The four most famous international exchanges:

Binance INTL	OKX INTL	Gate.io INTL	Huobi INTL
China Line　APP DL	China Line　APP DL	China Line　APP DL	China Line　APP DL

Note: The above exchange logo is the official website registration link, and the text is the APP download link.

Coin Circle (120BTC.coM): Monero, the king of privacy coins, recently revealed its Community Crowdfunding wallet
System, CCS) has been attacked since September. A total of 2,675.73 Monero coins (XMR) originally intended to support developers were lost, involving an amount of US$460,000. The incident also caused controversy in the community, which has always been considered unbreakable. Monero privacy sparks controversy.

 The source of the vulnerability has not yet been identified

The CCS wallet leakage incident was disclosed on GitHub on the 2nd by Monero developer Luigi. This incident occurred as early as September 1st. The specific source of the security vulnerability has not yet been identified. Fortunately, it was used to pay The hot wallet for core developers, which contains about 244 XMR, survived. In the past, Monero has used this wallet to raise funds from the outside world to support core developers.

According to a post on Github, Luigi and Spagni (also known as Fluffypony) are the only people who have the private key of the CCS wallet. The CCS wallet was established in 2020 on a system with Ubuntu, which also executes For a Monero node, Luigi will allocate funds from the CCS wallet to the hot wallet to pay community members when necessary. This hot wallet has been running on a Windows 10 Pro desktop computer since 2017. However, on September 1 , the CCS wallet was emptied in nine transactions, so the Monero core team is now looking for other general funds (General
Fund) came forward to solve the debt problem of the current core team.

Spagni pointed out that this attack may be related to a series of hacking incidents that have occurred since April, which involved a variety of stolen private keys, including Bitcoin wallet files (wallet.dats), and passwords generated by a variety of hardware and software. Seeds, Ethereum pre-sale wallets, etc., and now even XMR funds that have been wiped out.

Marcovelon, another anonymous developer, commented that if Luigi's Windows computer had been controlled by a botnet and was not discovered, the attacker could steal SSH keys or use Trojan remote desktop control functions without the user noticing. Launched this attack, it is not uncommon for large-scale corporate security incidents caused by developer computers to be compromised; other developers speculated that the cause of the theft may be a wallet key that may have been leaked on the Ubuntu server.

 Proposal to disband the core team

Yesterday (5) night, Spagni released another proposal on GitHub to discuss the dissolution of the Monero core team. He said that the recent CCS wallet incident is one of the examples where the core team may become a source of risk. Therefore, the proposal is to transform the core team into a six-member team. An independently formed working group will be transformed before January 1, 2025.

This proposal was approved by Douglas
Tuman supports it, saying that this gives people hope for progress, and firmly believes that this CCS incident will be a turning point in the development of the Monero project, making development and governance methods, as well as funding methods more decentralized and more resistant to attacks and Security vulnerabilities. However, he also said that he was not entirely sure whether the current proposal was the best, but it was good to see such discussions.

 The community suspects that the prisoner is committing theft

The possible source of the vulnerability has also caused widespread discussion in the community. Researcher ChrisBlec suspects: "The most likely scenario is that the person controlling the wallet (Luigi and/or fluffy) stole the money."

Another netizen unceremoniously stated that Spagni is the main suspect: When it comes to credibility issues, fluffy is the obvious suspect. Judging from past behavior, luffy is an obvious suspect. I have been saying for years that fluffy is the biggest risk facing Monero.

In this regard, Tuman stated that unless there is conclusive evidence that Spagni is harmful to Monero, he will always respect and trust him based on his huge contribution to Monero. Spagn himself responded that he had invested hundreds of thousands of dollars in developing Monero in the past and disclosed his expenditure details.

 Can privacy coins still protect privacy? 

It is worth noting that Moonstone
Research released a report to investigate how the attackers in this incident moved these funds, and finally confirmed three Monero transactions that may contain "stolen" funds, and stated that all Monero exchanges and services should check whether they have received following transactions so that they risk being frozen by the exchange. However, the flow of funds that can be tracked is inconsistent with the concept of privacy coins. Therefore, it has also caused extensive discussion in the community on whether privacy coins are sufficiently private.

In response, Seth For Privacy posted that Moonstone
Research’s analysis method does not apply to almost everyone who uses Monero. It reiterates that Monero is still private by default. Users can avoid large-scale surveillance without additional actions and can resist targeted tracking in most common scenarios. In addition, it was also revealed that Monero will continue to improve in the future. For example, after implementing the Seraphis global anonymity set, Moonstone
Research's current tracking methods would be nearly (or completely) impossible to achieve.

In response to this, Chris once again posted a response, although privacy protection technologies, such as Monero, are continuing to evolve. However, what we do today, and the current privacy technologies we apply, will become a historical record to be mined and studied by future data archaeologists. What he wanted to express was just like his previous tweet: There is no "eternal privacy" and all privacy technologies are fleeting. It works today, but not forever.