Security Company Salus Claims Revenue Family Project, Self-Claimed X Money Withdrawal Bridge, Involves Malicious Authorization to Transfer USDG
Security company Salus posted that the project Revenue Family, self-claimed as the X Money withdrawal bridge, involves malicious authorization. Malefactors submitted user permit signatures to obtain unlimited USDG quotas, then called transferFrom within the same transaction to transfer funds.
Funds flowed into two hacker addresses in an 80-20 ratio. Salus did not disclose the total amount transferred, the number of affected addresses, nor the two receiving addresses. Authorization and transfer were bundled in the same transaction, and the quota was immediately used after user signature.
The project stated on October 1 that its social media account was hijacked by internal auditors, has suspended exchanges, and denied that REV is an official token. On October 2, it posted again claiming it never collected payments or misappropriated funds, blaming losses on unrelated fake tokens. The account profile stated it was for X Money withdrawals, exchanging crypto assets, and did not require identity verification, registered on September 26, 2026.
Permit is an offline authorization in the token standard. The signature itself does not transfer tokens, but the unlimited quota allows the authorized address to subsequently call transferFrom. The path described by Salus is to first obtain unlimited USDG quota, then transfer out in the same transaction, with funds no longer remaining at the original address.
The project labeled itself as the X Money withdrawal bridge, not the channel officially announced by X. After the project denied REV, the remaining risk fell on the already signed USDG authorizations. Suspending exchanges only halts exchanges on the project side, not automatically revoking the quotas already granted by users.
Funds flowed from users' USDG balances to two hacker addresses, in an 80% and 20% ratio. The driving force behind the incident was the signature under the guise of the withdrawal bridge, not a public market sell-off. The beneficiaries are the two addresses receiving 80% and 20% shares, while the burden falls on USDG holders who signed unlimited quotas and had exchanges suspended.
Salus did not clarify whether the USDG issuer has frozen the relevant addresses, nor provided an official entry for revoking authorizations.
Source: Public Information
ABAB AI Insight
Revenue Family registered the account on September 26, 2026, directly labeling it as the X Money withdrawal bridge and stating no identity verification is required. On October 1, it attributed the account anomaly to hijacking by internal auditors, while suspending exchanges and denying that REV is an official token; on October 2, it claimed it never collected payments, with losses stemming from unrelated fake tokens. Salus's post described the path as permit signatures, unlimited USDG quotas, and transferFrom within the same transaction.
Funds did not enter the project treasury for delayed settlement but directly went to two addresses in an 80-20 split. Unlimited quotas mean a single signature covers the balance limit, and suspending exchanges cannot retract already signed permissions. X Money did not issue an announcement listing this bridge as an official channel; traffic comes from the account's self-claim.
Comparable incidents include phishing sites for cross-chain bridges in 2022, and later the authorization theft of tokens using Permit2 signatures in the same transaction. The project is not in the product launch stage but is nominally borrowing. The new payment brand has not publicly released a withdrawal interface, while a third-party account has preemptively occupied the term "withdrawal bridge."
Essentially, it is a transfer of pricing power. Users believe they are signing exchange permissions, while on-chain execution grants unlimited transfer rights. The mechanism is that permit changes authorization from on-chain confirmation to offline signing, with attackers inserting transferFrom into the same transaction; the split ratio only indicates how the two addresses share the funds, not altering the fact that the funds have already left the original holder. The official denial of REV does not allow for the retraction of already signed USDG quotas.
ABAB News · Cognitive Laws
The signature grants a quota, not an exchange receipt.
Suspending exchanges does not retract already signed authorizations.
The bridge's name is preemptively occupied before the new payment brand has an interface.