vulnerability

The official announcement from the Zcash (ZEC) Foundation states that independent security researcher Taylor Hornby discovered a serious reliability vulnerability in the Orchard zero-knowledge proof circuit on May 29, which could allow double spending within the Orchard pool.Core engineers from ZODL confirmed the issue within hours and initiated a fix. To buy time, they temporarily disabled Orchard operations through an emergency soft fork of Zebra 4.5.3 in the early hours of June 2. Finally, today, they activated the NU6.2 hard fork through Zebra 5.0 — at 12:05 PM Beijing time, the mainnet successfully completed the upgrade at block height 3,364,600, re-enabling Orchard with the corrected circuit, and the vulnerability was permanently closed.This is the second time Zcash has triggered a protocol upgrade due to security issues since its launch in 2016, with no known exploits occurring during the process. The network's total supply guard mechanism confirmed that the total supply remained intact, and user privacy, as well as Sapling and transparent transactions, were not affected.

The Zcash Foundation announced the release of the Zebra 4.5.1 version update to fix a consensus-level security vulnerability and strongly recommends that all node operators upgrade immediately.The vulnerability, identified as GHSA-2prc-cj5x-4443, involves a sigop (signature operation count) statistical error in P2SH transactions, which could lead to potential consensus fork risks. This fix corrects the incomplete patch issue from the previous 4.5.0 version, which was just released yesterday.The Zcash development team stated that the problem originated from discrepancies in sigop counting logic across different implementations, which could cause nodes to produce different results when validating transactions, thereby affecting on-chain consensus consistency. The fix was implemented by reverting and adjusting the Rust implementation logic to ensure alignment with the expected behavior of the protocol.The Zcash Foundation emphasizes that there is currently no workaround for this issue, and upgrading to 4.5.1 is the only way to ensure that nodes remain on the correct chain and avoid potential fork risks.

According to The Block, Gnosis co-founder and CEO Martin Koppelmann confirmed that the Zodiac delay module related to Gnosis Pay is currently under exploitation. Attackers can initiate transactions from Safe wallets that integrate this module, and Gnosis has requested cross-chain bridge validators to pause to control the risk.Koppelmann stated that Gnosis will cover all user losses and will remove the previous announcement urging users to urgently withdraw EURe and GNO, noting that most users are unable to withdraw their tokens independently. The team is working to control most of the losses and ensure that all users receive full compensation. Gnosis emphasized that the vulnerability is within the Gnosis Pay system, and the core contracts of Safe are unaffected.

DxSale.Network posted on platform X in response to a previous security incident, revealing that the recent vulnerability originated from the newly launched atomic swap feature on the Binance Smart Chain (BSC), affecting the v1 lock-up contract that was launched in 2021.The team has identified the source of the issue and stated that the v2 and above versions of the lock-up contract are completely secure and have passed the Certik audit. Users can rest assured that assets locked in v2 and above are not affected.

According to SlowMist monitoring, the ONTR token contract has an access control vulnerability due to the onlyOwner modifier, resulting in a loss of 49.4801 WETH, worth approximately $98,000. The attacker (0xe806...b760) exploited this vulnerability by calling transferOwnership() to set the attacker contract as the owner when the owner was address(0) through permission checks, then called desertJasper() to add hidden balances to the queue, and subsequently called glenFlash() to execute ashBud(), directly increasing the address balance by 1e30 basic units without increasing the totalSupply. The attacker transferred the inflated tokens to PancakePair (0xd46d...83fd) and exchanged them for WETH through swap().

CryptoQuant analyst MorenoDV_ pointed out that Bitcoin's recent price trend has shown a dangerous divergence: the Taker buy volume on Binance has continued to decline, reaching a low not seen in months, indicating a significant weakening of the market's willingness to buy actively; meanwhile, the funding rate on Binance has risen back into positive territory, suggesting that traders are increasing their long positions through leverage.Historical patterns show that when the funding rate rises while spot demand simultaneously shrinks, it often signals that the market is entering a later stage of speculation—leverage-driven trends lack support from spot capital, making them structurally fragile. If buying pressure does not effectively rebound, the current high funding rate may reflect more potential risks rather than market strength.

The founder of Slow Fog, Yu Xian, posted on the X platform to interpret the Squid security incident. He stated that sampling found that the related Safe wallets were all single-signature, and the owners were all different, but the issue was not with the private keys; the problem lay in the modules (SquidRouterModule) used by these Safe addresses, which had vulnerabilities. Attackers could forge messages, easily bypass relevant validations, and initiate subsequent exchange operations to transfer funds from the target Safe wallet. In addition, Yu Xian also disclosed information about the address where the attackers' profits were deposited.Previously, it was reported that a third-party Gnosis Safe module was exploited on Base and Ethereum, resulting in a loss of approximately $3.2 million, with the victims being 86 Gnosis Safes that had added this contract as a trusted Safe Module. The contract was named "SquidRouterModule" on Basescan, and subsequently, Squid clarified that it was not affected by the Gnosis Safe-related vulnerability incident.

