{ "version": 1, "event_id": "evt_28893b5a9e8c009d", "url": "https://xiyu.news/events/evt_28893b5a9e8c009d/", "json": "https://xiyu.news/api/events/evt_28893b5a9e8c009d.json", "type": "security_incident", "status": "monitoring", "category": "crypto", "title": { "zh": "Bybit 拦截协同式虚假充值攻击，避免逾 10 亿美元 DOT 潜在损失", "en": "Bybit Detects and Blocks Coordinated Fake Deposit Attacks, Preventing Over $1 Billion DOT in Potential Losses - Yellow.com" }, "current_state": { "zh": "Bybit 表示已检测并拦截了一波针对多条区块链网络的协同式虚假充值攻击，避免了价值超过 10 亿美元 DOT 的潜在损失。该交易所称，这些攻击采用了日益复杂的手法，意在利用其充值扫描系统的薄弱环节。\n\n虚假充值攻击打击的是交易所基础设施的验证层，也就是用户默认信赖、负责正确入账的那一环，因此若这一规模攻击得手，将成为交易所有史以来最大的损失事件之一。该事件也说明中心化交易所的充值流程仍是活跃的攻击面，攻击者可以跨链、跨币种将其产业化复制。\n\n据 Bybit 称，此次攻击横跨多条区块链网络，且具有协同性而非偶发性质，说明攻击者事先已摸清充值扫描的逻辑。公告中的数字指的是可能被虚假入账的 DOT 名义价值，而非实际损失的资金，因为 Bybit 表示这些尝试在结算前就已被阻止。", "en": "Bybit detected and blocked coordinated fake deposit attacks that could have resulted in over $1 billion in DOT losses." }, "first_seen_at": "2026-09-14T18:07:59.694970+00:00", "last_updated_at": "2026-09-14T18:07:59.694970+00:00", "last_material_change_at": "2026-09-14T18:07:59.694970+00:00", "confidence": 0.75, "updates_count": 1, "sources_count": 1, "entities": [ "attacks", "billion", "blocks", "bybit", "coordinated", "deposit", "deposit-attack", "detects", "dot", "fake", "losses", "over", "potential", "preventing", "yellow" ], "identifiers": [], "topics": [ "bybit", "deposit-attack", "dot" ], "updates": [ { "update_id": "upd_6d1a730aec8f088a", "event_id": "evt_28893b5a9e8c009d", "occurred_at": "2026-09-14T13:13:52Z", "published_at": "2026-09-14T13:13:52Z", "first_seen_at": "2026-09-14T18:07:59.694970Z", "time_precision": "published", "update_type": "initial", "material_change": true, "title_zh": "Bybit 拦截协同式虚假充值攻击，避免逾 10 亿美元 DOT 潜在损失", "title_en": "Bybit Detects and Blocks Coordinated Fake Deposit Attacks, Preventing Over $1 Billion DOT in Potential Losses - Yellow.com", "what_changed_zh": "Bybit 表示已检测并拦截了一波针对多条区块链网络的协同式虚假充值攻击，避免了价值超过 10 亿美元 DOT 的潜在损失。该交易所称，这些攻击采用了日益复杂的手法，意在利用其充值扫描系统的薄弱环节。\n\n虚假充值攻击打击的是交易所基础设施的验证层，也就是用户默认信赖、负责正确入账的那一环，因此若这一规模攻击得手，将成为交易所有史以来最大的损失事件之一。该事件也说明中心化交易所的充值流程仍是活跃的攻击面，攻击者可以跨链、跨币种将其产业化复制。\n\n据 Bybit 称，此次攻击横跨多条区块链网络，且具有协同性而非偶发性质，说明攻击者事先已摸清充值扫描的逻辑。公告中的数字指的是可能被虚假入账的 DOT 名义价值，而非实际损失的资金，因为 Bybit 表示这些尝试在结算前就已被阻止。", "what_changed_en": "Bybit detected and blocked coordinated fake deposit attacks that could have resulted in over $1 billion in DOT losses.", "current_state_zh": "Bybit 表示已检测并拦截了一波针对多条区块链网络的协同式虚假充值攻击，避免了价值超过 10 亿美元 DOT 的潜在损失。该交易所称，这些攻击采用了日益复杂的手法，意在利用其充值扫描系统的薄弱环节。\n\n虚假充值攻击打击的是交易所基础设施的验证层，也就是用户默认信赖、负责正确入账的那一环，因此若这一规模攻击得手，将成为交易所有史以来最大的损失事件之一。该事件也说明中心化交易所的充值流程仍是活跃的攻击面，攻击者可以跨链、跨币种将其产业化复制。\n\n据 Bybit 称，此次攻击横跨多条区块链网络，且具有协同性而非偶发性质，说明攻击者事先已摸清充值扫描的逻辑。