钱包 · 19425

The Sandbox confirms SAND cross-chain bridge vulnerability: Base and BSC networks are affected, and cross-chain functionality has been suspended

Comparing news, The Sandbox officially stated that the team has confirmed and fully controlled the recent SAND cross-chain bridge vulnerability incident involving the Base and BNB Smart Chain (BSC) networks. Officials say the impact of this incident was limited, involving less than 0.01% of SAND's total supply of tokens. SAND on Ethereum (Ethereum) and Polygon is unaffected, user wallets have not been compromised, and relevant coin holders and liquidity providers are not required to take action. According to reports, attackers have minted unsecured SAND tokens on the Base and BSC networks through exploits. Currently, The Sandbox has shut down the SAND cross-chain feature of the two networks, and SAND on Base and BSC have been isolated and cannot be transferred or exchanged for the time being. The Sandbox reminds users not to buy, sell, or trade SAND on the Base and BSC networks as liquidity on these networks has been affected. The team said it has completed a pre-incident snapshot and is formulating a compensation plan for affected liquidity pool (LP) users, while continuing to investigate the scope of impact of the vulnerability. A full incident report and technical review will be released later.

6h ago

Multicoin Capital transfers $14.54 million HYPE to Coinbase, or ready to sell

According to Onchain Lens monitoring, Multicoin Capital's associated wallet transferred 197,560 HYPES worth about $14.54 million to Coinbase in the past 9 hours. The transfer address is: 0xca292baab13a6b97fc83bb142e689440fd0812b8 Due to the flow of funds to a centralized trading platform, on-chain analysts believe that this operation may be used for sale. Previously, Multicoin Capital also transferred HYPE to Coinbase several times, drawing the market's attention to institutional position reduction.

13h ago

Kraken may become the first HIP-3 compliant deployment of CEX

Comparative news, according to Blockworks analyst Shaunda Devens, the Hyperliquid testnet has added compliance operation control functions such as whitelisting, forced liquidation, and collateral transfer. Currently, a node called Kraken HIP-3 test DEX is testing these licensing features and has whitelisted 10 wallets. Although the testnet supports unlicensed deployment, combined with Kraken's parent company's recent business expansion trends, the community speculates that Kraken may be the first CEX to test this compliant DEX feature.

23h ago

The US IRS warns of a new type of cryptocurrency phishing attack: forged letters use QR codes to steal private wallet keys

According to CoinDesk, according to CoinDesk, the US Internal Revenue Service (IRS) issued a warning that an advanced email phishing campaign targeting US cryptocurrency holders is spreading. By falsifying official tax letters, attackers induce users to scan malicious QR codes to steal encrypted wallet credentials and private keys. According to reports, the attackers impersonated the IRS to send paper letters, used names such as “tax compliance” and “account verification” to create a sense of urgency, and attached QR codes to the letters. Once scanned, users may be directed to a counterfeit website, which in turn leaks wallet login information, mnemonic words, or private keys, leading to the theft of digital assets. The IRS reminds taxpayers that official agencies will not require users to provide private cryptographic wallet keys, mnemonics, or perform similar “wallet verification” operations through unofficial channels. Cryptocurrency holders should be wary of any suspicious emails and letters asking to scan QR codes, connect to wallets, or submit sensitive information. As the number of crypto asset holders expands, social engineering attacks on digital wallets continue to increase, and regulators and security agencies are stepping up prevention reminders about related fraudulent activities.

23h ago#On-chain dynamics

BounceBit Chain updates vulnerability attack progress: will permanently shut down the chain and migrate to BNB Chain

Comparatively, cross-chain revenue protocol BanceBit issued a security incident announcement stating that its blockchain network was attacked by a protocol-level vulnerability attack between 8:02 UTC on August 19 and 01:54 UTC on August 20. The attackers used authorization flaws in the Evmos underlying architecture to transfer BB tokens from 9 main network accounts without the authorization of the account owners. According to the announcement, the attackers transferred a total of approximately 286.5 million BBs through 14 transactions. The impact of the incident was limited to BanceBit Chain itself, and did not involve private key leaks, signature forgery, wallet, hardware devices, or exchange account security issues. BanceBit CeDeFi Strategy, Promo Vaults, Prime, and RWA products were not affected. BounceBit stated that the vulnerability stemmed from a protocol native module authorization verification flaw in the Evmos architecture. When calling the relevant module through a smart contract, the attackers bypass security checks that should verify the authorization relationship of the fund source account, making it possible to specify any account as the source of funds. After the incident, BounceBit Chain stopped generating blocks at block height 20,702,857, then the team decided not to upgrade the chain, but to permanently shut down Bouncbit Chain and re-issue BB as an BEP-20 token based on BNB Chain. BounceBit stated that the new BB token supply will be based on an on-chain snapshot before the first abnormal transfer (block height 20,697,260), and the 286,543,148 BBs transferred by the attackers will not be included in the new token balance. Users do not need to submit an application or migrate their wallets, and the official plan is to automatically distribute the new BB to the corresponding BNB Chain addresses. Regarding the BB in the pledge, BounceBit said it will be restored as soon as the snapshot is in time, and there is no need for coin holders to perform unbundling or redemption operations. Currently, BounceBit has submitted requests for suspension and assistance to relevant exchanges, and reminds users to be wary of scams and not to click on any BB migration or receipt links that have not been officially confirmed. The team said that the new BEP-20 BB contract address and reissue progress will be announced later. This article is sponsored by GENG, Build Your Fortune on GENG (https://geng.one)

