Update on today's incident: We've identified a critical vulnerability in our withdrawal API, where there was an exploit that allowed unauthorized withdrawals to bypass our security checks. We've frozen withdrawing funds on smart wallets until this is fully resolved.

Most importantly - all smart contracts, admin wallets, and user smart wallets remain fully secure and uncompromised

The root cause was an authentication spoofing technique in our API routes due to architectural constraints within our auth system. We've learned a lot from this exploit and are implementing more robust security measures to prevent a situation like this from ever happening again.

All affected users will be refunded this week

The issue is now patched - here’s a quick summary.

Check out Ben’s cast for the full write up.

Co-founder @ponder | @survey | Ex   | colinjohnson.io

we love you right back. Thank you for existing my good ser. to your 4th point, who do we know in Paris? lmao or do you think the VPN they used were pointed to Paris?

Digital Media Producer. I like particles and waves too. I like art.

Could very well be a VPN, just funny that every hack seems to originate from there lol

co-founder @ponder @survey // benadamsky.com

Lmao ser many revolutions started there… maybe related? Haha

Le hacker

https://upload.wikimedia.org/wikipedia/commons/thumb/2/2a/Croissant-Petr_Kratochvil.jpg/1200px-Croissant-Petr_Kratochvil.jpg

Ponder

I didn’t realize /ponder was hosted on croissants… tbh

Turns out our real vulnerability was buttery flaky goodness