公告中的数字指的是可能被虚假入账的 DOT 名义价值，而非实际损失的资金，因为 Bybit 表示这些尝试在结算前就已被阻止。", "current_state_en": "Bybit detected and blocked coordinated fake deposit attacks that could have resulted in over $1 billion in DOT losses.", "detailed_summary_zh": "Bybit detected and blocked coordinated fake deposit attacks that could have resulted in over $1 billion in DOT losses.", "detailed_summary_en": "Bybit detected and blocked coordinated fake deposit attacks that could have resulted in over $1 billion in DOT losses.", "background_zh": "虚假充值攻击利用的是代币的非标准行为：如果代币智能合约返回异常数值，或悄悄失败而不回滚交易，交易所的充值扫描程序就可能为从未在链上真正结算的充值入账。DEPOSafe 等学术研究记录了实现不当的 ERC-20 合约叠加交易所验证缺陷如何使此类攻击规模化，CoinDesk 在 2020 年的一篇报道也曾指出约 10 亿美元的以太坊代币存在此类风险。DOT 是 Polkadot 网络的原生代币，用于质押、治理和支付手续费，并在中心化交易所有大量持有。", "background_en": "A fake deposit attack exploits non-standard token behavior: if a token's smart contract returns an unexpected value or silently fails rather than reverting, an exchange's deposit scanner may credit a deposit that never actually settled on-chain. Academic work such as DEPOSafe documented how mis-implemented ERC-20 contracts combined with deficient exchange verification enabled these attacks at scale, and a 2020 CoinDesk report flagged roughly $1 billion of Ethereum tokens as vulnerable. DOT is the native token of the Polkadot network, used for staking, governance and transaction fees, and is widely held on centralized exchanges.", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "最直接的暴露方是通过中心化交易所充提通道转移资金的 DOT 持有者，因为该攻击针对的是入账验证环节，而非链上共识或 DOT 供应量。由于没有实际资金损失，短期传导渠道更多是市场对交易所托管能力的信心与情绪，尤其是对合约行为非标准代币的处理能力，而不是 DOT 市场上被迫抛售或流动性抽离。", "market_impact_en": "The most direct exposure sits with DOT holders who move funds through centralized exchange deposit and withdrawal rails, since the attack vector concerns credit-verification rather than on-chain consensus or DOT's supply. Because no funds were lost, the near-term channel is sentiment and operational confidence in exchange custody for tokens with non-standard contract behavior, rather than any forced selling or liquidity drain in DOT markets.", "importance_score": 7.5, "references": [ { "url": "https://www.tradingview.com/news/chainwire:29c74feb3094b:0-bybit-detects-and-blocks-coordinated-fake-deposit-attacks-preventing-over-1-billion-dot-in-potential-losses/", "title": "Bybit Detects and Blocks Coordinated Fake Deposit Attacks..." }, { "url": "https://arxiv.org/pdf/2006.06419", "title": "DEPOSafe: Demystifying the Fake Deposit" }, { "url": "https://www.coindesk.com/tech/2020/08/25/ethereum-tokens-worth-1b-vulnerable-to-fake-deposit-attack", "title": "Ethereum Tokens Worth $1B Vulnerable to 'Fake Deposit Attack'" } ], "confidence": 0.75, "story_ids": [ "google_news:article:57b2baad3a7c0500" ], "sources": [ { "url": "https://news.google.com/rss/articles/CBMi5AFBVV95cUxOZjk5MDlvMHJhTFpLakpJOHJOY21DemEyUVF1S2FJNUZpMDJ3OFhGMVM0VGJjeWEzVW9qR0FfbmwyUmRJMWNTQmx2THFzS1hoMzN0UDlmSFltUEtfN3pjZWZWbEp4NEhwWHY5Z1NXcnJwWWpQN1l4eUFEQ05VUmQtbUppZFRsUWRYVXVKRWR4YkJsbmlOR1ZkM3ZXU3BqaFZjWEtuYXhhakFCQ1hQcXN5SkNuTGhCVXZTdk5wR2t1cmZrZk4xTmFoYXdkZndYalllWjFhZ0dXbzVpZ2VpanNlUnVPRVI?oc=5", "label": "Yellow.com", "source_type": "google_news", "official": false } ] } ] }