cross-chain

Blockaid has released two attacker addresses, example attack transactions, affected contracts, and cross-chain bridge addresses. One of the attacker addresses (0xaCA0...5718) currently has a balance of approximately $11,000.

Zilliqa stated that the investigation into the recent security incident is still ongoing, with affected components including the X-Bridge and certain liquidity pools using ZRC2 proxy contracts, involving tokens such as zUSDT, SEED, kUSD, and Zoge.Zilliqa emphasized that the native ZIL and Zilliqa EVM network were not affected, and the X-Bridge will remain suspended; users are advised not to use the cross-chain bridge and the affected liquidity pools for the time being.

Iron Fish stated that the team is investigating the abnormal issuance of wIRON on the Base network and has requested the cross-chain bridge service provider ChainPort to conduct an urgent review.Before further notice, users should avoid purchasing wIRON on Base or using the related cross-chain bridge. Iron Fish warned that it cannot currently guarantee that wIRON has 1:1 full asset backing and stated that it will announce further developments after verifying more facts.

The Ethereum Layer 2 network Blast has reached the withdrawal interface deadline, but approximately 40 million dollars worth of assets are still stranded in the cross-chain bridge.The official contract-level exit guide has been released, but withdrawals still require proof submission and a one-day wait; for USDB holders, a separate DAI claim is also necessary.

Cysic released an update on the cross-chain bridge security incident, stating that it plans to destroy 7.2 million CYS from the foundation's reserves by the end of October to offset the impact caused by unauthorized issuance and to realign the token supply with its token economic model.

Cross-chain trading application Fomo recently announced the official public launch of its self-built internal cross-chain bridge (Fomo Bridge) and router. Official data shows that after integrating the self-built system, its cross-chain transaction confirmation time is less than 1 second, and the transaction execution speed is 50% faster than existing market solutions.Fomo stated that its internal router can average optimize execution prices by 0.5% and optimize the worst-performing 10% of transactions by over 2%. Currently, Fomo's cross-chain trading volume is more than 10 times that of other trading applications. As a large cross-chain trading application that possesses both a cross-chain bridge and routing system, Fomo has thus gained control over the entire trading stack, including pricing, indexing, bridging, and routing, ensuring that users can still achieve a fast and low-cost trading experience even in extreme market conditions.

GMGN co-founder Haze stated that GMGN's self-developed cross-chain bridge is currently undergoing a small-scale rollout test, focusing on ensuring the speed, security, and stability of transactions.Haze mentioned that after this feature goes live, users will be able to directly use USDC within the GMGN App to purchase tokens on multiple blockchains.

According to CoinDesk, Ben Edgington, the coordinator of the Ethereum rapid finality research direction, along with several researchers, submitted a draft proposing to reduce the transaction finality waiting time from about 16 minutes to about 4 minutes, improving it by approximately four times.The current goal is to push this draft into the formal upgrade proposal process. The core idea of the draft is to separate the original "block selection" and "finality confirmation" mechanisms of validators, allowing finality to progress at a faster pace and facilitating future adoption of quantum-resistant signatures.Faster finality is expected to reduce the costs incurred by cross-chain transfer services due to capital occupation. The Ethereum Foundation's research provides an example: if a service advances about 1 million dollars per hour, under a 16-minute delay, approximately 267,000 dollars would be pending recovery, which could be reduced to about 67,000 dollars after shortening to 4 minutes.

The co-founder and Chief Operating Officer Alon of the meme coin issuance platform Pump.fun stated that the team had previously focused on launch pads for a long time and only began supporting cross-chain exchanges about 5 months ago. After investigating the cross-chain service provider Relay used at that time, he noted that over one-ninth of cross-chain purchases on Relay encountered errors, with typical purchase landing times close to 4 seconds, and one-tenth exceeding 7 seconds. The number of tokens users received was usually less than expected. He also mentioned that the social trading application FOMO still relies on Relay.Alon stated that the self-developed cross-chain bridge Pump Bridge has been opened to all Pump.fun application users. Compared to Relay, the purchase landing speed has improved by 2 times, and the error rate has decreased by 92%, dropping from over one-ninth to less than one percent. Users can obtain more tokens on average with the same amount of funds, and currently, no additional cross-chain fees are charged. He mentioned that due to the limitations of light speed and target chain confirmation time, the theoretical fastest landing time for purchases is about 1.1 seconds, and the team is still working to reduce the remaining gap.The above comparison comes from random tests conducted in the Pump.fun mobile application from September 28 to October 7, covering Robinhood, BSC, Base, Arc, and Ink, excluding Ethereum, with a total of 416,669 transaction results recorded. Among them, 383,326 transactions recorded the time taken from click to successful prompt, and an additional 35,333 transactions of completed USDC purchases under $500 were used for comparison. Alon also stated that the platform fee rate is 0.45%, with Callout rewards of at least $300,000 daily, totaling about $20 million over two months, and the platform does not retain platform fees.

