News linked to both this project and an event.
Odaily Report: Marc Zeller, founder of the Aave Chan Initiative (ACI), posted on X stating that the Aave protocol is fine.The Binance hacker injected 60 million USDT into the protocol within just 3 minutes and borrowed 19,762 wETH (approximately $44.9 million), at which point Tether had not yet frozen the address, nor had the Aave Guardian frozen the Aave V3 Core pool's reserves (this operation occurred 46 minutes later).However, USDT is backed by real dollars, and from the protocol's perspective, although this position is the proceeds of crime, it is overcollateralized — with a health factor of 1.04, holding $59.9 million in collateral against $44.9 million in debt.Of course, the protocol now has a large borrower with little incentive to repay the loan, but the liquidation mechanism will still operate as usual. If the ETH price rises above approximately $2,365 (+4%), the position will be liquidated just like any other position.Currently, the Aave V3 Core pool's total wETH reserves stand at 2.16 million wETH, and the hacker's debt accounts for "only" 0.9% of that, so Aave does not need to take any special action against the hacker. There are currently 345,000 wETH available (capital utilization rate of 81.6%), so if wETH depositors wish to withdraw, liquidity is fully sufficient. There is no reason or need for a bank run to occur.This situation is far less alarming than the Kelp hacker incident (which involved zero-value collateral). In theory, a governance proposal could be passed to force liquidation of the hacker by upgrading the pool (if the USDT liquidation threshold were lowered, it would affect all USDT depositors), but there is no practical benefit to doing so, as the normal liquidation mechanism can easily absorb this debt.
PaperTrade posted on X stating that trading volume in the first 6 hours after launch exceeded stock market trading volume; one day after launch, PaperTrade has become a trading platform supporting 1000x leverage, with liquidity pool (LP) size reaching $5 million and $25 million in rewards distributed to staking users.In response to community concerns about the fair launch mechanism and BTC/ETH market manipulation, PaperTrade stated that due to the need to prevent frontend congestion and spam request attacks, small orders cannot enjoy exactly the same priority as large orders, and the team has maximized fairness within these constraints. Some users exploiting the Hyperliquid BBO mechanism to manipulate BTC/ETH was not an oversight in mechanism design, but rather resulted from opening a higher OI cap during the initial launch period to alleviate queuing pressure. As traffic has declined, the team has begun tightening position limits at both the on-chain and relay levels to reduce the profit space for manipulation.PaperTrade added that no system can completely eliminate manipulation, and the goal is to make attacks nearly unprofitable through parameter adjustments, noting that in the relevant incidents, some users ultimately returned most of their profits to the platform due to persistent manipulation attempts.
Odaily News: DeFiLlama founder 0xngmi has raised questions about Apple's App Store review mechanism in a post on the X platform. He stated that his team had spent months trying to get Apple to remove a fake DeFiLlama app, but multiple previous complaints regarding trademark infringement and impersonation of the official app were not effectively addressed.In the end, the DeFiLlama team had to download and use the fake app, subsequently depositing a small amount of funds into it. As expected, the wallet assets were stolen, confirming the app's malicious behavior. After submitting another report to Apple with this evidence, the fake app was finally removed within a few days.
David Bailey, Chairman and CEO of Nasdaq-listed Bitcoin treasury company Nakamoto, stated that the failure of the so-called long-standing "BIP-110" controversy constitutes an "extremely bullish" outcome for Bitcoin, and believes this further validates the network's attack resistance and anti-splitting capabilities.
Taiko stated on its X platform that it has confirmed its chain state verification mechanism has been compromised, and the security assumptions of all cross-chain bridges deployed on Taiko are no longer reliable.Taiko said it is coordinating with its security committee and ecosystem partners to control the situation, suspending affected systems, and taking technical and legal actions. Taiko strongly advises all users to immediately withdraw funds from cross-chain bridges deployed on Taiko.Additionally, Taiko has made an urgent request for all centralized exchanges to suspend TAIKO token deposit services until further official notice. Previously, Taiko's ERC20 Vault was attacked, resulting in losses exceeding $1 million.
following the Kelp security incident, Tether's asset interoperability protocol USDT0 has disclosed details of its protocol security architecture. It stated that the system currently utilizes a proprietary DVN (Decentralized Verification Network) with message veto authority, and requires 3 independent validators, operating on different codebases, to reach a 3/3 consensus before cross-chain messages can be settled. The current verification nodes include the USDT0 proprietary DVN, LayerZero, and Canary, with future plans to expand to 4/4 and 5/5 verification mechanisms.USDT0 also stated that all multi-signature transactions must undergo multiple reviews by internal teams, external security teams, and auditing firms before signatures are submitted. The relevant contracts have been audited by firms such as Guardian and OpenZeppelin, and a $6 million bug bounty program has been launched on Immunefi.
LayerZero Labs posted on platform X, stating that the internal RPC used by LayerZero Labs had been attacked by the Lazarus Group over the past three weeks, compromising the true source of its DVN (Decentralized Verifier Network). Meanwhile, external RPC providers experienced DDoS attacks. The incident affected 0.14% of applications and approximately 0.36% of asset value. LayerZero Labs stated that assets are currently secure, and over $9 billion in funds have been bridged through the protocol since April 19.In response to the security risk, LayerZero Labs has ceased providing services for its DVN in a 1/1 configuration. Default configurations for all pathways will migrate to a multi-DVN model of at least 3/3 or 5/5 signatures. Additionally, regarding an incident from three years ago where a multi-sig holder mistakenly used a hardware wallet for personal transactions, LayerZero Labs has removed that signer and replaced the wallet, while developing a custom OneSig multi-sig system. LayerZero Labs advises developers to lock configurations to avoid reliance on default settings and plans to launch an asset management platform, Console, to enhance security monitoring.
Odaily News: Sonic Labs co-founder and Flying Tulip founder Andre Cronje posted on platform X, stating that his team is continuing to investigate the L0/rsETH incident. Preliminary reports indicate that approximately $200 million worth of rsETH was stolen, possibly due to a private key leak or configuration error. The related assets were subsequently deposited into Aave as collateral to borrow ETH (due to insufficient rsETH liquidity).Andre Cronje pointed out that the affected positions are technically still overcollateralized. However, if bad debt occurs, Aave's token mechanism and Safety Module will serve as the first line of defense to absorb the risk. Nevertheless, Aave has no mechanism to subsidize user losses, as doing so could trigger a bank run. Currently, Aave holds approximately $7 billion in ETH with an outstanding borrowing amount of around $100 million, so the overall impact of this incident is limited. Furthermore, prioritizing user liquidity, Flying Tulip has withdrawn all its ETH from Aave to its fund management wrapper contract. This action was taken because Aave's available liquidity had fallen below its set minimum threshold.