News linked to both this project and an event.
According to The Defiant, Synthetix's protocol DAO has recovered 8.4 million SNX tokens stolen in the Binance hack. These tokens are currently securely stored in its Safe and will be returned upon Binance's request.
ZachXBT stated that approximately 45 minutes ago, the stolen funds from the $6.3 billion Binance hack and the $388 million Bitget hack were transferred via THORChain and pooled into a single on-chain address. This flow of funds indicates that both incidents may have been carried out by the same attacker. ZachXBT pointed out that the Bitget attack was previously attributed to the North Korea-affiliated hacker group TraiderTraitor, which is also connected to earlier attacks, including those on Kelp DAO.
Odaily reports: On-chain detective ZachXBT posted on X that approximately 45 minutes ago, stolen funds from the $6.3 billion Binance security incident and the $388 million Bitget security incident flowed through THORChain into the same address and were mixed, indicating that both incidents were likely carried out by the same attacker.ZachXBT noted that the Bitget attack had previously been attributed to the North Korea-linked hacking group TraiderTraitor, which has also been linked to other security incidents such as Kelp DAO.
Odaily — According to on-chain analyst Aunt Ai, 30 minutes ago, the Binance hot wallet hacker transferred all 74.56 million ARB to address 0x000...0DA0. Arkham has tagged this address as Kelp DAO Hacker, and these tokens have not yet been moved or sold. Kelp DAO suffered an attack on April 18 this year, losing approximately $292 million in rsETH, and at the time the community speculated that the attacker was the North Korean hacker group Lazarus Group.
According to on-chain researcher Spreek, DeFi protocol Hifi Finance suffered a DAO governance takeover. The attacker gained control through four last-minute votes funded by Tornado Cash, subsequently minted 25 million governance tokens, and drained user collateral assets worth approximately $1 million, most of which were RWA tokens.
According to security researcher Spreek (@spreekaway), the administrative keys for swETH and rswETH under Swell DAO appear to have been compromised. Attackers are inflating the NAV (Net Asset Value) without asset backing by up to 1% per hour. Four malicious upgrade contracts have been deployed and are queued for multisig execution; if executed, they could result in the theft of approximately 2,500 ETH. Furthermore, analysis by ADL (@ADLXBT) indicates that the management keys control proxy administrator permissions. Once seized by attackers, these keys could allow the redirection of swETH/rswETH proxies to malicious implementation contracts, triggering minting or withdrawal functions to artificially inflate the NAV without corresponding asset backing. Spreek noted that any connection between this incident and the Railway platform remains speculative, with only a coincidental timeline observed and no concrete evidence available. The incident report he published was generated by Claude, and certain portions remain unverified.
Odaily News: Lido is developing a decentralized lending market called Lido Lend, which is built on a modified fork of Morpho Blue, adopts an isolated lending market design, is proposed to be governed by Lido DAO, and is pending a governance vote for approval. Lido Lend is limited to blue-chip assets, encourages price-correlated trading pairs such as stETH/ETH, and provides a deposit screening mechanism to guard against bad collateral. Lido stated that Lido Lend is not a general-purpose pool-based lending solution but is aimed at professional borrowers and risk-averse lenders; currently, stETH staking scale exceeds $25 billion, with no major security incidents since launch.
Attackers exploited a voting power calculation vulnerability to submit two malicious proposals attempting to replace the voting mechanism and transfer funds from the DAO treasury, but neither proposal passed, and no funds were transferred.
Odaily News: Cross-chain protocol Chainlink has released CCIP 2.0, allowing enterprises to add their own security checks for cross-blockchain transfers on top of its default network of 16 operator validators.The upgrade comes after Kelp DAO suffered a $292 million hack in April, an incident attributed to a LayerZero cross-chain bridge setup using a single validator; Kelp DAO subsequently migrated its rsETH token to Chainlink.Chainlink's risk management network no longer operates as a standalone security safeguard, and users who do not add their own validators will rely on one validation network rather than two. (CoinDesk)
According to CoinDesk, a Gnosis Safe wallet on Ethereum was attacked, with approximately 2,900 rsETH (valued at around $7.8 million) transferred. Security firms BlockSec, Blockaid, and SlowMist pointed out that the root cause of the attack lies in an authorization check flaw within the wallet-approved Multicall contract—the contract is intended to verify caller permissions, but the vulnerability allows anyone to bypass validation simply by targeting the contract itself. The attacker subsequently moved the rsETH into a liquidity pool based on the valueless token "Permissionless Attacker Token." An automated bot named "yoink" paid approximately $47,000 to frontrun the transaction, transferring 2,882 rsETH to a separate address. rsETH issuer Kelp DAO stated that its smart contracts are secure and rsETH is fully collateralized, and has implemented a 24-hour pause measure on the relevant addresses.
Odaily Report: Balancer Labs co-founder Marcus Hardt posted on X that he has proposed a governance proposal to gradually shut down Balancer. Balancer had previously completed a restructuring, including halting token emissions, transferring all protocol fees to the DAO, cutting the operational budget by one-third, and reducing the team from approximately 25 people to 12.5 full-time equivalents.Marcus stated that the restructuring was completed on the cost side as planned, but revenue performance fell short of expectations. Currently, most of Balancer's protocol revenue still comes from v2, and v3 revenue has not grown enough to replace v2. Previous security incidents have also continued to affect partners' willingness to adopt v3. Marcus said he can no longer see a funded path that could change the situation, and continuing to burn through treasury funds is not reasonable. Therefore, he has proposed gradually shutting down Balancer and will not lead efforts to develop a plan for continued operations. The Balancer code will remain open source, and other teams can fork it and continue development. The relevant proposal has been submitted to the governance forum, and the final decision still rests with token holders.
