Beosin: En mayo ocurrieron 36 incidentes de seguridad importantes, con pérdidas superiores a 76 millones de dólares

marsbitPublished on 2026-06-10Last updated on 2026-06-10

Abstract

**Resumen de los incidentes de seguridad de mayo según Beosin: pérdidas superiores a 76 millones de dólares** Según los datos de monitorización de Beosin Alert, en mayo de 2026 se registraron **36 incidentes de seguridad significativos**, con pérdidas totales que superan los **76.15 millones de dólares**. Las causas principales fueron vulnerabilidades en contratos inteligentes y fugas de claves privadas. **Hallazgos clave:** * Los **puentes cruzacadenas (cross-chain bridges)** sufrieron las mayores pérdidas (27,995 millones de dólares), destacando el ataque al Verus-Ethereum Bridge (pérdida: 11,58 millones) por un defecto en la verificación de mensajes. * Los protocolos **DeFi** fueron los más atacados (14 incidentes). * La cadena con mayores pérdidas fue **Ethereum** (más de 48,76 millones), seguida de BNB Chain, Monad y TON, mostrando una tendencia de ataques multicalena. * Los incidentes por **fuga de claves privadas** resultaron en pérdidas conjuntas de más de 25 millones de dólares. El caso de **StablR** ejemplifica fallos de seguridad operativa, como el uso de multifirmas con umbral bajo (1 de N) y la falta de mecanismos de respuesta rápida. **Análisis de incidentes destacados:** 1. **Verus-Ethereum Bridge:** Vulnerabilidad en la verificación de datos de prueba, permitiendo transferencias no respaldadas por fondos. 2. **Trusted Volumes:** Defecto en la verificación de firmas durante el proceso RFQ (solicitud de cotización), que permitió a un atacante desvia...

Escrito por: Beosin

Según las estadísticas de datos de monitoreo de la plataforma Beosin Alert, en mayo de 2026, el monto total de pérdidas por diversos incidentes de seguridad fue de aproximadamente 76.15 millones de dólares, ocurriendo un total de "36" incidentes importantes de ataques de hackers, principalmente debido a vulnerabilidades en contratos y filtraciones de claves privadas. Entre ellos, hubo 17 incidentes de seguridad por vulnerabilidades en contratos/red, y 10 incidentes con daños por filtración de claves privadas, lo que representa un desafío severo para la seguridad del código y la seguridad operativa del ecosistema DeFi.

Top 10 protocolos con mayores pérdidas en mayo

El puente de interoperabilidad Verus-Ethereum Bridge, que conecta la cadena Verus L1 con Ethereum, fue atacado debido a una vulnerabilidad en el contrato, registrando la mayor pérdida de 11.58 millones de dólares. Echo Protocol, debido a una filtración de clave privada, fue atacado y el atacante acuñó 1000 eBTC (valor en papel de aproximadamente 76.7 millones de dólares), pero debido a limitaciones de liquidez, la ganancia real final fue de aproximadamente 5.13 millones de dólares.

Tipos de proyectos atacados y situación de pérdidas por cadena

Los objetivos atacados cubrieron varios tipos, incluyendo puentes de interoperabilidad, intercambios descentralizados, protocolos de préstamo, mercados de predicción, stablecoins, usuarios comunes, entre otros. Entre ellos, los puentes de interoperabilidad sufrieron las mayores pérdidas en monto, alcanzando los 27.995 millones, y los proyectos relacionados con DeFi fueron atacados la mayor cantidad de veces, registrando 14 incidentes.

La cadena con mayor monto de pérdidas en mayo fue Ethereum, con pérdidas superiores a 48.76 millones de dólares. Algunos puentes de interoperabilidad y la mayoría de los incidentes de seguridad en protocolos DeFi aún se centran principalmente en Ethereum. Le siguen BNB Chain, Monad, TON, y también ocurrieron incidentes de seguridad en Monero y Bitcoin, mostrando un panorama de ataques en cadena multinivel.

