Coin Market

Hacker steals $8.4M from RWA restaking protocol Zoth

Published

3 days ago

March 21, 2025

Real-world asset (RWA) re-staking protocol Zoth suffered an exploit leading to over $8.4 million in losses, leading the platform to put its site on maintenance mode.

On March 21, blockchain security firm Cyvers flagged a suspicious Zoth transaction. The security firm said that the protocol’s deployer wallet was compromised and that the attacker withdrew over $8.4 million in crypto assets.

The blockchain security firm said that within minutes, the stolen assets were converted into the DAI stablecoin and were transferred to a different address.

Cyvers added the protocol’s website had been maintained in response to the incident. In a security notice, the platform confirmed that it had a security breach. The protocol said it’s working to resolve the problem as soon as possible.

The Zoth team said it worked with its partners to “mitigate the impact” and fully resolve the situation. The platform promised to publish a detailed report once its investigation is completed.

Since the hack, the attackers have moved the funds and swapped the assets into Ether (ETH), according to PeckShield.

Hacker moves stolen funds. Source: Peckshield

Hack likely caused by admin privilege leak

In a statement, the Cyvers team said the incident highlights vulnerabilities in smart contract protocols and the need for better security.

Cyvers Alerts senior SOC lead Hakan Unal told Cointelegraph that a leak in admin privileges likely caused the hack. Unal said that about 30 minutes before the hack was detected, a Zoth contract was upgraded to a malicious version deployed by a suspicious address.

“Unlike typical exploits, this method bypassed security mechanisms and gave full control over user funds instantly,” the security professional said.

The security professional told Cointelegraph that this type of attack could be prevented by implementing multisig contract upgrades to prevent single-point failures, adding timelocks on upgrades to allow monitoring and placing real-time alerts for admin role changes. Unal added that better key management is also advised to prevent unauthorized access.

While the attack could be prevented, Unal believes that this type of attack may continue to be a problem in decentralized finance (DeFi). The security professional told Cointelegraph that admin key compromises remain a “major risk” in the DeFi ecosystem.

“Without decentralized upgrade mechanisms, attackers will continue targeting privileged roles to take over protocols,” Unal added.

Magazine: Memecoins are ded — But Solana ‘100x better’ despite revenue plunge

Coin Market

US to return $7M to victims of ‘spoofed’ crypto investment websites

Published

43 minutes ago

March 24, 2025

US authorities are seeking to return $7 million to victims of a social engineering scam that tricked them into sending money to fake cryptocurrency investment platforms.

The scam involved the fraudsters contacting victims and earning trust before directing them to websites masquerading as legitimate crypto investment platforms, Virginia’s Eastern District US Attorney’s Office said in a March 21 statement.

Once victims made a deposit, the funds were funneled through over 75 bank accounts under the names of shell companies, then sent abroad “deceptively characterized” as domestic wires, despite being transferred to a bank outside the US.

Source: US Attorney’s Office, Eastern District of Virginia

“The sites falsely represented to the victims that their investments were making sizeable gains,” Virginia’s US Attorney’s Office added in its statement.

“When victims would attempt to make withdrawals, the perpetrators would coerce the victims to send even more money using tactics such as claiming the victims owed taxes on their purported profits.”

The United States Secret Service seized some of the stolen funds from a foreign bank in 2023 and began the civil forfeiture action by filing a claim in a US District Court.

However, the bank also made a claim against the cash, and the US authorities eventually reached a settlement agreement for $7 million of the seized funds.

Victims of the scam have been urged to contact the Secret Service to petition to recover their losses.

In its 2025 Crypto Crime Report, blockchain analytics firm Chainalysis said crypto crime has entered a professionalized era dominated by efficient cyber syndicates.

Australian federal police said on March 21 they had to alert 130 people of a message scam aimed at crypto users that spoofed the same “sender ID” as legitimate crypto exchanges such as Binance.

Another similar string of scam messages reported by X users on March 14, spoofed Coinbase and Gemini and attempted to trick users into setting up a new wallet using pre-generated recovery phrases controlled by the fraudsters.

Cybersecurity firm Malwarebytes sent a warning on March 18 about a syndicate using a new form of crypto-stealing malware hidden inside a “cracked” version of TradingView Premium.

Microsoft’s Incident Response Team said on March 17 that it had discovered cyber scammers were using a new remote access trojan (RAT) that targets crypto held in 20 cryptocurrency wallet extensions for the Google Chrome browser.

