How This Ethereum Lending Platform Was Attacked And Made A Deal With The Hacker

BitcoinistPubblicato 2022-06-28Pubblicato ultima volta 2022-06-28

Introduzione

Ethereum lending platform XCarnival confirmed a bad actor stole $3.8 million or 3,087 ETH. According to a report from on-chain...

Ethereum lending platform XCarnival confirmed a bad actor stole $3.8 million or 3,087 ETH. According to a report from on-chain security firm Peck Shield, a hacker exploited a vulnerability on the protocol’s smart contract by borrowing ETH and creating “multiple pledge orders to pledge BAYC (Bored Ape Yacht Club NFTs) many times”.
XCarnival operates as a non-fungible token (NFT) lending pool. The platform enables NFT holders to deposit their assets in exchange for liquidity. This process involves three smart contracts: an NFT manager, a P2Controller to manage lending restrictions, and fund storage, as stated by another security firm Go+ Security.
The hacker bought item 5110 from the popular Bored Ape Yacht Club NFT collection on OpenSea. Later, he deposited this asset on XCarnival and conducted an attack to “use the same NFT for borrowing”.
In other words, the attacker was able to pledge the NFT, borrowed ETH, and then remove the NFT without paying back the loan. The bad actor completed this process several times until the pool was drained.
Go+ Security explained that the hacker created a Master smart contract and several “slaves” smart contracts to conduct the attack:
Then Slave 5338 withdrew the NFT and sent it back to Master, who then repeated this process with other Slaves. In this way they created many orderIDs, which can later be used as lending credentials. But bugged xNFT contract didn’t revoke the credential after withdrawing.
XCarnival’s operated with a vulnerability on its smart contracts, mentioned above, which enable the attack if the user stays within a certain. Go+ Security added on the attack and the smart contract vulnerability: “Collateral is still valid after withdrawing. This is a very simple & naive bug in contract implementation.”
In light of the successful attack, the Ethereum-based NFT lending protocol decided to offer the hacker a deal.
Ethereum Platform Makes Deals With Its Attacker
According to its official Twitter account, the XCarnival offered the hacker a 1,500 ETH or $1.8 million bounty. Half the stolen funds. The attacker only needed to return the other half and they got to keep the money and suffer no legal consequences.
The team behind the platform confirmed that the hacker agreed to the terms. Half the stolen funds were returned to the pool. The Ethereum lending platform claims “security agencies have tentatively determined the hacker’s geographic location”.
This statement seems to hint at possible legal consequences for the attacker, but the team behind this project is yet to provide more information.

This is not the first time a hacker agrees to return a portion or the full amount of the stolen funds. Some hackers attack decentralized finance (DeFi) platforms and often held the money hostage until they receive payment for what they considered to be a “service”. Other projects are less lucky and pay the ultimate price.
At the time of writing, Ethereum (ETH) trades at $1,180 with a 3% loss in the last 24 hours.

ETH moving sideways on the 4-hour chart. Source: ETHUSD Tradingview

Letture associate

If the AI Bubble Is Already Bursting, Who Will Truly Remain?

**Summary: If the AI Bubble is Bursting, What Will Remain?** The debate around an AI bubble is intensifying, with figures like Ray Dalio warning of high valuations while Jensen Huang sees immense opportunity. This echoes the dot-com bubble, which saw massive wealth destruction but ultimately left behind critical infrastructure like undersea cables and broadband, enabling future giants like Amazon and Netflix. Similarly, today's AI boom involves trillions invested in data centers, power, cooling, and GPUs, while application-layer revenue remains comparatively modest. This investment-disparity signals a bubble. However, the core technological progress is real and accelerating. AI inference costs have plummeted by over 99.7% since 2023, making intelligence increasingly cheap and accessible. This cost collapse is unlocking vast new demand. Instead of reducing spending, enterprises are tripling their AI cloud expenditure. Cheap "tokens" enable AI to move beyond simple chatbots into complex workflows—automating code writing, legal document review, financial analysis, and scientific research. This follows "Jevons's paradox": improved efficiency leads to greater total consumption. The market is now undergoing a necessary purification, weeding out "API-wrapper" startups with no real moat. The deeper evolution involves a shift from capital expenditure (CapEx) on infrastructure to operational expenditure (OpEx) on value-creation in applications. While hardware vendors currently profit most, long-term value will migrate to AI-native firms solving vertical industry problems. Ultimately, a market correction will cleanse speculative excess but will not reverse the AI+ trend. The massive physical and algorithmic infrastructure being built will endure, becoming a cheap, utility-like foundation. Just as the internet became indispensable to all industries post-2000, AI is poised to empower and redefine every sector, moving society irreversibly toward an intelligence-augmented era. The bubble may burst, but the underlying productive momentum is solid.

链捕手8 min fa

If the AI Bubble Is Already Bursting, Who Will Truly Remain?

链捕手8 min fa

Microsoft CEO: In the AI Era, How Do You Define a Company's Moat?

