signature

According to SlowMist monitoring, the decentralized exchange Atomic protocol was attacked due to a signature replay vulnerability, resulting in a loss of approximately 29,984 USDC.The vulnerability originated from contract 0xa806010f, which lacked binding of position ID, position manager, caller, nonce, deadline, and chain ID in the signature hash, allowing the same manager's signature to be replayed on 21 different position IDs, executing unauthorized full LP destruction under flash loan price manipulation, and without TWAP or slippage checks.

Starknet announced that it has completed the quantum-resistant signature transfer test, where a wallet account using a quantum-resistant signature mechanism completed a real transfer on the Starknet mainnet, with a transaction fee of about 6 cents, and can be queried through the block explorer. This account is currently an experimental, unaudited version, mainly used for research testing. StarkWare stated that this transfer benefits from the design of the Starknet account model.Unlike most blockchains that fix the signature algorithm at the protocol layer, each account on Starknet is a smart contract that can autonomously define the accepted signature schemes, allowing users to upgrade their wallets from traditional elliptic curve signatures to quantum-resistant signatures without hard forks, asset migrations, or changing addresses. StarkWare pointed out that most blockchains face quantum computing risks because wallet signatures and underlying verification systems rely on elliptic curve cryptography. Once large-scale quantum computers appear, running Shor's algorithm could potentially break the related encryption systems. Currently, the Starknet ecosystem supports a quantum-resistant signature scheme based on Falcon-512, which is part of the NIST post-quantum cryptography standardization process, with relevant implementations promoted by ecosystem teams and organizations such as OpenZeppelin.

Bitgo CEO Mike Belshe deposited 100 BTC into a public Bitcoin address, valued at approximately $6.3 million at the time, and invited the Claude model under Anthropic to attempt to transfer the funds from that address. On-chain records show that the wallet received the funds on July 31, and the balance has not been transferred out.Anthropic previously disclosed that during 141,006 cybersecurity assessment runs, 3 incidents were found, with 6 assessment sessions involving 3 models unexpectedly interacting with real organizational systems. The relevant models include Claude Opus 4.7, Claude Mythos 5, and an unpublished internal research model, due to configuration errors by third-party testing partner Irregular that caused the testing environment to connect to the internet.Anthropic stated that Claude Opus 4.7 identified a real website sharing the same name as a simulated company during one assessment, exploited weak passwords and exposed services to recover infrastructure credentials, and accessed a production database containing hundreds of records. The company claimed that the model was attempting to complete assigned tasks and was not actively breaking restrictions or pursuing independent goals. Belshe's challenge involved the Bitgo institutional custody platform, which uses multi-signature or multi-party computation technology to distribute signing authority across multiple independent keys. Anthropic has not publicly responded to this challenge.

According to Onchain Lens monitoring, a certain whale has accumulated 266,400 LINK from Binance over the past month, worth approximately 2.15 million USD, and then transferred the entire balance to a Gnosis Safe multi-signature wallet.

According to Bitcoin News monitoring, approximately 594 BTC were transferred from 500 addresses within 25 minutes on Thursday, valued at around 38 million USD, and the funds were subsequently consolidated into another wallet. The affected holdings all used single-signature addresses, with balances ranging from about 0.15 to 0.26 BTC, and many UTXOs had been dormant for years.Early speculation focused on Coldcard, as at least one victim used the device. Coldcard CEO NVK denied the existence of a device-wide vulnerability, stating that the user may have imported a seed that had previously been leaked or compromised, and pointed out that the transfer involved keys from different wallets. Jameson Lopp noted that another victim only lost part of their UTXOs, not the entire wallet balance, which may indicate exposure of individual private keys rather than a complete seed leak.Currently, the coordinated transfer event is confirmed, but the source remains unknown, and there is no evidence to prove the existence of a Coldcard RNG flaw, supply chain vulnerability, or Bitcoin cryptographic failure.

According to monitoring by PeckShield, the attacker’s marked address has returned 331.8 ETH, approximately 623,900 USD, to the Across Protocol Hub Pool Owner multi-signature address.