Análisis de los principales incidentes de seguridad

1. Verus: Defecto en la verificación de mensajes de interoperabilidad

El funcionamiento del Verus-Ethereum Bridge consiste en que el presentador proporciona datos probatorios que muestren que existe una salida válida notariada en la cadena Verus, y una vez que el contrato del puente verifica y aprueba, libera los activos en Ethereum. La vulnerabilidad radica en que el contrato del puente en el lado de Ethereum verifica la prueba proveniente de la cadena Verus, pero no valida si esos datos corresponden a una salida original válida, permitiendo que un atacante construya salidas falsas que pasen la verificación y extraiga fondos muy superiores a su depósito.

Parte del código con la vulnerabilidad:

La vulnerabilidad de este incidente pertenece a la misma categoría que la que causó pérdidas de 320 millones de dólares en Wormhole y 190 millones de dólares en Nomad en 2022: el puente verifica el mensaje en sí, pero no verifica el valor de los fondos subyacentes.

2. Trusted Volumes: Defecto en parámetros de firma

En este ataque, el atacante aprovechó un defecto en el diseño de firmas dentro del flujo de solicitud de cotización (RFQ) de TrustedVolumes. Al realizar la transferencia real, mediante datos de firma personalizados, configuró la parte que transfiere como el contrato Resolver de TrustedVolumes, pasando la verificación exitosamente, logrando así transferir los activos del contrato Resolver para obtener ganancias.

Parte del código con la vulnerabilidad:

La verificación de autorización hace referencia a varg4, mientras que la ejecución de la transferencia de fondos hace referencia a otros parámetros. La falta de validación conduce a que el campo del firmante autorizado y la dirección real de débito no coincidan.

Por lo tanto, el atacante solo necesita usar una dirección de firmante registrada para firmar un pedido, donde maker = Exploit (que pasa la verificación de firma), y otros parámetros de firma (token, monto) se pueden establecer en valores arbitrarios, por ejemplo, un pedido falso 1:1, para que pase la verificación de precio razonable del oráculo de precios, y luego retirar los activos del contrato del protocolo:

3. Incidentes de filtración de claves privadas, tomando StablR como ejemplo

En mayo ocurrieron múltiples incidentes de filtración de claves privadas, con un monto total de pérdidas superior a los 25 millones de dólares. Entre ellos, StablR, como emisor de stablecoins reguladas, se convirtió en una lección típica sobre seguridad y gobernanza en el campo de stablecoins y DeFi.

StablR lanzó dos productos de stablecoins reguladas: EURR y USDR. La billetera multisignatura que controla la acuñación de EURR es 0x8278D2881dBF8F6Fc01c98d196c4b16F1aade5Bc; la billetera multisignatura que controla la acuñación de USDR es 0xF45392bd2D6e6b8C5Dc26BA6c8a12889419B82F3.

Dado que para iniciar una transacción desde estas 2 billeteras multisignatura solo se requiere 1 firma, el atacante, al controlar la dirección propietaria 0xC73fD562de86d7860EE636C20813Bcb2cF4D550d, agregó la dirección 0xD4677B5A8B1b97EA213Fdb876b0FcBAB3f9F6CD1 a estas 2 billeteras multisignatura, logrando así el control sobre los privilegios de acuñación del proyecto:

Este tipo de incidentes no se deben a vulnerabilidades de código, sino a problemas de seguridad operativa del proyecto: no proteger adecuadamente las claves privadas de las direcciones privilegiadas, no usar multisignatura con umbral alto para operaciones de alto valor/riesgo, no implementar bloqueos de tiempo para operaciones de acuñación de grandes montos, y falta de mecanismos de respuesta rápida de emergencia.

Tendencias de amenazas de seguridad en Web3

La tendencia más profunda en la seguridad de Web3 en 2026 es la expansión sistémica de las superficies de ataque. Las vulnerabilidades están apareciendo simultáneamente en código, infraestructura, operaciones de interoperabilidad y procesos humanos. Confiar únicamente en algunas auditorías de seguridad o herramientas no puede cubrir áreas como la seguridad operativa, el lado de los empleados, la infraestructura en la nube y la cadena de suministro de software. Esto plantea mayores exigencias para la seguridad operativa continua de los proyectos Web3.

