Connect with us
DAPA Banner

Crypto World

Whitehat hacker accuses Injective of ghosting after $500M bug disclosure

Published

on

Whitehat hacker accuses Injective of ghosting after $500M bug disclosure

A whitehat hacker has gone public over a months-long feud with the team behind Injective over its response to a critical bug disclosure.

According to the report, the vulnerability in question put $500 million at risk via a faulty validation system.

The pseudonymous crypto security researcher, who goes by the moniker al_f4lc0n, has accused Injective of ghosting them for three months, despite fixing the bug, and later lowballing the bounty payout.

Read more: Ethereum address poisoning spike, ‘wallets aren’t ready’ says researcher

Advertisement

The bug

The bounty hunter uploaded a full bug report to a GitHub repository called “injective-wall-of-shame.”

In the repo’s readme, entitled “I Saved Injective’s $500M. They Pay Me $50K,” they explain that the vulnerability allowed “any user to directly drain any account on the chain. No special permissions needed.”

The more detailed technical report describes how a faulty subaccount validation system allowed for an attacker to submit market orders on other users’ behalf.

The bug was exploitable by an attacker creating a worthless token and creating a spot market, pairing it with USDT. Both these actions are permissionless on Injective.

Advertisement

Then, by creating a sell order of the fake token, the attacker could force victim accounts to buy the worthless token for USDT, “at the attacker’s chosen price.” The USDT could then be permissionlessly bridged off Injective, to Ethereum.

The report claims this put all value on the blockchain at risk, and that the total was over $500 million at the time of disclosure.

The figure currently sits at $280 million, the vast majority of which is in the INJ token.

Embed: Oracle error adds to turmoil at DeFi giant Aave

Advertisement

The bounty

Injective is a blockchain network which lists the likes of Binance, Jump, Google and Pantera as partners, claiming “institutional and government players are joining us.”

Bug bounties are a common way for organizations to crowdsource continuous security monitoring from specialist whitehat bounty “hunters.”

Injective’s ImmuneFi page lists a maximum bounty of $500,000 for critical threats related to its blockchain and smart contracts.

The researcher claims, “a mainnet upgrade to fix the bug went to governance vote. The Injective team clearly understood the severity.”

Advertisement

They also allege that injective “ghosted” for three months after the fix, before offering a bounty 10x lower than the maximum. “To be clear: the $50K has not been paid either,” they stress. 

Protos has reached out to Injective for comment on al_f4lc0n’s claims, but hadn’t received a response before publication. This article will be updated should we receive one.

Got a tip? Send us an email securely via Protos Leaks. For more informed news, follow us on XBluesky, and Google News, or subscribe to our YouTube channel.

Advertisement

Source link

Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Crypto World

South Korea fines Bithumb $24 million, orders 6-month partial suspension over AML violations

Published

on

Bithumb mistake sent BTC price to $55,000 on that exchange

Bithumb, one of South Korea’s leading crypto exchanges, has been fined by the country’s anti–money laundering and counter-terrorism financing agency.

South Korea’s Financial Intelligence Unit (FIU) has slapped a 36.8 billion won ($24.6 million) fine and ordered a six-month partial suspension after finding millions of violations of the country’s anti-money laundering rules.

The sanctions stem from violations of the Act on Reporting and Using Specified Financial Transaction Information, the Financial Services Commission said, according to local media.

According to the FIU, Bithumb committed about 6.65 million violations. Around 3.55 million involved failures to carry out required customer identity verification, while 3.04 million were related to cases where the exchange failed to properly block transactions that should have been blocked.

Advertisement

The suspension targets services for newly registered users. Existing customers will still be able to trade and move funds on the platform, according to initial reports on these sanctions.

Regulators also issued personnel penalties. Bithumb’s chief executive received a reprimand warning, while the exchange’s reporting officer was suspended for six months.

The violations surfaced during on-site inspections of South Korea’s five largest crypto exchanges, Upbit, Bithumb, Coinone, Korbit and Gopax, conducted between 2024 and 2025.

The case comes as South Korean regulators tighten oversight of the crypto market. Last year, the FIU handed Dunamu, the operator of the country’s largest exchange, Upbit, a three-month partial suspension and a 35.2 billion won fine for compliance gaps. Korbit, a rival platform, faced a smaller penalty of 2.73 billion won, along with institutional warnings.

Advertisement

Bithumb, founded in 2014, ranks among the largest exchanges in South Korea by trading volume, according to CoinGecko data. The partial suspension comes just a month after Bithumb mistakenly distributed billions of dollars worth of bitcoin to users.

CoinDesk has reached out to Bithumb for comment, but hasn’t heard back at the time of writing.

Source link

Advertisement
Continue Reading

Crypto World

PayPay (PAYP) Stock Surges 16% Following Nasdaq IPO Launch and Positive Analyst Coverage

Published

on

PAYP Stock Card

Key Takeaways

  • PayPay (PAYP) set its IPO price at $16 per ADS on March 11, coming in under the anticipated $17–$20 range, generating approximately $880 million in proceeds
  • The stock launched on Nasdaq March 12 with an opening price roughly 19% higher than the offering price, establishing a company valuation near $12.7 billion
  • PAYP closed Friday March 13 at $21.14, representing a 16.41% gain and pushing market capitalization toward $14.1 billion
  • Macquarie launched coverage with an Outperform recommendation and $22.90 target, highlighting PayPay’s commanding 65% QR code market position and 72 million user base
  • ARK Invest reportedly purchased PAYP shares during the initial surge, while CEO Ichiro Nakayama mentioned potential for Tokyo Stock Exchange dual-listing

PayPay Corporation launched a successful Nasdaq debut last week, trading significantly above its initial public offering price and attracting early analyst attention within its first few trading days. The Japanese mobile payment platform, backed by SoftBank, has officially joined the public markets, capturing considerable Wall Street interest.


