Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
ETH 
SOL 
USDG The Revenue project was attacked by malicious authorization: Hackers used USDG license signatures to steal user funds in a single transaction.
Blockchain security company Salus released a report stating that the well-known cryptocurrency bridging service "Revenue" has recently encountered complex authorization phishing attacks. The attacker gained unlimited spending rights by inducing users to sign malicious USDG (a token) licensing signatures and transferred funds out of the victim's wallet in the same transaction.
Attack mechanism and financial flow analysis
According to Salus's investigation, the core of this attack lies in "Permit Signatures". This signature mechanism allows token holders to directly authorize third parties to spend their tokens without having to submit for approval of the transaction on the chain. After obtaining the user's signature, the attacker immediately calls the `transferFrom` function in the contract to transfer the token to the control address.
The entire process is completed in a single transaction, leaving a very short time for the user to respond. The stolen USDG was then assigned to two addresses controlled by the attacker, with 20% transferred to one address and 80% transferred to the other.
Salus pointed out that this fund allocation model is similar to the revenue sharing structure of Inferno, the well-known "Drainer-as-a-Service" platform. Although it has not been confirmed that Revenue directly uses Inferno's infrastructure, this 20/80 ratio has aroused high vigilance in the industry.
Principles and risks of approving phishing attacks
Such attacks fall into the common form of "approval Phishing." Unlike traditional theft of private keys or mnemonics, attackers only need to get users to sign an authorization message to gain rights to move specific assets. Because license signatures usually come in the form of message signatures rather than traditional on-chain transactions, it is often difficult for ordinary users to identify their dangers.
Once unlimited approval is granted, an attacker can transfer the maximum available balance of the token in the user's wallet at any time without re-authorization from the owner. In similar cases, Ethereum users have lost nearly $1 million after signing malicious transactions.
Background and controversy of Revenue
Revenue claims to be a service that allows users to convert X Money balances into cryptocurrency without having to perform KYC checks. Users need to log in with X account, create an order and send USD to a specified account (@RevenuePay) via X Money, and then receive cryptocurrencies such as USDC, USDT, SOL or ETH.
The service claims to read only X account information to associate orders, does not retain user access tokens, and emphasizes that it has no official association with X Corp. or X Payments. However, the project was in chaos days before the safety incident:
- Social media accounts were hacked: On October 1, Revenue announced that control of its social media accounts had been stolen by its internal review personnel and temporarily suspended redemption services.
- Fake token warning: Its Telegram channel warned users that the project did not issue official tokens, but then content promoting REV tokens appeared, causing confusion in information.
- Marketing tactics controversy: Salus pointed out that Revenue uses opinion leaders (KOL) in the crypto field to promote it in a manner similar to FomoPeek, another controversial platform.
Conclusions and Safety Recommendations
As of now, Salus has not announced the total loss amount of Revene-related transactions. Although the pattern of fund allocation is similar to that of known hacker groups, a single piece of evidence is not enough to fully confirm the direct connection to infrastructure.
Security experts remind users to carefully review smart contract requests when using any cryptocurrency service. Do not sign authorization messages from unknown sources at will, and regularly check the token authorization status of your wallet to revoke unnecessary unlimited approvals in a timely manner.