Además, los ataques contra contratos antiguos/inutilizados son frecuentes, donde las vulnerabilidades o autorizaciones son fácilmente explotables por atacantes. Los desarrolladores u operadores de contratos deberían revisar nuevamente la seguridad de los contratos anteriores. Para los contratos inutilizados, se deben manejar oportunamente o transferir adecuadamente los fondos residuales en el contrato, y contactar a los usuarios para cancelar autorizaciones innecesarias. Los usuarios también deben verificar periódicamente y cancelar autorizaciones de contratos que ya no usen, utilizando exploradores de blockchain o herramientas de revocación de autorizaciones.

Kraken Plans CFTC-Regulated Perpetual Futures For US Professional Traders

Kraken plans to launch CFTC-regulated perpetual futures for eligible US professional traders through its acquired derivatives exchange, Bitnomial. These contracts, featuring continuous pricing, no expiry, and regular funding, aim to provide a regulated domestic route to a product that is central to global crypto trading but has been largely inaccessible on US platforms. The offering is expected to be integrated into Kraken Pro, allowing traders to manage various exposures in one interface. Key factors for success will include eligibility criteria, contract design, and the development of sufficient liquidity. This move could pave the way for more regulated perpetual products in the US market.

bitcoinist1h ago

Kraken Plans CFTC-Regulated Perpetual Futures For US Professional Traders

bitcoinist1h ago

Warsh's Debut: Will the FED Chair Who Knows Crypto Best Bring Surprises or Shocks to the Market?

Kevin Warsh, the new Federal Reserve Chairman, prepares for his inaugural press conference amidst a challenging macroeconomic landscape: resurgent inflation, a bond market sell-off, and political pressure from President Trump for rate cuts. Uniquely, Warsh holds indirect investments in over 20 crypto and Web3 entities (e.g., Solana, dYdX), making him the first Fed Chair with disclosed crypto exposure. His stance may combine a hawkish, inflation-focused monetary policy with a crypto-friendly regulatory philosophy that shifts from Powell’s “same risk, same rule” approach toward a framework acknowledging blockchain’s productivity value. Warsh’s leadership could impact crypto markets across three dimensions: a paradigm shift in regulation (potentially accelerating pro-innovation legislation and stable币 rules), a re-pricing of risk premiums based on clearer communication and his view of AI as a structural disinflationary force, and a long-term reallocation of global institutional capital driven by increased legitimacy. Two potential scenarios for the press conference are outlined. A “positive surprise” would involve a dovish-leaning tone on rates coupled with signals of regulatory openness, potentially boosting crypto asset valuations. Conversely, a “negative shock” would see a more hawkish-than-expected stance on inflation and rates, triggering a broad risk-asset selloff that crypto markets would not escape. While ethics rules required Warsh to divest his crypto holdings upon confirmation, his deep understanding of the technology may fundamentally lower policy uncertainty and build a more receptive long-term foundation for digital assets’ integration into the mainstream financial system.

marsbit2h ago

Warsh's Debut: Will the FED Chair Who Knows Crypto Best Bring Surprises or Shocks to the Market?

marsbit2h ago

XRP Ledger Launches XRPLd Rebrand With Version 3.2.0 Upgrade

XRP Ledger has launched version 3.2.0, rebranding its core server software from "rippled" to "xrpld." This release focuses on back-end upgrades, including major memory optimizations that can reduce server memory usage by up to 40% and architectural improvements for future scaling. Key updates enhance security for features like vaults, lending, and decentralized exchanges, and introduce new invariant checks for ledger consistency. The upgrade also adds the capability for applications to retrieve protocol information without connecting to a server, aiding wallet and API development. Additional changes aim to improve enterprise connectivity and performance, featuring configurable block sizes and an updated default peering port, along with various fixes for core network functions.

