Хакер опустошил DeFi-протокол USPD на $1 млн

cryptonews.ruPublicado a 2025-03-04Actualizado a 2025-12-05

Злоумышленник воспользовался уязвимостью протокола децентрализованных финансов US Permissionless Dollar (USPD) и вывел ликвидность на сумму более $1 млн.

Согласно отчету команды USPD в соцсети X, неизвестный внес залог на 3122 ETH и выпустил 98 млн токенов USPD за одну транзакцию. В результате сумма созданных токенов в десять раз превысила первоначальный депозит, причем хакер получил дополнительно 237 stETH. Украденные криптоактивы он обменял на 300 000 стейблкоинов USDC через децентрализованную биржу Curve. Обнаружив критическую уязвимость в протоколе, разработчики USPD призвали клиентов не покупать стейблкоины USPD и немедленно отозвать все разрешения.

Команда протокола уточнила: для взлома использовался сложный вектор атаки под названием CPIMP (Clandestine Proxy In the Middle of Proxy). Злоумышленник получил контроль над прокси-сервером несколько месяцев назад. 16 сентября он запустил процесс инициализации с помощью транзакции Multicall3. Хакер использовал CPIMP для скрытого получения административных прав и полного осуществления скриптов протокола, чтобы затем начать несанкционированный выпуск токенов.

Чтобы скрыть вредоносную настройку от пользователей, аудиторов и даже обозревателя блокчейна Эфириума Etherscan, неизвестный внедрил теневой контракт, перенаправлявший вызовы на проверяемый контракт. Замаскировавшись таким способом, злоумышленник манипулировал данными событий и подделывал слоты хранения, чтобы обозреватели блоков отображали исполнение безопасного контракта. Это позволило хакеру полностью контролировать смарт-контракт в течение нескольких месяцев, пока он не обновил прокси-сервер и не выпустил токены для истощения протокола.

Команда USPD заявила, что привлекла к расследованию инцидента и отслеживанию движения средств правоохранителей, специалистов по безопасности и крупные биржи. Разработчики USPD предложили злоумышленнику вернуть 90% активов в качестве вознаграждения за обнаружение багов — тогда злоумышленник будет считаться белым хакером.

По данным аналитиков PeckShield, в ноябре убытки криптовалютных проектов от хакерских атак превысили $194 млн. Это на 969% больше, чем в октябре, когда потери составили $18 млн.

Lecturas Relacionadas

US Large Models Moving Towards Closure, In the Name of Security

Summary: The U.S. government has intervened to regulate the release of advanced AI models, citing national security concerns. This analysis details the events surrounding the controlled rollout of Anthropic's Mythos 5 and Fable 5 models and OpenAI's restricted GPT-5.6 release, following a Trump administration executive order. It questions the technical basis for the government's actions, noting that internal company safety assessments did not deem the models an unacceptable risk. The article draws parallels to the 1990s "Crypto Wars," where similar attempts to control encryption technology ultimately failed, harming U.S. competitiveness. Experts warn that opaque, non-technical regulatory processes could stifle innovation, concentrate power, and undermine the economic logic of the AI industry, especially as Chinese models embrace open-source development. The piece concludes that this marks a potential turning point toward a pre-approval era for U.S. AI, creating uncertainty for developers and potentially slowing the broad societal diffusion essential for a technology's success.

链捕手Hace 55 min(s)

US Large Models Moving Towards Closure, In the Name of Security

链捕手Hace 55 min(s)

Maple Finance rallies 20% after Kraken partnership – Will SYRUP’s rise continue?

