Scan to download
BTC $62,080.49 +1.74%
ETH $1,617.05 +2.78%
BNB $587.22 +1.83%
XRP $1.12 +2.70%
SOL $64.72 +2.67%
TRX $0.3255 +1.57%
DOGE $0.0845 +4.35%
ADA $0.1616 +3.85%
BCH $225.48 +6.83%
LINK $7.69 +4.61%
HYPE $59.71 -0.02%
AAVE $62.75 +2.18%
SUI $0.7536 +7.04%
XLM $0.2096 +7.34%
ZEC $406.05 +8.50%
BTC $62,080.49 +1.74%
ETH $1,617.05 +2.78%
BNB $587.22 +1.83%
XRP $1.12 +2.70%
SOL $64.72 +2.67%
TRX $0.3255 +1.57%
DOGE $0.0845 +4.35%
ADA $0.1616 +3.85%
BCH $225.48 +6.83%
LINK $7.69 +4.61%
HYPE $59.71 -0.02%
AAVE $62.75 +2.18%
SUI $0.7536 +7.04%
XLM $0.2096 +7.34%
ZEC $406.05 +8.50%

abuse

Wintermute warns that EIP-7702 is subject to malicious abuse, and users may be affected by automated attacks

ChainCatcher news, according to TheBlock, Wintermute recently issued a warning that the Ethereum Pectra upgrade may expose users to automated attacks. The EIP-7702 feature (account abstraction improvement) in the Ethereum Pectra upgrade is being maliciously exploited, with over 80% of authorizations being used for automated attacks. Blockchain security company Scam Sniffer recently monitored a user who lost nearly $150,000 due to a phishing attack, where the attacker deployed a copy-paste contract named "CrimeEnjoyor" that can automatically drain wallets with leaked private keys. EIP-7702, proposed by Ethereum founder Vitalik Buterin, aims to enhance user experience by temporarily granting wallets smart contract functionality, including batch processing multiple transactions, sponsoring gas fees, using biometric/social verification, and setting single transaction limits.According to Wintermute's Dune dashboard, the vast majority of EIP-7702 authorizations flow to malicious contracts with similar functions. Security expert Taylor Monahan pointed out that EIP-7702 makes draining addresses "cheaper and easier." Wintermute commented, "It's both absurd and cruel that the same copied bytecode occupies most of the EIP-7702 authorizations."BlockBeats previously reported that SlowMist founder Yu Xian stated that the biggest users of the new Ethereum mechanism EIP-7702 are theft gangs (rather than phishing organizations). EIP-7702 allows for the automatic transfer of funds from wallets with leaked private keys or mnemonic phrases through authorizations, with over 97% of EIP-7702 delegations pointing to theft contracts.

ESMA finalizes guidelines for EU regulators to detect and prevent abuse in the crypto market

ChainCatcher news, according to Finance Magnates, the European Securities and Markets Authority (ESMA) has released the "Final Guidelines on the Regulation of Market Abuse in Crypto Assets," which will be fully implemented within three months after its publication as part of the MiCA regulatory framework.The guidelines require the regulatory authorities of the 27 EU member states to establish a unified market monitoring system, focusing on preventing three types of violations: insider trading, illegal information disclosure, and market manipulation, with a particular emphasis on strengthening the regulation of false information dissemination on social media, blogs, and other online platforms.The document mandates that Professional Trading Firms (PPAETs) must deploy automated monitoring tools and establish a tiered processing mechanism for Suspicious Transaction Reports (STORs).For cross-border regulation, ESMA explicitly requires national regulatory authorities to share regulatory cases involving non-EU crypto firms and to regularly report to ESMA on cross-border cooperation obstacles. It is noteworthy that the guideline development process did not include a public consultation.ESMA explains that, since Article 125 of the MiCA regulation has already provided clear authorization, and the guidelines are aimed solely at regulatory authorities rather than market participants. National regulatory authorities must submit a compliance commitment letter to ESMA within two months, and if they choose partial exemptions, they must specify the details.

Sun Yuchen released the "Seven Deadly Sins" of FDT, including violation of fiduciary duty, abuse of client funds, and more

ChainCatcher message, Sun Yuchen published the "Seven Deadly Sins" of First Digital Trust (FDT) on social media, including: violation of fiduciary duty, misuse of client funds, unlicensed investment activities, fraud or theft, false reporting or concealment of information, violation of anti-money laundering (AML) regulations, violation of Hong Kong POBO regulations. The details are as follows:Crime 1: Violation of Fiduciary DutyAccording to the Hong Kong Trust Ordinance (Chapter 29), trustees must act with care, diligence, and loyalty. Misappropriation of client funds violates Section 4 (reasonable care obligation) and the principles of trust. Clearly, FDT will bear liability for compensation and damages in civil litigation.Crime 2: Misuse of Client FundsThe Securities and Futures (Client Money) Rules (Chapter 571) stipulate that custodial funds must not be used for the custodian's own purposes. Client assets must be held in segregated accounts, and unauthorized withdrawals are strictly prohibited. By transferring TUSD funds to ARIA DMCC without proper authorization, FDT faces enforcement actions, including fines, revocation of licenses, or criminal prosecution.Crime 3: Unlicensed Investment ActivitiesAlthough FDT is registered as a Trust or Company Service Provider (TCSP), it has no SFC license to conduct regulated activities on behalf of clients. Its so-called investment activities involving TUSD assets at ARIA directly violate the provisions of the Securities and Futures Ordinance, which prohibits engaging in regulated activities without a license.Crime 4: Fraud or TheftMisappropriation of funds with the intent to deceive clients constitutes fraud or theft. FDT conspired with accomplices (such as Aria CFF, Truecoin (Alex De Lorraine), Crossbridge/Finaport (Yai Sukonthabhund)) to cover up the misappropriation by falsifying records and claiming to have made false investments.Crime 5: False Reporting or Concealment of InformationTo cover up misappropriation or unauthorized transactions, FDT provided false statements and fraudulent documents, claiming that TUSD funds were intact and invested as instructed. This violates Section 300 of the Securities and Futures Ordinance (using fraudulent or deceptive means in securities transactions).Crime 6: Violation of Anti-Money Laundering (AML) RegulationsBy transferring misappropriated funds through complex transactions or offshore accounts to conceal their source, FDT facilitated and/or constituted a violation of anti-money laundering regulations.Crime 7: Prevention of Bribery Ordinance (POBO)The Prevention of Bribery Ordinance is the primary legislation in Hong Kong governing secret commissions. It criminalizes corrupt transactions, including agents receiving undisclosed benefits or commissions without the principal's consent. FDT/Legacy, under the direction of Vincent Chok, received secret kickbacks from DMCC in exchange for the illegal transfer of TUSD custodial funds.
app_icon
ChainCatcher Building the Web3 world with innovations.