Transparency is core to our mission. On December 11th, a targeted exploit compromised one of our reward contracts. We’re sharing what happened, what we’ve done to fix it, and how we’re making 0G stronger moving forward. An attacker exploited the emergency Withdraw function of our 0G reward contract, used to distribute alignment rewards, and stole 520,010 $0G tokens, which were later bridged and dispersed via Tornado Cash. Root Cause: The attacker accessed a leaked private key from an AliCloud instance. That instance managed NFT status and reward updates, and unfortunately, stored the private key locally, a practice we now know must never happen again. Further Findings: Investigation revealed a broader breach. Multiple AliCloud instances were compromised due to a critical Next.js vulnerability (CVE-2025-66478) exploited on Dec 5. The attacker moved laterally via internal IPs, affecting: → Alignment service → Validator node → Gravity NFT service → Node sale service → Compute, Aiverse, Perpdex, Ascend → …and more. Total confirmed losses: → 520,010 $0G → 9.93 ETH → $4.2K USDT No core chain infrastructure or user funds were affected beyond the reward distribution contract. Actions Taken Immediately: → Revoked and rotated all compromised keys → Purchased & deployed enhanced AliCloud Firewall + Security Suite → Shutdown and rebuilt affected services → Patched critical dependencies (including Next.js) → Removed all plaintext private keys from all instances What’s Next? Our Path Forward → All key-bearing services will be migrated to TEE (Trusted Execution Environments) → Contract permissions will be hardened; only multi-sig wallets will manage critical funds → Alerting pipelines will integrate with TG & Slack → Cloud access will follow least privilege by default → Contract balances will have automatic alert thresholds Security is not a checkbox; it’s a process. This was a painful but necessary wake-up call. We’ve taken responsibility, and we are now embedding zero-trust principles into every part of 0G. To our community: thank you for your support. Your trust is everything. This event will not define us; how we respond will. We’re not just building the future of decentralized AI. We’re building it securely. - The 0G Foundation Team. Block explorer: Postmortem coming soon.