News linked to both this project and an event.
BounceBit Chain 已于 8 月 20 日 02:36:37（UTC）在区块高度 20,702,857 停止出块。团队决定永久停止 BounceBit Chain，不再进行网络升级，并将在 BNB Chain 上以 BEP-20 代币形式重新发行 BB。新 BB 余额将依据 8 月 19 日 21:02:35（UTC）区块高度 20,697,260 的快照确定，攻击期间被转移的 286,543,148 枚 BB 不会计入重新发行代币。
SlowMist warned that legitimate crates in the Rust ecosystem—[email protected], [email protected], and [email protected]—were targeted in a supply chain attack. A malicious dependency, proc-macro1, was injected into these packages, enabling the download and execution of cross-platform malware during the Cargo build process. The attack poses risks including remote code execution at build time, host information collection, persistence, and browser data gathering.
According to reporter Kate Irwin (@kateirwin), GalaChain experienced an anomalous on-chain capital outflow this Tuesday. Approximately 1.99 billion GALA tokens (worth roughly $2.9 million), along with other tokens, were transferred from five major addresses to a newly created wallet, subsequently bridged out and swapped for ETH within approximately one hour. Of these, approximately 1.639 billion GALA (representing roughly 82%) originated from a wallet linked to Gala Games CEO and co-founder Eric Schiermeyer, which simultaneously transferred out other tokens valued at over $500,000. Within hours of the incident, the Gala development team urgently merged a fix commit on GitHub, classifying the event as resulting from a GalaChain EIP-712 unsigned field injection vulnerability. The Gala Ethereum cross-chain bridge has since been halted, with the Solana bridge concurrently deactivated. While officially cited as routine maintenance, users have been unable to access the cross-chain bridge services normally for several consecutive days.
Odaily News: BIP-110 supporters are discussing a hard fork to change the stalled minority chain's mining algorithm from SHA-256d to BLAKE2b. Transaction history before the fork remains shared by both chains. If transaction and signature rules remain consistent, the same transaction could be replayed on the other chain, creating a replay attack.BIP-110's peak miner support was approximately 2.53%. After the consensus rules took effect on August 8, the minority chain produced only two consecutive blocks before stalling, while the Bitcoin main chain continued operating and widening the block height gap. The BIP-110 proposal was subsequently marked as closed, and supporters shifted focus to discussing the BLAKE2b proof-of-work scheme.Bitcoin Knots plans to add a new signature hash option, but RDTS will still maintain compatibility with Bitcoin Core's existing signature hash types. Regular transactions may continue to be valid on both chains. Users will need to use the new option and rely on wallets or hardware signing firmware that support it to achieve asset separation.Luke Dashjr stated on August 18 that Bitcoin should bear the responsibility for replay protection, calling it "Spamcoin." If the BLAKE2b fork proceeds around September 1, exchanges, wallets, and holders will need to distinguish between cross-chain transactions and chain-specific transactions. (Bitcoin.com News)
Odaily News Bybit today released its H1 2026 Risk and Security Report. Following the security incident in February 2025, Bybit has comprehensively upgraded its security architecture, transitioning toward a new defense model characterized by earlier detection, faster response, and continuous adaptation. Key highlights from the report are as follows:User Fund Protection: In H1, over 30,000 suspicious withdrawals were intercepted, protecting nearly 20,000 users from potential losses exceeding $700 million. The average initial review time was just 4.7 minutes (with 95% completed within 10 minutes).100% On-Chain Monitoring: Monitoring covers all business-related on-chain activities (including listed tokens, ecosystem contracts, and hot/cold wallets). In H1, 10 security incidents involving listed token projects were handled with zero platform losses; of these, responses to 8 incidents were faster than other major exchanges, and 2 attacks were detected before the project teams themselves. Additionally, approximately $212 million in potentially fraudulent on-chain funds was identified, and over 10,000 malicious addresses were blacklisted.AI-Driven Security Operations: More than 100,000 security alerts were processed. AI-assisted audits identified critical vulnerabilities at an efficiency 3-5 times that of manual efforts; the automated red team platform reduced the time from asset discovery to initial testing to within 24 hours (compared to weeks with traditional manual methods), and the cycle from security assessment to testing was shortened from two weeks to two hours.Accountability and Asset Recovery: In collaboration with law enforcement agencies and blockchain intelligence firms, stolen assets are being traced, and legal action has been taken against North Korea and the Lazarus Group to hold them accountable and recover funds.David Zong, Head of Risk Control and Security at Bybit Group, stated: "The cybersecurity arms race has entered the era of 'minute-level' response. Leveraging AI to strengthen risk control capabilities and ensuring the security of AI systems themselves is our top priority, but critical security decisions remain centered on human judgment."
