Digital Asset
Intelligence
Security Incident

Phala Cloud API endpoint vulnerability

·Historical incident record

Incident Overview

A vulnerability in the Phala Cloud API endpoint allowed unauthorized modifications to some Offchain KMS CVMs. The attacker deployed a malicious pre-launch script to affected CVMs, which may have accessed decrypted environment variables after boot. The issue was identified, patched, and contained on June 1, 2026. Affected users/CVMs have been directly notified via email.

Sources & References

Original incident referencehttps://x.com/phalanetwork/status/2061523264783237153?s=46&t=DLwbX9Nw4QECiyZQ0av-fg (opens in a new tab)

This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.

More Security Incidents

View All →
  1. Incident date
    Target

    Fluid

    Attack methodPrivate Key Leakage
    Reported loss$ 215,000
  2. Incident date
    Attack methodOff-Chain Vulnerability in the Bridge Backend
    Reported loss$ 815,000
  3. Incident date
    Attack methodSmart Contract Vulnerability
    Reported loss$ 10,000
  4. Incident date
    Target

    $TENDRIL

    Attack methodSmart Contract Vulnerability
    Reported loss$ 555000
  5. Incident date
    Attack methodUnknown
    Reported lossNot disclosed