Update on today's incident: We've identified a critical vulnerability in our withdrawal API, where there was an exploit that allowed unauthorized withdrawals to bypass our security checks. We've frozen withdrawing funds on smart wallets until this is fully resolved.

Most importantly - all smart contracts, admin wallets, and user smart wallets remain fully secure and uncompromised

The root cause was an authentication spoofing technique in our API routes due to architectural constraints within our auth system. We've learned a lot from this exploit and are implementing more robust security measures to prevent a situation like this from ever happening again.

All affected users will be refunded this week

Ponder team is putting on a clinic for how to handle an incident. Communication has been top notch, hats off to the team

Sidenote — as FC grows, incidents *will* become more common. If you’re building in this space and using smart wallets, great opportunity to learn and have Ponder subsidize your tuition :)

friendly neighborhood shitcaster / building @pinetree

Appreciate it 🙏

If you're building a consumer crypto app that gains some traction, be aware that you'll become a target very quickly and need to have security measures in place

We've been fighting off attackers since February, including weekly ddos attacks, mass collusion, and data scraping

I have to say Farcasters have handled this situation exceptionally well. If this happened on X or Tg, it would’ve been full-blown FUD with users panicking. But here? I’m seeing maturity, calm confidence, and respect for the builders. Every fapp being made right now just reinforces that trust. Big ups to the community… real grown energy!

petition to aggregate all the great ways founders have managed crisis such as these - Ponder, Bybit & so many more. 

will be an invaluable resource