Maya Protocol founder AaluxxMyth disclosed that the protocol was attacked, with approximately 20 BTC (around $1.4 million) and other assets (around $300,000) stolen. The team has suspended global operations to contain losses and is fixing vulnerabilities to restore trading. Most of the losses resulted from arbitrage and pool fees caused by extreme slippage. The team is communicating with relevant parties and plans to recoup the funds through methods such as investments in Aztec Chain. If the 20 BTC are returned to the pool, the CACAO token price will recover to $0.115. The team also hopes the attacker will accept the bug bounty and return the funds.
Odaily News: BNB Smart Chain (BSC) has announced that the Pasteur hard fork will officially go live on the mainnet at 10:30 AM Beijing time on August 25 (02:30 UTC on August 25). Node operators are required to upgrade their clients to v1.7.7 in advance.This upgrade includes three improvements—BEP-682, BEP-695, and BEP-675—focusing on enhancing cross-chain security, validator governance mechanisms, and network throughput. Among them, BEP-682 will strengthen the BNB Chain cross-chain bridge verification mechanism, preventing permission bypass risks caused by duplicate signature counting by validators, thereby improving the security of cross-chain asset transfers. BEP-695 optimizes the validator key rotation mechanism, ensuring that old keys no longer retain management privileges after exit, while also fixing potential vulnerabilities related to slashing and governance voting.In terms of performance, BEP-675 reduces the time consumption caused by validators repeatedly executing transactions by optimizing the block construction process. In BNB Chain's internal QANet test environment, this solution increased throughput from 1,237 TPS to 2,324 TPS. While maintaining the 450-millisecond block time and the 100 million Gas block limit unchanged, the average Gas usage per block rose from 46.35 million to 84.15 million.BNB Chain stated that this upgrade is primarily aimed at validators and block builders, designed to provide greater capacity during network peak periods and advance the throughput expansion goals outlined in BNB Chain's roadmap for the second half of 2026.
Odaily News - A study published at USENIX Security '26 reveals that researchers identified 65,340 high-risk cryptocurrency addresses involved in abuse on Ethereum and BNB Chain, with associated native token losses reaching 126,982.94 ETH and 17,726.7 BNB. The study estimates that total losses linked to these addresses exceed $574.8 million, of which two newly described active attack vectors directly caused approximately $15.7 million in losses (2.7% of the total). The first category involves contract account misuse and exploitation of deterministic contract addresses; the second leverages EIP-7702 to delegate accounts with exposed keys to malicious code that directly transfers deposits. The research team extracted over 16.3 million unique private keys by mining 63,004 GitHub repositories from January 2015 to May 2025, achieving an overall accuracy rate of 99.11% in detection results. (Cryptoslate)
Odaily News: The cross-chain bridge connecting XRP Ledger and Coreum was attacked on August 9. The attacker exploited a validation logic vulnerability to steal approximately 199,900 XRP, reducing the bridge's asset balance from roughly 200,400 XRP to 493.5 XRP. The attack did not involve private key leaks and did not target the XRP Ledger protocol itself. The attacker forged deposit operations, causing the bridge system to recognize them as legitimate deposits and triggering the bridge wallet on the other end to send real XRP. On-chain data shows that the attacker completed the fund transfer through 94 multi-signature authorization transactions within 97 minutes. These transactions required signatures from 17 of the 28 relay node keys, allowing the attacker to bypass the bridge's validation mechanism. As of August 11, the Coreum cross-chain bridge remains suspended, and the Coreum Development Foundation has not yet released an official incident report. The XRP mainnet and user private keys remain unaffected and secure.
BNB Chain announces the "Build the Era" Hackathon, soliciting proposals to build the best AI Agent trading platform on BNB Chain. The hackathon offers over $40,000 in prizes jointly provided by BNB Chain, @TermiX_AI, @PancakeSwap, @alt_layer, @binance Pay, and @AltanaNetwork. Both individuals and teams can register to participate.
According to monitoring by blockchain security company SlowMist (@SlowMist_Team), its threat intelligence system MistEye detected a large-scale npm supply chain attack targeting the Keyv/Cacheable ecosystem. The attackers published over 2,000 malicious package versions in total, involving core components such as [email protected]. As a widely used key-value storage abstraction library, Keyv supports multiple backends including Redis, SQLite, PostgreSQL, and MongoDB, with weekly downloads reaching approximately 127 million, posing significant downstream supply chain exposure risks. This attack method is highly similar to the previous Shai-Hulud npm worm activity, characterized by high automation and scale. Potential risks include credential theft, environment variable leakage, CI/CD key leakage, remote payload delivery, and lateral penetration. SlowMist recommends security teams immediately investigate and remove affected package versions, upgrade to verified secure versions, review dependency lock files and build logs, monitor suspicious outbound connections, rotate exposed credentials, and rebuild relevant environments from trusted sources if intrusion is suspected.
