A Web3 project contract may have been implanted with malicious code by employees, resulting in losses of hundreds of thousands of dollars
On April 28, according to crypto community member Cat (@0xCat_Crypto), hundreds of thousands of USDTs were transferred due to a Web3 entrepreneurial project containing hard-coded authorized wallet addresses in the smart contract code. During the incident, the contract code submitted by an employee was suspicious, but the employee denied writing the relevant code, saying that the malicious code originated from the artificial intelligence programming assistant automatically generated and was not fully reviewed. At present, the ownership of the wallet involved cannot be confirmed, and it is difficult to identify the code writing body. Cosine Slow Fog issued a document saying that after preliminary investigation, in the environment using Cursor and Claude 3.7 models, the address automatically completed by AI did not match the malicious address involved, ruling out the possibility of AI code generation to do evil. The malicious address was given the rights of the smart contract owner, resulting in the project party's funds being completely transferred out.
Disclaimer: The views in this article are from the original Creator and do not represent the views or position of Hawk Insight. The content of the article is for reference, communication and learning only, and does not constitute investment advice. If it involves copyright issues, please contact us for deletion.