Tag: exploit

  • Zano Blockchain Restarts After Gateway Address Exploit, Begins Recovery and Reimbursement Process

    Zano Blockchain Restarts After Gateway Address Exploit, Begins Recovery and Reimbursement Process

    Privacy-focused blockchain Zano has successfully restarted its network from block 3,833,000 after a vulnerability in its Gateway Address feature allowed unauthorized ZANO and Freedom Dollar (fUSD) assets to enter circulation. The rollback removes nearly a month of blockchain history, including both the exploit-related activity and legitimate transactions recorded during that period.

    The restart brings the chain back to the point just before Hard Fork 6, which introduced Gateway Addresses on August 26. Zano’s investigation confirmed that wallet spending keys and ordinary transaction privacy were not compromised. The project’s core consensus mechanism also remained unaffected.

    Gateway Address Vulnerability Triggered the Crisis

    Gateway Addresses were designed to simplify integration for exchanges, bridges, and other services by offering an account-style balance while preserving Zano’s privacy features. However, a flaw in the asset issuance process through these addresses enabled unauthorized ZANO and fUSD to enter circulation, prompting the emergency recovery.

    Zano has not yet published a full technical post-mortem but has stated that a detailed explanation of the vulnerability, along with findings from a review of the Gateway Address code, will follow.

    Exchanges and Network Operators Must Update

    The recovery is not a simple software update controlled solely by Zano’s developers. Nodes, miners, stakers, pools, exchanges, and other services must install the emergency release and migrate to the recovered chain. Zano has advised users to verify that third-party wallets, exchanges, and payment services have completed the migration before sending funds. Since transactions confirmed during the affected period are not included on the restarted chain, users should retain transaction IDs and trading records and verify previous transfers before resending payments.

    Reimbursement Process Still Being Prepared

    The rollback has created challenges for users and businesses whose legitimate transactions occurred during the affected month. Zano is working with affected projects and counterparties to assess losses and plans to publish a formal reimbursement and claims process. The team emphasized that the recovery will remove unauthorized activity without creating additional ZANO tokens. Zano has also begun restoring its own services individually as network participants migrate.

    The project stated that Gateway Addresses will remain under review before being reactivated. Technical findings and conditions for safely restoring the feature are expected to provide more detail on the next stage of recovery.

  • Magic Eden Investigates Suspicious Zero-ETH NFT Transfers as Exploit Concerns Grow

    Magic Eden Investigates Suspicious Zero-ETH NFT Transfers as Exploit Concerns Grow

    Magic Eden is investigating unusual activity involving thousands of Ethereum-based NFTs that reportedly changed hands for 0 ETH, prompting concerns about a possible contract exploit. A pseudonymous account involved in the transactions claims the movement was part of a white-hat operation, but Magic Eden has not confirmed that assertion.

    NFT Transfers Raise Exploit Concerns

    NFT trader Cirrus flagged the issue on September 25, reporting NFT sales originating from Magic Eden and suggesting the marketplace’s contract may have been exploited. The flagged activity involved several thousand NFTs sold for zero ETH, with attention drawn to a wallet allegedly connected to the transfers.

    At the time of reporting, Magic Eden had not released a statement confirming an exploit. Details such as the number of wallets involved, the potential vulnerability, and the total value of the moved NFTs remained undisclosed.

    Pseudonymous Account Claims White-Hat Operation

    After Cirrus raised the alert, an X account using the pseudonym Quit claimed the transactions were part of a white-hat mission. According to Quit, assets held at wallet address 0x71cf3f5724bD2B72Ef6464992aCd26216DE7fe33 were safe and would be returned once no longer considered at risk.

    Magic Eden has not verified the wallet’s connection to a legitimate white-hat effort or confirmed whether the transactions were part of an organized recovery operation.

    Magic Eden Had Ended EVM Marketplace Support

    The reported Ethereum NFT activity follows the company’s earlier shift away from its EVM marketplace. According to Magic Eden’s documentation, support for the EVM marketplace ended on March 9, 2026. Listings, bids, and offers on that marketplace were moved off-chain and became inaccessible after the shutdown.

    Magic Eden continues to support Solana-based NFT trading. Its products also include Packs, which can contain NFTs from Ethereum collections; NFTs revealed through Packs can be traded on the marketplace.

    Magic Eden has not disclosed how the September 25 activity affected its services or contracts associated with the former EVM marketplace.

  • Hinkal Protocol Drained of $830K in Proofless Deposit Exploit; Stolen Funds Laundered Through Tornado Cash and Thorchain

    Hinkal Protocol Drained of $830K in Proofless Deposit Exploit; Stolen Funds Laundered Through Tornado Cash and Thorchain

    On July 3, attackers exploited Hinkal, a privacy-focused DeFi protocol, draining approximately $830,000 in USDC — nearly the entire total value locked (TVL) across the five blockchains it supports. Blockchain security firm CertiK traced the breach to an externally owned account that repeatedly executed ‘Transact’ calls after completing a ‘proofless deposit.’ According to DeFiLlama, Hinkal’s TVL stood at roughly $829,000 just before the attack.

    How the Exploit Worked

    CertiK identified the attacker’s wallet as 0xbB3f01a1b1C68F3DEB36C55342b5F5706c32fc20 and reported that it siphoned over $800,000 from a Hinkal smart contract. Meanwhile, PeckShield, citing on-chain investigator Specter, placed the total loss near $820,000 — slightly lower than CertiK’s estimate. The exploit leveraged a vulnerability in Hinkal’s deposit mechanism, allowing the hacker to withdraw funds without providing the required proof.

    Laundering the Stolen Crypto

    After the theft, the attacker converted the stolen USDC into Ether and quickly moved the funds through privacy tools and cross-chain bridges. CertiK noted that the wallet deposited 410 ETH (worth about $700,000) into Tornado Cash, an Ethereum mixer currently under U.S. sanctions. Separately, PeckShield reported that the attacker sent 44.67 ETH through Thorchain, converting it into Bitcoin, which eventually reached an address beginning with bc1qr2sf. This laundering pattern — combining sanctioned mixers with decentralized bridges — is commonly observed in DeFi exploits.

    A research article presented at the ACM Web Conference 2026 found that sanctioned cryptocurrency mixers still provide effective anonymity despite increased regulatory pressure. CertiK has also noted that both criminals and legitimate privacy-conscious users continue to use Tornado Cash, complicating efforts to distinguish illicit transactions from lawful ones.

    Impact on Hinkal’s Institutional Privacy Model

    Hinkal markets itself as an institutional-grade privacy layer, enabling users to create shielded addresses and perform swaps, transfers, and payments without exposing balances or counterparties. The protocol operates on Ethereum, Arbitrum, Base, Polygon, and OP Mainnet. It raised $5.5 million in seed and strategic funding from investors including Draper Associates, Quantstamp, and NGC Ventures. Just one day before the exploit, Hinkal announced a partnership with wallet infrastructure provider Turnkey to bring privacy features to Turnkey users.

    At the time of the attack, Hinkal ranked near the bottom of privacy protocols by TVL. DeFiLlama listed Tornado Cash at $440 million, Railgun at $77.5 million, and Privacy Pools at about $7.8 million — while Hinkal held just $829,000 before the exploit drained nearly all of it.

    What’s Next

    The Hinkal exploit removed roughly $830,000 in USDC, nearly matching the protocol’s total locked value. Users are advised to monitor official updates from Hinkal and carefully assess the risks associated with privacy-focused DeFi platforms.