: Crypto infrastructure company BitGo will switch its exclusive cross-chain service provider for $7.3 billion worth of WBTC from LayerZero to Chainlink CCIP. Following the $292 million cross-chain bridge exploit at Kelp, multiple projects have announced migrations from LayerZero to Chainlink, with disclosed migration volumes totaling $14.5 billion. BitGo will use CCIP for future assets while retaining control over token contracts, rate limits, and transfer settings.
According to TenArmorAlert monitoring, its system detected a suspicious attack involving the LULA token on the BSC chain, resulting in losses of approximately $578,100.
According to Cointelegraph, the cross-chain bridging and atomic swap protocol Garden Finance temporarily took its application offline after detecting abnormal activity on July 27. Blockchain security firm Blockaid disclosed that attackers exploited a vulnerability in Garden Finance's Hash Time Locked Contracts (HTLC), stealing a total of approximately $450,000 worth of USDT across four networks: Ethereum, Base, Arbitrum, and BNB Smart Chain.
According to The Block, Robinhood CEO Vlad Tenev's X account was hacked at approximately 17:24 UTC on July 23. Hackers posted claiming to launch "Vladhood ($VLAD)" as the "official mascot of Robinhood Chain," and attached a contract address. The Robinhood Chain blockchain explorer has labeled the token as a "potential scam," and the token has generated approximately 1,868 transactions since deployment. Robinhood officially confirmed later that the account was compromised, the relevant posts have been deleted, and the company is working with the X platform to restore account access.
Odaily News: Ethereum Layer 2 network Taiko released a post-mortem of the June 21 security incident, stating that the attack resulted from an off-chain signature key leak and a verification process gap. The attacker exploited these to forge proofs and bypass the Prover whitelist, rather than breaking ZK cryptography or smart contracts. The attacker stole approximately $1.75 million from cross-chain bridges and Vaults, but over $11 million in assets were protected, and no user funds were lost. Taiko has fixed the vulnerability, restored the pre-attack state, and resumed operation on July 2; an OpenZeppelin audit confirmed the fixes with no high, medium, or low-risk vulnerabilities identified. The official statement also indicated that the Unzen upgrade, scheduled for August 6, will require ZK proofs for every block to further enhance network security.
According to CertiK Alert monitoring, a security incident occurred on VerusCoin's Ethereum cross-chain bridge, with approximately $7.53 million in assets transferred out. Preliminary analysis indicates that this issue may be related to the cross-chain bridge failing to sufficiently verify whether the Verus chain-side input supports the paid amount, similar to an incident that occurred in May this year.
: According to on-chain detective Specter’s monitoring, B² Network may have suffered a vulnerability exploit on BNB Chain. The attacker transferred 8.591 million B2, worth $3.86 million, and exchanged them for 5,409 WBNB, worth $3.11 million. The funds were then bridged to Ethereum, and are currently being transferred to Zcash via NEAR Intents. The addresses used for the theft are 0xEc443f7D79835B464FBEAC798d3f92B62d6Ff433 and 0xf977427Ec8e583C55D413061FC205BCD57e8Bf6D.
According to on-chain analyst Specter, B² Network on BNB Chain suffered a hack, resulting in a loss of approximately 8.591 million B2 tokens (approximately $3.86 million). The attacker swapped them for 5409 WBNB (approximately $3.11 million) and bridged to Ethereum, and is currently transferring the funds to Zcash via NEAR Intents.
: BNB Chain Agent commercial clearing layer TermiX announced that Web3 security infrastructure GoPlus and smart contract security auditing firm Salus have officially become Provider Agents on the Agent.family platform. They have launched two production-grade security audit services, promoting the autonomous invocation and settlement of "security capability as a service" for AI Agents in on-chain commercial scenarios.GoPlus has packaged its verified token contract deep scanning capability as a standard Provider Agent service. DeepScan conducts comprehensive security checks on token contracts, identifying risk patterns such as Rug Pulls, honeypot scams, contract permission abuse, and trading restrictions, and generates structured audit reports.Salus has launched smart contract auditing and penetration testing services, encompassing formal verification, fuzz testing, machine learning-based vulnerability detection, and manual expert auditing. It covers high-risk vulnerability categories such as reentrancy attacks, access control issues, integer overflows, and DoS attacks. Salus, a seed-stage investment from Binance Labs, is a core security partner within the BNB Chain ecosystem.