vulnerability

The on-chain security platform Blockaid discovered a vulnerability in the Bitcoin bridge of the cross-chain protocol Symbiosis, where attackers minted approximately 2^62 syBTC to a newly created externally owned account, valued at about 46.1 billion dollars when calculated to 8 decimal places, and sold about 4.39 WBTC on Uniswap V4 on Ethereum, realizing a cash-out of approximately 336,000 dollars.Symbiosis stated that the attack occurred around 4:28 AM on September 11, and the team has suspended the BTC routing, while other routings remain operational and unaffected. The team has recovered about 15 Bitcoins and deposited them into a multi-signature wallet controlled by the team, while offering a 20% white hat bounty on the funds to the attackers, with a deadline of September 13.In recent weeks, Liquid Network, Nomic, and Symbiosis have all experienced security incidents involving the expansion of supply by minting tokens without real asset backing. As of September 13, Symbiosis has not publicly disclosed a technical review of BridgeV2, the final loss amount, or confirmation on whether the attackers accepted the bounty.

According to SlowMist's security alert, the AtomicQueue contract of ether.fi was exploited due to the lack of access control in the solve() function, resulting in approximately 15.45 ETH being stolen.The attacker created malicious requests using updateAtomicRequest(), forcing the victim's address to act as the solver. Subsequently, AtomicQueue called the victim's finishSolve and executed want.transferFrom, abusing the victim's existing ERC-20 authorization to transfer funds. SlowMist has privately disclosed the attacker’s address and the vulnerability contract address to the ether.fi team.

According to Bitcoin News monitoring, DART stated that it, along with independent white hat researchers, has recovered over 50 BTC from wallets affected by the COLDCARD entropy vulnerability, completing the transfer before malicious attackers could steal them. DART is a digital asset recovery organization that collaborates with white hat researchers to protect vulnerable funds and coordinates their legal return to the owners.The white hat researchers did not request a bounty and will return the Bitcoin to the owners. The recovered BTC has been transferred to the Crypto Recovery Trust. This trust is a dedicated statutory trust established under Wyoming state law to hold recovered digital assets and return them after confirming and verifying the legitimate owners.The trust will document the recovery process, separating the BTC from DART and the researchers' funds, conducting blockchain analysis, ownership verification, and sanctions screening, and providing a legal return process for verified owners. If there is a dispute over ownership, or if the related funds are involved in sanctions or criminal proceedings, the BTC will be handled according to applicable legal procedures. DART stated that other vulnerable assets and recovery leads are still under review.

Liquid Network has released the latest update stating that the emergency version Elements v23.3.4 is now online. Functionary nodes have immediately begun upgrading and all Liquid node operators are advised to synchronize updates. This version addresses the previously discovered Proof verification cache vulnerability and strengthens the cache keys used for Range Proof.Regarding network recovery, Blockstream states that it is still formulating a recovery plan, which is expected to proceed in three phases: restoring block production while continuing to suspend Peg operations; replaying verified valid transactions; and restoring Peg operations after the network status is fully restored and funds are confirmed to be returned. Currently, the first two phases are being tested in parallel, and any phase will only advance once safety is confirmed. Liquid Network indicates that Elements v23.3.4 has completed multiple rounds of internal and external reviews, with participants including the Bitcoin Red Team, Alpen Labs, and other teams.At the same time, Liquid Network reminds users to be vigilant against fraudulent upgrade websites exploiting this incident. Information should only be obtained through official Liquid Network and Blockstream channels, and users should never send funds to strangers or disclose private keys or recovery phrases.

Bitcoin News posted on the X platform that Alby confirmed a critical vulnerability exists in Alby Hub v1.7.0 to v1.18.5. If the management API is exposed to the public network, attackers may gain unauthorized access and transfer funds. Currently, it is known that 1 user has been affected, and Alby Hub v1.19.0 and higher versions are not affected.Alby recommends that affected users restrict public access to the management interface, immediately update to v1.24.0, and change the unlock password after the update. Multiple issues reported by Bitcoin Team Red, Project Loupe, and other researchers have also been fixed in the latest version.

According to Bitcoin News monitoring, Liquid Federation released an incident report stating that attackers exploited a cache vulnerability in the Elements range proof verification to mint approximately 4,000 unbacked L-BTC, which were then exchanged for real BTC through the authorized exit anchoring path via SideSwap. The Liquid authority considered the related transactions valid and released approximately 4,000 BTC from the federal reserve.Before the incident, Liquid held about 4,205 BTC, and the minimum reserve dropped to 197 BTC before operations were suspended. The self-identified white-hat attackers have since returned 3,400 BTC, with about 598.5 BTC still unreturned. No private keys were leaked, and the exit anchoring mechanism itself operated as designed. Liquid is currently still offline, and Blockstream is preparing to release an emergency version of Elements v23.3.4 and is working to restore the network with 1:1 Bitcoin reserve support.

