WasabiProtocol updates security incident handling progress

WasabiProtocol released a security incident update that pointed out that the attacker used a SpringBootActuator configuration vulnerability in its AWS infrastructure to steal the private key that controls the EVM smart contract, and stole approximately US$4.8 million in user funds and US$900,000 in agreement treasury funds from the related contracts, with a total loss of approximately US$5.7 million. The attack chain started with a public network server used for analysis. Its Actuator heapdump was not protected by normal password, causing the attacker to obtain another server certificate and eventually gain control of the smart contract's private key. This incident only affected EVM deployment, including some vaults on Ethereum, Base, Blast and Berachain. Solana deployment and PropAMM were not affected. There is no final update plan for the user compensation plan yet, but "making all damaged users compensated" is still the team's top priority, and an update on the survey progress will be released to the Discord community in the future.