 2026-06-10

Abstract

据Beosin监测，2026年5月共发生36起重大安全事件，总损失约7615万美元。主要原因包括合约漏洞（17起）和私钥泄露（10起）。损失最大的事件是Verus-Ethereum跨链桥因合约漏洞被攻击，损失1158万美元。Echo Protocol则因私钥泄露，攻击者铸造了纸面价值7670万美元的资产，实际获利约513万美元。按类型统计，跨链桥损失最高（约2799.5万美元），而DeFi项目被攻击次数最多（14次）。按公链划分，Ethereum链上损失最大（超4876万美元），BNB Chain、Monad、TON等链也均有事件发生，呈现多链攻击态势。报告分析了三个典型案例：1）Verus跨链桥因未有效验证原始资金数据，存在与历史知名桥接攻击类似的缺陷；2）Trusted Volumes因签名参数校验不一致导致资产被转移；3）StablR等多起私钥泄露事件，暴露出项目在运营安全（如多签阈值过低、缺乏时间锁）上的严重不足。趋势上，Web3安全攻击面正系统性扩大，涵盖代码、基础设施及人为流程。报告建议项目方需重视持续运营安全，并检查或妥善处理老旧合约；用户应定期取消不必要的合约授权。

撰文:Beosin

据 Beosin Alert 平台监测数据统计,2026 年 5 月,各类安全事件损失金额总计约 7615 万美元,发生重大黑客攻击事件共「36」起,主要原因为合约漏洞与私钥泄露。其中因合约 / 网络漏洞的安全事件有 17 起,因私钥泄露受损的安全事件有 10 起,DeFi 生态的代码安全与运营安全面临严峻挑战。

5 月损失 Top10 协议

连接 Verus L1 链和 Ethereum 的跨链桥 Verus-Ethereum Bridge 因合约漏洞被攻击,损失金额最大,达 1158 万美元。Echo Protocol 因私钥泄露被攻击者铸造 1000 枚 eBTC(纸面价值约 7670 万美元),但因流动性所限,最终实际获利约 513 万美元。

被攻击项目类型及各链损失情况

被攻击对象涵盖跨链桥、去中心化交易所、借贷协议、预测市场、稳定币、普通用户等多种类型,其中跨链桥损失金额最多,高达 2799.5 万,DeFi 相关的项目被攻击的次数最多,统计为 14 次。

5 月损失金额最多的链为 Ethereum,损失金额超过 4876 万美元,部分跨链桥和多数 DeFi 协议的安全事件依然以 Ethereum 为主。其次是 BNB Chain、Monad、TON,此外 Monero、Bitcoin 也有安全事件发生,链上攻击呈现多链态势。

主要安全事件分析

1. Verus:跨链消息验证缺陷

Verus-Ethereum Bridge 的运作方式是由提交方提供证明数据,表明 Verus 链上存在一笔经公证确认的合格输出,桥合约验证通过后在 Ethereum 上释放资产。而其中的漏洞在于 Ethereum 侧的桥接合约虽然验证了来自 Verus 链的证明,但未校验该数据是否为有效的原输出,使攻击者可以通过构造虚假的输出通过验证,提取远超其存款的资金。

存在漏洞的代码部分:

本次事件的漏洞与 2022 年导致 Wormhole 损失 3.2 亿美元、Nomad 损失 1.9 亿美元的漏洞属于同一类,都是桥接器验证了消息本身,却没有验证其背后的资金价值。

2. Trusted Volumes:签名参数缺陷

本次攻击者是利用 TrustedVolumes 询价(RFQ)流程中的签名设计缺陷,在实际转账时通过自定义签名数据,将转账方设定成 TrustedVolumes 的 Resolver 合约并顺利通过校验,从而把 Resolver 合约中的资产转出实现获利。

存在漏洞的代码部分:

授权检查引用的是 varg4,而执行资金转移却引用的是其它参数,缺少校验导致授权签名者域与实际扣款地址不一致。

那么攻击者只需用注册好的签名者地址签署一个订单,其中 maker = Exploit(通过签名校验),其它签名参数(代币、金额)可设为任意值,例如 1:1 的假订单,使其通过价格预言机的合理价格检查,随后从协议合约中划走资产:

