News linked to both this project and an event.
According to BlockSec monitoring, the BarnBridge SMART Yield cUSDC protocol was attacked on Ethereum, resulting in losses of approximately $776,000, suspected to be a governance attack. The attacker first gained DAO governance rights, then upgraded the SmartYield/controller proxy to a malicious implementation contract. This contract called the _takeUnderlying privileged function of CompoundProvider, utilizing pre-existing USDC approvals from 50 user accounts, and via transferFees, moved the aggregated funds to the attacker.
According to Odaily Planet Daily, Ethereum ZK Layer2 Starknet has officially launched the compliant privacy framework STRK20, providing native privacy transaction capabilities for various digital assets on-chain. The framework operates based on a privacy pool mechanism. Once user assets are deposited into the privacy pool, all transactions are encrypted, with details such as transfer addresses and amounts being invisible to the outside. Developers can quickly integrate this privacy system using the accompanying SDK and wallet API, catering to the private transfer needs of various ERC-20 assets. STRK20 incorporates a complete compliance process: users must undergo pre-screening before entering the privacy pool; only upon receiving a legally effective formal query request and after an independent assessment, will the platform selectively disclose specific users, corresponding time periods, or designated transfer records, without revealing the private data of unrelated users.
According to Lookonchain monitoring, hackers hacked into the SpaceXAI and Starlink accounts to issue and promote SCATMAN. The hacker's wallets (0xfee...a8ba, 0xdd...ba89) minted 10 trillion SCATMAN and exchanged all of them for 59 ETH, worth $108,000; another wallet under their control also exchanged 59.28 million SCATMAN for 14.7 ETH, worth $27,000. The hackers profited a total of approximately $125,000.
: According to monitoring by on-chain analyst Yu Jin, the hacker (0x18B...E66) who stole funds from a Coinbase user spent 7.378 million DAI early this morning to buy 4,049.7 ETH at a price of $1,822. Meanwhile, the address (0xa13...628) that received ETH from Tornado Cash last November had previously transferred out 4,978 ETH and exchanged them for 16.294 million DAI at a price of $3,273. Today, two hours ago, this address spent 4.34 million DAI to repurchase 2,405 ETH at a price of $1,804.
据链上分析师 Onchain Lens（@OnchainLens）监测，两个疑似属于同一实体的钱包地址以 1159 万枚 DAI 买入 6358枚 ETH，成交均价约为 1823 美元。Onchain Lens 表示，相关资金可能与黑客有关。
According to CoinDesk, the Ethereum Foundation recently disclosed that its security team used AI agents to test the software running on Ethereum validator nodes and successfully discovered a vulnerability that could be triggered remotely, causing node crashes. However, researchers emphasized that amidst the large volume of security reports generated by AI, manual review remains a key step in distinguishing real vulnerabilities from false positives. Reportedly, the vulnerability discovered resides in the Ethereum network message propagation protocol gossipsub, where attackers can remotely trigger the node software into an abnormal computation state, causing the program to crash and shut down, taking the validator node offline until the operator manually restarts it. The vulnerability has been fixed and registered under the number "CVE-2026-34219". Nikos Baxevanis, a member of the Ethereum Foundation Protocol Security Team, stated that the truly surprising aspect of this incident was not the AI's ability to discover vulnerabilities, but the significant amount of time the team spent distinguishing which vulnerabilities were real and which were merely plausible "hallucinations".
According to Lookonchain monitoring, a Solana OG had 181,000 SOL stolen. The hacker sold all 181,000 SOL, bridged the funds to Ethereum, and exchanged them for 7,918 ETH, worth $14.2 million.
: According to on-chain detective Specter's monitoring, the Hedera Network is suspected of being hacked. The attacker has bridged over $3.7 million from the Hedera Network to Ethereum via LayerZero. The stolen funds are currently being swapped from WBTC to ETH. The theft addresses include 0x9A4966152F6e10b33Cb7a37975e8619816d6a494 and 0xaf20D792A19fD42dCf697ceBa6100291D96dD93e.
on-chain detective ZachXBT disclosed in a personal channel post that a whale suspectedly suffered an asset theft a few hours ago, with approximately 180,900 SOL (worth about $14.2 million) being abnormally transferred. ZachXBT stated that he collaborated with another on-chain security analyst, Specter, to analyze the related transactions, identifying unusual unstaking activities and fund transfers from the Solana network across to Ethereum. It is reported that the address belongs to one of Solana's early participants and is associated with the Genesis block allocation. This unusual operation involves a large amount of SOL assets. The specific attack method, destination of the funds, and whether it was due to a private key leak have not yet been confirmed.
researchers from the Ethereum Foundation Protocol Security team said in a blog post on Thursday that they have deployed a series of AI agents to test the software relied upon by Ethereum, searching for vulnerabilities in encryption systems, protocol code, and smart contracts. The vulnerabilities discovered by the AI agents include a remotely triggerable panic issue in the libp2p gossipsub peer-to-peer layer used by Ethereum consensus clients. The issue has been fixed and disclosed on Github as CVE-2026-34219. Researchers stated that the AI agents are organized into specialized roles such as reconnaissance, search, patching, and verification, used to find potential attack paths, reproduce faults, and verify their applicability to production code. The Ethereum Foundation stated that AI has not replaced security researchers but has changed the way they work, enabling the team to cover far more scope than manual review. However, it requires researchers to exercise more careful judgment when evaluating a large number of seemingly credible conclusions. (Decrypt)
Odaily Odaily News According to Onchain Lens monitoring, on July 6, the Summer.fi attacker wallet (0x7BF...b3bdca) received 6.017 million DAI from the Summer.fi attack incident; subsequently, 1.35 million DAI have been transferred, swapped for ETH via Uniswap, and then sent to Tornado Cash through a second wallet (0x46e...eba7). The original wallet still holds approximately 4.67 million DAI, while the second wallet still holds 50 ETH.
