# Exploit Related Articles

HTX News Center provides the latest articles and in-depth analysis on "Exploit", covering market trends, project updates, tech developments, and regulatory policies in the crypto industry.

Hunter Becomes the Hunted: The Most Profitable MEV Bot Gets Hacked

The prominent Ethereum MEV bot address Jaredfromsubway.eth suffered a targeted on-chain attack, losing over $7.5 million. The incident was identified as a "counter-MEV honeypot attack," where the attacker deployed numerous fake token contracts and liquidity pools over several weeks, mimicking mainstream assets like WETH and USDC to create seemingly profitable arbitrage opportunities. The MEV bot, designed to automatically detect and execute such trades, interacted with the malicious setup. During the process, it granted approvals to attacker-controlled contracts, which were not promptly revoked. The attacker later exploited these persistent permissions in a single transaction, draining the bot's holdings of ETH, USDC, and USDT. Jaredfromsubway.eth is known as one of Ethereum's most active and profitable MEV bots, primarily executing "sandwich attacks" to extract value from user transactions. Its operations have been linked to a majority of such attacks on the network. This event highlights the evolving security threats in crypto, demonstrating that even sophisticated, rule-exploiting systems can become targets of carefully designed behavioral traps. Following the theft, an impersonator account on X falsely claimed to offer a bounty for the return of the funds, prompting warnings from developers.

Odaily星球日报06/21 09:15

Hunter Becomes the Hunted: The Most Profitable MEV Bot Gets Hacked

Odaily星球日报06/21 09:15

Four Questions on the Zcash Orchard Vulnerability: Was It Exploited? Can Funds Be Recovered? Is the Supply Verifiable? And Are There Others?

Zcash Orchard Bug: Four Key Questions Answered A critical forgery vulnerability was discovered in Zcash's Orchard privacy pool, raising four major concerns for users. 1. **Was the Orchard bug exploited?** The likelihood is considered low. The bug was found proactively using advanced AI-assisted tools and was promptly patched, limiting any potential attack window. If exploitation had occurred, evidence would likely have surfaced by now. 2. **Can legitimate Orchard funds be recovered?** It is believed so, based on the assessment that the bug was not exploited. If forgery did happen, existing "turnstile" mechanisms could prevent full recovery of legitimate funds if forged coins were moved out first, though this scenario is deemed unlikely. Users can choose to move funds, but this carries risks like loss of privacy or new wallet/software issues. 3. **Can users verify Zcash's total supply?** Currently, no. The vulnerability's prior existence prevented independent verification of the shielded supply. The proposed "Ironwood" network upgrade will restore this ability by sealing the Orchard pool, allowing anyone running a node to verify that the circulating ZEC does not exceed the correct amount. 4. **Are there other forgery bugs?** Ongoing intensive audits by multiple teams, including AI-assisted analysis, have not found additional forgery vulnerabilities, increasing confidence that none remain. Further work and collaborations are planned to provide additional guarantees. In conclusion, while the team assesses that exploitation was unlikely and the supply is safe, the upcoming upgrade is critical to restore users' ability to independently verify Zcash's supply integrity, moving away from reliance on trust.

marsbit06/15 07:50

Four Questions on the Zcash Orchard Vulnerability: Was It Exploited? Can Funds Be Recovered? Is the Supply Verifiable? And Are There Others?

marsbit06/15 07:50

Four Questions on the Zcash Orchard Vulnerability: Was it Exploited? Can Funds Be Recovered? Is the Supply Verifiable? Are There Others?

**Summary: Zcash Orchard Vulnerability Analysis** A critical forgery vulnerability was recently discovered in Zcash's Orchard shielded pool, raising concerns about the coin's supply and user funds. The developers, led by Zcash Open Development Labs, acted swiftly to temporarily freeze the pool and deploy a fix. The article addresses four key questions: 1. **Was the vulnerability exploited?** While unknown, the developers believe it is unlikely for several reasons: the bug was difficult to find, using advanced AI tools; the fix was deployed quickly; and typical crypto exploits are fast, with no evidence of abnormal outflows. 2. **Can legitimate Orchard funds be recovered?** If the bug was not exploited, all funds are safe. If exploited, a mechanism limits total withdrawals from the pool to the amount legitimately entered, potentially blocking some legitimate funds. The developers deem this unlikely but advise cautious users to consider moving funds, noting the privacy and risk trade-offs of moving to transparent or Sapling pools. 3. **Can users verify Zcash's total supply?** Not currently. The vulnerability temporarily broke the ability for users to independently verify that no extra ZEC was created. 4. **Are there other forgery bugs?** Ongoing audits by multiple teams, including using advanced AI analysis, have so far found no others, increasing confidence. The proposed "Ironwood" network upgrade is the core solution. It will **seal** the Orchard pool, preventing new entries or internal circulation. This action, combined with the existing withdrawal mechanism, will restore the ability for any node operator to verify that Zcash's supply limit has not been violated, regardless of whether exploitation occurred in the past. The upgrade aims to restore the system's long-term credibility through user-verifiable supply integrity.

