Market
CertiK Fixes $5 Million Wormhole Bridge Flaw

CertiK discovered and patched a major security flaw in the Wormhole bridge on the Aptos network, potentially saving $5 million.
This vulnerability could have let an attacker create fake token transfers, but CertiK’s swift action secured users’ funds.
Aptos’ Wormhole Bridge $5M Security Flaw Discovered
CertiK found the flaw in the Wormhole bridge on Aptos and reported it to the Wormhole team. The problem stemmed from incorrectly implementing the MOVE programming language’s ‘public(friend)’ and ‘entry’ modifiers.
The ‘public(friend)’ modifier allows functions to be called by others within the same module or by specified external accounts. In contrast, the ‘entry’ modifier allows any external account to call a function.
The bridge had a function called ‘publish_event,’ meant to announce events like token transfers. This function should only have been callable by other functions within the same module or certain specified external entities. However, the function was modified by both ‘public(friend)’ and ‘entry,’ making it possible for anyone to call ‘publish_event,’ even if they were not approved.
This flaw could have let an attacker create fake transactions, appearing to move tokens from one account to another without moving actual tokens. These fake events could have caused the Ethereum version of the bridge to mint or unlock tokens without real deposits backing them on the Aptos side, potentially draining up to $5 million.
CertiK’s Rapid Action to Patch and Secure the Wormhole Bridge
After discovering the flaw, CertiK immediately informed the Wormhole team on December 5, 2023. The team developed and tested a patch to close the security loophole. They informed the protocol’s Guardians, who approved the patch through a multi-signature vote. The protocol’s Aptos contract was then upgraded, securing the bridge. This process took approximately three hours.
Read more: Crypto Scam Projects: How To Spot Fake Tokens
Besides removing the ‘entry’ keyword from the publish_event function, the new patch also restricted the ‘governor rate limits’ on Aptos from $5 million to $1 million. This strategic move aimed to limit potential losses from future exploits. CertiK noted that current usage is below $1 million daily, so the rate limit should not affect most users.
“This case study not only underscores the critical role of proactive security practices but also celebrates the power of open source software in raising security and transparency standards across the Web3 world,” CertiK added.
Wormhole also conducted a retrospective analysis to check if the issue affected any user funds. The study confirmed no funds were illicitly transferred, and users’ balances remained safe.
This isn’t the first time Wormhole has faced security challenges. In 2022, the bridge lost over $321 million due to a bug in the Solana part of the bridge, allowing an attacker to mint unbacked tokens. Despite this setback, Wormhole improved its security practices and reclaimed $1 billion in total value locked.
Disclaimer
In adherence to the Trust Project guidelines, BeInCrypto is committed to unbiased, transparent reporting. This news article aims to provide accurate, timely information. However, readers are advised to verify facts independently and consult with a professional before making any decisions based on this content. Please note that our Terms and Conditions, Privacy Policy, and Disclaimers have been updated.
Market
Dark Web Criminals Are Selling Binance and Gemini User Data

More than 100,000 users of popular crypto exchanges Binance and Gemini may be at risk after a trove of sensitive information appeared for sale on the dark web.
The leaked data reportedly includes full names, email addresses, phone numbers, and location details—raising alarms over growing cyber threats in the crypto sector.
Dark Web Actors Are Targeting Crypto Users
On March 27, a dark web user operating under the alias AKM69 listed a large database allegedly tied to Gemini, one of the largest crypto trading platforms in the US.
According to Dark Web Informer, the dataset mainly includes information about users from the United States, with a few entries from Singapore and the United Kingdom. The attacker claims the data could be used for marketing, fraud, or crypto recovery scams.
“The database for sale reportedly includes 100,000 records, each containing full names, emails, phone numbers, and location data of individuals from the United States and a few entries from Singapore and the UK,” the report stated.
It is unclear whether the leak resulted from a direct breach of Gemini’s systems or from other vulnerabilities, such as compromised user accounts or phishing campaigns.
Meanwhile, this incident followed another alarming listing on March 26.
According to the report, a separate dark web actor, kiki88888, allegedly offered a trove of Binance user data for sale. The database is said to hold over 132,000 entries, including the exchange users’ login information.

The Dark Web Informer suggests phishing attacks likely caused the breach rather than a compromise of the exchange’s systems.
“Some of you really need to stop clicking random stuff,” the Informer stated.
Binance and Gemini have yet to publicly comment on these incidents. However, phishing remains one of the most effective methods cybercriminals use to exploit crypto holders.
Scammers often impersonate official accounts or place misleading ads that redirect users to fake websites. Coinbase users are also being extensively targeted through phishing campaigns.
As BeInCrypto reported earlier, in March, Coinbase users lost over $46 million to social engineering scams.
Blockchain security firm Scam Sniffer revealed that phishing-related losses exceeded $15 million in the first two months of the year. This figure highlights the growing scale of the threat.
Given the rising threats, crypto users should stay vigilant and avoid unfamiliar links. They should also protect their accounts with two-factor authentication and hardware wallets whenever possible.
Disclaimer
In adherence to the Trust Project guidelines, BeInCrypto is committed to unbiased, transparent reporting. This news article aims to provide accurate, timely information. However, readers are advised to verify facts independently and consult with a professional before making any decisions based on this content. Please note that our Terms and Conditions, Privacy Policy, and Disclaimers have been updated.
Market
South Carolina Could Spend 10% of Funds on Bitcoin Reserve