3. 以 StablR 为例的私钥泄露事件

5 月出现了多起私钥泄露事件,损失金额总共超过 2500 万美元。其中 StablR 作为合规稳定币发行方,成为了稳定币以及 DeFi 赛道关于安全治理的典型教训。

StablR 推出了两种合规稳定币产品:EURR 与 USDR,其中控制 EURR 铸造的多签钱包为 0x8278D2881dBF8F6Fc01c98d196c4b16F1aade5Bc;控制 USDR 铸造的多签钱包为 0xF45392bd2D6e6b8C5Dc26BA6c8a12889419B82F3。

由于上述 2 个多签钱包发起交易都只需 1 个签名,攻击者通过控制 owner 地址 0xC73fD562de86d7860EE636C20813Bcb2cF4D550d,就将地址 0xD4677B5A8B1b97EA213Fdb876b0FcBAB3f9F6CD1 加入到上述 2 个多签钱包,实现了对项目铸币权限的控制:

此类事件并不在于代码漏洞,而是项目方的运营安全问题:没有保存好特权地址的私钥,对于高价值 / 高风险的操作没有采用高阈值多签,对于大额铸造操作没有时间锁,缺乏快速应急响应机制。

Web3 安全威胁趋势

2026 年 Web3 安全呈现的最深层趋势是攻击面的系统性扩大。漏洞正同时在代码、基础设施、交互操作和人为流程中出现,单单依靠数次安全审计或工具无法覆盖运营安全、员工端、云基础设施、软件供应链等领域。这对 Web3 项目方的持续运营安全提出了更高要求。

此外,针对老旧 / 弃用的合约的攻击频发,其中的漏洞或是授权极易被攻击者利用。合约开发者或运营者应再次检查以往合约的安全性,对于弃用的合约,应及时处理或妥善转移合约中遗留的资金,联系用户取消不必要的授权。用户也应定期使用区块链浏览器或撤销授权工具检查并取消不再使用的合约授权。

Kraken Plans CFTC-Regulated Perpetual Futures For US Professional Traders

Kraken plans to launch CFTC-regulated perpetual futures for eligible US professional traders through its acquired derivatives exchange, Bitnomial. These contracts, featuring continuous pricing, no expiry, and regular funding, aim to provide a regulated domestic route to a product that is central to global crypto trading but has been largely inaccessible on US platforms. The offering is expected to be integrated into Kraken Pro, allowing traders to manage various exposures in one interface. Key factors for success will include eligibility criteria, contract design, and the development of sufficient liquidity. This move could pave the way for more regulated perpetual products in the US market.

bitcoinist2h ago

Kraken Plans CFTC-Regulated Perpetual Futures For US Professional Traders

bitcoinist2h ago

Warsh's Debut: Will the FED Chair Who Knows Crypto Best Bring Surprises or Shocks to the Market?

Kevin Warsh, the new Federal Reserve Chairman, prepares for his inaugural press conference amidst a challenging macroeconomic landscape: resurgent inflation, a bond market sell-off, and political pressure from President Trump for rate cuts. Uniquely, Warsh holds indirect investments in over 20 crypto and Web3 entities (e.g., Solana, dYdX), making him the first Fed Chair with disclosed crypto exposure. His stance may combine a hawkish, inflation-focused monetary policy with a crypto-friendly regulatory philosophy that shifts from Powell’s “same risk, same rule” approach toward a framework acknowledging blockchain’s productivity value. Warsh’s leadership could impact crypto markets across three dimensions: a paradigm shift in regulation (potentially accelerating pro-innovation legislation and stable币 rules), a re-pricing of risk premiums based on clearer communication and his view of AI as a structural disinflationary force, and a long-term reallocation of global institutional capital driven by increased legitimacy. Two potential scenarios for the press conference are outlined. A “positive surprise” would involve a dovish-leaning tone on rates coupled with signals of regulatory openness, potentially boosting crypto asset valuations. Conversely, a “negative shock” would see a more hawkish-than-expected stance on inflation and rates, triggering a broad risk-asset selloff that crypto markets would not escape. While ethics rules required Warsh to divest his crypto holdings upon confirmation, his deep understanding of the technology may fundamentally lower policy uncertainty and build a more receptive long-term foundation for digital assets’ integration into the mainstream financial system.

marsbit2h ago

Warsh's Debut: Will the FED Chair Who Knows Crypto Best Bring Surprises or Shocks to the Market?

