cross-chain

Chainalysis posted on the X platform that before the theft of THORChain, wallets suspected to be associated with the attacker had been transferring funds through Monero, Hyperliquid, and THORChain for several weeks. The attacker-associated wallets had already deposited into Hyperliquid positions via the Hyperliquid and Monero privacy bridge as early as the end of April. The funds were then exchanged for USDC and transferred to Arbitrum, and later bridged to Ethereum, with some ETH subsequently transferred to THORChain to become staked RUNE for newly added nodes, which are believed to be the source of the attack.Afterward, the attacker bridged some RUNE back to Ethereum and split it into four pathways, one of which went directly to the attacker. After being transferred through intermediate wallets, 8 ETH was sent to the final wallet receiving the stolen funds 43 minutes before the attack. The funds from the other three pathways flowed in the opposite direction. These wallets bridged ETH back to Arbitrum, deposited it into Hyperliquid, and transferred it into Monero through the same privacy bridge, with the last transaction occurring less than 5 hours before the attack began.As of Friday afternoon, the stolen funds have not yet been used, but the attacker has demonstrated their skilled cross-chain money laundering capabilities, and the Hyperliquid to Monero path may become the next move.

According to CoinDesk, Kraken announced that it will use Chainlink's cross-chain interoperability protocol CCIP, replacing LayerZero as the exclusive cross-chain infrastructure for its wrapped assets, covering kBTC and more wrapped assets in the future. This migration involves over $3 billion in TVL, following a $292 million LayerZero-related cross-chain attack incident that occurred in April. Kraken stated that the migration will cover networks such as Ink, Ethereum, Unichain, and Optimism. kBTC is set to launch in 2024, with a current market value of approximately $260 million. Coinbase had previously also chosen Chainlink CCIP as the sole cross-chain bridge solution for about $7 billion in wrapped tokens.

Aave stated that the first batch of rsETH has been transferred to LayerZero's OFT adapter, and cross-chain operations for rsETH between the mainnet and various L2s have been reopened.This progress means that the previously affected rsETH cross-chain channels have been restored for use, covering the Ethereum mainnet and L2 networks.

The TAC team announced that its cross-chain layer's TON side was exploited by external attackers, resulting in a loss of approximately $2.8 million, involving USDT, BLUM, and tsTON. TAC, TON, and all ERC-20 tokens bridged from Ethereum are unaffected. The bridging service remains suspended, and forensic analysis and repair work are ongoing. A complete report with more details will be released within the next 48 hours.The team is actively collaborating with law enforcement, SEAL 911, and security partners to track and freeze the stolen funds. The team stated that its core focus is to sell the foundation's TAC token reserves in a legally structured manner to compensate for user losses and fully restore bridging liquidity. Official channels will continue to update progress.

NEAR Intents announces an upgrade to its cross-chain exchange functionality, allowing users to directly exchange over 100 types of tokens for Zcash (ZEC) through a single transaction process.This upgrade is based on NEAR's intent-based infrastructure, abstracting complex backend routing logic to simplify the user experience for cross-chain interactions. By integrating Zcash into a broader exchange ecosystem, NEAR Intents targets users who wish to consolidate multiple token holdings into a single privacy-enhanced asset without needing to switch between multiple protocols or cross-chain bridges. This move demonstrates NEAR's ongoing commitment to advancing cross-chain interoperability through its Intents protocol.

Sky Ecosystem posted on platform X that the USDS OFT cross-chain bridging on the Solana network has resumed operation, which was temporarily paused due to a security review related to the rsETH vulnerability.Sky stated that throughout the review period, both the Sky Protocol and the USDS contract were unaffected, and USDS has always maintained full collateral as designed by the protocol, which can be verified on-chain at any time. This pause was a precautionary measure.With the completion of the security review, the USDS cross-chain bridging on the Solana chain has reopened, while the bridging to Avalanche will resume after further review is completed.

