Transparency isn’t a feature. It’s a standard. WINkLink Price Service upgrade is a step toward making oracle data: • Clearer • Traceable • Actionable And that’s what real infrastructure looks like.

Transparency update on the 9Summits ETH vault. Part of the vault was allocated to YieldBasis staked-cbBTC, held in YB's legacy pools. The risk parameters of those legacy pools let the position's value drift below its high-water mark through 2 successive drawdowns. On its own that gap was unrealized and could recover over time. The issue: staying in the legacy pools kept us exposed to further drawdowns of the same kind, with no guarantee of recovery. In close collaboration with the YieldBasis team, the right move was clear, migrate the position to YB's new pools (safer, better risk parameters). Being forced to migrate is what realized the loss now rather than let us carry an inflated mark. To mitigate the impact, 9Summits returned ~10.9 ETH of fees from its own treasury into the vault, leaving a net recognized drawdown of -8.35 ETH, or a PPS change of -0.0043188 (-0.43%). Even after this, the vault's 1Y net performance stands at 4.31% APR. Counting the YB the vault earned and sold, the position is still net positive, and we expect the gap to the vault's HWM to keep closing over the coming weeks. An upcoming Season 2 airdrop is also expected to help offset the hit. We understand how frustrating this event can be and remain fully committed and confident in finding the best outcome for our LPs. Please reach out with any questions.

Transparency is one of our core product principles Before you confirm a trade, you see: → full fee breakdown → exact amount you’ll receive And after you confirm, the numbers stay the same

Transparency isn't the default in Web3 — because hiding can still pay. Projects won't disclose unless incentives change. But without transparency, investors can't make informed decisions — and institutions stay away. Sunlight isn't optional. It's the unlock for real adoption 👇

Transparency is core to our mission. On December 11th, a targeted exploit compromised one of our reward contracts. We’re sharing what happened, what we’ve done to fix it, and how we’re making 0G stronger moving forward. An attacker exploited the emergency Withdraw function of our 0G reward contract, used to distribute alignment rewards, and stole 520,010 $0G tokens, which were later bridged and dispersed via Tornado Cash. Root Cause: The attacker accessed a leaked private key from an AliCloud instance. That instance managed NFT status and reward updates, and unfortunately, stored the private key locally, a practice we now know must never happen again. Further Findings: Investigation revealed a broader breach. Multiple AliCloud instances were compromised due to a critical Next.js vulnerability (CVE-2025-66478) exploited on Dec 5. The attacker moved laterally via internal IPs, affecting: → Alignment service → Validator node → Gravity NFT service → Node sale service → Compute, Aiverse, Perpdex, Ascend → …and more. Total confirmed losses: → 520,010 $0G → 9.93 ETH → $4.2K USDT No core chain infrastructure or user funds were affected beyond the reward distribution contract. Actions Taken Immediately: → Revoked and rotated all compromised keys → Purchased & deployed enhanced AliCloud Firewall + Security Suite → Shutdown and rebuilt affected services → Patched critical dependencies (including Next.js) → Removed all plaintext private keys from all instances What’s Next? Our Path Forward → All key-bearing services will be migrated to TEE (Trusted Execution Environments) → Contract permissions will be hardened; only multi-sig wallets will manage critical funds → Alerting pipelines will integrate with TG & Slack → Cloud access will follow least privilege by default → Contract balances will have automatic alert thresholds Security is not a checkbox; it’s a process. This was a painful but necessary wake-up call. We’ve taken responsibility, and we are now embedding zero-trust principles into every part of 0G. To our community: thank you for your support. Your trust is everything. This event will not define us; how we respond will. We’re not just building the future of decentralized AI. We’re building it securely. - The 0G Foundation Team. Block explorer: Postmortem coming soon.