An attacker has drained about $72,000 worth of STRONG and STRNGR tokens after taking control of StrongBlock’s abandoned on-chain governance system through a malicious proposal.
Summary
- An attacker drained about $72,000 after taking control of StrongBlock’s abandoned governance system.
- A malicious proposal gave the attacker admin control of the protocol’s Governor contract.
- The attacker upgraded the Governor contract before stealing 32,695 STRONG and 383,447 STRNGR tokens.
- The incident relied on governance control rather than a smart contract vulnerability.
- The attack follows recent crypto security breaches targeting governance, infrastructure and wallet software.
According to blockchain security firm Defimon Alerts, the attacker acquired enough voting power in StrongBlock’s governance to pass a proposal that ultimately transferred administrative control of the protocol’s Governor contract before the funds were removed.
Instead of exploiting a flaw in StrongBlock’s smart contracts, the attacker used the protocol’s own governance process to gain privileged access. After obtaining administrator rights, the attacker upgraded the Governor proxy to a new implementation that allowed arbitrary contract calls using the Governor’s authority.
The incident adds to a series of recent crypto security events that have targeted governance systems, supporting infrastructure, and wallet software through different attack paths rather than relying solely on smart contract bugs.
StrongBlock governance was used to seize protocol control
Before the attack unfolded, the attacker accumulated a majority of the protocol’s STRONG governance token, which Defimon Alerts described as having become nearly worthless after the project was abandoned.
Holding enough voting power, the attacker submitted a governance proposal instructing the Governor’s Upgrader contract to execute setPendingAdmin(attacker), making the attacker’s address the pending administrator.
Rather than bypassing governance, the proposal advanced through every required stage. It received sufficient votes, entered the queue, and was executed according to the protocol’s normal governance process, eventually transferring administrative control of the Governor proxy to the attacker.
Administrative privileges then allowed the attacker to replace the Governor implementation with a minimal, unverified contract containing a forward(address, bytes) function.
According to Defimon Alerts, the function was restricted to the attacker’s externally owned account and effectively served as an arbitrary-call mechanism, allowing the attacker to execute transactions with the Governor’s authority across StrongBlock’s contracts.
The token transfers occurred in the following transaction.
More than 400,000 tokens were removed from the pool
Using the upgraded implementation, the attacker executed transactions that transferred assets from the protocol’s pool rather than exploiting an error in the protocol’s contract logic.
Defimon Alerts said the attacker removed 32,695 STRONG tokens together with 383,447 STRNGR, bringing the estimated value of the stolen assets to approximately $72,000.
The security firm characterized the incident as a governance takeover because every critical action, including the administrator change and contract upgrade, occurred through governance permissions instead of a software vulnerability.
By replacing the Governor implementation before moving the funds, the attacker turned the governance contract itself into the mechanism used to authorize the transfers.
Governance attacks differ from recent crypto exploits
Recent security incidents have demonstrated that attackers are increasingly targeting different parts of crypto infrastructure.
Late last month, decentralized perpetuals protocol Ostium concluded that attackers stole 23.75 million USDC after gaining unauthorized access to its off-chain infrastructure instead of exploiting vulnerabilities in its smart contracts.
According to Ostium’s post-mortem, fraudulent BTC-USD price reports submitted through trusted infrastructure allowed the attacker to generate artificial trading profits that were settled against the protocol’s public OLP liquidity vault. Earlier analysis from blockchain security firm Blockaid similarly concluded that manipulated oracle reports, rather than flaws in contract code, enabled the exploit.
Separately, the Coldcard wallet incident originated from a firmware issue introduced during a March 2021 software update. Coinkite and Block’s Bitcoin engineering and security teams concluded that affected firmware generated wallet seeds using a deterministic pseudo-random generator instead of the intended hardware random-number generator, reducing the entropy used to create private keys.
Galaxy Research has confirmed thefts totaling 1,596 BTC across roughly 7,300 addresses linked to three attack waves. The research firm has also identified a suspected fourth coordinated wave involving another 448.7 BTC, although it has not yet included those addresses in its confirmed total because additional victim confirmation remains pending.
Coldcard review has expanded into Bitcoin-wide security checks
The Coldcard incident has prompted developers to review a much larger portion of Bitcoin’s software ecosystem.
Earlier this week, Bitcoin developer Calle said the volunteer Bitcoin Red Team had completed AI-assisted and manual reviews across 390 Bitcoin-related repositories, identifying 4,962 potential security issues, including 720 classified as high or critical severity.
According to Calle, about 21.4% of the reported findings have already been reproduced through manual verification before being privately disclosed to affected developers.
The review campaign covers Bitcoin wallets, cryptographic libraries, infrastructure software, and other open-source projects. Calle said OpenSats is funding approximately $10,000 per day in computing costs, while Kimi Moonshot has provided AI accounts and access to its Kimi K3 model to support the effort.
Governance remained the attack surface
Unlike the Ostium exploit or the Coldcard wallet incident, the StrongBlock attack did not rely on compromised infrastructure, oracle manipulation, or cryptographic weaknesses.
Instead, the attacker first obtained control of governance before modifying the protocol’s own administrator contract.
According to Defimon Alerts, upgrading the Governor proxy to an implementation containing the restricted forward(address, bytes) function gave the attacker’s wallet exclusive authority to execute arbitrary calls through the Governor contract.
The stolen assets were then transferred using permissions that the protocol itself granted after the governance proposal completed, illustrating how abandoned governance systems can continue exercising administrative control over protocol contracts even after development activity has largely ceased.