According to GoPlus analysis, the stablecoin protocol StablR had security issues with its multi-signature contract settings on Ethereum (multi-signature threshold of 1), and the holder's private key was stolen, resulting in StablR $EURR and $USDR stablecoins being depegged by 20%. The attacker has profited approximately $2.8 million.

The latest market intelligence report released by the digital asset trading firm Wintermute shows that global financial markets are undergoing a large-scale macroeconomic repricing, with the market narrative shifting from discussions about the timing of interest rate cuts to preparing for potential rate hikes. This structural shift has been triggered by unexpectedly strong economic data and reignited inflationary pressures, creating significant headwinds for digital assets.The report notes that Bitcoin saw a sharp decline after briefly breaking through $83,000, giving back significant gains within a week, while mainstream alternative tokens experienced double-digit percentage drops. Global wealth managers are actively de-risking under macro constraints, highlighting the fragility of digital asset expansion. On-chain trading indicators suggest that the previous price increases were not driven by genuine spot market demand or organic retail accumulation, but rather primarily from short squeezes in the perpetual futures market.The total open interest in Bitcoin derivatives rapidly expanded by $10 billion to $58 billion within a month, while the underlying spot trading volume simultaneously fell to a two-year low. When Bitcoin broke through $80,000, a large number of short positions were forcibly liquidated, triggering a brief buying frenzy, but failed to establish a lasting structural bottom.The main driving factor behind the current market reversal is that global CPI data continues to exceed expectations, reigniting widespread concerns about interest rate hikes. At the same time, ongoing uncertainty surrounding the nomination of the next Federal Reserve chair has injected unpredictability into the market. Despite long-term positive signals, including a recent net inflow of $623 million into spot ETFs and Bitcoin reserves on trading platforms dropping to a seven-year low, Wintermute emphasizes that these long-term trends are insufficient to alleviate recent structural risks.As international asset managers shift capital towards short-term sovereign debt instruments, digital platforms are struggling to maintain momentum. The near-term outlook for the tokenized market will depend on whether genuine spot buyers return to stabilize the weak liquidity gap.

Verus posted on the X platform confirming that the Verus-Ethereum cross-chain bridge has been attacked, with ETH, USDC, and tBTC stolen from the Ethereum chain contracts. Currently, other bridged assets have not been affected. The Verus network has now suspended operations, and most block-producing nodes have proactively gone offline after experiencing the impact of the attack. The development team is working hard to investigate the scope of the incident, the attack path, and subsequent handling plans, and will announce progress after confirming more information.Verus stated that it is willing to cooperate with relevant law enforcement agencies to pursue legal responsibility; however, if the attacker returns the full amount of funds, the project team is willing to offer a bug bounty and will not pursue further accountability. Verus also reminds anyone claiming to be a member of the Verus team or community in public channels, private messages, or other channels and offering "compensation" or "reimbursement plans" to be scammers. The official emphasizes not to interact with anyone claiming to have compensation projects or offering reimbursement, and to report relevant accounts to Discord or the X platform in a timely manner.Previously, the Verus Ethereum cross-chain bridge was attacked, resulting in a loss of approximately $11.58 million.

THORChain released an update on the hacking incident on platform X. Preliminary evidence suggests that a node that recently joined the network may have been controlled by a malicious operator, who exploited the GG20 TSS vulnerability to obtain key information from vault participants, ultimately reconstructing the vault private key and executing unauthorized withdrawal transactions. Currently, multiple THORChain nodes have been shut down, resulting in the network being in a paused state. RUNE transfers are expected to resume in about 12 hours, but the specific situation will depend on node decisions. Functions such as trading, liquidity provider operations, and signing are still unavailable, and a full restoration of network functionality is expected to take several days. Recovery plans are under discussion and may include reducing the staking of affected nodes, as well as other remedial measures proposed by the community.

Aave officially announced an update to its bug bounty program to better match the risk characteristics of various parts of the ecosystem and simplify the review process. According to the latest adjustments, the bounty cap for critical bugs in Aave V4 and Core Aave V3 has been increased to five times the original amount.Aave Labs also proposed a reorganization of the bounty framework, placing different subsystems under the management of platforms such as Immunefi, Sherlock, and Cantina. The core components such as Core Aave V3, V2, and GHO will continue to be managed by Immunefi; Aave V4 and Aave App Stack will transition to Sherlock; and Aave V3 on Aptos will be managed by Cantina.