Representative Jordan Pace introduced legislation to create a Bitcoin Reserve for South Carolina, joining a nationwide effort. Currently, nearly half of all US states have an active bill to create a similar Reserve.
However, the talking point that this bill “allows 10% of state funds” in Bitcoin investments is taking off like wildfire. It may scare off fiscal conservatives, which contributed to recent failures.
South Carolina Joins the Bitcoin Reserve Race
Since President Trump announced his intention to create a US Bitcoin Reserve, many state governments have attempted to create smaller models.
In the last month, these efforts have been intensifying, with more and more states joining the effort. Today, South Carolina filed its own Bitcoin Reserve bill, allowing the state to make substantial purchases:
“The State Treasurer may invest in digital assets including, but not limited to, Bitcoin with money that is unexpended, unencumbered, or uncommitted. The amount of money that the State Treasurer may invest in digital assets from a fund specified in this section may not exceed ten precent of the total funds under management,” it reads.
State Representative Jordan Pace proposed South Carolina’s Bitcoin Reserve legislation. He claimed that this bill “gives the Treasurer new tools to protect taxpayer dollars from inflation,” one of crypto’s most well-known use cases. Pace is currently the bill’s only sponsor, and it’s unclear what chances it has of passing.
Still, there may be challenges ahead. Similar proposals in other Republican-led states—like Montana and Wyoming—have already failed. This was largely due to concerns over using public funds to buy cryptocurrency.
Even though Trump backs the idea on a national level, not all GOP lawmakers are convinced at the state level.
That said, there are some signs of progress elsewhere. For example, Texas has advanced its Bitcoin Reserve bill, achieving bipartisan support. A key reason for its success is that the bill doesn’t require the state to make crypto purchases; it simply allows them at the Treasurer’s discretion.
Likewise, South Carolina’s bill wouldn’t force the state to invest 10% of its funds into Bitcoin. It just opens the door for that possibility, giving the state financial flexibility rather than a mandate.
Disclaimer
In adherence to the Trust Project guidelines, BeInCrypto is committed to unbiased, transparent reporting. This news article aims to provide accurate, timely information. However, readers are advised to verify facts independently and consult with a professional before making any decisions based on this content. Please note that our Terms and Conditions, Privacy Policy, and Disclaimers have been updated.
Market
FDIC and CFTC Rescind Old Crypto Guidelines

The FDIC and CFTC have both been working to change previous crypto guidelines. As federal regulators reconcile with the industry, they are removing old rules that specifically target crypto.
The former institution is removing the requirement that banks report crypto business, while the latter holds crypto to the same standards as other industries.
FDIC and CFTC Change Crypto Policies
The FDIC is one of the top financial regulators in the US, and it’s turning over a new leaf. After being one of the principal architects of Operation Choke Point 2.0, it recently began declassifying documents and changing rules that allowed crypto debanking.
Today, the agency is revoking a 2022 directive that impacted banks’ interactions with crypto:
“With today’s action, the FDIC is turning the page on the flawed approach of the past three years. I expect this to be one of several steps the FDIC will take to lay out a new approach for how banks can engage in crypto- and blockchain-related activities in accordance with safety and soundness standards,” said FDIC Acting Chairman Travis Hill.
Specifically, it rescinded a rule that mandated that all banks and institutions under its supervision notify the FDIC of any crypto involvement. The new guideline claims that banks “may engage in permissible crypto-related activities without receiving prior FDIC approval” without enacting any other policies.
Since Gary Gensler left the SEC, all the top US financial regulators have been trying to rework their relationship with crypto. In an apparent coincidence, the CFTC made a very similar move to the FDIC by rescinding two crypto guidelines.
Both of these actions did not establish a new policy; they merely removed the old ones.
Essentially, both of the CFTC’s rule changes are set to ensure that crypto-related derivatives are subject to the same requirements as non-crypto ones. This is somewhat surprising, considering that the industry has typically tried to insist that it necessitates specific regulations.
However, this is largely beside the point. The FDIC and CFTC are both working to remove previous guidelines that opposed the crypto industry.
These institutions will undoubtedly be amenable to creating new ones in the spirit of cooperation. In the meantime, this olive branch can help build a lot of goodwill.
Disclaimer
In adherence to the Trust Project guidelines, BeInCrypto is committed to unbiased, transparent reporting. This news article aims to provide accurate, timely information. However, readers are advised to verify facts independently and consult with a professional before making any decisions based on this content. Please note that our Terms and Conditions, Privacy Policy, and Disclaimers have been updated.
-
Altcoin23 hours ago
Dogecoin Price Set To Reach $1 As Once In A Year Buy Opportunity Returns
-
Market24 hours ago
Hedera Falls 4% as Bears Dominate: What’s Next for HBAR?
-
Regulation19 hours ago
FDIC Revises Crypto Guidelines Allowing Banks To Enter Digital Assets
-
Altcoin24 hours ago
Why the US SEC Is Delaying the Ripple Case?
-
Ethereum23 hours ago
Ethereum Fails To Break $2,100 Resistance – Growing Downside Risk?
-
Regulation18 hours ago
Sonic Labs To Abandon Plans For Algorithmic USD Stablecoin, Here’s Why
-
Market23 hours ago
Analysts Reveal Q2 Crypto Market Outlook: BTC at $200,000?
-
Market18 hours ago
Coinbase Users Lost $46 Million to Crypto Scams in March