TheNewsCrypto2h ago

XRP Ledger Launches XRPLd Rebrand With Version 3.2.0 Upgrade

TheNewsCrypto2h ago

AGI is Not the End, DeepMind's New Paper: Moving Towards ASI, the Real AI Progress Has Just Begun

In a new report, Google DeepMind researchers argue that achieving Artificial General Intelligence (AGI) is not the end goal, but rather a step toward Artificial Superintelligence (ASI). They outline four potential pathways for this transition: 1) continued scaling of compute, models, and data; 2) algorithmic evolution and potential paradigm shifts; 3) recursive self-improvement; and 4) multi-agent coordination and collective intelligence. The report also identifies six key bottlenecks that could hinder progress: data limitations (the "data wall"), economic and resource pressures, limitations of current neural network paradigms, increasing research difficulty, "abstraction barriers" in forming new concepts, and regulatory and societal pushback. Looking ahead, the authors emphasize the need for new evaluation methods once AI surpasses human benchmarks. They call for a large-scale, interdisciplinary effort to prepare for a future where AI-driven advancements could trigger transformative changes across multiple fields. The path and speed of progress remain uncertain, constrained by physical laws, computational complexity, and real-world feedback loops.

marsbit3h ago

AGI is Not the End, DeepMind's New Paper: Moving Towards ASI, the Real AI Progress Has Just Begun

marsbit3h ago

Kraken Launches Pre-IPO Perps For OpenAI And Anthropic With Up To 5x Leverage

Kraken has launched pre-IPO perpetual futures contracts for private AI giants OpenAI and Anthropic, offering eligible traders up to 5x leverage. These derivatives provide synthetic exposure to the companies' valuations ahead of any public listing, tapping into high investor demand for AI themes. However, the product carries unique risks compared to standard crypto perpetuals, as private company valuations lack transparent, continuous pricing and depend on funding rounds, secondary transactions, and IPO timelines. This move signals crypto exchanges' expansion into alternative speculative markets beyond digital assets, though it raises questions about risk management, liquidity, and investor understanding, especially when using leverage.

