🚨 On August 19, 2026, the well-known cross-chain bridge @Allbridge_io was attacked, resulting in a loss of approximately $190,000. However, the attack itself took nearly a month to complete. The SlowMist Security Team has fully analyzed the incident. 🧩 Attack flow: 1️⃣ On July 26, the attacker directly called Circle’s MessageTransmitterV2.sendMessage on Polygon to construct a forged CCTP-style message claiming a 1,000,000 USDC transfer (no actual USDC burn occurred). Circle subsequently issued a valid attestation for the complete message, as expected. 2️⃣ After waiting ~24 days, on August 19 the attacker struck just 6 seconds after a genuine CCTP deposit caused ~191k USDC to be minted to the Base Router, bringing its balance to ~191,156 USDC. 3️⃣ The attack contract called Allbridge’s receiveCctpMessage with the forged message + attestation. Missing checks allowed the forged message to be treated as a genuine deposit and 1M USDC to be credited without actual minting. 4️⃣ An Aave flash loan temporarily topped up the Router with 808,844 USDC, bringing its balance in line with the forged amount. 5️⃣ Router.receiveToken trusted the internal credit record and transferred ~999,000 USDC (after a 0.1% fee) to the attacker. 6️⃣ The attacker repaid the flash loan + fee, leaving a net profit of ~$189,751. Most of the drained funds came from genuine cross-chain deposits that had just arrived and had not yet been transferred to users. ⚙️ Root Cause: Missing checks on the message sender (must be the remote TokenMessenger) and recipient (must be Circle TokenMessengerV2). Allbridge trusted the attacker-crafted amount and messageHash in hookData without verifying actual USDC minting or a corresponding balance increase. Circle attestation ≠ real asset movement. 🔒 SlowMist Insight: Authenticated messages are necessary, but actual asset receipt is the basis for payment. Enforce trusted sender, recipient = TokenMessengerV2, and credit only after confirmed minting and balance increase. Full analysis👇

Shibarium runs on BONE, but the staking that secures it lives on Ethereum ethereum:0x9813037ee2218799597d83d4a5b6f3b6778218d9 pays gas on Shibarium, yet the staking that secures the chain does not happen on Shibarium at all. Validators and delegators lock BONE in contracts sitting on Ethereum mainnet, per @Shibtoken's documentation. The design is modeled on Polygon's proof-of-stake architecture. A validator layer called Heimdall bundles periodic snapshots of Shibarium's state, called checkpoints, and submits them to Ethereum. A separate layer, Bor, produces the blocks and executes transactions, with block producers drawn from the validator set. Anchoring stake and checkpoints to Ethereum ties Shibarium's record to the larger network's security.

Does Polymarket run on Polygon or does Polygon run for Polymarket? Polymarket processes 2.1–2.6M transactions on Polygon every single day. That's around 33% of all daily transactions on the network But the craziest part is that Polymarket spends $40–50k on gas every day. That's 45–50% of all gas fees paid across the entire blockchain. That's $1.2–1.5M every single month, or $14.6–18.3M every year and the number just keeps growing A dedicated blockchain for Polymarket is only a matter of time.

This week on Polygon: ■ @ZKPanther deploys mainnet on Polygon, bringing programmable privacy to DeFi ■ @0FiatDotCom adds USDT on Polygon for payments across 45+ countries ■ @Hadronfc x @Ignyte_AE launch Smart Commerce Infrastructure Challenge on Polygon with a 25K USDC prize pool ■ @MessariCrypto Polygon Q1 report is out with fresh payments data ■ @katana perps trading competition starts, powered by Polygon CDK ■ Private payments launch on Polygon for stablecoin transfers ■ Polygon Chain block time drops to 1.75s, making it the first reduction since genesis ■ Polygon Chain gets upgraded to 140M gas, bringing max TPS to 3,800+ The chain is faster, the capacity is bigger, the payments keep growing.

That's a strong year for @0xPolygon on-ramps on Mercuryo. Its on-ramp volume has grown 65% year-to-date compared to the same period last year. Demand for stablecoins on Polygon is also rising. This year, 94% of network on-ramps were in stablecoins, up from 51% YTD last year.

AEON drives adoption of $USDC on Polygon. A few days ago, @AEON_Community announced that @0xPolygon-based $USDC payments were live for merchant payments in several key geos: - Phillippines - Africa - Brazil - Mexico - Argentina The news is especially important for the $POL ecosystem, which is currently seeking to establish itself as a major player in the stablecoin game. Polygon's stablecoin economy currently stands at more than $3 billion, making it the 8th largest chain by such a metric.

Here's what you missed this week on Polygon: ■ @0xMiden Testnet connects to Agglayer, making the interop solution officially chain-agnostic ■ @EntEthAlliance releases its first Privacy Report with Polygon Labs ■ @AsseteraGlobal and Deploi launches private credit issuance on Polygon for EU investors ■ @StraitsX's xSGD crosses $1.1B volume on Polygon ■ @zerion releases its Agent CLI with support for Polygon ■ @graphprotocol launches Agent0 Subgraphs on Polygon ■ @0FiatDotCom kicks off a Sats Pizza Party for Polygon ■ @mayan crosses $300M+ in payments on Polygon ■ @USDT0_to confirms Polygon had the most active USDT0 senders with 6M+ ■ New privacy upgrade goes live for Polygon CDK with @SuccinctLabs

JP Morgan ran a live cross-currency DeFi trade on Polygon (@0xPolygon) PoS in November 2022, one of the first led by a bank. Hamilton Lane later used tokenization on the $POL network to cut its private credit minimum to $10,000. What each one built: