ChainCatcher news, decentralized exchange (DEX) Clipper clarifies that there was a vulnerability in its withdrawal function, which led to a recent hack of its protocol, resulting in a loss of $450,000, rather than the "third party" claim of a private key leak.Clipper stated: "On December 1, the attacker exploited two liquidity pools, locking approximately 6% of the total value. A third party claimed there was a private key leak issue. We can confirm that this is not the case and is inconsistent with Clipper's design and security architecture. The withdrawal function in the form of a token (bundled exchange + deposit/withdrawal transactions) has been disabled."Previously, the co-founder of security company Fuzzland posted on X that Clipper was "hacked due to an API vulnerability (such as private key leakage)," adding that the API might have vulnerabilities that allowed attackers to sign deposit and withdrawal requests, stealing more funds than they deposited.

ChainCatcher message, the DeSci project Pump Science announced this morning that its test wallet (address starting with T5j2UB) has suffered a private key leak due to negligence in the GitHub code repository. This wallet has been marked as the off-chain creator of URO and RIF tokens on the pump.fun platform, and attackers may exploit this private key to issue more tokens.The project team stated that this private key was initially used for testing purposes only, and the development team mistakenly believed it was unimportant. Pump Science reminds users that any new tokens issued by this compromised wallet, aside from URO and RIF, should be considered scams.As a result, URO is currently priced at 0.034 USDT, with a 24-hour decline of 30.55%; RIF is priced at 0.0846 USDT, with a 24-hour decline of 36%.

ChainCatcher news, Wintermute research director Lgor Lamberdiev stated that pump.fun was likely attacked due to a private key leak, resulting in the theft of 2000 SOL and a large amount of MEME coins.Lamberdiev also mentioned that the service account address 5PXxuZ somehow signed the txs, transferring funds to the attacker and random addresses, instead of deploying the Raydium pool, which strongly suggests that the attack was likely caused by the leak from pump.fun.

ChainCatcher news, according to Ars Technica, a newly discovered vulnerability in Apple's M series chips may lead to wallet key leakage. This vulnerability is a side channel that allows end-to-end key extraction when Apple chips run encrypted wallets, but this flaw cannot be directly patched as it originates from the microarchitecture design of the chip itself. Instead, it can only be mitigated by establishing defenses in third-party encryption software, which significantly reduces the performance of the M series, especially in the earlier M1 and M2 generation products. The vulnerability is exploited when the target encryption operation runs on the same CPU cluster as a malicious application with normal user system privileges.

ChainCatcher news, according to the Beosin KYT anti-money laundering analysis platform, the address 0x121ad060686848b196df8ca5c5e24722efe57115 on the Ronin chain, jihoz.ron (0xa09a9b6f90ab23fcdcd6c3d087c1dfb65dddfb05), is suspected of private key leakage. Multiple tokens were transferred to the address 0x39f817976c51a91b60145febad81067e69713105, exchanged for ETH, and then cross-chain to Ethereum, subsequently flowing directly into Tornado.cash.

ChainCatcher news, Lido officials stated that in the past 24 hours, contributors to Lido DAO were informed of a platform vulnerability affecting the active node operator (InfStones) of Lido on Ethereum, which had been exploited at some point over the past few months. This vulnerability was disclosed to InfStones by security researchers dWallet Labs in July 2023. The node operator announced that the vulnerability has been resolved.The vulnerability involved the potential exposure of root-level access to 25 validator servers to external attackers who may not be related to the Lido protocol, which could include critical materials. It is currently unclear whether contributors included servers and/or keys related to Lido validators within the scope of the affected systems.Contributors to Lido DAO have drawn the following conclusions regarding the aforementioned vulnerability: there is no indication that any keys were leaked due to this vulnerability; however, as a precaution, InfStones voluntarily withdrew all validators and rotated to new keys, awaiting DAO voting. All ETH from the withdrawn validators will flow back to the Lido protocol through the withdrawal process and will subsequently be re-staked into available keys in the buffer.

