Long Reports WETH Hack Incident After RPC Log Spoofing

Long released a post-incident report on its September 14 WETH hack event. According to ChainCatcher, at 07:07 UTC the bridge paid 46.7928 WETH from the Robinhood Chain treasury to an attacker address. No user funds were lost, and the treasury was fully replenished from platform revenue. The bridge has been rebuilt with additional safeguards and remains operational, although some orders were delayed by several hours during recovery. Long said its keeper relied on RPC reads of burn events on Arc to release assets. At the time, the official mainnet endpoint was not yet live, so the system depended on public RPC. After the backup endpoint was overloaded, the main endpoint briefly supplied the keeper with forged withdrawal event logs that did not exist on Arc. The keeper was protected against replay and duplicate payments but did not question the data source, allowing the WETH release. Three other forged withdrawals were reverted on-chain. Long said the fake events entered through the RPC channel, and its contracts, keys, and treasury were not breached.