0G Foundation: Reward contract attacked, 520,000 0G stolen

CryptoWorld News reports that the @0G Foundation posted on the X platform stating that on December 11, a targeted attack compromised its reward contract. The attacker exploited the emergency withdrawal function of the @0G reward contract used for distributing alliance rewards, stealing 520,010 $0G tokens, which were subsequently bridged and dispersed through Tornado Cash. The attacker obtained the private key leaked from an Alibaba Cloud instance responsible for managing NFT status and reward updates, with the private key stored locally. Due to a serious vulnerability in Next.js (CVE-2025-66478) exploited on December 5, multiple Alibaba Cloud instances were compromised. The attacker moved laterally via internal IP addresses, affecting calibration services, validator nodes, Gravity NFT services, node sales services, computing, Aiverse, Perpdex, Ascend, and others. The confirmed total losses amount to 520,010 $0G, 9.93 ETH, and 4200 USD USDT. Apart from the reward distribution contract, core blockchain infrastructure or user funds were not affected.