ChainCatcher message, Bit Jungle analyzed the reasons behind the theft of a certain cryptocurrency wallet related to Binance deployers yesterday. It is reported that a certain cryptocurrency wallet related to Binance deployers was stolen yesterday, with hackers stealing 27.07 million USDT and 11 ETH from the wallet. Subsequently, the hackers cross-chained most of the funds and further transferred assets through ChangeNow, FixedFloat, SideShift, and others. However, a small portion of the funds has been converted to ETH and has not yet been transferred.

ChainCatcher news, the on-chain analysis agency X-explore posted on social media stating that it believes the reason for the attack on Poloniex is the leakage of private keys, and the attackers are the Lazarus Group.It is reported that this attack is similar to the attack on Stake.com on September 4, 2023, where hackers stored different tokens in different addresses, with each address handling only one type of token.

ChainCatcher message, Slow Mist founder Yu Xian posted on social media that through the analysis of Slow Mist's on-chain behavior (across multiple networks including Base/ETH/BSC), it was determined that the account private key of friend.tech user Pangchy is at risk of being leaked. As for the leakage channel, it can be referenced in the owner's investigation, but it cannot be confirmed at this time.Yu Xian stated that users are using third-party bots that run on Telegram, which are all centralized. Once the private key is given away, the risk is hard to assess.

ChainCatcher news, Arbitrum ecosystem DEX GMBL.COMPUTER explained the details of today's signature key leak incident on platform X, stating that someone was able to forge a "call" and obtain a signature from its server, then pass that signature to the contract, extracting nearly 500 ETH (approximately $815,000 at current prices) worth of GMBL from the contract.GMBL.COMPUTER stated that this is not a contract vulnerability, and the team has identified the root cause of the issue. The key leak was an off-chain action, and the team has gathered all the information about the attacker and will begin to recover the funds. They will offer a bug bounty, and if the funds are returned, no legal action will be taken.

ChainCatcher news, Kuan Sun, the founder of the encrypted derivatives trading company Eureka Trading, stated: "Last June, I lost 15 million USD due to a private key leak and was hacked. Currently, I have some preliminary IP and other information, but I have not yet been able to identify the hacker. I hope that individuals or organizations capable of providing valuable clues can assist in recovering the funds, and I can offer a reward."He added, "Hacker address: 0xa1ac23be458e14ac0a0003dc1343d2ac575ea3b6. At least 20% of the funds will be used as a reward, with the specific proportion depending on the level of contribution. So at least 3 million USD in rewards is available for those who are capable." (source link)

ChainCatcher news, Bitcoin core developer Luke Dashjr tweeted that almost all of his Bitcoin was stolen due to the leak of his PGP (Pretty Good Privacy) private key. According to on-chain data, Luke Dashjr's wallet address conducted four transactions on December 31, transferring 216.93 BTC, worth approximately 3.5 million dollars at current prices.It is reported that PGP is the first widely used encryption software to implement public key cryptography, utilizing a hybrid cryptosystem architecture that employs both symmetric and asymmetric encryption to achieve a high level of security. Binance founder Changpeng Zhao commented that he would cooperate with the investigation and has notified the Binance security team to monitor the situation, while reminding users that "self-custody comes with various risks." (source link)

ChainCatcher news, Raydium officials stated regarding the attack that occurred yesterday, the vulnerability seems to stem from a trojan attack and the leakage of the pool owner's account private key. The attacker accessed the mining pool owner's account and was able to call the withdrawalPNL function, which is used to collect transaction/protocol fees earned from swap trades in the pool. The affected pools include SOL-USDC, SOL-USDT, RAY-USDC, RAY-USDT, etc., with a total loss of approximately $4.395 million.Additionally, as an immediate solution, the permissions of the previous mining pool owner have been revoked, and all accounts have been updated to new hardware wallet accounts, so the attacker no longer has access and cannot exploit these pools for further attacks. If the attacker returns the funds, a 10% reward will be offered to the hacker for the stolen funds, treated as a white hat bounty. (source link)