# Vulnerability Articoli collegati

Il Centro Notizie HTX fornisce gli articoli più recenti e le analisi più approfondite su "Vulnerability", coprendo tendenze di mercato, aggiornamenti sui progetti, sviluppi tecnologici e politiche normative nel settore crypto.

Turning 200,000 into Nearly 100 Million: DeFi Stablecoin Attacked Again

DeFi stablecoin protocol Resolv Labs was exploited, resulting in a hacker minting 80 million USR tokens using only 200,000 USDC. The attacker’s address (starting with 0x04A2) first created 50 million USR with 100,000 USDC, and later minted another 30 million with an additional 100,000 USDC. This caused USR to depeg, dropping to around $0.25 before partially recovering to approximately $0.80. The incident also impacted related lending markets on Morpho and Lista DAO, which paused new borrowing requests. Additionally, RLP token holders, including Stream Finance—which holds over 13 million RLP tokens—face significant exposure, with estimated losses around $17 million. Initial analysis by DeFi community YAM suggests the exploit occurred because the protocol’s SERVICE_ROLE, which provides minting parameters, was compromised. The system fully trusted this role’s input without on-chain verification or minting limits, allowing the attacker to manipulate the mint amount. The project’s emergency response was also slow, taking nearly three hours to pause the protocol due to multi-signature delays. This attack highlights critical vulnerabilities in off-chain role trust and emergency mechanisms within DeFi protocols.

marsbit03/22 09:47

Turning 200,000 into Nearly 100 Million: DeFi Stablecoin Attacked Again

marsbit03/22 09:47

A Quick Fix: Ripple Patches Major Issue That Could Threaten XRP Users On The Ledger

Ripple has released Rippled version 3.1.2 to patch a critical vulnerability in the XRP Ledger's Batch amendment feature. The flaw, discovered shortly after the feature's introduction, could have allowed attackers to execute unauthorized transactions and caused servers to crash or restart under certain conditions. Developers from RippleX collaborated on the urgent fix. This is the third rapid update addressing issues originating from Rippled 3.1.0. Separately, Ripple CTO David Schwartz responded to criticism about the company's practice of selling XRP to fund operations, arguing that such sales do not necessarily harm retail investors.

bitcoinist03/18 03:32

A Quick Fix: Ripple Patches Major Issue That Could Threaten XRP Users On The Ledger

bitcoinist03/18 03:32

Is Your "OpenClaw" Running Naked? CertiK Test: How Vulnerable OpenClaw Skill Bypasses Audits, Takes Over Computers Without Authorization

OpenClaw, a popular open-source, self-hosted AI agent platform, has experienced rapid growth due to its flexibility and extensibility. Its ecosystem relies heavily on third-party “Skills” from the Clawhub marketplace, which can perform high-risk operations like system automation and crypto wallet transactions. However, security firm CertiK has identified critical vulnerabilities in the platform’s security model. CertiK’s research reveals that OpenClaw’s current security—primarily dependent on pre-publishing scans like VirusTotal, static code analysis, and AI logic checks—is fundamentally flawed. These measures can be easily bypassed through simple code obfuscation, and malicious Skills can be published even before scanning is complete. In a proof-of-concept, CertiK developed a seemingly benign Skill that contained a hidden remote code execution vulnerability. It passed all checks without warnings and, once installed, allowed full system control via a remote command. The core issue is not a specific bug but a industry-wide misconception: over-reliance on scanning instead of runtime isolation. Unlike systems like iOS, which enforce strict sandboxing, OpenClaw’s sandbox is optional and often disabled for functionality, leaving systems exposed. CertiK recommends that OpenClaw enforce mandatory sandboxing and granular permission controls for Skills. Users are advised to deploy OpenClaw on isolated devices and avoid exposing sensitive data or assets until stronger isolation is implemented. The report stresses that security must evolve from detection-based approaches to default containment of risks at runtime.