According to on-chain analyst @ai_9684xtpa, the Worldcoin multi-signature address transferred a value of $13.84 million in WLD to two new addresses 9 hours ago.The upstream address actually received 60 million WLD, and this time only transferred out 36.94 million WLD; the receiving addresses have not yet transferred or sold.

According to Specter monitoring, a long-inactive PancakeSwap liquidity provider (LP) lost approximately $2.96 million due to signing a malicious EIP-7702 authorization.It is reported that the attacker removed about $1.48 million in BSC-USD and $1.48 million in BUSD liquidity provided by the victim and exchanged BUSD for ETH. Currently, the attacker has deposited approximately $1.46 million in funds to Tornado Cash, while the remaining approximately $1.48 million in USDT is still held in the attacker's address.

Libbitcoin developer @evoskuil stated that the latest version of Libbitcoin Server can complete the initial block download of a Bitcoin full node in 55 minutes and perform full verification. This speed improvement comes from a new GPU-based signature verification system that runs in parallel with conventional script verification, rather than as a separate step.The software does not pause execution to verify each ECDSA and Schnorr signature; instead, it captures signature checks, batches them, and processes them via GPU while the remaining verification continues. @evoskuil indicated that this method achieves about a 99.5% signature capture rate without blocking verification, thus eliminating the need for a second verification. If a batch signature check fails, the software traces it back to the corresponding block and marks that block as invalid. He also mentioned that this design can batch process an almost arbitrary number of signatures, keeping the GPU ahead of the remaining verification process and significantly shortening the full node synchronization time.

According to Cointelegraph, the State Duma of Russia has passed the bill No. 1194918-8 "Digital Currency and Digital Rights" in its second and third readings on Tuesday, setting rules for the operation of crypto assets and cross-border trade within the country.The bill establishes a regulatory framework for market participants such as cryptocurrency exchanges, brokers, asset management companies, and custodians, and sets operational requirements for industry companies. The bill allows crypto assets to be used for foreign trade activities, while payments for goods and services within Russia remain prohibited. The main provisions are expected to take effect on September 1, 2026, with a transition period until July 1, 2027, and the bill still needs to be signed by President Vladimir Putin to become law.

According to Onchain Lens monitoring, a certain Chainlink whale transferred 431,000 LINK to a Gnosis Safe multi-signature wallet, valued at approximately 3.76 million dollars.This whale had previously accumulated and withdrawn these tokens from Binance into two wallets through multiple transactions over the past three weeks, with the final two transfers being 176,029 LINK, valued at approximately 1.53 million dollars, and 255,468 LINK, valued at approximately 2.23 million dollars.

According to official news, the ENS DAO has approved the proposal to activate a new security committee, with a term of two years. The committee consists of eight members and has veto power, allowing it to cancel proposals during the waiting period after malicious proposals are passed but before execution. The committee's authority is limited to canceling transactions within the time lock and cannot access treasury funds, submit proposals, or rewrite approved proposals.The committee can only exercise its power under emergency conditions specified in its charter. ENS points out that governance itself may become an attack surface—voting rights can be borrowed to initiate attacks, proposal codes can hide malicious behavior, and credential leaks can be used to push harmful transactions. The new committee adopts a 5-of-8 multi-signature, requiring at least five members' agreement to cancel a proposal, and must seek DAO voting for extension after the two-year term.

According to GoPlus analysis, Lumi Finance on Arbitrum was attacked on July 13, resulting in a loss of approximately $270,000.The vulnerability originated from a logical flaw in the validateUserOp function of the Sodium smart account contract (ERC-4337) when calling _validateSignature to verify the signature—specifically, during the execution of isValidSignatureNow, the signer parameter was passed as the attacker's address. After an error occurred in the call to ECDSA.tryRecover, it did not revert but instead called the isValidSignature function in the attack contract and passed the verification. The attacker exploited this vulnerability to execute Token approve operations during the UserOperation verification period, obtaining approval rights for ERC20 tokens from multiple smart accounts without the payer's consent.

