Invest ideasNews
31 May 2026, 09:18
Gravity Bridge Hit by $5.4M Exploit as Bitcoin ETFs Bleed $2.97B Amid Peak Sentiment
Crypto News Gravity Bridge, a cross-chain protocol moving assets between Ethereum and the Cosmos ecosystem, was drained of roughly $5.4 million in a fresh exploit that has forced validators to susp...
31 May 2026, 05:06
Gravity Bridge Hit by $5.4M Cross-Chain Security Breach
Gravity Bridge suffered a $5.4M loss after suspected key breach, security firms reported. Attackers quickly moved funds via exchanges, yet over $4M in ETH remains in their wallet. Cross-chain bridge hacks persist, adding to $328.6M losses across eight incidents in 2026. Gravity Bridge has lost about $5.4 million after a suspected compromise of a signing key, according to security firm PeckShieldAlert. The attack hit the cross-chain bridge that connects Ethereum and the Cosmos ecosystem, allowing the attacker to drain several digital assets and quickly move part of the funds. In a post on X, PeckShieldAlert said the stolen assets included $4.3 million in USDC, 274 ETH worth about $553,000, $434,000 in USDT, and roughly $64,000 in PAYG tokens. The attacker routed some of the funds through ChangeNow and Binance shortly after the theft. However, on-chain data shows the… Read The Full Article Gravity Bridge Hit by $5.4M Cross-Chain Security Breach On Coin Edition .
31 May 2026, 02:30
XRP Ledger's new proposal blocks the flash loan attacks costing DeFi hundreds of millions
A draft XRPL amendment notes that flash loan attacks are "structurally impossible" on the network because of how its transactions are built, an architectural quirk that has spared the chain from the exploit class that has cost Ethereum DeFi billions.
30 May 2026, 23:45
South Korea Cracks Down on CatFi Rugpull: First-Ever Crypto Fraud Case Under New Investor Protection Law
South Korean prosecutors have filed charges against a group of individuals linked to a Solana-based meme coin project called CatFi, following allegations that the token was used in a coordinated rugpull scheme after attracting investor funds. The Seoul Southern District Prosecutors’ Office confirmed in its Wednesday statement that five individuals are now facing charges in connection with the case, including two main suspects who have been placed in custody and three others who have been indicted without detention. Influencer Ruse, Fake Lockups Investigators say the group created and launched CatFi in early 2025 through the Solana meme coin platform Pump.fun. It managed to draw in investors soon after listing, only to abandon the project once enough money had entered the token. Prosecutors highlighted that the case is legally significant because it is the first time the country’s Virtual Asset User Protection Act has been used to prosecute a rug pull under fraudulent and unfair trading provisions. Interestingly, it is also the first known prosecution involving a crypto crime carried out through a decentralized exchange, which had previously remained largely outside regulatory reach. According to the findings, the suspects did not rely solely on token mechanics to generate interest but allegedly built a misleading promotional ecosystem around the project. One of the accused reportedly presented himself online as an independent crypto influencer, using that identity to push investment interest toward CatFi. Meanwhile, another handled official project communications, where follower numbers were artificially inflated, and announcements were posted claiming fake token lock-up arrangements intended to suggest stability. Authorities further allege that the group circulated tokens across multiple wallets and carried out wash trading activity to disguise their control over supply and to create the appearance of genuine market demand. In the hours following launch, CatFi’s price reportedly surged dramatically, increasing by roughly 1,001 times within a 26-hour window, during which about 6,000 investors bought into the token. Prosecutors said that 256 of these investors later reported total losses amounting to around 900 million Korean won, which is roughly equivalent to $600,000, while the suspects are believed to have secured profits exceeding 400 million won. The scheme had initially drawn attention from online blockchain analysts who traced wallet activity and publicly identified those involved, but police at the time closed the case after the suspects claimed they had been victims of hacking. The matter was later escalated when the Financial Services Commission referred it to prosecutors, which ultimately led to a joint investigation involving a dedicated crypto crime unit as well as financial and tax authorities, that tracked down the suspects, including one individual who had evaded capture for three months using disguises. Arrests followed on May 11 for two suspects, while the remaining three were detained later on Wednesday. High User Activity Despite Allegations Pump.fun has come under intense scrutiny for enabling large-scale speculative token activity on Solana, where most newly created meme coins are linked to scams like rug pulls and pump-and-dump schemes. The platform’s ease of token creation and low transaction costs drove rapid trading. Despite this, the meme coin launchpad emerged as one of the Solana ecosystem’s top revenue-generating applications in 2025. In fact, it was one of seven Solana apps that earned over $100 million in revenue during the year. The post South Korea Cracks Down on CatFi Rugpull: First-Ever Crypto Fraud Case Under New Investor Protection Law appeared first on CryptoPotato .
