POPA ReconAttacker spent $190 to take $670K
Attacker spent $190 to take $670K - the wallet was created today at 13:40 UTC and funded with $190 of USDC bridged from Ethereum, just enough for gas - draining started at 16:49 and is still running, 8,857 transactions and counting - every account is taken the same way: submit a signature bundle, call AddCollateralAdmin to make yourself an admin, then withdraw - the second signature check pointed back at instruction 0, so Solana verified the attacker's own signature a second time while the program credited an admin key it should never have accepted - that left the attacker as an admin on more…
The excerpt is quoted from a public Telegram channel, which owns its text.