Vanish

On 20 September at 18:58 UTC, Vanish suffered an exploit in it's private swap functionality, abused by attackers leading to a loss of ~$335,000. The exploit was limited to Vanish pools, connected wallets are not at risk. A full snapshot of every account balance has been taken. User remediation is next to be announced. Our silence since the incident has been painful but staying quiet was imperative to the incident investigation, which we're carrying out with law enforcement, security and forensics teams. The protocol has been paused while deeper investigation and security hardening are being completed. We're grateful for user and partners patience during this time. What happened: • An API key for Vanish's signing service was compromised, enabling attackers to create transactions that bypassed signing policies and account balance verification. • Abusing this, attackers routed protocol assets to an external destination, returning zero to Vanish accounts. • Vanish used signing policies to restrict activity incase of potential compromises, however attackers reverse-engineered the exact structure of legitimate transactions, leading to the abuse and exploit. • Following reported issues, our team activated the @0xGroomLake incident response after our internal validation of an incident. Next steps: • Deeper investigation and cooperation with law enforcement, forensics and security partners. • Protocol security hardening updates, further restricting whitelisted actions of all protocol functions. • Affected user remediation procedure and service reactivation to be announced. Past this, we're putting our full attention on completing our ZK systems: open-source, verifiable code where no human error or key can touch funds. Thank you for sticking with us through this.