1d agoburnking
Black eats black? Fake DeFi actually snatched out North Korea's Lazarus real hacker

Black eats black? Fake DeFi actually snatched out North Korea's Lazarus real hacker

Source: Security Company ANY.RUN Compiled by: Daily Planet Daily Original title: Fishing Show of the Year, Fake DeFi Picks Out North Korea's Lazarus, Real Madrid Fans, Real Madrid Fans. With a mathematical background, they only use AI to write code. Core point of view: By setting up a fake DeFi company, the security agency successfully infiltrated the “Famous Chollima” hacker group under North Korea's Lazarus Group, revealed its complete process of using false identities, AI tools, and remote collaboration to infiltrate Western companies, and revealed its evolving toolset and infrastructure. Key element: The researchers disguised themselves as recruiters and recruited three North Korean agents within a few months to record their operation behavior, tool usage, and collaboration patterns in real time through the ANY.RUN sandbox environment. Agents used forged driver's licenses, stolen social security numbers, and mule accounts to complete the onboarding process. Some of these documents were processed by Google Gemini and had SynthID watermarks, revealing signs of forgery. Attackers rely on AI tools such as ChatGPT and Google Gemini to encode, translate, and modify files, and use AstrillVPN, remote desktop software, and dedicated servers to covertly access corporate environments. The three agents showed insufficient skills during development, frequently searched for basic issues, and exposed more proxy server and infrastructure information induced by selective network outages and captcha. The investigation found that Famous Chollima aims to lurk within the enterprise for a long time and legally obtain access to code, systems, and intellectual property rights, and is not limited to short-term attacks, and the threat persists significantly. Crypto friends who are often phished have probably heard of the North Korean hacker group Lazarus Group. Its well-known “campaigns” include, but are not limited to: Bybit ($1.5 billion) theft, Ronin Network/Axie Infinity Bridge attack ($6.2 billion), DMM Bitcoin/Ginco related attack ($308 million), Harmony Horizon Bridge attack ($100 million), and Atomic Wallet attacks ($100 million), etc. And the key to the success of these attacks is social engineering — hackers usually disguise themselves as normal job applicants, lurk at crypto companies for years, and wait for the right time. Recently, security agency ANY.RUN joined forces with BCA LTD (a company dedicated to threat intelligence and hunting) and NorthScan (a threat intelligence program to uncover the infiltration of North Korean IT workers) to effectively crack down on North Korean hacker agents. The researchers created a fake DeFi startup and successfully recruited “Famous Chollima” agents under North Korea's Lazarus Group who specialize in human infiltration, to gain an inside perspective on the actions of North Korea's IT workers. The ANY.RUN sandbox environment shows the agent's behavior patterns in real time, revealing their evolving toolsets, remote access workflows, AI tool usage, and supporting infrastructure. This survey went beyond the simple recruitment process and showed in depth how these agents collaborated, obtained, and used company resources after joining the company. The findings suggest that the North Korean IT worker program not only poses a recruitment risk; once agents sneak inside the organization, they can legally obtain access to code, systems, intellectual property, and critical business processes. The following is a report co-authored by the three parties, compiled by Daily Planet Daily. ——————Introduction In December of last year, we fully recorded the infiltration cycle of “Famous Chollima” for the first time. From recruiting collaborators to help them join Western companies, to falsifying documents, shipping laptops to intermediaries, and even using AI tools to assist and translate in real time during interviews, everything is under control. In that survey, we pretended to be a middleman willing to interview them and lend them a laptop in exchange for a percentage of their salary. The point is that those laptops are actually ANY.RUN sandbox environments that record every click and every step they take. This provided us with massive metrics, hours of computer operation videos, and face-to-face contact images, making an unprecedented survey and making headlines in many media. (“Famous Chollima...

1d agoOdaily星球日报#wallet security #hacks

Hong Kong court sentences e-fraud “middleman” to 56 months in prison: police track cryptocurrency to lock up ransom flows

Comparative news, according to a Caixin report, the Hong Kong High Court of Appeal yesterday rejected Ma Zhihao's application for commutation of the sentence, the mastermind of electronic fraud and human trafficking, and upheld the original sentence of 56 months in prison. In the investigation of the case, the Hong Kong police tracked criminal funds through blockchain and cryptocurrency transaction records to lock down the key to collecting ransoms and criminal proceeds. According to reports, a victim's family paid about 9527 USDT (USDT) to a cryptocurrency wallet designated by the criminal. Blockchain tracking records unequivocally prove that 8127 USDT went into an exchange account registered with Ma Zhihao's real name and Hong Kong ID card, then exchanged for about HK$63,000 and transferred to her personal HSBC bank account, which became important evidence to prove that she participated in the crime and obtained profits. The Court of Appeals stated that if not subject to the District Court's seven-year maximum sentence, the defendant would face a much heavier penalty.

1d ago