Gate 华语官方 X 账号发文披露，针对网传"Gate 被盗 170 万美元"事件，Gate 官方对完整操作时间线进行了还原。7月 4 日至 6 日期间，涉事账户通过活体人脸验证、历史交易记录核验等多重身份验证，完成了手机解绑、谷歌验证码重置、登录密码及资金密码修改等操作；7月 7 日，该账户在一台历史老设备上通过旧 Passkey 登录，随后经全面身份验证完成 5 笔提现，共涉及约 49.96 ETH、746,475 枚 HSK 及 1,565,982 枚 USDT；7月 8 日，用户方才向客服反馈资产被盗。Gate 强调，所有操作轨迹均来源于平台后台完整留存数据，可溯源核验，目前全站用户资产及账户安全。
According to Onchain Lens monitoring, the Summer.fi attacker is actively transferring funds. The relevant address is splitting 6.017 million DAI into multiple small transactions and swapping them for ETH via Uniswap.
According to Lookonchain, the Step Finance attacker, after 5 months of inactivity, sold all 261,933 SOL, worth $21.4 million. The funds were then bridged to Ethereum to purchase 12,128 ETH, which were subsequently deposited into Tornado Cash to launder the money.
decentralized privacy protocol hinkal has released an update on a security incident, confirming that an attacker extracted approximately 797,000 USDC from its Ethereum contract through a series of transactions and exchanged it for about 454 ETH. Of this, roughly 410 ETH was subsequently transferred to Tornado Cash, while the remaining approximately 44.67 ETH was bridged to the Bitcoin network via THORChain. hinkal is currently collaborating with an external security team to trace the flow of funds.hinkal stated that the impact of this security incident is limited to the relevant fund pools on the Ethereum chain, and contracts on other chains remain unaffected. However, all contracts have been temporarily suspended for fixes and security verification. All affected users will be fully compensated at a 1:1 ratio, with specific compensation procedures and timelines to be announced in a subsequent update.
According to Onchain Lens monitoring, the UXLINK hacker swapped $10.54 million in DAI for 6,001 ETH at an average price of $1,757, and subsequently transferred the funds to Tornado Cash.
Ethereum Layer 2 project Taiko has reopened its cross-chain bridge. Taiko stated that the network is now fully recovered, all user funds have been replenished, and it will soon release a full post-mortem report on the vulnerability incident. (The Block)
zero-knowledge scaling company StarkWare has released a Starknet quantum resistance roadmap, stating that the roadmap is divided into three phases to address the risk of future quantum computing attacks. StarkWare CEO Eli Ben-Sasson stated that Starknet can leverage its architectural advantages to achieve quantum resistance, as its underlying cryptography is based on zero-knowledge STARK proofs. According to reports, the first phase of the roadmap includes replacing part of the existing secure mathematical mechanism, Pedersen hash, with a quantum-resistant version, and adding quantum-resistant signatures; the second phase focuses on migration tools, upgrading existing smart contracts without requiring developers to manually rebuild applications; the third phase involves dependencies that Starknet cannot solve alone, primarily relying on Ethereum's quantum upgrade roadmap. Circle, Ethereum, Solana, Tezos, and Algorand have all proposed quantum resistance roadmaps. (Cointelegraph)
Taiko, an Ethereum Layer 2 project, announced that its fix has been reviewed by independent security experts. The mainnet will resume operations in four steps, including: deploying the fix and confirming the chain's final state is correct, ensuring there are no invalid checkpoints or attacker-submitted records that could be accepted; replenishing cross-chain bridge liquidity to ensure all L2 assets maintain a 1:1 reserve; restoring network operations and reopening L2 transfers, swaps, and trading functions; and having the security committee propose lifting the bridge suspension to fully restore asset deposit and withdrawal functionality.Taiko stated that during the initial reopening period, relatively conservative withdrawal limits will be set as an additional security measure, but this is not expected to affect users' normal asset operations.
Aave founder Stani Kulechov has responded to reports suggesting Kraken's parent company Payward is interested in acquiring a 15% stake in the Aave protocol, stating that AAVE is "not going to be sold at a 70% discount."Prior reports from CoinDesk indicated that Payward was in talks to acquire a 15% stake in Aave at a valuation of $385 million. If calculated at this valuation, it would represent only approximately 30% of AAVE's fully diluted valuation, significantly below the market valuation.In a post on X, Kulechov stated that the relevant reports were not entirely accurate. He did not completely deny the possibility of Aave Labs selling a portion of its held AAVE tokens, but noted that Aave Labs does have a certain allocation of AAVE, and that multiple market participants have discussed purchasing either directly or indirectly, or engaging in deeper collaboration centered around long-term partnerships.Aave is the largest decentralized lending protocol on the Ethereum ecosystem. Kulechov stated that Aave currently generates an annualized revenue of approximately $134 million, with the relevant revenue flowing to the Aave DAO. He has also previously proposed a governance plan to redirect revenue from Aave Labs, the protocol, and its products to the Aave DAO and token holders.These rumors emerge at a time when Aave is experiencing certain pressures. Following the Kelp DAO incident in April, Aave's TVL saw a significant decline. Although Aave itself was not directly attacked, the KelpDAO cross-chain bridge attacker utilized Aave to convert the stolen rsETH into other assets.