LayerZero Labs posted on the X platform that the internal RPC used by LayerZero Labs was attacked by the Lazarus Group in the past three weeks, resulting in the compromise of the true source of its DVN (Decentralized Verification Network), while external RPC providers faced DDOS attacks. This incident affected 0.14% of applications and approximately 0.36% of asset value.LayerZero Labs stated that asset security is currently intact, and since April 19, over $9 billion in funds have been completed across chains through the protocol. In response to security risks, LayerZero Labs has stopped providing services for its DVN in a 1/1 configuration, and all default configurations for channels will be migrated to at least a 3/3 or 5/5 multi-DVN mode.Additionally, in response to an incident three years ago where multi-signature holders mistakenly used hardware wallets for personal transactions, LayerZero Labs has removed that signer and changed wallets, while also developing a OneSig custom multi-signature system. LayerZero Labs recommends that developers lock configurations to avoid relying on default settings and plans to launch an asset management platform Console to enhance security monitoring.

According to The Block, after experiencing a bridge attack of approximately $292 million last month, Kelp DAO decided to abandon LayerZero and instead adopt Chainlink's cross-chain infrastructure.Kelp DAO will use the Chainlink Cross-Chain Interoperability Protocol, which requires 16 independent node operators to validate cross-chain transactions, becoming the first major protocol to leave LayerZero after the attack. During the attack, the LayerZero-driven OFT bridge used a 1-of-1 single validator configuration, with 47% of LayerZero applications using the same configuration at that time. LayerZero subsequently announced the cessation of single validator configurations.Kelp DAO stated that migrating to Chainlink CCIP directly addresses the architectural vulnerabilities in the attack. rsETH will also adopt a cross-chain token standard. As part of the DeFi United rescue operation, LayerZero has donated and lent approximately 10,000 ETH to Aave.

"On-chain detective" ZachXBT disclosed that the DSJ Exchange (DSJEX) / BG Wealth Sharing Ponzi scheme, involving over $150 million, collapsed last week.Under its leadership, actions were taken in collaboration with Tether, Binance security teams, OKX, and U.S. law enforcement agencies, resulting in approximately $41.5 million in funds being frozen, including $38.4 million frozen by Tether on May 4, and about $3.1 million frozen by other platforms.It is reported that the project has been operating since 2025, using "1.3%--2.6% daily returns" as a gimmick to attract users through referral commissions and tiered rewards. DSJ has been identified as a fraudulent trading platform, BG as a supporting investment organization, and the so-called CEO "Stephen Beard" is also a fictional character. Investigations show that the project team evaded regulation by frequently changing domain names and hot wallets, and promoted false trading signals through messaging applications. Before the collapse, the platform had suspended withdrawals and demanded users pay a 12% "tax" under the pretext of "upcoming IPO."In terms of fund flow, the involved addresses transferred assets through Tokenlon exchanges, cross-chain bridges (such as Bridgers, Butter Network), and stablecoin wrapping/unwrapping, ultimately flowing into addresses of multiple exchanges. Currently, 13 regulatory agencies from five continents have issued risk warnings regarding this project. Analysts believe that this incident once again highlights the critical role of cross-chain tracking and multi-party collaboration in combating cryptocurrency fraud.

According to The Block, Nasdaq-listed Solana ecosystem treasury company SOL Strategies announced the signing of a final acquisition agreement with HoudiniSwap, with an acquisition amount of $18 million, which includes $8.25 million in cash, $5.75 million in six-month promissory notes, and $4 million in STKE stock (calculated based on the volume-weighted average price over the 90 days prior to the completion of the acquisition).HoudiniSwap is a non-custodial, privacy-focused cross-chain exchange aggregation platform that supports competitive exchange routing across centralized and decentralized exchanges as well as blockchain bridges, with revenue of approximately $13 million last year.