marsbit2h ago

XRP Ledger Launches XRPLd Rebrand With Version 3.2.0 Upgrade

XRP Ledger has launched version 3.2.0, rebranding its core server software from "rippled" to "xrpld." This release focuses on back-end upgrades, including major memory optimizations that can reduce server memory usage by up to 40% and architectural improvements for future scaling. Key updates enhance security for features like vaults, lending, and decentralized exchanges, and introduce new invariant checks for ledger consistency. The upgrade also adds the capability for applications to retrieve protocol information without connecting to a server, aiding wallet and API development. Additional changes aim to improve enterprise connectivity and performance, featuring configurable block sizes and an updated default peering port, along with various fixes for core network functions.

TheNewsCrypto3h ago

XRP Ledger Launches XRPLd Rebrand With Version 3.2.0 Upgrade

TheNewsCrypto3h ago

AGI is Not the End, DeepMind's New Paper: Moving Towards ASI, the Real AI Progress Has Just Begun

In a new report, Google DeepMind researchers argue that achieving Artificial General Intelligence (AGI) is not the end goal, but rather a step toward Artificial Superintelligence (ASI). They outline four potential pathways for this transition: 1) continued scaling of compute, models, and data; 2) algorithmic evolution and potential paradigm shifts; 3) recursive self-improvement; and 4) multi-agent coordination and collective intelligence. The report also identifies six key bottlenecks that could hinder progress: data limitations (the "data wall"), economic and resource pressures, limitations of current neural network paradigms, increasing research difficulty, "abstraction barriers" in forming new concepts, and regulatory and societal pushback. Looking ahead, the authors emphasize the need for new evaluation methods once AI surpasses human benchmarks. They call for a large-scale, interdisciplinary effort to prepare for a future where AI-driven advancements could trigger transformative changes across multiple fields. The path and speed of progress remain uncertain, constrained by physical laws, computational complexity, and real-world feedback loops.

marsbit4h ago

AGI is Not the End, DeepMind's New Paper: Moving Towards ASI, the Real AI Progress Has Just Begun

marsbit4h ago

Kraken Launches Pre-IPO Perps For OpenAI And Anthropic With Up To 5x Leverage

Kraken has launched pre-IPO perpetual futures contracts for private AI giants OpenAI and Anthropic, offering eligible traders up to 5x leverage. These derivatives provide synthetic exposure to the companies' valuations ahead of any public listing, tapping into high investor demand for AI themes. However, the product carries unique risks compared to standard crypto perpetuals, as private company valuations lack transparent, continuous pricing and depend on funding rounds, secondary transactions, and IPO timelines. This move signals crypto exchanges' expansion into alternative speculative markets beyond digital assets, though it raises questions about risk management, liquidity, and investor understanding, especially when using leverage.

