AMA Recap | Decoding mETH's "Dual-Core Engine": Dynamic Defense System + Minute-Level Response Log
TechFlow Selected TechFlow Selected
AMA Recap | Decoding mETH's "Dual-Core Engine": Dynamic Defense System + Minute-Level Response Log
Replay the key strategies implemented by mETH Protocol during the Bybit incident, addressing users' most pressing security concerns.
Navigating Web3 tides with focused insights
Teacher Zolo's Question: Crisis Response Case Study (Building Trust)
-
「Post-Mortem」User’s First Question: What exactly did mETH do during the Bybit incident?
This incident was indeed one of the larger security events in crypto history. On February 21, 2025, Bybit Exchange suffered a security breach where hackers attacked a cold wallet primarily holding ETH, including partial holdings of mETH and cmETH assets. However, it must be emphasized that the mETH protocol itself was not compromised—this event occurred within Bybit’s infrastructure. Our protocol remained unaffected, and both mETH and cmETH remained secure. We acted as a key collaborator in helping Bybit recover its assets.
Specific actions taken:
-
After 8,000 mETH were withdrawn by the attacker, they were exchanged into ETH in three separate transactions on DEXs.
-
An attempt to withdraw 15,000 cmETH was made, but the built-in 8-hour withdrawal delay mechanism of the mETH protocol played a critical role, successfully preventing the hacker from completing the withdrawal.
-
Thanks to this security feature, we gained sufficient response time and ultimately ensured the full recovery of the 15,000 cmETH, with no permanent loss incurred by mETH assets.
Cross-platform defense collaboration:
This incident demonstrated the collaborative power of the blockchain security ecosystem, with multiple teams and tools playing vital roles in incident response:
-
SEAL911 provided security advisory and tactical support.
-
Hexagate (Chainalysis) & Blocksec conducted real-time on-chain monitoring and provided data analysis.
-
Mudit Gupta, CISO of Polygon, and his security team recognized this as the fastest asset recovery action seen in the Bybit incident.
-
Veda (infrastructure partner for cmETH) remained on standby 24/7, promptly flagging suspicious fund flows.
-
Etherscan & Arkham Intelligence provided real-time fund visualization tools, enabling us to track fund movements more precisely.
-
The collaboration among these partners enabled rapid asset recovery and delivered valuable lessons for future security practices.
-
「Efficiency Focus」How did mETH freeze suspicious assets within 48 hours?
mETH’s specific response strategy:
-
The 8-hour withdrawal delay mechanism was triggered: This security feature successfully prevented the immediate transfer of 15,000 cmETH, buying us crucial response time.
-
During those critical 8 hours, we took the following steps to maximize protection for the mETH protocol:
-
At 2:00 AM on February 22, we paused cmETH withdrawals: Immediately after confirming the attack, we halted withdrawals to prevent further asset loss.
-
Simultaneously, we reduced cmETH liquidity on Mantle L2: Lowering exposure to potential secondary risks. While executing these measures, we worked closely with security team SEAL911 and partner Veda to identify the hacker’s addresses.
-
Around 4:00 AM, we blacklisted the attacker’s address: The hacker’s address was added to our blacklist, blocking further operations.
-
We manually executed smart contract calls to recover assets: Due to the temporary suspension of certain automated infrastructure (e.g., Safe), we manually invoked contract functions via Etherscan, successfully recovering the 15,000 cmETH.
-
After identifying the hacker and completing the redemption, we resumed normal operations of the mETH protocol at 5:46 PM.
-
Typically, centralized exchanges may take 3 days or longer to confirm and freeze funds in similar incidents. In contrast, we completed core countermeasures within just 2 hours and fully resolved the issue within 48 hours. This highlights the advantage of decentralized security mechanisms—leveraging on-chain transparency and smart contract control for greater efficiency than traditional approaches.
Teacher Chen Mo's Question: Security Architecture Breakdown (Addressing Doubts)
-
「Soul-Searching Question」If hackers upgrade their attack methods, can mETH’s defense system hold up?
Our security system is dynamically upgradable. Not only have we responded effectively to this incident, but we are also prepared to strengthen our defenses against more sophisticated attacks in the future. We’ve begun collaborating with leading security teams on a series of upgrades and detection enhancements. Through this AMA, we’d like to share an AI threat prediction case and officially announce our public “Bug Bounty Program”:
mETH’s defense system has three key upgrade directions:
-
Enhanced transaction signature security — Strengthening hardware wallet integration & cross-verification mechanisms to prevent phishing attacks.
-
AI-powered threat prediction — Using machine learning to analyze on-chain transaction patterns and proactively detect anomalies, staying ahead of attackers. Simultaneously reducing reliance on centralized multi-sig setups.
-
Cross-platform intelligent circuit breaker — Automatically restricting withdrawals when a security incident occurs on any integrated exchange, preventing risk propagation.
Bug Bounty Program — We’ve partnered with Immunefi to launch an official bug bounty program for mETH, offering rewards up to $500,000. We aim to incentivize developers and white-hat hackers in the community to help continuously improve and secure the mETH protocol.
Teacher Mark’s Question: Technical Evolution Roadmap (Setting Expectations)
「Autonomous Evolution」Can the community participate in iterating mETH’s security strategies?
Our users and COOK token holders can directly participate in security governance:
We’ve introduced a "Crisis Simulation Voting" module into our DAO mechanism, allowing the community to collectively decide on:
-
Whether to enable new security mechanisms
-
The optimal response strategy in the event of a hack
-
We are committed to maximum transparency, ensuring COOK Holders and the broader community have full information and meaningful influence over mETH Protocol’s security governance.
Teacher Zolo’s Question: Ecosystem Co-Development Plan (Encouraging Participation)
「Anti-Hack Alliance」Will mETH open its security suite to other exchanges?
We are currently participating in Bybit’s Bounty Program.
Teacher Chen Mo’s Question: Ultimate Trust Building (Emotional Resonance)
1. 「Transparency Revolution」Will mETH dare to publish a real-time security data dashboard?
2. 「Values Declaration」When profits conflict with user security, which does mETH choose?
-
Absolutely. We are actively developing a real-time security data dashboard to clearly publish all information and security inspection details. This will serve as a reference for the community and market, allowing users to monitor the security status of the mETH ecosystem at any time. Key features of the dashboard include:
-
Blacklist & Risk Monitoring — Publishing all known risk addresses so the community can query them directly.
-
Withdrawal Delay & Transaction Interception Statistics — Transparently showing how many suspicious transactions have been blocked.
-
Vulnerability Fix Progress — Updates on the white-hat bug bounty program, keeping the community informed about ongoing security improvements.
-
Third-party Audit Certification：
-
Transparency is a core value of DeFi. We believe only through open data can the entire industry become safer. We’ve engaged independent security audit firms and will regularly publish security reports to ensure full transparency.
-
-
Security always comes first—profit yields to trust. As an issuer of staked assets, mETH consistently adheres to the principle of “never making users bear risks that the protocol could have avoided.” This means:
-
If a decision increases returns but reduces security, we would rather not proceed.
-
Even if TVL growth is constrained, we will not sacrifice security for short-term gains.
-
All major upgrades must undergo rigorous security audits.
Join TechFlow official community to stay tuned
Telegram:https://t.me/TechFlowDaily
X (Twitter):https://x.com/TechFlowPost
X (Twitter) EN:https://x.com/BlockFlow_News
@0xMantleCN
