News linked to both this project and an event.
BNB Chain is developing a new Layer 1 blockchain designed for Agentic Trading, releasing the first detailed architectural information after months of research and development. According to BNB Chain's disclosed technical roadmap for the second half of 2026, the new chain will run in parallel with the existing BNB Chain ecosystem, targeting transaction preconfirmation times of less than 50 milliseconds. The goal is to deliver an execution experience close to that of centralized exchanges (CEX) while retaining the advantages of on-chain self-custody and transparency.In terms of technical architecture, the new chain will remove the traditional public mempool and introduce a transaction transmission mechanism called "TxStream," which directly sends transactions to block producers to reduce latency and minimize MEV extraction behaviors such as sandwich attacks. (The Block)
: Cardano wallet service provider SecondFi has released an update on the security incident recovery progress, stating that EMURGO has established an asset recovery fund to return assets to users affected by the attack.SecondFi stated that emergency measures have been taken to protect and restore access to some assets. The team is currently discussing appropriate custody mechanisms with Intersect to ensure the safe return of assets to users.Furthermore, SecondFi is collaborating with a Cardano community-led working group to advance the on-chain recovery plan. Due to the recovery plan being more complex than initially expected, the overall recovery time may exceed the previously estimated two weeks.
Base has officially released an analysis report on the block production outage, disclosing that the Base mainnet experienced two block production interruptions on June 25 and 26, lasting 116 minutes and 20 minutes respectively. On-chain asset security was unaffected, and funds remained safe at all times. The root cause was a vulnerability in the sequencer's block construction logic: after a transaction execution failure, the old journal state was not properly cleared, causing subsequent legitimate transactions to encounter gas calculation errors during execution, thereby generating invalid state transition blocks and halting block production on the entire L2 chain.Base stated that the issue has been resolved through a patch, and will strengthen the protocol's fuzz testing and stress testing framework to identify potential malicious transaction paths, while optimizing monitoring and operational processes. Additionally, plans are in place to introduce a recovery mechanism to enhance rapid recovery capabilities in future similar events.
Cybersecurity firm Novee, in its latest research, revealed a CI/CD supply chain vulnerability pattern dubbed “Cordyceps,” primarily involving command injection, authentication logic flaws, artifact poisoning, and privilege escalation within GitHub Actions workflows. According to the report, unauthenticated users can exploit these vulnerabilities under specific conditions to hijack workflows, steal credentials, or gain control of code repositories.
HashKey Chain will host the “HashKey Chain Horizon” hackathon in Japan from June 18 to July 14. Built upon the foundation of building a compliant and secure Web3 ecosystem, this hackathon is open to developers, innovators, and Web3 enthusiasts worldwide. It features two challenge tracks focused on key areas within the HashKey Chain ecosystem.
Taiko stated on its X platform that it has confirmed its chain state verification mechanism has been compromised, and the security assumptions of all cross-chain bridges deployed on Taiko are no longer reliable.Taiko said it is coordinating with its security committee and ecosystem partners to control the situation, suspending affected systems, and taking technical and legal actions. Taiko strongly advises all users to immediately withdraw funds from cross-chain bridges deployed on Taiko.Additionally, Taiko has made an urgent request for all centralized exchanges to suspend TAIKO token deposit services until further official notice. Previously, Taiko's ERC20 Vault was attacked, resulting in losses exceeding $1 million.
Odaily news, Slow Mist founder Cosine published an analysis stating that the approximately $1.1 million loss incident in the OLPC / LABUBU liquidity pool on BNB Chain is suspicious. The loss occurred due to a severe imbalance in the OLPC/LABUBU trading pair, caused by a "vulnerability" in OLPC being exploited. Under certain conditions in _update, it is possible to burn OLPC tokens amounting to value * decimalsValue. Normally, decimalsValue is 1, but approximately 46 days before the attack, it was changed by the owner to an extremely large value of 7,326,680,472,586,200,649. A few days later, the OLPC owner renounced ownership, setting it to the zero address.Today, the attacker exploited this extremely large decimalsValue to trigger the Pair reserve burn, allowing a small amount of OLPC to extract a large amount of LABUBU. The attacker ultimately swapped 1.115 million USDT at a low cost. The suspicious point lies in the setting of decimalsValue—why did the OLPC owner set such an abnormally large value?
PancakeSwap has issued a notice regarding abnormal activity in the BNB Chain OLPC/LABUBU liquidity pool, stating that the team has acknowledged community reports and initiated a preliminary investigation.PancakeSwap indicated that initial findings confirm no issues at the smart contract level, and the relevant incident is still under further review. The team will continue to monitor the situation and provide updates as more information becomes available.The platform reminds users to rely on information released through PancakeSwap's official channels and to be cautious of unverified rumors.
according to PeckShield monitoring, the OLPC/LABUBU liquidity pool on BNB Chain's PancakeSwap was attacked. The attacker stole approximately $1.1 million worth of assets. After the incident, the attacker cross-chain transferred the stolen funds to Ethereum and subsequently deposited 633.4 ETH into the mixing protocol Tornado Cash. Additionally, the attacker sent 0.0221 BNB and 0.0411 ETH to a deprecated address. Relevant attack details and fund flows are still under continuous tracking.
According to on-chain analyst PeckShield (@PeckShieldAlert), the Humanity attacker’s address has bridged 130 ETH (approximately $220,600) from Ethereum to BNB Chain (381 BNB).
SlowMist announced that over 140 Mastra-related npm packages were compromised via a supply-chain attack. Affected versions introduce the malicious dependency `[email protected]`, which triggers attacker-controlled code execution during installation.