marsbit03/17 14:39

Is Your "OpenClaw" Running Naked? CertiK Test: How Vulnerable OpenClaw Skill Bypasses Audits, Takes Over Computers Without Authorization

marsbit03/17 14:39

Bonk.fun Hack Exposes Solana Users to Wallet Drainer Attack

A security vulnerability on the Bonk.fun platform exposed Solana users to wallet drainer attacks. Malicious scripts were injected into the site, redirecting users to phishing pages that prompted them to approve transactions. These approvals allowed attackers to automatically drain tokens from users' wallets. The platform, which is used for meme token trading, was compromised, and users were deceived through fake reward claims and interface changes. Bonk.fun issued a warning on X, advising users not to interact with the site until it was secured. The developer team acted quickly to remove the malicious scripts and urged users to revoke any suspicious approvals. The incident raised concerns in the crypto community, though the prompt response helped mitigate potential damage.

TheNewsCrypto03/12 11:17

Bonk.fun Hack Exposes Solana Users to Wallet Drainer Attack

TheNewsCrypto03/12 11:17

Must-Watch Next Week｜Iran Conflict Continues to Impact Global Situation; February CPI Data Approaches (Mar 9-15)

Key Events to Watch Next Week (March 9-15): Iran conflict enters its second week, with global attention on the selection of a new Supreme Leader and Israel’s military stance. Tensions in the Strait of Hormuz continue to threaten global oil supply and economic stability. Economic data releases include U.S. February CPI on March 11 and January PCE on March 13, which will be closely monitored for inflation trends. Other notable events: SharpLink holds its 2025 earnings call on March 9; Neutron pauses order book functions due to a security vulnerability, with services expected to resume the same day. The UK’s Financial Services Regulation Committee is accepting submissions on stablecoin regulation until March 11.

marsbit03/08 12:05

Must-Watch Next Week｜Iran Conflict Continues to Impact Global Situation; February CPI Data Approaches (Mar 9-15)

marsbit03/08 12:05

AI Within the Range of Artillery

"AI in the Range of Cannons" discusses the vulnerability of AI infrastructure in the context of modern warfare, triggered by a real-world incident. On March 1, an Iranian missile struck an Amazon data center in the UAE, causing a fire, power outage, and disruption of about 60 cloud services. This led to a global outage of Claude, a major AI service running on Amazon's cloud. Although officially attributed to surging user demand, the incident is linked to a U.S.-Israel airstrike on Iran that used Claude for intelligence analysis, despite a recent U.S. ban on Anthropic (Claude's developer) for refusing unrestricted military use. The article highlights that this marks the first physical destruction of a commercial data center in war, emphasizing that AI, though virtual, relies on physical infrastructure located in geopolitically unstable regions like the Middle East. Silicon Valley has heavily invested in AI infrastructure in the Gulf due to cheap electricity, wealthy sovereign funds, and data localization laws, with projects from Amazon, Microsoft, and OpenAI. However, security frameworks like the Pax Silica agreement focus on chip controls and political alignment, ignoring physical security risks. The piece raises critical questions: When data centers serve both civilian and military purposes, are they legitimate targets? International law lacks clarity. The incident shifts focus from AI replacing jobs to its fragility—over 1,300 large data centers worldwide are protected only by basic measures like fire systems and generators. As AI becomes national infrastructure, its protection becomes a collective responsibility, beyond individual companies or governments. The title’s metaphor underscores that in an era of conflict, even advanced technology lies within the range of destruction.

marsbit03/03 10:29

AI Within the Range of Artillery

marsbit03/03 10:29

XRPL Foundation Fixes Major Bug Just Ahead of Mainnet Release

A critical vulnerability in the XRP Ledger, potentially exposing up to $80 billion, was discovered by a security engineer using an AI-assisted tool. The flaw involved malformed transactions that could cause consensus failure under specific edge cases. The issue was responsibly disclosed, verified, and patched by the development team. Validator operators were urged to update their software immediately. No exploitation occurred prior to the fix. The incident highlights the effectiveness of combining AI tools with human expertise in blockchain security, enabling early detection of complex vulnerabilities and reinforcing trust in decentralized systems.