Maple Finance's native token SYRUP surged roughly 20% following a partnership announcement with crypto exchange Kraken to provide on-chain, asset-backed financing. This development, coupled with a broader market recovery, fueled significant trading volume, particularly from U.S. investors. The protocol's fundamentals strengthened, with its Total Value Locked (TVL) increasing by $201 million to around $2.05 billion and Q2 gross revenue reaching $24.16 million. An ongoing token buyback program and rising Open Interest in perpetual markets, alongside a positive but modest Funding Rate, indicate sustained bullish sentiment. The overall outlook remains positive, suggesting potential for further short-term gains for SYRUP.

ambcryptoHace 2 hora(s)

Maple Finance rallies 20% after Kraken partnership – Will SYRUP’s rise continue?

ambcryptoHace 2 hora(s)

Ethereum down 45% YTD – So why do SharpLink and whales keep buying?

Despite Ethereum (ETH) being down 20-45% year-to-date amid broader crypto weakness, institutional and whale buying activity suggests growing long-term conviction. SharpLink, after an eight-month pause, purchased 5,000 ETH and later added $45.54 million in LSETH, increasing its total holdings significantly despite substantial unrealized losses. Similarly, a new whale wallet accumulated over 18,000 ETH worth $28.9 million in nine days, indicating strategic positioning for future price movements rather than short-term trading. However, this accumulation contrasts with spot Ethereum ETFs, which saw net outflows of $12.85 million recently, highlighting a divergence between direct treasury/whale buyers and ETF investors. While the persistent buying from these large holders may gradually ease selling pressure, a sustained recovery for Ethereum still depends on a reversal in ETF flows and a broader improvement in network demand and market sentiment.

ambcryptoHace 6 hora(s)

Ethereum down 45% YTD – So why do SharpLink and whales keep buying?

ambcryptoHace 6 hora(s)

Just now, DeepSeek V4 updates with DSpark, improving inference speed by 80%

DeepSeek has updated its DeepSeek V4 model with the DSpark speculative decoding framework, achieving a significant 60-85% speedup in generation for Flash models and 57-78% for Pro models while maintaining the same overall throughput. This engineering-focused update, rather than a core architectural change, introduces DSpark to address latency and throughput bottlenecks in high-concurrency production environments. DSpark combines high-throughput parallel generation with adaptive load-aware verification. Its key innovations include a semi-autoregressive generation architecture to model dependencies within token blocks and a hardware-aware confidence-scheduled verification system. This system uses a confidence head to predict token acceptance probabilities, allowing it to dynamically optimize verification length per request and allocate compute only to tokens with the highest expected payoff. The asynchronous scheduler is designed for real-world deployment, ensuring zero-overhead scheduling and continuous CUDA graph replay while preserving the target model's output distribution. In tests across mathematical reasoning, code generation, and daily dialogue, DSpark outperformed state-of-the-art models like Eagle3 and DFlash, increasing average acceptance length by 26.7%-30.9% and 16.3%-18.4% respectively on Qwen3 target models. DeepSeek also open-sourced DeepSpec, a full-stack codebase for training and evaluating speculative decoding draft models, providing a standardized toolkit that includes data preparation tools, model implementations, training code, and evaluation scripts.

marsbitHace 7 hora(s)

Just now, DeepSeek V4 updates with DSpark, improving inference speed by 80%

marsbitHace 7 hora(s)

Can Aavenomics 3.0 sustain AAVE’s recovery rally amid Kraken buyout talks?

Aave Labs CEO Stani Kulechov has dismissed reports of a potential stake sale to Kraken, clarifying that Aave would not sell at a significant discount. He highlighted Aave's substantial annualized revenue and its focus on a broad financial market. Kulechov also announced plans for Aavenomics 3.0, featuring a new automated buyback mechanism. Following these updates, the AAVE token price surged 12%, extending its June recovery rally to over 50% from its recent lows. The rally is partly attributed to reduced selling pressure and positive sentiment from the announced tokenomics plan, despite the token remaining significantly below its all-time high.

ambcryptoHace 8 hora(s)

Can Aavenomics 3.0 sustain AAVE’s recovery rally amid Kraken buyout talks?

ambcryptoHace 8 hora(s)

Trading

Spot