PANews|May 12, 2026 11:43
[Security Agency: Aurellion Labs Contract Hit by Reentrancy Initialization Attack, Resulting in Approximately 455,000 USDC Loss]
Blockchain security agency SlowMist tweeted that the Diamond contract associated with Aurellion Labs was exploited due to the `initialize(address)` function in the SafeOwnable Facet being unprotected. The attacker reentered the initialization process, tampered with the contract owner, and executed `diamondCut` to inject a malicious Facet containing `pullERC20`, thereby transferring authorized USDC assets. SlowMist stated that the affected contracts include addresses such as 0x0adc63e7… (victim contract), 0x2e933518…, 0xa90714a1…, 0xeced2d37…, among others. The attacker's address is 0x9f49591a3b…, and the total loss amounts to approximately 455,003 USDC.
Share To
HotFlash
APP
X
Telegram
CopyLink