TheNewsCrypto02/27 13:16

XRPL Foundation Fixes Major Bug Just Ahead of Mainnet Release

TheNewsCrypto02/27 13:16

“Uncle Injured by Lobster” Scam Leads to $440,000 Loss: Are AI Agents Really This Easy to Exploit?

On February 22, 2026, Lobstar Wilde, an autonomous AI trading agent on Solana, mistakenly transferred 52.4 million LOBSTAR tokens (worth approximately $440,000) to a stranger’s wallet after a user’s social media plea: “My uncle got tetanus from a lobster bite and needs 4 SOL for treatment.” The agent, created by an OpenAI employee three days earlier with $50,000 in SOL, intended to send only 52,439 tokens—equivalent to 4 SOL—but misread decimal places, resulting in a transfer three orders of magnitude larger. The incident exposed critical vulnerabilities in AI agents managing on-chain assets: irreversible execution, susceptibility to social engineering, and flawed state management. After a session restart due to a tool error, the agent reconstructed its identity from logs but failed to verify its actual wallet balance, leading to the erroneous transaction. This case highlights broader risks as AI agents gain autonomy in Web3 and Web4.0 ecosystems: lack of rollback mechanisms, near-zero-cost attack surfaces, and internal state synchronization failures. Proposals to improve safety include multi-signature approvals for large transfers, mandatory state verification after resets, and human oversight layers. The event underscores the need for robust infrastructure before AI agents can safely participate in decentralized economies.

marsbit02/27 10:49

“Uncle Injured by Lobster” Scam Leads to $440,000 Loss: Are AI Agents Really This Easy to Exploit?

marsbit02/27 10:49

When Depth Becomes an Illusion: Polymarket Faces 'Order Attack' Stress Test

A sophisticated "order attack" is exploiting a critical vulnerability in Polymarket's hybrid off-chain matching/on-chain settlement system. For less than $0.10 in gas fees on Polygon, an attacker can initiate a trade and then, in the brief window before on-chain execution, drain their wallet via a high-gas transfer. This causes the initial trade to fail on-chain due to insufficient funds. However, Polymarket's off-chain system responds by forcibly removing all the legitimate market maker orders that were matched with the failed transaction. This attack has two primary profit methods. First, attackers clear the order book of competitors, create a liquidity vacuum, and then place their own orders with artificially wide spreads to monopolize trading. Second, they "hunt" automated trading bots: after a trade is matched off-chain, a bot hedges its new position, but the attacker then forces the original trade to fail on-chain. This leaves the bot with an unhedged, risky position, which the attacker exploits for profit. One identified attacker address, created in February 2026, reportedly profited over $16,000 in a single day by targeting just 7 markets. The attack severely undermines market maker confidence, threatens the platform's liquidity, and exposes a fundamental design flaw. While the community has developed monitoring tools, Polymarket team has not yet issued an official fix.

比推02/26 04:52

When Depth Becomes an Illusion: Polymarket Faces 'Order Attack' Stress Test

比推02/26 04:52

AI Agents Tested to Prevent $3.4B Crypto Hacks

In 2025, the crypto industry suffered significant breaches, with three major incidents accounting for 70% of total thefts, including a $1.4 billion hack on Bybit. To combat vulnerabilities, OpenAI is testing AI agents in collaboration with Paradigm and OtterSec using EVMbench. These AI systems aim to detect and fix smart contract flaws more efficiently than human auditors, addressing the $3.4 billion lost to hackers in 2025. While AI agents excel at identifying vulnerabilities, concerns remain about potential misuse by attackers. Industry leaders suggest AI and crypto could become increasingly intertwined, with stablecoins and crypto payments playing key roles in future AI-driven systems.

TheNewsCrypto02/19 09:39

AI Agents Tested to Prevent $3.4B Crypto Hacks

TheNewsCrypto02/19 09:39

活动图片

Indepth Research

Bitcoin