0G Foundation: Contract attacked, resulting in 520,000 $0G stolen

On December 13, 0G Foundation posted on the X platform that a targeted attack compromised its reward contract. The attacker took advantage of the emergency withdrawal function of the 0G reward contract used to distribute alliance rewards and stole 520,010 $0G tokens, which were then bridged and decentralized through Tornado Cash. The attacker obtained the leaked private key in the Alibaba Cloud instance, which is responsible for managing NFT status and reward updates, and stored the private key locally. Due to a critical vulnerability in Next.js (CVE-2025-66478), which was exploited on December 5, multiple Alibaba Cloud instances were compromised. The attackers moved laterally through internal IP addresses, affecting calibration services, validator nodes, Gravity NFT services, node sales services, compute, Aiverse, Perpdex, Ascend, etc. Total confirmed losses: 520,010 $0G, 9.93 ETH, and $4,200 USDT. No core chain infrastructure or user funds were affected except for the reward distribution contract.