Microsoft CEO Satya Nadella argues that in the AI era, a company's true competitive edge, or "moat," is not determined by choosing the single most powerful model, but by its ability to build a continuous "learning loop." This system integrates and evolves by connecting human workflows, domain expertise, organizational judgment, and employee experience. He posits that future companies will accumulate two types of capital: Human Capital (employee knowledge, judgment, creativity) and "Token Capital" (a firm's own built and owned AI capabilities). Importantly, AI amplifies rather than devalues human capital. Human direction is essential to guide progress, as computational power alone is aimless. The core opportunity lies in creating a closed-loop system where human and token capital reinforce each other in a compound, self-improving cycle. A company must be able to preserve its unique institutional knowledge—its "company veteran" expertise—even if it switches underlying general-purpose AI models. This requires private evaluation benchmarks, reinforcement learning environments based on internal data, and queryable knowledge bases. Nadella warns against a future where economic value is concentrated by a few dominant models that commoditize entire industries' knowledge. Instead, the priority should be building a broad "frontier ecosystem" where every company, industry, and nation can own its learning loop. This allows organizations to retain control of their intellectual property, amplify employee capabilities, and ensure the economic value created by AI is captured within their own businesses and communities. True corporate sovereignty in the AI age comes from turning organizational knowledge into a compounding system that creates enduring, defensible value.

marsbit43 min fa

Microsoft CEO: In the AI Era, How Do You Define a Company's Moat?

marsbit43 min fa

ETFs Are Just the Ticket: The True Institutionalization of Bitcoin Is Happening Where You Can't See It

Beyond the Bitcoin ETF spotlight, a deeper institutionalization is underway, leveraging Bitcoin as a foundational financial primitive. Institutions are using Bitcoin for purposes long reserved for assets like U.S. Treasuries and gold: as collateral for loans, insurance reserves, and the backbone of rated bonds. Examples include a Barbados-based insurer capitalizing with $40M in Bitcoin reserves and Ledn's $188M securitization of Bitcoin-backed loans, which received the first-ever investment-grade rating (BBB-) from S&P for a digital asset-backed security. This structure was stress-tested during a 27% price drop in early 2026, triggering automatic liquidations that functioned as designed but revealed the systemic risk of synchronized selling across leveraged positions. Infrastructure is evolving to support this, with platforms like Anchorage Digital's Atlas network enabling secure, institutional-grade settlement and collateral management. Strategies like basis trades and corporate treasuries (exemplified by companies like MicroStrategy issuing billions in equity and debt to fund Bitcoin acquisitions) further integrate Bitcoin into financial mechanics. While ETFs solved "how to own" Bitcoin, these developments answer "what to do with it," embedding the asset into the working machinery of finance—as collateral upon which loans, derivatives, and structured products are built. The real, enduring institutional shift is happening in these largely invisible plumbing and financing systems.

marsbit49 min fa

ETFs Are Just the Ticket: The True Institutionalization of Bitcoin Is Happening Where You Can't See It

marsbit49 min fa

ZEC Co-Founder Responds to Orchard Vulnerability: No Signs of Theft, Orchard Pool to Be Sealed

ZEC Co-Founder Addresses Orchard Vulnerability: No Signs of Theft, Plans to Sunset Orchard Pool A security vulnerability was recently discovered in Zcash's Orchard shielded pool, raising key concerns. The primary questions are whether the flaw was exploited, if user funds are safe, whether users can verify the total ZEC supply, and if other similar vulnerabilities exist. Analysis suggests the vulnerability was likely not exploited prior to its discovery. It was found proactively by a researcher using specialized tools, not due to an active breach. The development team and mining pools acted quickly to contain the issue. Typical financially-motivated attacks would likely have left visible on-chain evidence, which has not been observed. User funds in Orchard are considered safe and should be recoverable, assuming no prior exploitation. If the flaw was never used, all legitimate funds can be withdrawn. The article outlines risks associated with moving funds to transparent addresses or other pools, but concludes that leaving assets in place is a reasonable option. Currently, users cannot independently verify that the total ZEC supply hasn't been inflated due to this bug. However, the planned Ironwood network upgrade is designed to resolve this. It will permanently close the Orchard pool to new deposits and internal transfers, allowing only withdrawals. This mechanism will cap total withdrawals at the amount of legitimately deposited funds, enabling anyone to cryptographically verify the supply post-upgrade. Multiple teams, including Shielded Labs, have conducted extensive audits focused on counterfeiting vulnerabilities, assisted by advanced AI tools. No additional flaws of this type have been found so far, increasing confidence that no other similar undisclosed vulnerabilities exist. In summary, evidence indicates the Orchard bug was probably not used, user funds are secure, and no other counterfeiting flaws are currently known. The upcoming Ironwood upgrade will restore users' ability to independently verify the total ZEC supply, closing this chapter.

Foresight News54 min fa

ZEC Co-Founder Responds to Orchard Vulnerability: No Signs of Theft, Orchard Pool to Be Sealed

Foresight News54 min fa

Japan's Central Bank on the Verge of Raising Rates, Can the AI Bull Market Still Hold?

TL;DR: The impending Bank of Japan (BOJ) interest rate hike is shifting global market focus this week, raising questions about its potential impact on the AI-driven bull market and cryptocurrencies like Bitcoin. For years, the yen has served as a cheap global "funding currency," enabling carry trades where investors borrowed yen at low rates to buy higher-yielding assets. This dynamic amplified liquidity and risk appetite in global markets, benefiting high-beta assets like AI tech stocks and crypto. The BOJ's expected move to raise rates from 0.75% to 1.0% signals a shift away from this era of ultra-low-cost funding. The core concern isn't the 1% rate itself, but the direction of change and its potential to reduce global leverage and risk tolerance. An unwinding of yen carry trades could force investors to sell global assets to buy back yen for repayment, potentially triggering synchronized volatility in overvalued sectors. While AI fundamentals and crypto-specific drivers remain intact, the market impact will depend on whether the BOJ signals a faster-than-expected pace of normalization. Post-decision, watch for correlations between a strengthening yen, rising Japanese bond yields, and simultaneous pressure on tech stocks and cryptocurrencies to gauge if the market is pricing in a broader tightening of cheap global liquidity.

marsbit1 h fa

Japan's Central Bank on the Verge of Raising Rates, Can the AI Bull Market Still Hold?

marsbit1 h fa

Trading

Spot

Futures