0G FOUNDATION: TARGETED ATTACK ON REWARD CONTRACT RESULTS IN THEFT OF 520,000 0G

0G Foundation stated that on December 11, its alliance reward contract was targeted in an attack. The attacker exploited the emergency withdrawal function to steal 520,010 0G tokens, which were then dispersed via Tornado Cash.

The compromised private key originated from a leaked Alibaba Cloud instance and was linked to a Next.js vulnerability (CVE-2025-66478) exploited on December 5. Confirmed losses include 520,000 0G, 9.93 ETH, and $4,200 USDT. Core chain infrastructure and user funds were not affected.