According to official news, The Sandbox announced the official opening of SAND compensation claims. Users affected by the cross-chain contract vulnerability incident involving Base and BNB Smart Chain (BSC) networks on August 22, who held bridged SAND on the affected networks before the incident, can receive full compensation in SAND on the Ethereum network at a 1:1 ratio. Eligibility for compensation is based on the on-chain balance snapshot before the incident and is unrelated to any transactions, transfers, or holdings by users after the incident.The Sandbox stated that eligibility for compensation is determined based on the on-chain balance recorded before the contract was compromised. The snapshot for the Base network corresponds to block 50283188 at 23:42:03 UTC on August 21, 2026, and the BSC snapshot corresponds to block 117322025 at 11:42:44 UTC on August 21, 2026.Users holding Base or BSC network SAND through centralized exchanges do not need to take any action, as The Sandbox is coordinating with the relevant exchanges to handle compensation; however, users holding SAND in personal wallets will need to claim it themselves. The claim period is from September 8 to September 22, 24:00 (UTC+8). Claims only require a transaction initiated from the original wallet that held SAND at the time of the snapshot, without the need for token authorization, signing off-chain messages, or transferring to any address.

According to Bitcoin News, Blockstream has notified "white hat" hackers that the vulnerability has been fixed, and 4,000 BTC can be safely returned. The hacker, who previously extracted about 4,000 BTC from the Liquid network, expressed willingness to return the funds but needed to wait for the vulnerability to be fixed. The entire negotiation process was conducted publicly through Bitcoin OP_RETURN messages.The hacker initially proposed to return "most" of the BTC but later changed their stance, requesting that the vulnerability be fixed first: "Please fix the vulnerability first. The latest submitted code puts the chain at risk. Ensure that every node has been patched, and then we will confirm the fix and safely return the funds."The hacker also sent encrypted details of the vulnerability to Blockstream. About two hours ago, Blockstream responded with a PGP-signed OP_RETURN message: "The cross-chain bridge nodes have been patched and can safely return the funds." Currently, 3,998.5 BTC remains under the hacker's control.

According to Slow Mist's warning, two attackers have been detected replicating the recent Notional Finance vulnerability attack method on the BSC chain. The attackers have completed their preliminary preparations and created malicious fCash positions using the same vulnerability pattern. Currently, the attack has not been fully executed, and the malicious positions are awaiting expiration.Once expired, the attackers may settle the positions and withdraw assets from the protocol. Slow Mist strongly recommends that affected projects take immediate mitigation measures to complete protection before the positions expire.

According to the Slow Fog Security Team, they have detected an attack activity disguised as a free VPS service, specifically targeting iPhone Safari browsers running iOS versions 18.4 to 18.6.2.The attackers exploited six vulnerabilities codenamed DarkSword to form a complete attack chain, covering aspects such as WebKit remote code execution, sandbox escape, and kernel read/write, allowing them to obtain App container files and keychain data without user awareness, and to record keyboard inputs when wallets like imToken, TokenPocket, or TronLink are in the foreground.The Slow Fog team stated that the aforementioned six vulnerabilities have now been patched by Apple, and the current attack belongs to the reuse of n-day vulnerability chains. Simply visiting a malicious page does not directly prove that mnemonic phrases or private keys have been stolen; confirmation still requires device forensics. iOS/iPadOS users are advised to upgrade their systems to version 18.7.3 or 26.3 and above as soon as possible.

According to the Securities Times, at the Fourth Cybersecurity (Tianjin) Forum, Zhou Hongyi, the founder of 360 Group, gave a keynote speech, stating that AI has changed the landscape of cyber offense and defense, and traditional solutions are difficult to sustain. He emphasized the need to create a new automated offense and defense system centered on "model governance," using AI capabilities to address AI risks, ensuring the safety of large models, the reliability of generated content, and the credibility of output results.Zhou Hongyi also proposed that there should be lifecycle management for intelligent agents, establishing an auditable, intervenable, and interruptible control mechanism, and called for the cybersecurity industry to quickly form a system for AI vulnerability discovery, automated defense, and intelligent agent security.

According to SlowMist's monitoring, the GebProxyActions contract suffered a loss of approximately 5.9436 ETH due to a lack of caller access control. Affected users previously called GebProxyActions.quitSystem directly instead of through a DSProxy delegated call, resulting in ownsSAFE[safe] being set to the GebProxyActions contract.The attacker directly called GebProxyActions.quitSystem(manager, safe, dst), bypassing the safeAllowed check of GebSafeManager and transferring the collateral to themselves.