bitcoinist3h ago

Kraken Launches Pre-IPO Perps For OpenAI And Anthropic With Up To 5x Leverage

bitcoinist3h ago

Trading

Spot

Futures

Hot Articles

What is DOGE M

Doge Matrix ($doge m): The New Breed of Community-Driven Cryptocurrency Introduction In the ever-evolving landscape of cryptocurrency, new projects constantly emerge, each aiming to capture the interest of investors and enthusiasts alike. One of the latest entrants to this domain is Doge Matrix, represented by the ticker symbol $doge m. This project has attracted attention thanks to its roots in the popular meme culture surrounding Dogecoin, establishing its place within the web3 space. This article aims to provide a comprehensive analysis of Doge Matrix, covering its overview, creator, investors, functionality, timeline, and notable aspects. What is Doge Matrix ($doge m)? Doge Matrix is a community-driven cryptocurrency project that seemingly builds upon the widespread appeal of Dogecoin, a digital currency known for its Shiba Inu mascot and its meme origins. While the overarching objectives of Doge Matrix are not extensively defined, it is characterised by a commitment to harnessing community involvement and support. Unlike traditional cryptocurrencies that often emphasise utility or intrinsic value through underlying technologies, Doge Matrix positions itself within a space that embraces the cultural phenomenon of cryptocurrencies, particularly appealing to those who resonate with the ethos of meme-based assets. Drawing on the strengths of the Dogecoin community, Doge Matrix operates as part of a broader ecosystem, inviting participation and engagement from users who share an interest in cryptocurrency and the digital landscape. Who is the Creator of Doge Matrix ($doge m)? The identity of the creator of Doge Matrix remains unknown. This lack of transparency is not an uncommon occurrence in the cryptocurrency space, where some projects are launched without revealing the identities of their founders. The absence of information regarding the founding team can raise questions among potential investors about the project’s accountability and direction. Who are the Investors of Doge Matrix ($doge m)? As it stands, there is no publicly available information detailing the investors or investment foundations that back Doge Matrix. The project appears to rely primarily on community support rather than institutional investment. This model aligns with the community-driven nature of the initiative, fostering an environment where the direction of the project is shaped by its participants rather than being dictated by a select few financial backers. How Does Doge Matrix ($doge m) Work? The specifics regarding the operational mechanisms of Doge Matrix are somewhat vague, reflecting a broader trend of projects in the meme coin space where innovative functionalities are not always clearly articulated. Nonetheless, Doge Matrix seems designed to tap into the existing cryptocurrency ecosystem by encouraging user participation while tapping into the familiar cultural references associated with Dogecoin. Its potentially unique characteristics derive from community interactions rather than technological advancements, emphasising shared experiences and collaboration among token holders. While the exact innovations have not been explicitly outlined, the project appears to create a space where community members can engage, share ideas, and propel the project's potential forward. Timeline of Doge Matrix ($doge m) Reflecting on the project’s timeline reveals notable events that have defined its journey thus far: November 25, 2024: Doge Matrix reached its all-time high value, marking a significant milestone in its early history. January 1, 2025: Conversely, Doge Matrix hit its all-time low value, illustrating the volatility often associated with cryptocurrencies, especially in the early stages of a project's lifecycle. Ongoing: The project continues to be actively traded and supported by its community, although specific future milestones or objectives have yet to be disclosed. Key Points About Doge Matrix ($doge m) Community Focus At the heart of Doge Matrix is a commitment to community engagement. The project thrives on the premise of collaboration and shared objectives among its members, emphasising the importance of collective effort. Unlike centralised projects that often have a defined leadership structure, Doge Matrix at present showcases a more fluid approach to governance, where every community member's voice matters. Volatility The cryptocurrency market is notorious for its volatility, and Doge Matrix is no exception. Its price history reflects significant fluctuations between high and low values, which is typical of many new cryptocurrencies but underscores the risks associated with investment in emerging tokens. Lack of Detailed Information One of the most striking features about Doge Matrix is the scarcity of detailed information regarding its technological underpinnings and operational mechanisms. This ambiguity necessitates that potential investors conduct thorough due diligence before engaging with the project. Conclusion In summary, Doge Matrix ($doge m) illustrates a new wave of cryptocurrency projects that lean heavily on community engagement and cultural relevance. While lacking in certain specifics—such as clear leadership, defined objectives, and detailed functionality—the project has managed to generate interest within the crypto community, leveraging the established appeal of meme culture. As with any investment in the cryptocurrency space, understanding the inherent risks and conducting comprehensive research is essential for potential participants. Doge Matrix stands as a reminder of the dynamic, sometimes unpredictable nature of the crypto industry, marked by constant evolution and enthusiasm for community-driven initiatives.