bitcoinist4h ago

Kraken Launches Pre-IPO Perps For OpenAI And Anthropic With Up To 5x Leverage

bitcoinist4h ago

Trading

Spot

Futures

Hot Articles

What is DOGE M

Doge Matrix ($doge m): The New Breed of Community-Driven Cryptocurrency Introduction In the ever-evolving landscape of cryptocurrency, new projects constantly emerge, each aiming to capture the interest of investors and enthusiasts alike. One of the latest entrants to this domain is Doge Matrix, represented by the ticker symbol $doge m. This project has attracted attention thanks to its roots in the popular meme culture surrounding Dogecoin, establishing its place within the web3 space. This article aims to provide a comprehensive analysis of Doge Matrix, covering its overview, creator, investors, functionality, timeline, and notable aspects. What is Doge Matrix ($doge m)? Doge Matrix is a community-driven cryptocurrency project that seemingly builds upon the widespread appeal of Dogecoin, a digital currency known for its Shiba Inu mascot and its meme origins. While the overarching objectives of Doge Matrix are not extensively defined, it is characterised by a commitment to harnessing community involvement and support. Unlike traditional cryptocurrencies that often emphasise utility or intrinsic value through underlying technologies, Doge Matrix positions itself within a space that embraces the cultural phenomenon of cryptocurrencies, particularly appealing to those who resonate with the ethos of meme-based assets. Drawing on the strengths of the Dogecoin community, Doge Matrix operates as part of a broader ecosystem, inviting participation and engagement from users who share an interest in cryptocurrency and the digital landscape. Who is the Creator of Doge Matrix ($doge m)? The identity of the creator of Doge Matrix remains unknown. This lack of transparency is not an uncommon occurrence in the cryptocurrency space, where some projects are launched without revealing the identities of their founders. The absence of information regarding the founding team can raise questions among potential investors about the project’s accountability and direction. Who are the Investors of Doge Matrix ($doge m)? As it stands, there is no publicly available information detailing the investors or investment foundations that back Doge Matrix. The project appears to rely primarily on community support rather than institutional investment. This model aligns with the community-driven nature of the initiative, fostering an environment where the direction of the project is shaped by its participants rather than being dictated by a select few financial backers. How Does Doge Matrix ($doge m) Work? The specifics regarding the operational mechanisms of Doge Matrix are somewhat vague, reflecting a broader trend of projects in the meme coin space where innovative functionalities are not always clearly articulated. Nonetheless, Doge Matrix seems designed to tap into the existing cryptocurrency ecosystem by encouraging user participation while tapping into the familiar cultural references associated with Dogecoin. Its potentially unique characteristics derive from community interactions rather than technological advancements, emphasising shared experiences and collaboration among token holders. While the exact innovations have not been explicitly outlined, the project appears to create a space where community members can engage, share ideas, and propel the project's potential forward. Timeline of Doge Matrix ($doge m) Reflecting on the project’s timeline reveals notable events that have defined its journey thus far: November 25, 2024: Doge Matrix reached its all-time high value, marking a significant milestone in its early history. January 1, 2025: Conversely, Doge Matrix hit its all-time low value, illustrating the volatility often associated with cryptocurrencies, especially in the early stages of a project's lifecycle. Ongoing: The project continues to be actively traded and supported by its community, although specific future milestones or objectives have yet to be disclosed. Key Points About Doge Matrix ($doge m) Community Focus At the heart of Doge Matrix is a commitment to community engagement. The project thrives on the premise of collaboration and shared objectives among its members, emphasising the importance of collective effort. Unlike centralised projects that often have a defined leadership structure, Doge Matrix at present showcases a more fluid approach to governance, where every community member's voice matters. Volatility The cryptocurrency market is notorious for its volatility, and Doge Matrix is no exception. Its price history reflects significant fluctuations between high and low values, which is typical of many new cryptocurrencies but underscores the risks associated with investment in emerging tokens. Lack of Detailed Information One of the most striking features about Doge Matrix is the scarcity of detailed information regarding its technological underpinnings and operational mechanisms. This ambiguity necessitates that potential investors conduct thorough due diligence before engaging with the project. Conclusion In summary, Doge Matrix ($doge m) illustrates a new wave of cryptocurrency projects that lean heavily on community engagement and cultural relevance. While lacking in certain specifics—such as clear leadership, defined objectives, and detailed functionality—the project has managed to generate interest within the crypto community, leveraging the established appeal of meme culture. As with any investment in the cryptocurrency space, understanding the inherent risks and conducting comprehensive research is essential for potential participants. Doge Matrix stands as a reminder of the dynamic, sometimes unpredictable nature of the crypto industry, marked by constant evolution and enthusiasm for community-driven initiatives.

