BTC $77,424.92 +0.43%
ETH $2,453.21 +1.28%
BNB $697.38 +0.38%
XRP $1.53 +3.75%
SOL $95.23 +1.36%
TRX $0.3438 +0.09%
DOGE $0.0940 +3.30%
ADA $0.2273 +1.18%
BCH $276.57 -0.94%
LINK $11.54 -1.70%
HYPE $80.08 +3.24%
AAVE $138.56 +12.20%
SUI $0.8302 +0.09%
XLM $0.2015 +0.81%
ZEC $854.43 +8.04%
BTC $77,424.92 +0.43%
ETH $2,453.21 +1.28%
BNB $697.38 +0.38%
XRP $1.53 +3.75%
SOL $95.23 +1.36%
TRX $0.3438 +0.09%
DOGE $0.0940 +3.30%
ADA $0.2273 +1.18%
BCH $276.57 -0.94%
LINK $11.54 -1.70%
HYPE $80.08 +3.24%
AAVE $138.56 +12.20%
SUI $0.8302 +0.09%
XLM $0.2015 +0.81%
ZEC $854.43 +8.04%

for

All
Article
Flash

Slow Mist Reveals Details of the Allbridge Cross-Chain Bridge Attack: Forged CCTP Messages, Flash Loans, Insufficient Minting Result Verification

The Slow Mist security team disclosed that the cross-chain bridge project Allbridge was attacked on August 19, 2026, resulting in a loss of approximately $190,000. Notably, this attack was not executed instantly; the attacker had begun laying the groundwork nearly a month prior and bypassed the verification mechanism by forging cross-chain messages. According to Slow Mist's analysis, on July 26, the attacker directly called Circle's MessageTransmitterV2.sendMessage function on the Polygon chain, constructing a cross-chain message disguised as a CCTP style message, claiming that a transfer of 1 million USDC existed, but in reality, no USDC destruction operation took place. Subsequently, Circle generated a valid verification proof (attestation) for this complete message according to normal procedures.About 24 days later, on August 19, the attacker waited for the Base Router to receive a real CCTP deposit, increasing the balance to approximately 191,000 USDC, and initiated the attack just 6 seconds later. The attacker utilized the previously forged message and verification proof to call Allbridge's receiveCctpMessage function. Due to the project's lack of critical verification, the system mistakenly recognized the false cross-chain message as a real deposit and recorded a limit of 1 million USDC. The attacker then temporarily borrowed approximately 809,000 USDC through an Aave flash loan, matching the Router balance with the forged amount, and used the internal credit record to call the transfer function, ultimately transferring out approximately 999,000 USDC (after a 0.1% fee). After repaying the flash loan and fees, the attacker netted a profit of about $189,800. The root cause of this vulnerability lies in Allbridge's failure to verify the identities of the sender and receiver of the cross-chain message, as well as not confirming whether USDC was genuinely minted and whether the balance actually increased, instead directly trusting the amounts and message hash data constructed by the attacker. Slow Mist emphasizes that on-chain message verification does not equate to the actual arrival of real assets. Cross-chain protocols not only need to verify the authenticity of messages but must also ensure that the message source is trustworthy, that the receiver is Circle's official TokenMessengerV2, and that asset accounting can only proceed after confirming the actual minting of assets and changes in balance. This incident once again highlights the security risks of cross-chain bridges in the message verification and asset settlement processes.

Large U.S. banking organizations propose to include customer identification requirements for the secondary market of stablecoins

The Bank Policy Institute (BPI) is an organization representing large banks such as JPMorgan, Bank of America, Wells Fargo, and Citi. BPI proposed that the Financial Crimes Enforcement Network (FinCEN) of the U.S. Department of the Treasury should expand customer identification program requirements to the secondary market for stablecoins, covering exchanges and other platforms that establish direct account relationships with retail investors.BPI stated that the relevant exchanges and platforms engage in a significant amount of buying and selling activities within the payment stablecoin ecosystem, where most illegal activities related to stablecoins occur. If the proposal is incorporated into the rules, the relevant platforms will be required to collect customer information in accordance with the Bank Secrecy Act, and decentralized exchanges may also fall under regulatory oversight. The proposed rules by FinCEN indicate that transactions in the secondary market for stablecoins on the blockchain typically use anonymous or pseudonymous identities, and there are no centralized nodes for collecting identity information, limiting the ability of issuers to gather customer data from the secondary market. BPI has also opposed the current version of the Digital Asset Market Structure Bill along with other banking organizations.

The institutionalization of the South Korean cryptocurrency market is accelerating: 6,590 corporate accounts at 5 major exchanges, with Bithumb accounting for nearly half

According to a report by the Korean News Agency, the Financial Supervisory Service of Korea submitted data to the National Assembly's Political Affairs Committee, revealing that as of the end of July, the five major virtual asset exchanges in Korea (Upbit, Bithumb, Coinone, Digital Asset Exchange, Gopax) have registered a total of 6,590 corporate accounts.In terms of the distribution of exchanges, Bithumb has the highest number of registered corporate accounts, reaching 3,280; the operator of Upbit, Dunamu, has 2,086 accounts. The two major exchanges account for a total of 5,366 corporate accounts, which is 81.4% of the total. Additionally, Korbit has 620, Coinone has 539, and Gopax has 65.In terms of compliance, there are a total of 711 corporate accounts that have completed customer identity verification (KYC), accounting for 10.8% of all corporate accounts. Among them, Upbit has the most with 290; Bithumb has 199, Korbit has 184, and Coinone and Gopax have 33 and 5, respectively. In terms of the scale of virtual asset holdings, Korean corporate accounts hold approximately 43.377 billion Korean won (about 31.2 million USD), with Upbit having the highest share, holding approximately 27.08 billion Korean won, accounting for 62.4% of the total; Bithumb holds about 6.29 billion Korean won, and Coinone holds about 5.15 billion Korean won. The deposit scale of corporate accounts is approximately 9.13 billion Korean won.
app_icon
ChainCatcher Building the Web3 world with innovations.