Artículos Relacionados con Exploit

El Centro de Noticias de HTX ofrece los artículos más recientes y un análisis profundo sobre "Exploit", cubriendo tendencias del mercado, actualizaciones de proyectos, desarrollos tecnológicos y políticas regulatorias en la industria de cripto.

Bonzo Lend Incident Review: How Did a Zero-Signature Vulnerability Cause the Protocol to Lose $9.05 Million?

The lending protocol Bonzo Lend on Hedera was exploited for $9.05 million due to a zero-signature vulnerability in an oracle verifier. An attacker deposited $250 worth of SAUCE tokens and submitted a manipulated price feed with a zero-valued signature and public key point. The oracle verifier, operated by Supra, incorrectly accepted this invalid cryptographic proof as legitimate because the pairing equation mathematically evaluated to true for these zero/identity inputs. This allowed the attacker to artificially inflate the collateral's value by roughly 12 orders of magnitude and borrow $6.63 million in USDC and 34.5 million wrapped HBAR. A second wallet borrowed ~$1 million during the incident but has since contacted Bonzo, identifying as a whitehat with intent to return funds. Bonzo has paused all operations and withdrawals. Supra has reportedly patched the verifier flaw. The protocol remains in maintenance mode while determining recovery plans, compensation, and withdrawal terms for liquidity providers.

marsbitHace 12 hora(s)

Bonzo Lend Incident Review: How Did a Zero-Signature Vulnerability Cause the Protocol to Lose $9.05 Million?

marsbitHace 12 hora(s)

Inside Bonzo Lend’s $9M exploit – Why secure smart contracts couldn’t stop it

Bonzo Lend, a lending protocol on the Hedera network, suffered a $9.05 million exploit due to a flaw in the external Supra oracle system. The attacker manipulated SAUCE token price feeds, enabling them to borrow assets far exceeding their collateral. Audits confirmed the protocol's own smart contracts and the Hedera core network were secure; the failure originated in the trusted oracle infrastructure. This incident highlights a recurring DeFi risk where correct protocol logic can still be weaponized via compromised external data. The attack impacted market sentiment, causing a drop in HBAR's price and Hedera's DeFi TVL, underscoring the need for stronger oracle safeguards and verification standards.

ambcryptoHace 2 días 11:04

Inside Bonzo Lend’s $9M exploit – Why secure smart contracts couldn’t stop it

ambcryptoHace 2 días 11:04

Blockaid withdraws BTTC bridge exploit alert after shutdown operation confirmed

Blockchain security firm Blockaid retracted an alert about a potential $13.3 million exploit on the BitTorrent Chain (BTTC) Bridge. The firm had initially flagged suspicious on-chain activity involving the movement of assets like 7,285 ETH. However, Tron founder Justin Sun clarified the transactions were part of the authorized completion of the BTTC Bridge Sunset Program, an internal operation to shut down the bridge. Blockaid updated its assessment, confirming it was not an exploit. The bridge shutdown had been announced in June, with users instructed to migrate assets by a set deadline. All user funds remain safe, and the project will shift focus to decentralized AI initiatives.

ambcrypto07/07 20:53

Blockaid withdraws BTTC bridge exploit alert after shutdown operation confirmed

ambcrypto07/07 20:53

Summer.fi reveals months-long preparation behind $6M DeFi exploit

Summer.fi has detailed a $6.04 million exploit against its Lazy Summer Protocol USDC vaults, concluding it was a planned attack executed on July 6 after roughly three months of preparation. The root cause was an operational issue during the offboarding of an old strategy, not a smart contract bug. The attacker manipulated the net asset value (NAV) of two USDC vaults by donating stale-valued Silo vault tokens into an Ark that, despite being capped during offboarding, was still included in NAV calculations. This artificially inflated the vaults' share prices, allowing the attacker to redeem shares and withdraw $6.04 million. Losses were split between the Lower Risk Vault (~$5.64M) and the Higher Risk Vault (~$400k). Summer.fi emphasized the exploit did not involve compromised keys or a coding flaw. It also clarified the attack was not a simple flash loan exploit; flash loans only provided final transaction liquidity, while the attacker had accumulated the necessary assets months in advance. All protocol vaults are currently paused. Governance must now decide on compensation for affected users and when unaffected vaults can safely resume operations.

ambcrypto07/07 17:34

Summer.fi reveals months-long preparation behind $6M DeFi exploit

ambcrypto07/07 17:34

‘Incentivize democracy’ at the cost of security? Inside Bonk’s $20M exploit

BonkDAO, the governance body for the memecoin BONK, suffered a $20 million exploit due to a malicious governance proposal. The attacker acquired enough BONK to create a proposal with a 1% vote threshold, which then authorized transferring 4.4 trillion BONK to their wallet. Security analysts criticized the low approval threshold and lack of safeguards like lock periods for treasury transfers, calling it an operational security failure. The incident fueled debate about balancing decentralized governance with security. Following the news, BONK's price dropped 10%, though on-chain data indicated continued accumulation by large holders since June. The project is collaborating with law enforcement and exchanges to mitigate the situation.