521 Total ViewsPublished 2025.02.03Updated 2025.02.03

What is $M

Understanding Mantis ($M): A New Era in Cross-Chain Interoperability In the continually evolving landscape of Web3 and cryptocurrency, new projects strive to offer innovative solutions aimed at enhancing the user experience and expanding functional possibilities within the decentralised financial ecosystem. One such project garnering attention is Mantis ($M), a pioneering protocol founded on the principles of cross-chain interoperability and intent-based settlements. This article delves into the essential aspects of Mantis, including its core functionality, creators, investment backing, innovative features, and critical milestones. What is Mantis ($M)? Mantis is described as a multi-domain intent settlement protocol that simplifies cross-chain interactions, enabling users to execute complex financial transactions across various blockchain platforms seamlessly. The protocol operates through three primary layers: Intent Expression: Users can articulate their transaction goals using natural language facilitated by the DISE LLM, an advanced AI language model. For instance, a user might express a desire to swap Ethereum (ETH) for Solana (SOL) with a specific slippage tolerance of 1%. Execution: This layer employs a network of solvers that compete to fulfil user intents. Transactions are executed using mechanisms such as Coincidence of Wants (CoWs) and Order Flow Auctions (OFAs), which ensure that user demands are met optimally. Settlement: Leveraging the Inter-Blockchain Communication (IBC) protocol, Mantis enables atomic cross-chain transactions, allowing users to operate across various supported chains, including Ethereum, Solana, and Cosmos. Mantis is engineered to introduce native yield generation for idle assets, employing cryptographic proofs to maintain the integrity of transactions throughout the entire process. Creators & Development Team Mantis was conceived by the Composable Foundation, a research-driven organisation notable for its emphasis on blockchain interoperability solutions. This foundation collaborates with esteemed academic institutions, including Harvard University and the University of Lisbon, contributing to extensive research and development efforts that inform Mantis's architecture and functionality. The Composable Foundation’s commitment to fostering innovation in the blockchain space positions Mantis as a robust solution for the growing demand for interoperability among multiple blockchain networks. Investors & Backing While specific details about individual investors have not been publicly disclosed, Mantis enjoys substantial backing from various entities, including: Ecosystem grants from IBC-enabled chains, which support the protocol's growth and integration within decentralised finance ecosystems. Strategic partnerships with infrastructure providers that enhance Mantis's network capabilities and deployment strategies. Funding through the Composable Foundation's treasury, ensuring sustained financial support for ongoing development and operational costs. These collaborative efforts reflect a consensus among stakeholders about the importance of enhancing cross-chain functionality and the potential utility of Mantis's infrastructural innovations. Key Innovations Mantis sets itself apart through several pioneering innovations that enhance its functionality and utility: Chain-Agnostic Intents: Users can initiate transactions from any supported chain while settling on another. This flexibility empowers users, driving increased interaction among different platforms. AI-Powered Interface: The integration of DISE LLM allows users to conduct complex DeFi operations using natural language, thereby simplifying interactions and making blockchain technology accessible to a broader audience. Cross-Domain MEV Capture: Mantis creates an internal market for maximal extractable value (MEV) through competitions among solvers. This innovative approach allows for greater efficiency and value extraction in complex transactions. Modular Settlement Layer: The protocol supports various verification methods, including zero-knowledge proofs and optimistic rollups, providing a versatile framework that can adapt to emerging blockchain technologies. Historical Timeline Mantis's development is marked by several critical milestones that chart its trajectory and growth: | Year | Milestone | |————|————————————————————————-| | 2022 | Initial concept development within the Composable Foundation's research division. | | Q3 2024 | Launch of the testnet with bridging capabilities between Solana and Ethereum. | | Q1 2025 | Anticipated Token Generation Event (TGE) alongside the mainnet launch. | | Q2 2025 | Expected integration of DISE LLM and expansion of cross-chain capabilities. | | 2025 H2 | Planned support for over 15 chains through further IBC upgrades. | This timeline outlines Mantis's evolution, from conceptual discussions to active implementation and future growth phases. Ecosystem Growth Strategy Mantis's strategy for ecosystem growth includes several initiatives designed to encourage user participation and developer engagement: Credits System: Users can earn protocol credits by providing liquidity and engaging in referral programmes. These credits are redeemable for incentives in the future, fostering a robust user community. Modular Software Development Kit (SDK): This toolkit empowers developers to create applications based on intent-driven models utilising Mantis's infrastructure, thus promoting innovation within its ecosystem. Governance Model: As the protocol matures, $M token holders will have a voice in protocol governance, allowing them to vote on proposed upgrades and changes, thereby enhancing community engagement and decentralisation. Mantis represents a significant advancement in the realm of cross-chain architecture. By seamlessly integrating advanced AI algorithms with a robust settlement framework, Mantis seeks to tackle the problems of fragmentation within multi-chain ecosystems. Its innovative approach prioritises improved user experiences while adhering to the foundational principles of decentralisation and security, setting a new standard for the future interoperability of blockchain technologies. As Mantis continues its journey of growth and implementation, it promises to be a project to watch closely in the competitive landscape of Web3 and decentralised finance. With its focus on crossing boundaries and elevating user engagement, Mantis is poised to be an integral part of the future developments in the cryptocurrency space.

45 Total ViewsPublished 2025.03.18Updated 2025.03.18

Discussions

Welcome to the HTX Community. Here, you can stay informed about the latest platform developments and gain access to professional market insights. Users' opinions on the price of M (M) are presented below.