GoPlus Security 🚦 (@GoPlusSecurity): 🧵1/3

🧵1/3 ⚠️Three major security incidents occurred within 24 hours, resulting in total losses of over $35 million ❗️ Three major Web3 security incidents occurred within the past 24 hours, including two social engineering fraud and private key compromise incidents, as well as one smart contract verification logic vulnerability. ——Even more concerning, one of the projects was attacked for the second time within three months! The Web3 security landscape remains challenging, highlighting the urgent need for upgraded security paradigms! Attacked Project 1️⃣: @AFX_XYZ's cross-chain bridge on #Arbitrum was exploited, resulting in losses of approximately $24.15 million. Root cause: The private keys of 5 hot validators were compromised. The attacker used sufficient voting power (7,142/10,000 > 2/3) to approve fraudulent withdrawals, and the contract executed them as designed. Afterwards, the attacker bridged the stolen ~24.15 million USDC to Ethereum and converted it into 12,467.437 ETH. Attacker addresses: 0x2f2974fAbc54dbA33442261211c06BD20E0FEefc 0x627654B2782bfC57580ecD11d40869b350B6ebAC Affected contract address: 0xCb3B9A3E5668AFE84DC7A864B36b845dCE062e67 Attack transactions: Vote 👉https://arbiscan.io/tx/0x217c45c1272550e0439e53243f2987b7fb3f58b1d33c222597bbb71851b93f74 Transfer 👉https://arbiscan.io/tx/0x50d0b3ec6c3f5fce0f10abf81540bbb508f421494aa2b3480c4a264b0436547b