Security company Salus posted that the project Revenue Family, self-claimed as the X Money withdrawal bridge, involves malicious authorization. Malefactors submitted user permit signatures to obtain unlimited USDG quotas, then called transferFrom within the same transaction to transfer funds.

Funds flowed into two hacker addresses in an 80-20 ratio. Salus did not disclose the total amount transferred, the number of affected addresses, nor the two receiving addresses. Authorization and transfer were bundled in the same transaction, and the quota was immediately used after user signature.

The project stated on October 1 that its social media account was hijacked by internal auditors, has suspended exchanges, and denied that REV is an official token. On October 2, it posted again claiming it never collected payments or misappropriated funds, blaming losses on unrelated fake tokens. The account profile stated it was for X Money withdrawals, exchanging crypto assets, and did not require identity verification, registered on September 26, 2026.

Permit is an offline authorization in the token standard. The signature itself does not transfer tokens, but the unlimited quota allows the authorized address to subsequently call transferFrom. The path described by Salus is to first obtain unlimited USDG quota, then transfer out in the same transaction, with funds no longer remaining at the original address.

The project labeled itself as the X Money withdrawal bridge, not the channel officially announced by X. After the project denied REV, the remaining risk fell on the already signed USDG authorizations. Suspending exchanges only halts exchanges on the project side, not automatically revoking the quotas already granted by users.

Funds flowed from users' USDG balances to two hacker addresses, in an 80% and 20% ratio. The driving force behind the incident was the signature under the guise of the withdrawal bridge, not a public market sell-off. The beneficiaries are the two addresses receiving 80% and 20% shares, while the burden falls on USDG holders who signed unlimited quotas and had exchanges suspended.

Salus did not clarify whether the USDG issuer has frozen the relevant addresses, nor provided an official entry for revoking authorizations.

Source: Public Information