0G Foundation Suffers Major Security Breach, Tokens Stolen

A targeted attack on December 11 compromised the 0G Foundation’s reward contract, exploiting a vulnerability to steal 520,010 $0G, affecting various services via breached Alibaba Cloud instances.

The incident underscores security flaws in cloud-reliant infrastructure, highlighting potential risks for projects using similar platforms while demonstrating the resilience of core chain infrastructures.

520,010 $0G Tokens Stolen Via Next.js Vulnerability

0G Foundation reported on X that on December 11, their reward contract was compromised, resulting in the loss of 520,010 $0G tokens. The breach stemmed from a leaked private key in Alibaba Cloud instances, exploited via a Next.js vulnerability. The attacker utilized the emergency withdrawal feature to illegally transfer the assets.

Following the breach, the attacker bridged and dispersed the stolen tokens using Tornado Cash. The attack tactics involved private key acquisition from cloud instances, exploiting the CVE-2025-66478 vulnerability. The breach affected multiple internal services but did not impact the core chain infrastructure. Immediate actions included securing internal networks and services.

Community and industry players have remained vigilant. Although no prominent industry leaders have commented publicly, 0G’s timely response and transparency were acknowledged by some exchanges and data-aggregators.

Cloud Security Under Scrutiny After 69% Token Price Drop

Did you know? This incident highlights the ongoing vulnerabilities associated with remote cloud storage configurations, reminiscent of past breaches leveraging similar vulnerabilities.

As recorded by CoinMarketCap, the 0G token’s price stood at $0.93 with a market cap of $198.68 million. Over the last 90 days, it experienced a decline of 69.02%, reflecting market volatility. During the last 24 hours, its price increased by 3.01% amidst considerable trading volume shifts.

Analysts at Coincu indicate that the breach underlines the necessity for enhanced cloud security protocols. Historical trends show similar breaches prompting revisions in cloud and token contract security practices, creating potential regulatory challenges for the industry.