Odaily星球日报06/15 07:50

Four Questions on the Zcash Orchard Vulnerability: Was it Exploited? Can Funds Be Recovered? Is the Supply Verifiable? Are There Others?

Odaily星球日报06/15 07:50

Token Of Power Governance Exploit Drains $1.58 Million In WETH, TRM Says

Blockchain intelligence firm TRM Labs reports a governance exploit against the Token of Power protocol, resulting in a loss of approximately $1.58 million in WETH. The attacker exploited a missing timelock in the protocol's Aragon DAO setup, allowing them to propose, vote on, and execute a malicious action within a single block. The attacker funded the operation with 662 ETH from Tornado Cash, purchased enough TOP tokens to gain majority voting power, minted 10 billion new TOP tokens, and swapped them for WETH via a Balancer pool before moving funds back through Tornado Cash. The incident underscores that governance design is a critical security risk in DeFi, where parameters like timelocks provide essential reaction time. It also highlights how mixers and liquidity pools can be utilized in exploits without being directly compromised. Observers are now watching for any movement of the stolen funds and further remediation details from involved parties. This event is part of a broader shift in crypto, emphasizing the importance of underlying infrastructure, security, and governance alongside market movements.

bitcoinist06/14 21:32

Token Of Power Governance Exploit Drains $1.58 Million In WETH, TRM Says

bitcoinist06/14 21:32

Exploit Wallet Converts Stolen Tokens Into 18,510 ETH And 1,548 BNB

An exploit-linked wallet has reportedly converted stolen assets into 18,510 ETH (approximately $30.83 million) and 1,548 BNB ($924,000). According to on-chain tracking data cited by WuBlockchain and Lookonchain, the attacker sold compromised "H tokens" to obtain these more liquid assets and still holds an additional 111.36 million H tokens worth about $14 million. This conversion into major cryptocurrencies like ETH and BNB is a common step after an exploit, as attackers move from illiquid, traceable tokens toward deeper, more liquid assets. This consolidation can signal potential next steps, such as moving funds through bridges or mixers, and complicates recovery efforts for security teams. While blockchain analysis provides real-time visibility into such transactions, the identity of the wallet controller often remains uncertain. The data serves as a valuable snapshot of fund movement, highlighting the role of on-chain monitors in tracking security incidents before official investigations are complete.

bitcoinist06/13 18:43

Exploit Wallet Converts Stolen Tokens Into 18,510 ETH And 1,548 BNB

bitcoinist06/13 18:43

Restoring Crypto Privacy: ZCASH (ZEC) Makes A Move After 50% Crash

Following a severe price crash of over 50% triggered by the discovery of a critical counterfeiting vulnerability in its Orchard privacy pool, Zcash (ZEC) is taking steps to restore confidence. The bug, found by a security researcher using AI, could have allowed undetected creation of fake ZEC tokens. Developers from the Zcash Open Development Lab (ZODL) and others quickly patched the flaw, helping the price rebound over 70%. However, Orchard's privacy features make it impossible to verify if any counterfeit tokens were actually created before the fix. To address this, key ecosystem groups including Shielded Labs and The Zcash Foundation have proposed a new system called Ironwood. Its primary goal is to restore users' ability to independently verify Zcash's total circulating supply. Once activated, node operators could confirm the supply hasn't been tampered with. The Ironwood proposal would also block any new coin minting in the Orchard pool and restrict fund movement through a controlled mechanism. This system could provide evidence on whether the vulnerability was ever exploited. If no excess ZEC attempts to leave the pool, it suggests no counterfeiting occurred. Any attempted exit of fake coins would be blocked and destroyed, publicly revealing any attack while protecting the legitimate supply.

bitcoinist06/11 05:02

Restoring Crypto Privacy: ZCASH (ZEC) Makes A Move After 50% Crash

bitcoinist06/11 05:02

Over $31 Million Stolen from Humanity, Is the Team Behind It Paving the Way for a New Project?

