Main takeaway: The BTTC bridge on Ethereum was likely attacked, with about $13.3M stolen including ~7,285 ETH and various ERC-20 tokens. Blockaid says after a Safe admin upgrade, attacker gained CFO_ROLE on the new RootChainManager and used withdrawAll(address[]) to drain assets from the bridge's Predicate contract.
币界网消息，据Blockaid监测，Bittorrent在Ethereum上的BTTC跨链桥疑似遭攻击，约1330万美元资产被转出，包括约7285枚ETH及多种ERC-20资产。Blockaid表示，BTTC跨链桥管理员Safe执行特权代理升级后，攻击者获得升级后RootChainManager合约的CFO_ROLE权限，并调用withdrawAll(address[])函数，从桥接Predicate合约中转出ETH及ERC-20资产。