ambcrypto07/07 10:02

‘Incentivize democracy’ at the cost of security? Inside Bonk’s $20M exploit

ambcrypto07/07 10:02

Why the UXLINK hacker’s 14,336 ETH transfers raise fresh questions for DeFi

Recent on-chain activity reveals the UXLINK exploiter is actively laundering stolen funds, complicating tracing efforts. The September 2025 hack, which exploited a 'delegateCall' vulnerability to steal roughly $4.5 million, involved converting illicit assets into DAI and Ethereum. Recently, the attacker swapped over 10 million DAI for approximately 6,000.8 ETH and has deposited a total of 14,336.6 ETH into the privacy mixer Tornado Cash in recent weeks, including over $8.1 million worth in a single move. Simultaneously, wallets connected to the defunct Mining Express Ponzi scheme have been converting long-held assets, swapping 5,004 ETH for 8.8 million DAI. Following a separate exploit of the Jaredfromsubway.eth MEV bot, about $5.1 million was also routed to Tornado Cash. These incidents underscore a critical vulnerability in DeFi: while enabling permissionless transfers, the ecosystem lacks effective mechanisms to halt or manage illicit funds once in motion, allowing them to be moved and concealed relatively easily. This highlights the need for strengthened cross-network coordination and real-time threat detection to better safeguard the space.

ambcrypto07/05 10:02

Why the UXLINK hacker’s 14,336 ETH transfers raise fresh questions for DeFi

ambcrypto07/05 10:02

How Hinkal protocol’s smart contract flaw sparked $820K USDC exploit

The Hinkal stablecoin privacy protocol suffered an exploit resulting in the loss of approximately $820,000 worth of USDC. The attack was enabled by a flaw in one of the protocol's smart contracts. The attacker manipulated the `prooflessDeposit()` function and executed a series of `transact()` calls, allowing them to withdraw funds that should not have been accessible. While the exact technical vulnerability remains unclear, it points to a failure in deposit validation or proof verification within Hinkal's privacy architecture. This incident highlights the persistent risk of smart contract bugs in DeFi, even as overall losses in the first half of 2026 are reported to be less than half of those from the same period in 2025.

ambcrypto07/04 13:02

How Hinkal protocol’s smart contract flaw sparked $820K USDC exploit

ambcrypto07/04 13:02

Crypto hacks hit record high in H1 2026 – What’s fueling the surge?

According to TRM Labs, crypto hacks reached a record high in the first half of 2026 with 207 incidents, more than double the 85 reported in H1 2025. While the number of breaches surged, the total value stolen fell to $972 million, less than half the $2.3 billion lost in the same period the previous year. Smart contract exploits were the most common attack type, constituting 125 cases. However, TRM Labs' Ari Redbord noted that three-quarters of the stolen value came from infrastructure failures like compromised keys and custody systems, highlighting a gap between improved code auditing and lagging operational security. Notably, North Korean-linked actors were responsible for 66% of the stolen funds. Major exploits, such as the $293 million attack on KelpDAO, triggered liquidity crises in protocols like Aave and contributed to a broader loss of confidence in DeFi, leading to significant capital outflows and a drop in Total Value Locked to a two-year low of $70 billion.

ambcrypto07/02 16:02

Crypto hacks hit record high in H1 2026 – What’s fueling the surge?

ambcrypto07/02 16:02

SecondFi Outlines Two-Week Recovery Plan After $2.4 Million Cardano Wallet Breach

SecondFi (formerly Yoroi wallet) has detailed a two-week recovery plan following a Cardano wallet security exploit that drained approximately $2.4 million in ADA from 374 addresses. The breach was caused by a flaw in the wallet-generation software, raising significant concerns about user trust in self-custody tools. SecondFi's structured response aims to accurately identify affected addresses and transparently restore funds, with its execution being critical to limiting reputational damage. While the Cardano network itself remains unaffected, the incident underscores that security at the wallet and user-interface layer is vital for overall ecosystem confidence. The outcome for the broader Cardano community hinges on the successful return of user assets and the demonstrated resolution of the underlying vulnerability.

bitcoinist06/30 03:31

SecondFi Outlines Two-Week Recovery Plan After $2.4 Million Cardano Wallet Breach

bitcoinist06/30 03:31

SecondFi Outlines Recovery Plan After $2.4 Million Cardano Wallet Exploit

SecondFi, a project on the Cardano blockchain, has completed a forensic investigation and outlined a recovery plan following an exploit that drained approximately $2.4 million in ADA from user wallets. The company has taken a snapshot of user balances and aims to return the assets within two weeks. The incident is characterized as a wallet-level vulnerability, not a failure of the Cardano protocol itself. The report cautions against blaming the underlying blockchain without direct technical evidence. This event is highlighted as a specific data point for traders to monitor amidst broader market uncertainty, emphasizing the importance of verifying official security updates and on-chain transaction records over speculative narratives.

bitcoinist06/28 19:20

SecondFi Outlines Recovery Plan After $2.4 Million Cardano Wallet Exploit

bitcoinist06/28 19:20

活动图片

Technology Trendsright-arrow

Trading Strategiesright-arrow