BTC $79,001.61 +2.21%
ETH $2,480.32 +1.35%
BNB $704.17 +0.79%
XRP $1.50 -0.91%
SOL $95.95 +0.68%
TRX $0.3429 -0.15%
DOGE $0.0908 -1.79%
ADA $0.2218 -1.91%
BCH $275.64 +0.80%
LINK $11.54 +0.26%
HYPE $78.73 -1.94%
AAVE $134.66 -3.50%
SUI $0.8173 -0.74%
XLM $0.1953 -1.87%
ZEC $832.36 -3.04%
BTC $79,001.61 +2.21%
ETH $2,480.32 +1.35%
BNB $704.17 +0.79%
XRP $1.50 -0.91%
SOL $95.95 +0.68%
TRX $0.3429 -0.15%
DOGE $0.0908 -1.79%
ADA $0.2218 -1.91%
BCH $275.64 +0.80%
LINK $11.54 +0.26%
HYPE $78.73 -1.94%
AAVE $134.66 -3.50%
SUI $0.8173 -0.74%
XLM $0.1953 -1.87%
ZEC $832.36 -3.04%

cati

All
Article
Flash

Slow Mist Reveals Details of the Allbridge Cross-Chain Bridge Attack: Forged CCTP Messages, Flash Loans, Insufficient Minting Result Verification

The Slow Mist security team disclosed that the cross-chain bridge project Allbridge was attacked on August 19, 2026, resulting in a loss of approximately $190,000. Notably, this attack was not executed instantly; the attacker had begun laying the groundwork nearly a month prior and bypassed the verification mechanism by forging cross-chain messages. According to Slow Mist's analysis, on July 26, the attacker directly called Circle's MessageTransmitterV2.sendMessage function on the Polygon chain, constructing a cross-chain message disguised as a CCTP style message, claiming that a transfer of 1 million USDC existed, but in reality, no USDC destruction operation took place. Subsequently, Circle generated a valid verification proof (attestation) for this complete message according to normal procedures.About 24 days later, on August 19, the attacker waited for the Base Router to receive a real CCTP deposit, increasing the balance to approximately 191,000 USDC, and initiated the attack just 6 seconds later. The attacker utilized the previously forged message and verification proof to call Allbridge's receiveCctpMessage function. Due to the project's lack of critical verification, the system mistakenly recognized the false cross-chain message as a real deposit and recorded a limit of 1 million USDC. The attacker then temporarily borrowed approximately 809,000 USDC through an Aave flash loan, matching the Router balance with the forged amount, and used the internal credit record to call the transfer function, ultimately transferring out approximately 999,000 USDC (after a 0.1% fee). After repaying the flash loan and fees, the attacker netted a profit of about $189,800. The root cause of this vulnerability lies in Allbridge's failure to verify the identities of the sender and receiver of the cross-chain message, as well as not confirming whether USDC was genuinely minted and whether the balance actually increased, instead directly trusting the amounts and message hash data constructed by the attacker. Slow Mist emphasizes that on-chain message verification does not equate to the actual arrival of real assets. Cross-chain protocols not only need to verify the authenticity of messages but must also ensure that the message source is trustworthy, that the receiver is Circle's official TokenMessengerV2, and that asset accounting can only proceed after confirming the actual minting of assets and changes in balance. This incident once again highlights the security risks of cross-chain bridges in the message verification and asset settlement processes.

Large U.S. banking organizations propose to include customer identification requirements for the secondary market of stablecoins

The Bank Policy Institute (BPI) is an organization representing large banks such as JPMorgan, Bank of America, Wells Fargo, and Citi. BPI proposed that the Financial Crimes Enforcement Network (FinCEN) of the U.S. Department of the Treasury should expand customer identification program requirements to the secondary market for stablecoins, covering exchanges and other platforms that establish direct account relationships with retail investors.BPI stated that the relevant exchanges and platforms engage in a significant amount of buying and selling activities within the payment stablecoin ecosystem, where most illegal activities related to stablecoins occur. If the proposal is incorporated into the rules, the relevant platforms will be required to collect customer information in accordance with the Bank Secrecy Act, and decentralized exchanges may also fall under regulatory oversight. The proposed rules by FinCEN indicate that transactions in the secondary market for stablecoins on the blockchain typically use anonymous or pseudonymous identities, and there are no centralized nodes for collecting identity information, limiting the ability of issuers to gather customer data from the secondary market. BPI has also opposed the current version of the Digital Asset Market Structure Bill along with other banking organizations.

first_img FASB seeks public comment on the classification of stablecoins and other digital assets as cash equivalents

On August 18, 2026, the Financial Accounting Standards Board (FASB) issued a proposed Accounting Standards Update (ASU) aimed at clarifying how the current definition of "cash equivalents" applies to certain digital assets, such as stablecoins, and enhancing the transparency of disclosures regarding important components of cash equivalents. Stakeholders are encouraged to submit comments by November 19, 2026.In the 2025 FASB agenda consultation project and other feedback, stakeholders pointed out that there is uncertainty regarding whether certain digital assets, including stablecoins, meet the definition of cash equivalents under current Generally Accepted Accounting Principles (GAAP), leading to differences in practical treatment. The proposed ASU will provide illustrative examples to promote a more consistent application of this definition and enhance comparability among entities choosing to report qualifying digital assets as cash equivalents, but it will not change the current definition of "cash equivalents."At the same time, the proposed rules require all entities reporting assets as cash equivalents, regardless of whether they include digital assets, to enhance disclosures regarding the important components of cash equivalents and related amounts, so that investors and other financial statement users can obtain more transparent information. The relevant proposed ASU and methods for submitting comments can be found on the FASB website.

Vitalik releases research on "local mixing" cryptography: exploring next-generation obfuscation techniques, which may become a new foundational primitive in cryptography

Ethereum co-founder Vitalik Buterin published a new article titled "Obfuscation (Part 3): Local Mixing," which delves into a cryptographic obfuscation technique being explored—"Local Mixing." He claims it may become a new foundational cryptographic tool following elliptic curves, RSA, and lattice-based cryptography.Vitalik states that current mainstream obfuscation techniques mainly rely on complex mathematical assumptions, often resulting in extremely high computational overhead. In contrast, Local Mixing adopts a completely different approach, not relying on elliptic curves, large integer factorization, or lattice cryptography. Instead, it draws on experiences from symmetric cryptography and hash function design, continuously shuffling, reconstructing, and hiding circuit structures to eliminate information leakage while maintaining functionality.The Local Mixing technique primarily includes steps such as reversibility, hardening, mixing, splitting, crossing walk, and "gadgetization." By introducing random structures into the circuit, rearranging logic gates, and employing nonlinear hiding mechanisms, it makes it difficult for attackers to recover the original computational logic.Vitalik points out that this technology is still in its early stages, with security not yet validated over the long term and facing challenges such as random attacks and linear analysis. However, he believes that Local Mixing represents a completely new path for cryptographic exploration, aiming to construct more efficient indistinguishable obfuscation (iO) schemes.If breakthroughs in Local Mixing technology are achieved, it could lead to new quantum-resistant public key encryption schemes and promote the development of general obfuscation techniques. The field still requires years of cryptanalysis and optimization validation, but AI-assisted research may significantly accelerate this maturation process. Vitalik states that obfuscation technology is seen as the "final frontier" of cryptography because, theoretically, other cryptographic primitives can be constructed based on obfuscation and one-way functions. Local Mixing may not only reduce the costs of traditional obfuscation schemes but could also become an important direction for future cryptographic infrastructure.
app_icon
ChainCatcher Building the Web3 world with innovations.