An attacker has taken control of StrongBlock’s abandoned on-chain governance system and used it to remove about $72,000 worth of STRONG and STRNGR tokens from the protocol’s pool.
Blockchain security firm Defimon Alerts said the attacker first acquired enough STRONG governance tokens to secure a majority of voting power. The token had become nearly worthless after StrongBlock was abandoned, according to the firm.
That voting power was then used to submit and pass a malicious governance proposal. The proposal instructed StrongBlock’s Governor’s Upgrader contract to run `setPendingAdmin(attacker)`, making the attacker’s address the protocol’s pending administrator.
The proposal was not forced through by bypassing the system. It progressed through each of StrongBlock’s normal governance stages, gaining enough votes, entering the queue and eventually being executed. That process transferred administrative control of the Governor proxy to the attacker.
With administrator privileges secured, the attacker replaced the Governor’s original implementation with a new, minimal and unverified contract. The replacement contained a `forward(address, bytes)` function.
Defimon Alerts said the function was restricted to the attacker’s externally owned account and effectively acted as an arbitrary-call mechanism. It allowed the attacker to execute transactions with the Governor’s authority across StrongBlock’s contracts.
The attacker then used the upgraded implementation to move 32,695 STRONG tokens and 383,447 STRNGR tokens from the protocol’s pool. Defimon Alerts estimated the combined value of the assets at approximately $72,000.
The security firm described the incident as a governance takeover rather than a conventional smart contract exploit. The administrator change and subsequent contract upgrade were both carried out using permissions granted through StrongBlock’s governance process.
By replacing the Governor implementation before transferring the tokens, the attacker turned the governance contract itself into the tool that authorised the theft.
The incident is the latest in a series of cryptocurrency security events in which attackers have targeted governance mechanisms, supporting infrastructure and wallet software through different routes, rather than relying solely on flaws in smart contract code.
Late last month, decentralised perpetuals protocol Ostium said attackers stole 23.75 million USDC after gaining unauthorised access to its off-chain infrastructure. The incident did not involve an exploit of vulnerabilities in Ostium’s smart contracts.
According to Ostium’s post-mortem, fraudulent BTC-USD price reports were submitted through trusted infrastructure. Those reports enabled the attacker to create artificial trading profits, which were settled against the protocol’s public OLP liquidity vault.
Earlier analysis by blockchain security firm Blockaid also concluded that manipulated oracle reports, rather than errors in contract code, enabled the Ostium exploit.
A separate incident involving the Coldcard wallet was traced to a firmware problem introduced in a March 2021 software update. Coinkite and Block’s Bitcoin engineering and security teams found that the affected firmware generated wallet seeds using a deterministic pseudo-random generator instead of the intended hardware random-number generator.
That reduced the entropy used to create private keys. Galaxy Research has since confirmed thefts totalling 1,596 BTC from about 7,300 addresses linked to three attack waves.
Galaxy Research has also identified what it believes to be a fourth coordinated wave involving a further 448.7 BTC. Those addresses have not yet been included in the confirmed total because confirmation from additional victims is still pending.
The Coldcard incident has also led developers to examine a much wider section of Bitcoin’s software ecosystem.
Earlier this week, Bitcoin developer Calle said the volunteer Bitcoin Red Team had completed artificial intelligence-assisted and manual reviews of 390 Bitcoin-related repositories. The work identified 4,962 potential security issues, including 720 classified as high or critical severity.
Calle said about 21.4% of the findings had already been reproduced through manual verification before being privately disclosed to the developers affected.
The review covers Bitcoin wallets, cryptographic libraries, infrastructure software and other open-source projects. Calle said OpenSats was funding computing costs of approximately $10,000 per day, while Kimi Moonshot had supplied AI accounts and access to its Kimi K3 model.
Unlike the Ostium exploit and the Coldcard wallet incident, the StrongBlock attack did not depend on compromised infrastructure, manipulated oracle data or a cryptographic weakness.
Instead, the attacker gained control of StrongBlock’s governance and then modified the protocol’s own administrator contract. Defimon Alerts said the new Governor implementation gave the attacker’s wallet exclusive power to use the restricted `forward(address, bytes)` function and make arbitrary calls through the Governor.
The token transfers were therefore completed using permissions that StrongBlock itself granted when the malicious proposal passed. The incident demonstrates how an abandoned governance system can continue to hold administrative power over protocol contracts even after development activity has largely stopped.