Cross-chain stablecoin bridge Cashmere announces expansion plans, with the automated liquidity product Goat LP set to open to all users, followed by the launch of the main product Mountain and the token $CSM. Cashmere Bridge currently supports zero-slippage stablecoin transfers across 16 chains, and Goat Street features 6,666 goat NFTs on the Robinhood Chain. The team states that there is currently no official $CSM, and the related arrangements are part of the current plan and may change.Goat LP targets Uniswap v3 and v4 positions on the Robinhood Chain, with positions remaining in users' wallets as Uniswap NFTs. Automatic reinvestment incurs a 10% reinvestment fee, with Gas covered by the project team; automatic adjustment of ranges and automatic exits both incur a 0.15% fee. The official description refers to it as experimental software. The Mountain code has completed testing and will undergo external auditing before going live. Barn is a soulbound NFT with a maximum of 10 slots, and after issuance begins, new $CSM will be distributed every second. Goat NFTs can be permanently bound to receive issuance shares and cannot be sold or withdrawn after binding.The plan is to issue 1,000 founding Barns, with a guaranteed slot price of 0.125 ETH, whitelist at 0.25 ETH, and public auction prices dropping from 1.5 ETH to 0.25 ETH. $CSM will begin trading through the official Uniswap v4 ETH pool, while market making and tokens on Anvil have been canceled and redeployed due to technical issues. The maximum supply is planned at 666 million, with 10% allocated for official pool liquidity, 25% for the team and treasury with designated ownership, and 65% issued as the system operates. The team also plans to airdrop to Barn participants, Goat Street activators, and early users, with wallets that have listed goat NFTs on OpenSea being excluded.

On October 17, ILITY announced on platform X that a security incident occurred with the ILITY Network, and the ILITY cross-chain bridge has been temporarily closed. They are cooperating with law enforcement agencies, cryptographic forensic experts, and investors to investigate, and have not yet disclosed the amount of losses or details of the attack.On-chain analyst Specter stated that they observed a certain wallet transferring approximately 35,700 ZEC (worth about $41 million at the time) from a privacy pool, which was then transferred to the Bitcoin and Ethereum networks via NEAR Intents and multiple addresses. Their tracking suggests that the related addresses are associated with the ILITY cross-chain bridge and claim that approximately 4.1 million ILY tokens flowed out of that bridge. Due to the privacy features of Zcash, it has not yet been confirmed whether this ZEC belongs to stolen funds or its exact relationship with the ILITY incident.

The decentralized computing network Cysic released an event report on platform X stating that its cross-chain bridge was attacked on Saturday. The attacker exploited a processing vulnerability to unauthorizedly mint 10 million CYS on the BNB Smart Chain, and the cross-chain bridge has now been suspended. Preliminary investigation results indicate that the attacker accessed the database supporting the cross-chain bridge without authorization.The report shows that the minting occurred at 12:31:38 UTC, and Cysic added the receiving address to the token contract blacklist at 13:47:52. At that time, the address still held approximately 2.8 million CYS, and transfers have been restricted. Cysic stated that this incident was limited to the message processing and minting aspects of the cross-chain bridge and did not affect the mainnet or other operational systems, nor did it result in the theft or unauthorized transfer of CYS or other assets already in user wallets.Cysic emphasized that the quantity of minted tokens alone cannot determine the final dollar loss, and related token transfers, exchanges, and actual losses are still under verification. The company has hired a security agency and plans to release a follow-up report after the current investigation phase concludes. CYS is used to coordinate incentives for users, computing power providers, governance participants, and contributors within the Cysic network.

According to the official event report from UNCX Network, on October 14, attackers exploited a set of public vesting operations of Smart Token Vesting V2, creating a discrepancy between the token balance in the pool and the recorded shares, allowing the controlled positions to withdraw excess tokens.The attack affected four networks: Ethereum, BNB Chain, Base, and Robinhood, involving 10 tokens and a total of 11 confirmed withdrawal transactions, with a verified economic value of approximately $807,609, of which about $567,500 was from the BNB Chain. The involved calls did not use administrator privileges.After the incident, white hats returned 82,143,476 X tokens and 23.8682 ETH, and currently, there are no significant tokens pending disposal. UNCX stated that it is working with legal advisors to review technical evidence and subsequent handling.

The cross-chain exchange protocol NEAR Intents released a post-mortem report attributing a $3.8 million vulnerability to a flaw in the deposit notification feature. The protocol deploys a public settlement contract on NEAR that maintains an internal ledger of deposited tokens, while withdrawals transfer tokens out via a cross-chain bridge. The report was published by NEAR Intents General Manager Alex Shevchenko on October 16, stating that the attacker withdrew $3.8 million before the protocol was shut down on October 1 and returned all funds within 36 hours of detection, with all affected users fully compensated.The report indicates that the feature notifies third-party contracts when tokens are deposited. The attacker created a contract that intentionally caused the notification to fail, allowing the token contract to refund the deposit while NEAR Intents retained the corresponding ledger credit. Through 23 failed deposit transactions, the attacker accumulated $3.8 million in unsupported balance, referred to in the report as ghost funds, and subsequently withdrew real tokens based on this and transferred them to other chains via the Omni infrastructure. Shevchenko stated that this was a vulnerability in the NEAR Intents contract, not in the Omni infrastructure.Withdrawals occurred between September 29 and October 1. The settlement contract was paused and reopened on October 1, with affected routes gradually restored, and contract-side deposits resumed on October 2. The report noted that the vulnerability went undetected because monitoring only compared the original chain assets with the total balance of NEAR side tokens, without comparing the total internal user balances with the actual tokens held by the contract; the team has since added this check and will automatically pause the contract when there is a balance inconsistency. The fix for the October vulnerability was deployed on October 2, but another serious vulnerability report regarding the same feature prompted its complete removal on October 7, with the relevant researcher receiving a $300,000 reward.

