zkLink Nova

11 hours agoNews Editor

zkLink Nova Halts Block Production After Bridge Exploit Drains More Than $780,000

zkLink Nova, a network built by the zkLink team, stopped producing blocks after an attacker drained more than $780,000 from the bridge connecting Nova to Ethereum. In an update posted Thursday morning, zkLink said it had pushed emergency fixes to the affected contracts and temporarily disabled withdrawals while engineers review all related components. The team said services will return only after it confirms that all risks have been removed, but it did not provide a restart timeline, a confirmed loss figure, or a cause. Earlier, zkLink said the attack targeted Nova’s Arbitrator contract on both Ethereum and Optimism. It asked the attacker to stop and return the funds, offering a 20% white hat bounty and saying no further action would be taken if the assets were sent back. Onchain data reviewed by Unchained showed Nova’s escrow contract marked as paused on Ethereum by Thursday afternoon. Separate exploit transactions moved a mix of ETH and tokens, including pufETH, ezETH, and ZKL. Security firms Blockaid and SlowMist published differing but close loss estimates and described an attack path involving a forged batch root and reused message hash, though zkLink has not confirmed those accounts.

50

Cysic

11 days agoNews Editor

Cysic bridge exploit led to unauthorized minting of 10 million CYS on BNB Chain

Cysic Foundation said its cross-chain bridge was attacked on Oct. 17, leading to the unauthorized minting of 10 million CYS on BNB Chain, equal to 1% of the token’s total supply. About 7.2 million tokens were sold before the receiving address was blacklisted, according to the project’s incident report and on-chain records cited by The Block. Cysic has suspended bridge services and said the incident did not affect the Cysic mainnet or directly steal assets already held in user wallets. The project’s preliminary investigation said the attacker obtained access to a database related to bridge operations and exploited a flaw in message-handling logic to submit fake mint requests. The proceeds were swapped into USDT and BNB, then moved to Ethereum through SWFT, Mayan and deBridge, where the attacker received about 306.6 ETH worth roughly $727,000 before sending the funds to another wallet. The incident adds to a string of bridge-related security failures this year, with the source article also citing losses tied to KelpDAO, Verus, Across and Wanchain.

530

GIWA

1 months agoNews Editor

Fake GIWA Layer 2 bridge loses 766.25 ETH after DYORSWAP misidentified network

A fake Layer 2 network posing as GIWA, which The Defiant described as being backed by Upbit, had 766.25 ETH drained from its Ethereum bridge on Sept. 27, with the amount valued at roughly $2 million in the report. According to The Defiant, the loss happened after decentralized exchange DYORSWAP mistook the fake network for the legitimate GIWA chain. Ethereum transaction data cited in the report shows the transfer moving out from the bridge address 0xbA9938…435ab2. The summary available in the source does not provide additional operational details beyond the transfer, the date, the amount, and the address reference.

830

DeFi

1 months agoNews Editor

Payy Network, Duelbits, and Meter lose more than $11 million in three attacks over one day

Three separate crypto security incidents hit in a single day, pushing combined losses past $11 million, according to Protos. Payy Network was the first to be exploited after its Ethereum bridge was drained of its full balance, with losses pegged at $1.8 million. The company said the stolen assets were users’ non-custodial deposits tied to Payy Network and Payy Wallet, and paused all transactions while the investigation continues. Duelbits, a crypto casino and sports betting platform, was then hit in what was described as a suspected private key compromise. Estimates climbed from $4.3 million to $5.9 million before co-founder Joe put the figure at about $7 million. He said the platform would remain offline until the team understood what happened, while adding that user funds were safe and hot wallets would be replenished before services resumed. Meter.io, an EVM blockchain, disclosed a separate bridge-related incident tied to a block validation flaw. The attacker minted unbacked MTR and MTRG, sold them on PancakeSwap, and bridged funds out, with reported losses of roughly $2.3 million. Meter paused its mainnet and bridge, said chain state had been preserved, and told users to stop all activity. The sell-off sent MTR and MTRG down almost 80% and 75%, respectively.