Odaily News: According to Defimon monitoring, YAM Finance has suffered a governance takeover attack. The attacker self-delegated approximately 504,000 YAM tokens, accounting for about 3.3% of the total supply, slightly above the legal voting threshold, and subsequently submitted proposal #45 to YamGovernorAlpha. The proposal description is empty and only contains an operation to call the setPendingAdmin method of the YAM Timelock contract, redirecting permissions to the attacker's address. If the proposal passes and is executed, the attacker will become pendingAdmin and can then fully control the Timelock through acceptAdmin, thereby gaining administrative access to all YAM protocol contracts and the DAO treasury, involving a risk amount of approximately $337,000. As the YAM protocol is currently in a dormant state, Defimon Alerts reminds YAM holders to vote against this proposal before block height 25897343, with approximately 34 hours remaining until that block.
Odaily News: Blockchain project Core DAO has announced a coordinated emergency hard fork, caused by validators receiving CORE rewards exceeding the blockchain's originally scheduled issuance. Core DAO stated that the incident is under control, malicious validators can no longer continue to obtain excess rewards, and the upgrade will not roll back the network or revoke confirmed transactions.Core DAO previously stated that a small number of validators had accumulated rewards significantly higher than the protocol's set issuance, and that the incident only involved reward distribution, with user assets remaining secure. Coinbase, Bithumb, Coinone, Bitget, and LBank had restricted CORE deposits, withdrawals, or transfers.Core DAO has not yet disclosed the amount of excess CORE issued, the duration of the related activity, whether the extra tokens entered circulation, or the cause of the vulnerability, and stated that it will publish a technical post-mortem report. (Cointelegraph)
Term Labs 发文更新漏洞事件进展。目前所有 Term Meta Vault 已关闭，DAO 治理角色已被撤销。此关闭不可逆，永久禁止进一步存款，但提款仍开放。本次事件涉及 Term Vault 治理。底层 Term 协议及其直接借贷市场尚未受到影响，团队正在继续核实影响范围。若仍存在资金缺口，团队将寻找解决途径。 此前消息，据 CertiK 监测，Term Finance 于昨日遭遇治理攻击，损失约 850 万美元。
According to Blockaid monitoring, Crypto DAO's Pro token was attacked. As of 00:23 early this morning, the attacker and related profit addresses currently hold a combined total of approximately 8.2 million USDT.
According to BlockSec monitoring, the BarnBridge SMART Yield cUSDC protocol was attacked on Ethereum, resulting in losses of approximately $776,000, suspected to be a governance attack. The attacker first gained DAO governance rights, then upgraded the SmartYield/controller proxy to a malicious implementation contract. This contract called the _takeUnderlying privileged function of CompoundProvider, utilizing pre-existing USDC approvals from 50 user accounts, and via transferFees, moved the aggregated funds to the attacker.
According to Fortune, DeFi asset management and risk analysis company Gauntlet completed a $125 million financing round, exclusively invested by Japanese financial group SBI Holdings. The financing was completed in June this year, and the specific valuation was not disclosed. This is Gauntlet's largest financing round since its establishment in 2018, far exceeding its $24 million Series B round in 2022 led by Ribbit Capital at a $1 billion valuation. Gauntlet was founded by former Wall Street quantitative trader Tarun Chitra. It initially focused on providing stress testing and vulnerability analysis services for DeFi protocols. Later, as the DAO governance model waned, it gradually transitioned to a "treasury curation" business—assessing yield strategy risks through quantitative analysis to help institutional investors manage digital asset allocation. Currently, its clients include asset management giant Apollo, Coinbase, and stablecoin issuer Circle.
Odaily, on-chain security firm Specter has released preliminary findings on the BONK DAO governance attack. After tracing on-chain fund flows, significant suspicions have emerged: the Realms founder, an address associated with Crypto Notte, shows signs of capital flow interaction with the suspected attacker's wallet.According to the review, the attacker published a malicious governance proposal on June 30. The proposal required 1% of the total BONK circulating supply in voting power to pass. Between July 4 and 5, the attacker acquired sufficient voting weight by purchasing tokens through exchanges and borrowing from Marginfi, totaling approximately $4 million, thereby pushing forward and executing the governance attack.
据官方消息，BonkDAO 表示，其 DAO 金库 因一项恶意治理提案遭攻击，约价值 2000 万美元的 BONK 代币被盗。调查显示，相关地址曾在提案发起前通过交易所钱包购买 BONK。BonkDAO 正与交易所、跨链桥及 Solana 基金会合作处理此事，执法部门已获通知，后续将继续推进资金追回及责任追查。
the official Bonk Inu X account announced that BonkDAO was attacked via a malicious governance proposal, resulting in the theft of approximately $20 million worth of BONK tokens from its DAO treasury.According to reports, the attacker exploited a suspicious governance proposal to transfer assets from the BonkDAO treasury. The stolen BONK subsequently began flowing to exchanges, putting downward pressure on the BONK price. Data from The Block shows that the BONK price has dropped over 9%.South Korean exchange Upbit subsequently issued a notice stating that it has temporarily suspended BONK deposits and withdrawals to address the incident and mitigate potential risks. (The Block)