The article reports a major security incident involving Humanity Protocol (H), resulting in over $31 million stolen. The team attributes the hack to a private key leak from a Humanity Foundation member, leading to a rapid sale of H tokens and a 90% price drop. However, prominent on-chain investigator ZachXBT suggests the event might be an "exit scam" orchestrated by the team, rather than an external hack. This suspicion is fueled by the team's controversial history, including past management failures, legal issues, and previous scandals like outsourced technology and problematic airdrops. Further investigation reveals that the core team behind Humanity is already involved with a new project called "Everything," which recently secured funding. This has led to community speculation that the alleged hack is a deliberate scheme to abandon the H project while shifting focus and resources to their new venture, leaving investors to bear the losses. The article questions whether this is a genuine security failure or a premeditated "rug pull" strategy.

Odaily星球日报06/09 04:54

Over $31 Million Stolen from Humanity, Is the Team Behind It Paving the Way for a New Project?

Odaily星球日报06/09 04:54

Humanity Loses $31 Million, a Private Key Causes Token Price to Plunge 90%

On June 9th, the digital identity project Humanity Protocol suffered a major security breach resulting in over $31 million stolen from hundreds of wallets holding its H token. The attack was caused by the compromise of a private key belonging to a foundation member, leading the team to advise users against interacting with its bridge or liquidity pools. Following the incident, the price of the H token plummeted by over 90%, from around $0.70 to a low of $0.052, wiping out a significant portion of its market capitalization. The attacker allegedly minted 100 million new H tokens and began selling them for BNB. Humanity Protocol, founded in 2024, aimed to verify human users through palm-print biometrics and zero-knowledge proofs on Polygon CDK. Despite raising $50 million across two funding rounds and achieving a unicorn valuation, the project faced prior controversies. Shortly after its June 2025 token launch, reports emerged that only about 1 million of its 9 million registered IDs had completed biometric verification, suggesting 88% might be bots. Furthermore, allegations surfaced that the project might be a rebranded "shell" of a Chinese access control company, raising concerns about data privacy and authenticity. The project's founder, Terence Kwok, has a controversial business history. His previous venture, Tink Labs, burned through $170 million in funding before collapsing in 2020. The breach highlights the persistent critical risk of private key management in crypto. With no user compensation plan detailed in the initial response, the incident deals a severe blow to trust in a project already struggling with credibility issues.

Foresight News06/09 03:18

Humanity Loses $31 Million, a Private Key Causes Token Price to Plunge 90%

Foresight News06/09 03:18

Behind ZEC's Over 30% Plunge: An 'Unlimited Minting' Vulnerability with No Way to Prove if It Was Ever Exploited

A critical vulnerability was discovered in Zcash's Orchard privacy pool, allowing for the theoretical creation of undetectable counterfeit ZEC. Researcher Taylor Hornby found the flaw on May 29th, 2024, within the Orchard circuit's cryptographic constraints, which could let an attacker bypass asset conservation rules. Although a rapid emergency fix was deployed within days via a coordinated soft and hard fork, a core uncertainty remains: due to Orchard's privacy features, it is impossible to cryptographically prove whether this "unlimited mint" flaw was exploited in the nearly four years since the pool's 2022 launch. This uncertainty, rather than the patched flaw itself, triggered a market panic, causing ZEC's price to drop over 30%. While the Zcash Foundation stated no evidence of exploitation was found, independent entity Shielded Labs emphasized the impossibility of definitively proving no counterfeit ZEC was ever created. The incident highlights the unique trust challenge in privacy systems. To address this, developers are proposing a new network upgrade with enhanced auditing to allow verifiable proof of supply integrity. Notably, the researcher utilized the newly released AI model Claude Opus 4.8 as a tool during the security review, signaling the growing role of advanced AI in uncovering complex cryptographic vulnerabilities.

marsbit06/05 06:51

Behind ZEC's Over 30% Plunge: An 'Unlimited Minting' Vulnerability with No Way to Prove if It Was Ever Exploited

marsbit06/05 06:51

Crypto AI Platform Bankr Locks Down System After Hacker Breaches 14 Crypto Wallets

Crypto AI trading platform Bankr has locked down its system after a hacker breached 14 user wallets. The attack, which targeted wallets automatically created via interactions with Bankr's AI bot on X, appears to be a social engineering scheme exploiting the platform's connection with Grok. Security experts suspect the use of "prompt injection" to manipulate the AI into approving unauthorized transactions. Losses from individual wallets reached as high as $150,000, with a total of $440,000 identified in three attacker-controlled addresses. Tech entrepreneur Austen Allred was among the victims. Bankr has halted all transactions, pledged full reimbursement for lost funds, and advised affected users to set up new wallets and transfer any remaining assets. This incident follows a series of major crypto exploits in recent months.

bitcoinist05/20 16:20

Crypto AI Platform Bankr Locks Down System After Hacker Breaches 14 Crypto Wallets

bitcoinist05/20 16:20

活动图片

Hot Categoriesright-arrow

Hot Tagsright-arrow

Regulatory Policyright-arrow