OKX DEX is suspected of being exploited. Some wallets authorized to OKX DEX were stolen for more than $424k. The deployer of the OKX DEX: Aggregation Router was involved in the attack. The proxy for attack has been removed. It is suspected of 0xFacf3 permission account's private key is leaked. — link — link
Suspected attacker:
0xFacf375Af906f55453537ca31fFA99053A010239
Profit address:
0x1F14E38666cDd8e8975f9acC09e24E9a28fbC42d

OKX stated that due to the hack of the management rights of an abandoned OKX DEX market maker contract, 18 address assets authorized for the contract were hacked. The affected contracts have been deactivated and all user assets have been confirmed to be safe. All affected users have lost approximately $370k, and OKX will compensate. OKX will conduct a security self-examination and reorganize all relevant abandoned contracts.

⚠️ Explainer of the Twitter XSS & CSRF Vulnerability — shoucccc

Had this question pop up this morning while in a call with friends

What will MEV in a parallelized EVM look like?

Think this might be an interesting read: https://writings.flashbots.net/speeding-up-evm-part-1

Introducing the Mantle LSP — crypto_linn

Comprehensive Guide to Crypto Futures Indicators — CryptoCred

What might an “enshrined ZK-EVM” look like? — vitalik

Immutable zkEVM and Immutable Passport will be capable of gas fee abstraction, eliminating gas fees for all players. The Immutable zkEVM is powered by Polygon zkEVM — Immutable

⚠️ LEDGER LIBRARY COMPROMISED — h/t @thedailyape

DO NOT INTERACT WITH ANY APP

https://x.com/matthewlilley/status/1735275960662921638

https://x.com/bantg/status/1735279127752540465

https://x.com/blockaid_/status/1735275569586090221

Revoke cash and Sushi UIs compromised! Stay safe!

• x.com/officer_cia/status/1735276914321846498?1

#security #alert

Ledger Library Exploit Explainer for Average Folks:
Hudson Jameson

What is going on with the recent alerts not to use dapps?
A library that is used by many dapps that is maintained by Ledger was compromised and a wallet drainer was added.

What do I do as a normal user?
Do not interact with any dapp front ends on websites for now. This is an ongoing situation and it is risky to use dapps currently if you don't understand what backend libraries they use.

How does this drain your money?
If you visit the website you won't get automatically drained or your funds. However, prompts from your browser wallet (like MM) will display that give your assets to the malicious actors.

Does Ledger know about this?
Yes they do and are working on it.

Note: Even after Ledger corrects the bad code in their library, projects using and deploying that library will need to update things before it is safe to use dapps that use Ledger's web3 libraries.

The first connect-kit version with the drainer (1.1.6) was added to the npm registry at 9:44am UTC. Check that you have not interacted with any UIs starting this time — FrankResearcher

Polygon proposes Apechain to be built using Polygon CDK, purchases $10m+ APE to show alignment — Source

Binance Will List Bonk (BONK) with Seed Tag Applied
https://www.binance.com/en/support/announcement/1592b7a6ec9a408daf4b778f50ab1ca6

Crypto.com lists BONK —Tweet

RED ALERT 🚨: dingaling

If you've ever used NFT Trader [nft Marketplace] in the past, revoke approval to their contract ASAP (0x13d8faF4A690f5AE52E2D2C52938d1167057B9af)

*So far already 37 BAYC and 13 MAYC have already been drained to this address.

Boring Security: if you have any apes in lending protocols and have ever used NFTTrader, revoke approvals to NFTTrader before withdrawing.

It is most important to get folks who have deposits in BendDAO and Paraspace to revoke! For as soon as they withdraw they will be drained!

Jupiter Exchange (JUP) airdrop criteria & checker — Source

airdrop.jup.ag