DeFi Backdoor Threatens $10M as Texture, Kinto Face Attacks

According to VennBuild, the vulnerability was connected to a group suspected of links to North Korea. The attackers manipulated proxy contracts—tools that allow upgrades to programs running on the blockchain—by introducing malicious versions. The compromised contracts appeared normal on public blockchain explorers like Etherscan, masking the threat to users. Security groups including Dedaub and the DeFi Security Alliance (SEAL) helped secure the majority of assets at risk.

“The backdoor gave Hackers full control, forwarding calls to the original contract while [block explorer] Etherscan showed no issues,” said a researcher using the handle “deebeez.” The researchers believe the attackers were waiting for a large target and had not yet exploited the contracts when the issue was identified. “We stayed stealthy to avoid tipping them off. A high-stakes game.”

In a separate incident, Texture, a lending platform on the Solana Blockchain, suffered a $2.2 million breach in its USDC vault contract. The company’s response included offering the attacker a 10% bounty for returning the remainder of the stolen funds, arguing, “it’s not too late to avoid escalating the situation.” The approach led to the return of 90% of the taken assets. The same day, the decentralized exchange GMX was hacked for $42 million, indirectly causing $9 million in losses to Abracadabra, which used GMX assets as loan collateral.

Meanwhile, the price of Kinto’s K token plunged sharply amid accusations of a “rug-pull,” a situation where insiders allegedly sell off their own holdings and crash the market. Kinto co-founder Ramon Recuero later reported that a “state actor” had exploited a proxy contract on the Arbitrum network to mint fake tokens and immediately sell them. Scanners such as Arbiscan failed to detect the altered contract.