Magazine: Ripple says SEC lawsuit ‘over,’ Trump at DAS, and more: Hodler’s Digest, March 16 – 22

Coin Market

Fidelity files for Ethereum-based US Treasury fund ‘OnChain’

Published

3 hours ago

March 24, 2025

Fidelity Investments has filed to register a tokenized version of its US dollar money market fund on Ethereum — joining the likes of BlackRock and Franklin Templeton in the blockchain tokenization space.

Fidelity’s March 21 filing with the US securities regulator said “OnChain” would help track transactions of the Fidelity Treasury Digital Fund (FYHXX) — an $80 million fund consisting almost entirely of US Treasury bills.

While OnChain is pending regulatory approval, it is expected to take effect on May 30, Fidelity said.

Fidelity’s filing to register a tokenized version of the Fidelity Treasury Digital Fund. Source: Securities and Exchange Commission

The OnChain share class aims to provide investors transparency and verifiable tracking of share transactions of FYHXX, although Fidelity will maintain traditional book-entry records as the official ownership ledger.

“Although the secondary recording of the OnChain class on a blockchain will not represent the official record of ownership, the transfer agent will reconcile the secondary blockchain transactions with the official records of the OnChain class on at least a daily basis.”

Fidelity said the US Treasury bills wouldn’t be directly tokenized.

The $5.8 trillion asset manager said it may also expand OnChain to other blockchains in the future.

Asset managers have increasingly turned to blockchain to tokenize Treasury bills, bonds and private credit over the past few years.

The RWA tokenization market for Treasury products is currently valued at $4.78 billion, led by the BlackRock USD Institutional Digital Liquidity Fund (BUIDL) at $1.46 billion, according to rwa.xyz.

Market caps of blockchain-based Treasury products. Source: rwa.xyz

Over $3.3 billion worth of RWAs are tokenized on the Ethereum network, followed by Stellar at $465.6 million.

BlackRock’s head of crypto, Robbie Mitchnick, recently said Ethereum is still the “natural default answer” for TradFi firms looking to tokenize RWAs onchain.

“There was no question that the blockchain we would start our tokenization on would be Ethereum, and that’s not just a BlackRock thing, that’s the natural default answer.”

“Clients clearly are making choices that they do value the decentralization, they do value the credibility, and the security and that’s a great advantage that Ethereum continues to have,” he said at the Digital Asset Summit in New York on March 20.

Magazine: Comeback 2025: Is Ethereum poised to catch up with Bitcoin and Solana?

Coin Market

Cathie Wood to kick off El Salvador's AI public education program

Published

6 hours ago

March 23, 2025

Cathie Wood, founder of the Ark Invest investment firm, will give the inaugural lecture for El Salvador’s new Urban Centers for Welfare and Opportunities (CUBO) AI program, a public education initiative spearheaded by the government of El Salvador.

According to El Salvador’s Bitcoin Office, the program will bring university-level AI courses to students and professionals and follows the country’s highly successful CUBO Bitcoin (BTC) and Lightning Network developer program.

The program will leverage industry experts to provide AI education to the public. El Salvador’s Bitcoin Office wrote in a March 23 X post:

“As El Salvador turbocharges its transformation into the ultimate tech and financial powerhouse of the region, CUBO AI will arm students and professionals in the country with the tools to dominate the AI frontier.”

El Salvador continues to attract crypto businesses and foreign direct investment as the Central American country positions itself as a regional tech and digital finance hub.

Cathie Wood pictured left, with El Salvador’s President Nayib Bukele in the center, and economist Art Laffer, on the right, meet in May 2024. Source: El Salvador’s Bitcoin Office

El Salvador becoming a regional tech hub amid education and investment push

El Salvador has taken several steps to establish itself as a regional hub for innovation, including integrating Bitcoin classes into public education, leveraging geothermal energy to mine BTC, and passing pro-crypto and AI policies.

Cathie Wood met with El Salvador’s President Nayib Bukele in May 2024 to discuss the future of digital assets and AI policy in the Central American country, including potential education initiatives tailored by Ark Invest.

Wood left the meeting confident that El Salvador could increase its gross domestic product (GDP) tenfold over the next five years if it continues pursuing its tech-focused agenda.

“The President could scale El Salvador’s GDP 10-fold during his next 5-year term,” Wood wrote in a May 2024 X post and praised Bukele as forward-thinking.

Bukele also met with Elon Musk in September 2024 to discuss artificial intelligence and other 21st-century technologies, including crypto.

Musk likewise praised Bukele as “an amazing leader,” and the two continue to build rapport that could potentially lead to collaboration between the businessman and the government of El Salvador.

Magazine: El Salvador’s national Bitcoin chief has been orange-pilling Argentina