0G Labs Hack

On December 11, 2025, an attacker drained 520,010 0G tokens from a 0G reward distribution contract. CertiK valued them at about $516K. The attacker also took 9.93 ETH and about $4.2K USDT. The stolen 0G was bridged to another chain and laundered through Tornado Cash.

The contract itself was not the weak point. The 0G Foundation said the key controlling it was stored in plaintext on an Alibaba Cloud (AliCloud) server. From December 5, the attacker exploited the Next.js vulnerability CVE-2025-66478 on 0G's AliCloud instances. It then moved laterally through internal services, including alignment, validator node, NFT and node-sale services. With the leaked private key, the attacker called the contract's privileged emergency-withdrawal function and withdrew the reward tokens.

The Foundation said core chain infrastructure was not affected and no additional losses tied to user-held assets had been found. It rotated the compromised keys, rebuilt and patched the affected services, removed plaintext keys, and said it would move signing to trusted execution environments with multi-signature controls.