According to official news, B.AI announced a formal partnership with deBridge, and both parties will jointly explore intent-driven cross-chain infrastructure to provide seamless cross-chain execution for a scalable AI Agent economy. B.AI is committed to building the financial underlying infrastructure for the AI Agent era, while deBridge's 0-TVL model and gasless cross-chain technology provide secure and decentralized underlying support. With deBridge's MCP and intent-driven Bundles, both parties will work together to promote an efficient and secure autonomous trading system, accelerating the implementation of cross-chain execution in the AI Agent era.

According to market news, attackers launched an attack on Syndicate by infiltrating the Commons cross-chain bridge. The related address acquired approximately 18.5 million SYND tokens and sold them for a profit of about $330,000, with the funds having been transferred to Ethereum.

ZetaChain announced that the GatewayEVM contract was attacked, but it only affected the internal team wallets of ZetaChain. The team has blocked the attack vector to ensure that no further funds are at risk and will release a detailed post-mortem analysis report after completing the investigation.Currently, as a precaution, ZetaChain has suspended cross-chain transactions. The investigation is still ongoing, and so far, no user funds have been affected by this attack. The current status can be tracked on the relevant page.

According to on-chain analyst Yu Jin's monitoring, the Bless project team continued to cross-chain 100 million BLESS (worth approximately $660,000) from the Solana chain to the BSC chain today and sold it.Since BLESS surged more than ten days ago, the Bless project team's address has sold a total of 500 million BLESS, worth approximately $5.09 million, of which 200 million were transferred to Bitget for sale, and 300 million were dumped on the BSC chain.

Ethena officially announced that the LayerZero cross-chain bridge functionality for sUSDe and USDe has been relaunched on all chains. To enhance security, Ethena has upgraded the decentralized verification network (DVN) configuration on each chain from 2/2 to 4/4, while maintaining the existing rate limit of $10 million per hour. The official statement indicated that further updates will be provided as necessary.

According to on-chain analyst Specter (@SpecterAnalyst), the North Korean hacker group TraderTraitor began laundering stolen funds from KelpDAO early this morning Beijing time, just three hours after the Arbitrum Council froze 30.7 ETH (approximately $71 million).The attackers split the remaining funds into three wallets, holding approximately 25,000 ETH (about $57.6 million), 25,700 ETH (about $59.2 million), and 25,000 ETH (about $57.9 million), with the third wallet immediately starting the laundering process, currently holding about 3,800 ETH (approximately $8 million). The funds are primarily being bridged to the Bitcoin network via THORChain, with about 99% of the funds flowing through this protocol, causing THORChain's trading volume to surge to $211 million that day, more than ten times its 30-day average, generating approximately $189,000 in fees.During this laundering process, the funds were also mixed with illicit proceeds from the BTC Turk (2025) and Bybit (2025) hacking incidents, with related funds currently tracked on the Bitcoin network totaling approximately 442 BTC (about $33 million), and the entire laundering process has utilized over 400 addresses.

ether.fi posted on platform X that weETH based on the LayerZero cross-chain bridge has now been restored on all chains, and liquidity minting and redemption functions have been enabled.In terms of security, the ether team has increased the number of DVNs (Decentralized Verification Networks) from 2 to 4 and implemented stricter rate limiting mechanisms to further enhance system security. Additionally, related services will gradually resume under the guidance of security partners, and more updates will be released in the future.

On-chain investigator ZachXBT updated that the funds related to the KelpDAO attack have begun to be transferred, with approximately $1.5 million being cross-chain transferred from the Ethereum mainnet to the Bitcoin network via Thorchain, and another approximately $78,000 being transferred through Umbra.The initial source of funds for the related attack addresses came from Tornado Cash, and the money laundering and cross-chain transfers are still ongoing.

The USDT0 cross-chain bridging infrastructure has resumed normal operations today, with system integrity and risk exposure unaffected. All in-transit transactions submitted before the suspension have been safely settled.Previously, USDT0 suspended OFT bridging services as a precautionary measure pending the investigation of the KelpDAO rsETH incident, emphasizing that USDT0 has no risk exposure related to this incident, and all USDT0 tokens remain fully backed 1:1 by USDT.