Fabricated Audit Reports, a Fake '115% Reserve': CFTC Sues Goliath Ventures Over $397M Crypto Ponzi Scheme

An exploit of the gap created when a contract sends assets out before it updates its own internal ledger — before the contract has a chance to record "this has already been withdrawn," the attacker repeatedly calls the same withdrawal function, tricking the contract into believing each call is a brand-new request, and drains the assets within a single transaction.

A verification mechanism that lets users independently confirm, through cryptographic means, whether their own balance is genuinely included in an exchange's total claimed assets — rather than simply taking the exchange's word for it. Its core tool is the <a href="/en/glossary/blockchain-fundamentals/merkle-tree/">Merkle Tree</a>, but what it proves is only a snapshot at a specific point in time, not a guarantee that the exchange remains fully solvent at every moment afterward.

The attacker doesn't need to steal your <a href="https://crypto-bible.com/en/glossary/wallet-and-security/private-key/" target="_blank" rel="noopener">Private Key</a> or <a href="/en/glossary/wallet-security/seed-phrase/">Seed Phrase</a> — they just need to trick you into signing what looks like a routine "approval" transaction, which grants them unlimited, indefinite permission to move a specific <a href="https://claude-me.com/en/glossary/core-concepts/token/" target="_blank" rel="noopener">Token</a> from your wallet, to be executed whenever they choose without any further warning to you.