650

Kelp DAO

1 months agoNews Editor

Kelp DAO Developer Sues LayerZero and CEO Bryan Pellegrino Over $292 Million rsETH Bridge Exploit

Evercrest Technologies, the company behind liquid restaking protocol Kelp DAO, has filed suit against LayerZero Labs and co-founder and CEO Bryan Pellegrino in the Supreme Court of British Columbia over the April exploit of rsETH’s LayerZero bridge. The civil claim, dated Sept. 24 and published by Kelp late Thursday, says the exploit stemmed directly from LayerZero’s failures and argues that LayerZero had reviewed and approved the bridge setup in writing. The April 18 attack released 116,500 rsETH worth roughly $292 million at the time, despite those tokens not being backed by deposits. LayerZero later linked the incident to North Korea’s Lazarus Group. Evercrest is alleging negligent misrepresentation, negligence, and defamation, and says the exploit and LayerZero’s subsequent public statements caused tens of millions of dollars in damage. The dispute centers on whether LayerZero had supported a single-verifier bridge design, what warnings were or were not given to Kelp, and whether public comments from LayerZero and Pellegrino mischaracterized Kelp’s configuration after the exploit.

720

Fetch.ai

1 months agoNews Editor

Fetch.ai, NuNet, and SingularityNET hit in triple exploit with about $2.25 million realized

A single attacker exploited Fetch.ai, NuNet, and SingularityNET over the weekend, realizing about $2.25 million in profit, according to a Protos report citing Bitquery. The incidents involved 8.7 million FET drained from Fetch.ai’s bridge and large-scale unauthorized minting across NTX, AGIX, WMTx, and CGV. Bitquery said the nominal value of the minted tokens was several times higher at the time of the theft, while blockchain security firm PeckShield estimated the exploiter’s unrealized gains at nearly $17 million when it flagged the third incident. PeckShield said the attacker was holding roughly $16.77 million in crypto at that point, including 198.3 million AGIX worth $14.42 million and 649 ETH worth about $1.67 million. Bitquery also reported a preliminary sweep of ETH and BNB from 16 wallets, four of which it had previously labeled as SingularityNET or NuNet staff wallets, and said $289,575 in USDC was later drained from a payroll contract. The report warned that most signing keys had not yet been changed.

1010

Symbiosis

1 months agoNews Editor

Symbiosis bridge exploit let attacker mint 46.1 billion unbacked syBTC from a 330-satoshi deposit

Symbiosis said two software flaws in its Bitcoin Bridge let an attacker use a 330-satoshi bitcoin deposit, worth about $0.25, to generate roughly 46.1 billion unbacked syBTC through 12 bogus deposits. According to the project’s post-mortem and blockchain data reviewed by CoinDesk, the attack unfolded across BNB Chain, Ethereum and Rootstock in about four minutes. One bug let the attacker obtain administrator privileges by exploiting how the bridge identified the sender of a bitcoin transaction. A second bug treated a negative fee as an addition, allowing the deposit amount to be inflated to essentially any number the attacker entered. Despite the huge token count, Symbiosis put preliminary losses at 9.97 BTC, or about $770,000, because unbacked bridge tokens do not create the real assets needed for redemption. The project said syBTC supply had been only 13.91 before the attack, with 11.26 syBTC in pools paired with WBTC, cbBTC, BTCB and RBTC. Symbiosis has taken the native Bitcoin Bridge offline, said it will rewrite the bitcoin-side software, commission an independent audit and compensate affected users and liquidity providers.

1220

Symbiosis

1 months agoNews Editor

Symbiosis says it recovered 15 BTC after bridge exploit and is offering a 20% bounty

Cross-chain liquidity protocol Symbiosis said it has recovered 15 BTC, worth about $1.1 million, after an exploit hit its native Bitcoin bridge on Friday. The recovered Bitcoin has been moved to a team-controlled multisig wallet, while the protocol said all routes remain operational except for the native Bitcoin bridge, which is still paused. Blockchain security firm Blockaid said the attacker minted 46.1 billion unbacked tokens through the bridge and ultimately realized net proceeds of 4.3 WBTC, or about $336,000. Symbiosis has not explained how the recovered 15 BTC relates to that figure. The protocol is now offering a 20% bounty to anyone whose information leads to asset recovery, after an earlier 20% white-hat offer to the attacker expired on Sunday. Symbiosis also said it will disclose a compensation framework for affected liquidity providers. DeFiLlama has estimated losses at roughly $336,000, though the protocol has yet to publish a final accounting. The incident adds to a recent run of bridge-related exploits, including the Secret Network and Verus-Ethereum cases earlier this year.

1410

Total 28 items

Go topage

Bit.Fan