Block's Bitcoin open-source development department Spiral has launched a free AI vulnerability scanning tool Loupe for open-source Bitcoin projects, supporting continuous security scanning, aimed at helping small and medium-sized development teams enhance their security auditing capabilities.

The Chief Information Security Officer of Slow Fog, 23pds, disclosed that a privilege escalation vulnerability named Dirty Frag has been exposed in Linux systems, with complete details and exploit code now public. This vulnerability allows any local low-privilege user to directly obtain root privileges on almost all mainstream Linux distributions. It is classified as a deterministic logic flaw, and the attack does not rely on complex race conditions, resulting in a very high success rate without causing kernel crashes, posing significant danger. Linux users are advised to upgrade their systems promptly.

According to CoinDesk, Aave Labs will rewrite the asset listing and collateral risk control rules. In addition to the existing price and volatility assessments, new reviews will be added for compatibility, network security, and underlying architecture, and minimum standard guidelines will be published for asset issuers.This move stems from the KelpDAO cross-chain bridge attack in April, where hackers minted approximately $293 million worth of unbacked rsETH and borrowed real wETH on Aave as collateral, resulting in hundreds of millions of dollars in bad debt for the protocol. Aave will also shift from a single pool perspective to studying systemic connections between different DeFi protocols to reduce cross-protocol risks and is calling on other DeFi projects to follow similar standards.

According to Protos, Bitcoin Core developers recently disclosed a high-risk vulnerability numbered CVE-2024-52911, which affects versions 0.14.1 to 28.4, allowing miners to remotely crash other users' nodes and execute code by mining specially crafted blocks.The vulnerability was discovered and responsibly disclosed by developer Cory Fields in November 2024. The fix was merged in December of that year and released with version v29 in April 2025. The last vulnerable 28.x version series was discontinued on April 19, 2026.However, since upgrading Bitcoin full nodes is voluntary, it is estimated that about 43% of nodes are still running the vulnerable old version software, facing potential risks. Fortunately, the cost of implementing such an attack is extremely high—miners would need to allocate significant computational power to mine invalid blocks that do not yield block rewards—so it is likely that it has never been exploited in practice.

SolanaFloor posted on platform X, stating that a suspected MEV bot conducted an MEV-style price manipulation attack on the ANB pool of Meteora, converting 0.22 USD USDC into 696,000 USD USDC in a single transaction. The ANB token dropped by 99%.

According to Cointelegraph, the cross-chain protocol ZetaChain disclosed that the security issues involved in its recent approximately $334,000 vulnerability attack event had been reported in advance by researchers in the bug bounty program but were deemed "expected behavior" by the project team at that time and were not addressed.According to the official incident review, this attack originated from a combination of three design flaws that initially appeared to be independent and low-risk: the Gateway contract allowed anyone to send any cross-chain instructions; the receiving end could execute calls on almost any contract, and the blacklist restrictions were too narrow; some wallets retained unlimited approvals for a long time without being cleared. The attacker ultimately combined these flaws to instruct the Gateway to transfer tokens directly to their controlled address, thus completing the asset transfer.ZetaChain stated that this attack involved 9 transactions across four chains: Ethereum, Arbitrum, Base, and BSC, with the stolen funds all coming from wallets controlled by ZetaChain, and user funds were not affected. The official noted that the attack showed clear premeditation. The attacker funded the wallet through Tornado Cash three days before the attack and deployed a dedicated Drainer contract in advance, while also implementing an Address Poisoning attack.Currently, ZetaChain has begun pushing repair patches to the mainnet nodes, permanently disabling the arbitrary call function and changing the unlimited approval mechanism in the deposit process to "exact amount authorization."

Sui ecosystem DEX protocol Aftermath Finance announced that the team has discovered a vulnerability affecting the protocol and is actively investigating it with security partners.As a precaution, the protocol has been suspended, and measures are being taken to minimize the potential impact on user funds.

According to market news, attackers exploited a flawed EIP-7702 account to steal 1,988.5 QNT (approximately 54.93 ETH) from the QNT reserve pool. The root cause is that the reserve pool administrator EOA delegated the code to the BatchExecutor contract via EIP-7702, and this contract set the permissionless BatchCall contract as the authorized caller.Since the BatchCall.batch() function did not have any permission checks set, any external caller could invoke it, ultimately leading to the depletion of the reserve pool assets.