Web3 attack incidents and security accidents

Slow Fog issued a security warning stating that Aurellion was attacked, resulting in a loss of approximately 455,003 USDC (about $455,000).Analysis pointed out that the root of the vulnerability lies in the lack of effective protection in the initialize(address) function of the SafeOwnable Facet. Since the Diamond contract did not go through the initialize path when setting the owner, the _initialized version slot was not updated correctly, allowing the attacker to reinitialize the contract and override owner permissions.Subsequently, the attacker called diamondCut to inject a malicious Facet and transferred the USDC assets of authorized users through the malicious pullERC20 function, ultimately completing the theft of funds.

According to The Street, the lending protocol Purrlend was attacked on the MegaETH and HyperEVM networks, resulting in a loss of approximately $1.52 million.The attacker extracted about $1.2 million in assets from the HyperEVM network, including 449,683 USDC, 214,125 USDT, 194,745 USDH, as well as some UBTC, wstHYPE, UETH, kHYPE, and WHYPE. The attacker also extracted about $324,000 in assets from the MegaETH network, including USDT, WETH, and USDm.Currently, Purrlend has suspended the protocol and launched an investigation, and the attacker's address has been identified in the block explorers of both networks.

On-chain data shows that the Kelp DAO's rsETH bridging protocol based on LayerZero has allegedly been exploited by hackers, resulting in a loss of 116,500 rsETH, worth approximately $292 million.Kelp DAO officials stated that they have detected suspicious cross-chain activities involving rsETH, and have now suspended the rsETH contracts on the mainnet and multiple Layer2s. They are working with security experts and will provide updates on the situation.