PAYP Stock Card
PayPay Corporation American Depository Shares, PAYP

The company established its IPO pricing at $16 per ADS on March 11 — a figure that fell short of the marketed $17 to $20 range. This cautious pricing strategy reflected broader market uncertainty stemming from international geopolitical developments. The offering generated approximately $880 million through the sale of roughly 55 million ADSs. Lead underwriters included Goldman Sachs, J.P. Morgan, Mizuho, and Morgan Stanley.

When trading commenced on March 12, PAYP launched approximately 19% above its offering price. The momentum continued building throughout the session.

By the closing bell on Friday March 13, PAYP settled at $21.14 — representing a $2.98 increase, or 16.41% daily gain. Trading volume exceeded 14 million ADSs during the session. The stock reached an intraday peak of $21.98 while touching a low of $19.81.

This Friday closing price elevated PayPay’s market capitalization to approximately $14.1 billion, rising from the roughly $12.7 billion valuation established at the IPO opening. Extended-hours trading showed modest retreat to around $20.80.

Advertisement

The public offering represents the most significant U.S. IPO from a Japanese enterprise in ten years. It additionally marks SoftBank’s first substantial U.S. public market debut of a majority-controlled portfolio investment since Arm’s 2023 listing.

Macquarie Launches Coverage with Bullish Stance

On March 16, Macquarie began coverage of PAYP with an Outperform designation and established a $22.90 price objective.

The investment firm highlighted PayPay’s commanding presence in Japan’s QR code payment ecosystem — controlling approximately 65% market share and serving roughly 72 million users, equivalent to about three-quarters of Japan’s smartphone-equipped population. QR code transactions account for one in five cashless payments across Japan.

Macquarie observed that PayPay is evolving beyond a simple payment wallet into a comprehensive digital financial services platform encompassing money transfers, savings products, lending solutions, and investment services. The platform currently serves around 16 million card holders, maintains 9.7 million bank accounts, and manages 1.54 million securities accounts.

Advertisement

Japan’s cashless payment adoption reached 42.8% in 2024. Government objectives target 65% penetration by 2030, while QR code payment adoption has expanded at a compound annual growth rate of approximately 75% from 2019 through 2024.

Macquarie projects PayPay’s revenue will achieve ¥456.5 billion in the fiscal year concluding March 2027, reflecting 21.6% year-over-year growth, while operating profit is expected to surge 73.6% to ¥135.1 billion.

Future Outlook for PAYP

CEO Ichiro Nakayama ceremonially opened Nasdaq trading on debut day. Subsequently, he has expressed receptiveness to potentially pursuing a dual listing on the Tokyo Stock Exchange.

ARK Invest was documented as having acquired PAYP shares during the early post-listing momentum — demonstrating institutional appetite for the stock.

Advertisement

PayPay is currently executing the integration of Line Pay operations, with complete merger completion scheduled for late March 2026.

For the twelve-month period ending December 31, 2025, PayPay’s payment division gross merchandise volume surpassed ¥15 trillion.

Source link

Advertisement
Continue Reading

Crypto World

US, UK, and Canada Launch Joint Operation to Disrupt Crypto Fraud

Published

on

Fraud, Law, Canada, United States, United Kingdom, Enforcement

The US Secret Service, UK National Crime Agency, and Canadian authorities have partnered to disrupt fraudulent schemes related to crypto, raise awareness of scams, and recover stolen funds.

In a Monday notice, law enforcement agencies from the three countries — including Canada’s Ontario Provincial Police and the Ontario Securities Commission — said that they had launched “Operation Atlantic,” focusing on identifying people at risk of losing or those who had already lost crypto through “approval phishing” schemes.

“Approval phishing and investment scams cost victims millions in financial loss each year,” said Brent Daniels, deputy assistant director for the US Secret Service’s Office of Field Operations. The agencies said they hope to identify and disrupt these scams in near real-time.

Fraud, Law, Canada, United States, United Kingdom, Enforcement
Source: Ontario Securities Commission

According to blockchain analytics platform Chainalysis, approval phishing scams involve “the scammer trick[ing] the user into signing a malicious blockchain transaction that gives the scammer’s address approval to spend specific tokens inside the victim’s wallet, allowing the scammer to then drain the victim’s address of those tokens at will.”

According to the Ontario Securities Commission, Operation Atlantic built upon the commission’s Project Atlas. The operation was launched in 2024 by the Ontario Provincial Police with the US Secret Service and targeted crypto fraud networks. 

Advertisement

The initiative will also work with the Royal Canadian Mounted Police, the City of London Police, the US Attorney’s Office for the District of Columbia and the UK’s Financial Conduct Authority (FCA).

Related: SEC drops case against BitClout founder with prejudice

Are different phishing scams on the rise?

Phishing scams usually involve different methods, seemingly from legitimate sources, that trick users into giving fraudsters access to their crypto wallets. According to crypto intelligence platform Nominis’ monthly report, phishing attacks increased sharply in February, but the amount stolen in crypto-related scams and exploits overall fell to $49 million from $385 million in January.

Chainalysis launched Operation Spincaster in 2024, targeting “approval phishing” scams, which it reported had resulted in $2.7 billion in crypto stolen between May 2021 and July 2024.

Advertisement

Magazine: All 21 million Bitcoin is at risk from quantum computers