521 Total ViewsPublished 2025.02.03Updated 2025.02.03

What is $M

Understanding Mantis ($M): A New Era in Cross-Chain Interoperability In the continually evolving landscape of Web3 and cryptocurrency, new projects strive to offer innovative solutions aimed at enhancing the user experience and expanding functional possibilities within the decentralised financial ecosystem. One such project garnering attention is Mantis ($M), a pioneering protocol founded on the principles of cross-chain interoperability and intent-based settlements. This article delves into the essential aspects of Mantis, including its core functionality, creators, investment backing, innovative features, and critical milestones. What is Mantis ($M)? Mantis is described as a multi-domain intent settlement protocol that simplifies cross-chain interactions, enabling users to execute complex financial transactions across various blockchain platforms seamlessly. The protocol operates through three primary layers: Intent Expression: Users can articulate their transaction goals using natural language facilitated by the DISE LLM, an advanced AI language model. For instance, a user might express a desire to swap Ethereum (ETH) for Solana (SOL) with a specific slippage tolerance of 1%. Execution: This layer employs a network of solvers that compete to fulfil user intents. Transactions are executed using mechanisms such as Coincidence of Wants (CoWs) and Order Flow Auctions (OFAs), which ensure that user demands are met optimally. Settlement: Leveraging the Inter-Blockchain Communication (IBC) protocol, Mantis enables atomic cross-chain transactions, allowing users to operate across various supported chains, including Ethereum, Solana, and Cosmos. Mantis is engineered to introduce native yield generation for idle assets, employing cryptographic proofs to maintain the integrity of transactions throughout the entire process. Creators & Development Team Mantis was conceived by the Composable Foundation, a research-driven organisation notable for its emphasis on blockchain interoperability solutions. This foundation collaborates with esteemed academic institutions, including Harvard University and the University of Lisbon, contributing to extensive research and development efforts that inform Mantis's architecture and functionality. The Composable Foundation’s commitment to fostering innovation in the blockchain space positions Mantis as a robust solution for the growing demand for interoperability among multiple blockchain networks. Investors & Backing While specific details about individual investors have not been publicly disclosed, Mantis enjoys substantial backing from various entities, including: Ecosystem grants from IBC-enabled chains, which support the protocol's growth and integration within decentralised finance ecosystems. Strategic partnerships with infrastructure providers that enhance Mantis's network capabilities and deployment strategies. Funding through the Composable Foundation's treasury, ensuring sustained financial support for ongoing development and operational costs. These collaborative efforts reflect a consensus among stakeholders about the importance of enhancing cross-chain functionality and the potential utility of Mantis's infrastructural innovations. Key Innovations Mantis sets itself apart through several pioneering innovations that enhance its functionality and utility: Chain-Agnostic Intents: Users can initiate transactions from any supported chain while settling on another. This flexibility empowers users, driving increased interaction among different platforms. AI-Powered Interface: The integration of DISE LLM allows users to conduct complex DeFi operations using natural language, thereby simplifying interactions and making blockchain technology accessible to a broader audience. Cross-Domain MEV Capture: Mantis creates an internal market for maximal extractable value (MEV) through competitions among solvers. This innovative approach allows for greater efficiency and value extraction in complex transactions. Modular Settlement Layer: The protocol supports various verification methods, including zero-knowledge proofs and optimistic rollups, providing a versatile framework that can adapt to emerging blockchain technologies. Historical Timeline Mantis's development is marked by several critical milestones that chart its trajectory and growth: | Year | Milestone | |————|————————————————————————-| | 2022 | Initial concept development within the Composable Foundation's research division. | | Q3 2024 | Launch of the testnet with bridging capabilities between Solana and Ethereum. | | Q1 2025 | Anticipated Token Generation Event (TGE) alongside the mainnet launch. | | Q2 2025 | Expected integration of DISE LLM and expansion of cross-chain capabilities. | | 2025 H2 | Planned support for over 15 chains through further IBC upgrades. | This timeline outlines Mantis's evolution, from conceptual discussions to active implementation and future growth phases. Ecosystem Growth Strategy Mantis's strategy for ecosystem growth includes several initiatives designed to encourage user participation and developer engagement: Credits System: Users can earn protocol credits by providing liquidity and engaging in referral programmes. These credits are redeemable for incentives in the future, fostering a robust user community. Modular Software Development Kit (SDK): This toolkit empowers developers to create applications based on intent-driven models utilising Mantis's infrastructure, thus promoting innovation within its ecosystem. Governance Model: As the protocol matures, $M token holders will have a voice in protocol governance, allowing them to vote on proposed upgrades and changes, thereby enhancing community engagement and decentralisation. Mantis represents a significant advancement in the realm of cross-chain architecture. By seamlessly integrating advanced AI algorithms with a robust settlement framework, Mantis seeks to tackle the problems of fragmentation within multi-chain ecosystems. Its innovative approach prioritises improved user experiences while adhering to the foundational principles of decentralisation and security, setting a new standard for the future interoperability of blockchain technologies. As Mantis continues its journey of growth and implementation, it promises to be a project to watch closely in the competitive landscape of Web3 and decentralised finance. With its focus on crossing boundaries and elevating user engagement, Mantis is poised to be an integral part of the future developments in the cryptocurrency space.

45 Total ViewsPublished 2025.03.18Updated 2025.03.18

Discussions

Welcome to the HTX Community. Here, you can stay informed about the latest platform developments and gain access to professional market insights. Users' opinions on the price of M (M) are presented below.