Humanity has announced the $H incident recovery plan: The legacy version of H on Ethereum, BNB Smart Chain, and Humanity Mainnet has been deprecated. A new Ethereum ERC-20 version of H will be airdropped 1:1 to eligible holders based on a pre-attack snapshot. Attackers and associated addresses have been excluded.
According to on-chain security platform Blockaid (@blockaid_), the MILC Platform cross-chain bridge suffered a private key leak on both the BNB Chain and Ethereum networks. The attacker exploited a historical bridge administrator wallet to grant the DEFAULT_ADMIN_ROLE and MANAGER_ROLE permissions to the attacker’s address. Subsequently, assets were withdrawn from the bridge contract, and administrative control was transferred to the attacker’s wallet. Confirmed losses currently stand at approximately $97,003 USDT (on BNB Chain) and approximately 39.21 ETH (on Ethereum, transferred out via Rhino.fi), totaling roughly $161,000.
Humanity released a post-mortem report on the H token security incident that occurred between June 8 and 9, stating that the incident was not caused by a smart contract vulnerability, but rather by a malware intrusion into a developer's device, which led to the leakage of private keys. Humanity stated that the attacker still holds the ProxyAdmin permissions for the ETH bridge and the BNB Chain token. Preliminary investigations confirmed that a colleague's device was infected with malware, which the attacker used to obtain the hot wallet private key of the administrator and the private keys for signing on 6 Gnosis Safe wallets. The team has hired an external security agency to conduct a forensic investigation and stated that they are formulating a recovery plan for affected users.
Syscoin released a preliminary post-mortem of the cross-chain bridge incident, stating that due to a verification issue in the bridging process, the attacker exploited an abnormal transaction proof validation to generate approximately 5 billion SYS tokens abnormally on the UTXO side via the affected bridging path.
: SlowMist posted on X platform, stating that its threat intelligence system has detected a new Rust supply chain malware activity named IronWorm. This malware actively attacks developer environments and the Web3/crypto ecosystem through malicious npm packages. Potential attack behaviors include credential theft, wallet seed phrase and password theft, GitHub repository tampering, malicious package publishing, CI/CD key theft, Tor-based command and control, and covert persistence via eBPF rootkits.SlowMist recommends that security teams audit repositories for backdated commits, suspicious branches, abnormal build hooks, and commits attributed to automated identities such as claude, dependabot, renovate, or github-actions; remove or deprecate affected package versions, publish clean versions, rotate all exposed keys and tokens, review GitHub Actions build artifacts, and rebuild potentially compromised developer or CI systems from clean images. This threat was discovered and analyzed by JFrogSecurity.
: According to an official announcement, on June 3, Trust Wallet announced a partnership with BNB Chain and CoinMarketCap to officially launch the "BNB Hack: AI Trading Agents" hackathon, featuring a total prize pool of $36,000. The Trust Wallet Agent Kit serves as the core on-chain execution technology stack for this event. This hackathon also marks the first time the Trust Wallet Agent Kit has been fully integrated as a core infrastructure component into a top-tier AI Agent hackathon system.The hackathon features two main tracks: "Autonomous Trading Agents" (prize pool $24,000, 5 winners) and "Strategy Skills" (prize pool $6,000, 3 winners), in addition to three partner special awards of $2,000 each. In the "Autonomous Trading Agents" track, participants must leverage the Trust Wallet Agent Kit to achieve local self-custodial signing, autonomous mode operation, and on-chain trade execution, deployed within native BNB Chain scenarios such as PancakeSwap and BSC Perpetual Contracts. The "Strategy Skills" track does not require an execution layer; participants build backtestable strategy proposals based on 12 categories of data tools from CoinMarketCap MCP, including market data, technical indicators, on-chain data, sentiment, and news.Track one uses real PnL as the core evaluation criterion, setting a maximum drawdown limit as the risk control threshold. Track two is comprehensively scored by a judging panel across four dimensions: technical execution, originality, real-world value, and presentation. The build window runs from June 3 to June 21, the trading window from June 22 to June 28, and winners will be announced during the week of July 6. In addition to cash prizes, winning teams will receive CoinMarketCap Pro API subscription credits, mentorship from CMC Labs, and the BNB Chain Kickstart ecosystem support package.
According to on-chain analyst PeckShield (@PeckShieldAlert), approximately 19 hours ago, TesseraDao (@TesseraDao) on BNB Chain was attacked. The hacker maliciously minted 99 million TSR tokens and immediately dumped them, causing the TSR price to plummet by 99%. The attacker then exchanged the stolen TSR for approximately $2.5 million in USDT and cross-chained the funds to Ethereum. The attacker has since laundered 1,285.5 ETH via TornadoCash.
According to The Block, the DeFi lending protocol Radiant Capital has announced it will officially cease operations. The protocol suffered a hack in October 2024, losing approximately $51 million; the attacker gained unauthorized access by deploying backdoor contracts on Arbitrum and BNB Chain. Earlier in 2024, the protocol had also been hit by a flash loan attack, resulting in a loss of roughly 1,900 ETH (approximately $4.5 million). After 18 months of recovery efforts, Radiant Capital stated that it has neither recovered a significant portion of the stolen funds nor secured new financing, declaring that “the DAO has no viable path forward.” The protocol will now enter a “maintenance mode”: its frontend and smart contracts remain accessible, allowing users to withdraw funds, repay loans, and manage positions. Any funds recovered in the future will be returned to affected users.
DxSale.Network posted on X platform in response to a recent security incident, disclosing that the vulnerability originated from the newly launched atomic transaction feature on BNB Smart Chain (BSC), which affected the v1 lockup contract launched in 2021. The team has identified the source of the issue and stated that lockup contracts for v2 and above are completely secure and have been audited by Certik. Users can rest assured that assets locked in v2 and above are unaffected.