30 May 2026, 20:30
Alephium token bridge exploited for $815K as hackers mint millions of unbacked ALPH
Hackers have drained approximately $815,000 from Alephium’s Token Bridge on Ethereum. They minted 13.76 million wrapped ALPH tokens from forged transactions, prompting the project to warn liquidity providers to pull their funds immediately. This exploit adds to the increasing number of bridge attacks that have occurred in May. The Verus-Ethereum bridge lost around $11.5 million in an attack on May 18, while Cryptopolitan reported earlier on May 30 that Gravity Bridge lost $5.4 million, the same day Alephium’s TokenBridge suffered an exploit. What made the attack successful? Blockchain security firm Blockaid detected the exploit and reported that the attacker compromised three of four guardian keys protecting the bridge. Upon gaining control of a signing majority, the attacker forged Verified Action Approvals (VAAs), the cryptographic messages that authorize cross-chain transfers. According to Blockaid, the entire operation took roughly seven minutes. The attacker used the forged VAAs to mint 13.76 million wrapped ALPH, which is reportedly more than 100% of the token’s prior wrapped supply. Additional assets, including USDT, USDC, WBTC, and WETH, were unlocked from the bridge’s custody contract. On-chain analyst Specter flagged that the attack hit both the Ethereum and BNB Chain bridge contracts. Specter stated that the attacker then moved stolen funds from BNB Chain to Ethereum, and a portion has already been deposited into Tornado Cash, according to Specter’s analysis posted on X. Alephium denies guardian key compromise However, Alephium has provided further updates disputing the Blockaid’s submission, stating, “The exploit was NOT caused by a compromise of the guardian keys, contrary to some early external reports.” According to the protocol, the exploit was “caused by an offchain vulnerability in the bridge backend that could be triggered in specific edge cases.” Alephium gave a breakdown of the funds that were drained across Ethereum and BNB, stating that 200,967 USDT, 17,594 USDC, 5.18 WETH, and 0.335 WBTC were taken from the former, while 36,750 USDT and 24.386 WBNB were taken from BNB. Alephium tells LPs to withdraw Alephium also warned anyone providing liquidity to ALPH pools on Uniswap or PancakeSwap. In a follow-up update, the platform gave a comprehensive reason why it asked users to withdraw liquidity, stating , “Because the bridge has been shut down, the attacker cannot redeem or bridge these wrapped ALPH back through the Alephium bridge. We therefore ask users not to provide liquidity to ALPH pools on Ethereum or BNB Chain, to withdraw any existing liquidity, and not to swap against these pools,” adding that “Additional liquidity or trading activity would increase the attacker’s ability to realize value from the unauthorized wrapped ALPH.” ALPH is currently trading at $0.037 with a market capitalization of over $5 million, while the total value locked (TVL) across Alephium’s DeFi protocols sat at approximately $756,000, and it has over $308,000 as bridged TVL, per DefiLlama data . The Alephium team has stated that they are currently focusing on recovery and remediation efforts and promised to share more updates in the coming week. A brutal month for bridges The Alephium exploit adds to what has become a punishing stretch for cross-chain infrastructure. The Gravity Bridge hack , also reported the same day, saw $5.4 million drained through what on-chain analysts suspect was a contract key compromise, according to Cryptopolitan’s reporting. About two weeks earlier, the Verus-Ethereum bridge lost $11.5 million in a verification bypass exploit, according to DefiLlama’s hacks database. THORChain also suffered a $10 million coordinated attack across Bitcoin, Ethereum, BNB Chain, and Base on May 15, as reported by Cryptopolitan. Cross-chain bridges have seen increased attacks from bad actors recently, and they have collectively lost over $326 million in 2026 alone as of mid-May. Bridge protocols account for $3.2 billion of the $16.6 billion in total value hacked across crypto history, according to DefiLlama, a disproportionate share given the relatively small number of bridge protocols compared to other DeFi categories. The persistent vulnerability of these platforms and the growing frequency of attacks from April into May have made the pattern difficult to ignore. Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free .
30 May 2026, 20:10
Circle freezes Zama's cUSDC contract after Overnight Finance funds flow into privacy wrapper
Zama’s co-founder Rand Hindi, has clarified that the blacklist placed by Circle on the protocol’s contract address had nothing to do with Zama at all. Reports show that approximately $12.6 million in user funds were locked in Zama’s confidential USDC token on Ethereum. Why was Zama’s contract frozen? Following reports that $12.6 million in user funds on Zama have become inaccessible, the company’s co-founder, Rand Hindi, took to X to give an explanation. He also gave credit to on-chain investigator ZachXBT for his role in identifying the source of the problem. The story goes that an address linked to the Overnight Finance hack had deposited more than $12.5 million USDC into Zama’s cUSDC wrapper. However, as the wrapper was not so popular at the time, that single deposit represented nearly 100% of all the funds in the contract. “This has nothing to do with Zama, or privacy,” Hindi insisted on X. “The issue stems from an address related to the Overnight Finance hack.” The USDT/USDC Ban List Telegram tracker shows that Zama’s contract address was frozen at 01:08 UTC on Friday. The targeted address, 0xe978…72B2, is publicly labeled on Etherscan as “Zama: cUSDC Token.” Why did Circle’s ban affect uninvolved users? Circle’s compliance system flagged the depositor’s wallet, but because those funds sat inside Zama’s cUSDC contract, a standard holding freeze was applied to the entire contract address rather than just the individual depositor. ZAMA’s token dropped by 18.2% intraday, falling from around $0.039 to $0.032 over roughly five and a half hours. Trading volume spiked to 61% in 24 hours to $73.9 million, nearly matching the token’s $77.5 million market cap. The token partially recovered to $0.035, but that’s still less than its value prior to the freeze. Hindi emphasized that the protocol “is not a mixer” and does not obscure senders or recipients, only balances and amounts. He pointed out the depositor’s cUSDC transaction history on Blockscout as evidence that transactions remain traceable. As an immediate precaution, Zama paused its cUSDC, cUSDT, and cWETH contracts pending a full investigation. Hindi said the team would publish a post-mortem and a framework for handling future freeze requests. If Zama’s legal team fails to convince Circle or the court that issued the restraining order to narrow the freeze to the specific flagged depositor, legitimate users who deposited USDC into cUSDC will remain locked out. If you're reading this, you’re already ahead. Stay there with our newsletter .
