BlockSec

1/3 USDT has been quietly unfreezing addresses that @circle's USDC still has frozen. In multiple cases, funds moved directly to @Binance within hours of removal.

.@KelpDAO was reported attacked hours ago, with total losses estimated around $290M. Based on community on-chain analysis (e.g., @banteg), the likely root cause is a compromise of the configured DVN/verifier on the Unichain→Ethereum rsETH bridge route: the route relied on a 1-of-1 check, which may have let a forged/unbacked bridge message pass verification and trigger a drain from the protocol's rsETH Adapter. The exploiter then deposited rsETH into Aave/Compound/Euler and borrowed roughly $236M in assets (WETH, wstETH, WBTC), which is the attacker’s tracked profit so far. @aave has frozen rsETH markets (V3/V4). The incident is still under investigation. The main risk now is contagion: thin rsETH liquidity could turn collateral exposure into bad debt.

2/ The Ethereum Security Subsidy Program is proud to be launching with access to 20+ of the leading audit providers active in the Ethereum ecosystem: @AdevarLabs, @bailsecurity, @BlockSecTeam, @Certora, @chain_security, @cyfrin, @dedaub, @GuardianAudits, @hackenclub, @HackenProof, @Hashlock_, @hexens, @immunefi, @LeastAuthority, @lethalspoons, @NethermindSec, @Quantstamp, @QuillAudits_AI, @rv_inc, @SecurityOak, @sherlockdefi, @spearbit, @statemindio, @zellic_io, and @zokyo_io. These top-tier security providers make the program possible through their commitment to support Ethereum mainnet.

ALERT! Our system detected suspicious transactions targeting tokens managed by @hyperbridge’s HandlerV1 contract on #Ethereum, with estimated losses of ~$242K. The likely root cause is a Merkle Mountain Range (MMR) proof replay vulnerability caused by missing proof-to-request binding. This flaw allows an attacker to replay a previously accepted proof and pair it with a newly crafted request, enabling privileged actions (such as changing admin permissions) for profit. Specifically, in HandlerV1, replay protection only verifies that a request commitment (request.hash()) has not been used before. However, the proof verification process does not bind the submitted request payload to the validated proof. Because of this disconnect, a valid historical proof can be reused with a different malicious request. For example, in the transaction with the largest loss observed so far, the attacker changed the admin of the #Polkadot (#DOT) Token, then used admin privileges to mint #DOT and profit by swapping the newly minted tokens. app.blocksec.com/phalcon/explor… Other Attack TXs: • app.blocksec.com/phalcon/explor… • app.blocksec.com/phalcon/explor… • app.blocksec.com/phalcon/explor… • app.blocksec.com/phalcon/explor… • app.blocksec.com/phalcon/explor… • app.blocksec.com/phalcon/explor… • app.blocksec.com/phalcon/explor… 🟦 Found by #PhalconSecurity, 🟦 Analyzed via #PhalconExplorer.

We’re excited to announce a strategic partnership between @InterlaceMoney and @BlockSecTeam, a leader in blockchain security. Together, we’re advancing the future of stablecoin payments by collaborating on security across the entire transaction lifecycle. By combining Interlace’s payment infrastructure with BlockSec’s cutting-edge security solutions, we aim to enhance real-time monitoring, risk evaluation, and on-chain safety,especially on agentic payment field. This partnership reinforces our shared commitment to building a more secure, trustworthy foundation for institutions and individuals in the next digital financial system driven by AI. #AI #AIAgent #Web3 #interlace #digitalpayments #agenticpayments #aipayments