According to PANews on April 28, a Web3 startup project lost hundreds of thousands of USDT due to a hardcoded authorization wallet address in the smart contract code, as disclosed by crypto community member @0xCat_Crypto. In the incident, a suspicious contract code was submitted by an employee who denied writing the code, claiming that the malicious code was automatically generated by an AI programming assistant without thorough review. Currently, the ownership of the involved wallet cannot be confirmed, and the source of the code writing is difficult to determine.
Slow Fog Yuan Cosine stated that after preliminary investigation, using Cursor and Claude3.7 models, the AI auto-completed address does not match the malicious address, ruling out the possibility of AI code generation causing harm. The malicious address was granted owner permissions in the smart contract, resulting in the complete transfer of project funds.