According to Bitcoin.com analysis, the U.S. prediction market platform Kalshi saw a single-day nominal trading volume of up to $3.9 billion over the weekend, with combo bets contributing about 70% of the weekend's nominal trading volume.The analysis also pointed out that nominal trading volume measures the face value scale of contracts and does not equate to the actual cash invested by buyers, nor does it represent the number of new users on the platform. Therefore, this metric cannot directly reflect Kalshi's actual capital inflow or user growth situation.

The Bitcoin financial application Mezo announced that the cross-chain withdrawal deadline for swBTC and USDe is October 13, and the withdrawal for SolvBTC and xSolvBTC will continue until October 29. Currently, the recharge for the above four tokens has been suspended.Mezo is developed by the Thesis team, which has been deeply involved in the Bitcoin ecosystem for over 10 years and has launched products such as tBTC, Fold, and Taho. Mezo is positioned as a Bitcoin financial application, providing users with loans collateralized by Bitcoin, a yield vault supported by Upshift Finance, and a native stablecoin MUSD that is 100% backed by Bitcoin reserves.

On October 13, 2026, the real-world asset market HyperDex announced the launch of a spot and perpetual contract aggregator, placing spot routing, cross-chain transfers, and the newly announced perpetual aggregation on the same interface. The announcement did not disclose the trading volume upon launch, and the perpetual section did not specify the venue, supported contracts, collateral rules, or liquidation mechanisms; the product is currently labeled as beta.The interface provides quotes for each exchange and cross-chain transaction between exchanges, cross-chain bridges, and intent resolvers; users sign with their own addresses, and funds are routed through audited contracts to the selected target, with the platform not holding custody. The team claims to have integrated with LI.FI, RIFT, Enso, Ravn, and specifically mentions Relay, Across, NEAR Intents, Chainflip, among others, totaling over 70 venues and more than 19,000 tokens, including tokenized stocks, gold, government bonds, and credit issued by Ondo, Backpack, Coinbase, Robinhood, etc. The supporting chain documentation states that routing covers 69 mainnets, 36 bridges, and 39 exchanges, including EVM, Bitcoin, Solana, Sui, and Zcash.After selecting tokens, chains, and quantities, the system requests quotes and sorts them by the best price or fastest completion, refreshing quotes every 20 seconds. Before signing, it displays the minimum received amount, network fees, HyperDex fees, and estimated completion time; standard transfer fees are 0.50%, private exchanges are 0.75%, and protocol fees are deducted from the sent tokens. On-chain settlements are reportedly completed atomically, and any slippage beyond the limit will roll back; if a cross-chain bridge is completed but the target chain exchange fails, users will receive the bridged assets on the target chain. The routing contracts are claimed to be audited, open-source, and have a bug bounty program.

According to official news, Payy announced the initiation of the compensation process for affected users regarding the cross-chain bridge contract theft incident on September 24, with a claim application window of 30 days. Compliant claims will be compensated in the form of USDC on the Ethereum network.At the same time, Payy Wallet is currently in a suspended state and will be completely shut down after the compensation window ends.

The cross-chain exchange protocol THORChain officially announced that its native token RUNE has been 100% unlocked. The official statement indicated that the supply of RUNE has been continuously decreasing, starting with 1 billion tokens, which later dropped to 500 million. In May, based on ADR-023, 64.4 million RUNE were destroyed from reserves, further reducing the supply to 360 million.The official also introduced the system's revenue distribution. Nodes must bind RUNE to ensure the security of THORChain and receive 59% of the system's revenue, which comes from the fees paid by users during cross-chain exchanges. An additional 20% flows into the protocol's own liquidity, and every 3 days, the protocol deposits RUNE into the liquidity pool with the highest relative depth of fees, half of which is retained in the form of RUNE and held by THORChain.

The blockchain security platform Phalcon stated that approximately 6 hours ago, around 3.55 million dollars of unclaimed cross-chain funds were claimed and transferred. Phalcon raised the question: Was the related transaction initiated by the fund owner, or did the attacker obtain valid EIP-7702 authorization?On-chain information shows that the claim was submitted by address 0x24a9, with funds coming from Tornado Cash and executed through EIP-7702 delegation on an external account. The two transaction amounts were 1.33 million dollars and 2.22 million dollars, with on-chain data confirming the validity of the related authorization.A few days ago, on-chain researcher stuckfunds.eth repeatedly sent messages to address 0x4943, informing the owner that the related funds were still claimable. Currently, on-chain data cannot confirm whether the owner intentionally signed, was induced to sign, or if the private key has been leaked.