News linked to both this project and an event.
DeFi lending protocol Alchemix has completed an update to its cross-chain infrastructure, with its old alUSD/alETH cross-chain bridges on Optimism and Arbitrum officially taken offline and replaced with a new cross-chain bridge compatible with v3 Alchemist. Alchemix disclosed that the DVN (Cross-Chain Transaction Verification) configuration has been updated synchronously, maintaining a 2/3 multi-signature confirmation mechanism for cross-chain transactions. Additionally, it has introduced Deutsche Telekom as a verification service provider to enhance the reliability of the cross-chain verification infrastructure.
According to on-chain analyst PeckShield (@PeckShieldAlert), a user’s Alchemix Yearn yvVault position (token $yvWETH) was attacked, resulting in an estimated loss of approximately $1 million. The root cause of the attack lies in the user’s prior approval grant to an unverified contract (contract address: 0x143a), deployed 10 days ago. Reverse-engineering analysis revealed that this contract contains a vulnerability enabling arbitrary call execution. Exploiting this vulnerability, the attacker successfully transferred the victim’s yvVault position. PeckShield has now publicly disclosed the specific logic of this vulnerability. Users are advised to review and revoke token approvals granted to unknown or unverified contracts to mitigate asset risks.