Balancer posted on platform X that the team discovered a vulnerability in the legacy Balancer v1 contracts that allows for the depletion of LP funds. These pools are deprecated and cannot be paused, and users are advised to withdraw funds proportionally through legacy.balancer.fi. Other Balancer products are not affected.

The Cronos network has resumed and restarted block production after pausing operations to protect users from the vulnerabilities of the Tectonic protocol. A complete post-incident analysis report will be released soon.

Flow blockchain officially announced that at approximately 06:18 UTC today, there was a vulnerability in Ankr's ankrFLOW liquid staking contract, allowing attackers to create about 8.6 million uncollateralized ankrFLOW. This is not a vulnerability of the Flow EVM or the Flow protocol and does not affect the Flow token economics.The attackers subsequently used ankrFLOW as collateral to deplete approximately 15.5 million WFLOW reserves on the MORE Markets lending protocol, valued at about $410,000, and made a profit of about $246,000 after slippage. Some reports incorrectly stated that the impact was around $9.3 million. Ankr and MORE Markets have suspended the related contracts, and some exchanges have proactively suspended FLOW deposits.The Flow Foundation will work with Ankr to replenish the stolen WFLOW reserves and rebalance the liquidity pool. The Flow network is operating normally, and ankrFLOW staking and MORE Markets lending will be suspended until Ankr deploys a fix upgrade. User funds are safe, and no action is required.

Cronos Network officially announced that the network has resumed block production and is fully operational again. Previously, Cronos paused block production due to a vulnerability exploitation incident involving the Tectonic protocol, and validators took emergency consensus measures to protect user funds, rolling back the chain state to before the Tectonic vulnerability exploitation on August 30.The network has resumed block production at UTC time August 30, 23:49:01 from block height 90,896,189. Cronos stated that node operators can now restart their nodes using Cronos v1.7.8 and the latest mainnet snapshot.The network is currently under continuous monitoring, and some protocols, RPC service providers, block explorers, and cross-chain bridges are expected to take longer to recover. Cronos stated that the team will release a complete event review report after confirming network stability.

Balancer announced that a vulnerability was found in the old Balancer v1 contract, which could lead to LP funds being drained.The related liquidity pools have been deprecated and cannot be paused, and users are advised to withdraw their liquidity as soon as possible. Other Balancer products are not affected.

Blockstream stated that Jade is not affected by the Coldcard random number generator vulnerability and has released firmware 1.41 after receiving extensive AI-assisted security reviews. Jade indicated that it has undergone dozens of automated AI scans and multiple manual reviews, focusing on sensitive areas such as random number generation and transaction signing.The new firmware enhances stack protection, updates dependencies, audits sensitive memory cleanup processes, and upgrades the Jade runtime environment. Blockstream claims that Jade's random number generation mechanism uses multiple entropy sources, including hardware chip noise, timing data, sensor data, and camera noise, and mixes them using SHA-512 to prevent a single entropy source failure from affecting seed generation. The team stated that other lower-severity findings are still being addressed, and firmware 1.42 is expected to be released in a shorter development cycle.

Polygon disclosed multiple previously undisclosed security vulnerabilities recently fixed through two hard forks, Austin and Kyoto, which could affect its proof-of-stake network. The vulnerabilities involve Polygon's Bor and Heimdall clients, including denial-of-service risks, validator resource exhaustion, and defects affecting checkpoint and milestone processing.Polygon stated that the fixes were privately tested before being deployed to the mainnet and publicly disclosed. The most severe issue involved Heimdall, where carefully crafted transactions could force validators to perform excessive processing work, disrupting the network. The Austin hard fork also fixed two denial-of-service risks in Bor that could slow down block processing or cause node crashes. Polygon indicated that these vulnerabilities were not exploited on the mainnet, and the fixes were proactively completed before the details of the vulnerabilities were made public.

Polygon disclosed multiple previously undisclosed security vulnerabilities that were recently fixed through two hard forks, which could affect its proof-of-stake network. The vulnerabilities involve Polygon's Bor and Heimdall clients, including denial of service risks, validator resource exhaustion, and defects affecting checkpoint and milestone processing.Polygon stated that these vulnerabilities were fixed through the Austin and Kyoto hard forks, and the fixes were privately tested before being deployed to the mainnet and publicly disclosed. The most serious issue involved Heimdall, where a carefully crafted transaction could force validators to perform excessive processing work, thereby disrupting the network. The Austin hard fork also fixed two denial of service risks in Bor that could slow down block processing or cause node crashes.Polygon indicated that these vulnerabilities were not exploited on the mainnet, and the fixes were proactively deployed before the details were made public. Nodes running outdated client versions have fallen out of consensus after the hard fork activation height and must upgrade to rejoin the standard network. All Polygon PoS nodes are required to upgrade to Bor v2.1.0, and validators and full nodes must upgrade to Heimdall v0.11.0, both upgrades are now effective on the mainnet.