According to the official announcement from NEAR Chain Status, the NEAR mainnet version 2.13.0 has been released, introducing post-quantum transaction signature schemes and dynamic sharding features.Voting will begin at 8:00 AM Beijing time on July 20. Former NEAR core developer Vadim introduced that this upgrade includes features that would typically require a ten-year roadmap for most blockchains: the post-quantum signature ML-DSA-65 becomes the third key type in the protocol after ed25519 and secp256k1, allowing accounts to hold keys that cannot be forged by quantum computers, with only a 32-byte hash recorded on-chain; dynamic sharding enables the chain to automatically monitor the status and size of each shard and to split and re-shard at epoch boundaries without the need for protocol upgrades or manual intervention; Gas Keys provide critical functionality for the proxy economy, allowing a single account to run a batch of proxies to send transactions simultaneously without nonce conflicts.

The TRON network's Nile testnet has officially launched the post-quantum signature feature following the proposal from Committee No. 20628, with FN_DSA_512 enabled on the Nile testnet. This marks a new advancement for TRON in the validation of quantum-resistant cryptography and the evolution of testnet functionalities.TRON welcomes developers to experience the new features on the Nile testnet and to conduct testing and validation in conjunction with the post-quantum signature usage guidelines. The official reminder states that the related features are currently only effective on the Nile testnet and have not yet been launched on the mainnet.

According to on-chain analysts, the Ondo team’s multi-signature wallet transferred 150 million ONDO to address 0xEA5...675e1 8 hours ago, worth 49.56 million USD.Since April 22, this address has received a total of 425 million ONDO (147 million USD), and the previous two batches of received tokens were deposited into Coinbase in parts, with the purpose unknown.

According to CoinDesk, the Stellar Development Foundation has announced a quantum security plan to migrate all XLM accounts to a quantum-resistant signature scheme by the end of 2027, while keeping existing addresses and on-chain transaction history unchanged.The foundation stated that this migration will be completed through protocol layer updates to address the potential cracking risks posed by future quantum computing to existing cryptographic signature algorithms, and to ensure that user accounts do not need to change addresses or rebuild transaction records during the migration process.

Layer 1 blockchain Tempo proposed TIP-1061, a native multi-signature account proposal, aiming to introduce multi-signature as a native account type at the protocol layer, allowing multi-signature control without the need to deploy smart contract wallets like Safe.This solution supports M/N multi-signature, weighted multi-signature, as well as Secp256k1, P256, and WebAuthn signatures, and allows for subsequent adjustments of members and permissions while keeping the account address unchanged. This proposal is primarily aimed at scenarios involving DAOs, institutions, and validators, and is currently still in the draft stage.

Circle released the "Post-Quantum Security White Paper," proposing a phased post-quantum resilience roadmap focused on the long-term security of the Arc blockchain ecosystem.The roadmap covers multiple technical directions, including quantum secure signatures, private execution environments, validator hardening, infrastructure migration, and account recovery, applicable to core components such as the Arc network, USDC, smart contracts, and validators.Circle stated that it plans to provide post-quantum signature support when the Arc mainnet launches (in 2026) to enhance the ecosystem's ability to respond to future quantum computing threats.

SUPERFORTUNE AI posted on platform X that the team is investigating the GUA security incident that occurred on May 27. This incident caused severe fluctuations in token prices, and preliminary investigations indicate that the incident may involve address tampering in a multi-signature transaction.The announcement stated that the plan was to send additional unlocked tokens to the airdrop claim contract address, but during the execution of the transaction, the funds were mistakenly sent to another hacker address. The team noted that this hacker address had never interacted with any addresses related to SUPERFORTUNE before, so the likelihood of an "address poisoning attack" as a method of attack is low. Additionally, SUPERFORTUNE stated that its internal processes already include a multi-address verification mechanism, and the team is still continuing to investigate the incident and will update the community on the latest developments.