Security Incident @v4vapp: KeepSats Transfer via Authentication Flaw — Now Resolved

**[Vote for Brianoflondon's Witness KeyChain or HiveSigner](https://vote.hive.uno/@brianoflondon)** ***This is a value for value post: see the explanation in the footer.*** ---  **Security Incident: KeepSats Transfer via Authentication Flaw — Now Resolved** On 12 October 2026 an attacker exploited a flaw in the v4v.app authentication flow. After signing a normal Ethereum wallet challenge that requested `hive:active` scope, the attacker called the token-refresh endpoint and supplied an arbitrary Hive username. The API issued a valid access token for that username while keeping the elevated scope. With the resulting token the attacker called the KeepSats transfer endpoint. The public API used the username from the JWT as the sender; the backend then broadcast a `v4vapp_transfer` custom_json operation signed by the server account `v4vapp`. This moved 40,000 sats on the internal KeepSats ledger from `one_of_my_accounts` to `emem0515`. No Hive posting or active keys belonging to `one_of_my_accounts` were presented or used, and no Lightning payment or Hive/HBD left the service. The same client first performed smaller test transfers and username switches, confirming the behaviour before the larger movement. The authentication path that allowed a refresh to mint a token for an arbitrary username without a corresponding signature or membership check has been closed. The affected session is no longer valid and the vulnerability has been patched. ## The Attacker? I have a number of Hive account IDs and ETH addresses which were used to do this. Fortunately my alert systems were quick enough to shut this down before any funds could move out of my system, and those accounts are now all blocked permanently. ## After the Attack Repeat log on attempts: | Time (UTC) | Name | Source | Result | |----------------------------|----------|------------------------------|------------------------| | 13:32–13:33, four tries | hiveln | 186.247.41.86 | Bad User, no challenge | 186.247.41.86 is still showing up. Right after the restart it read KeepSats, refreshed, and logged out, then polled `/v1?get_crypto=true` every 10 minutes until 10:23. At 13:32–13:33, with no Referer, it asked for challenges for `brianoflondon` and `v4vapp` (`clientId=audit-check-2`, `scope=hive:active`). Those challenges were issued and never signed. It also asked for `nonexistentuser12345`. It then signed in as `ryum216` in 1.21s and posted a KeepSats transfer of 999,999,999 sats from `ryum216` to `ryum216`, memo `audit-overbalance`. The backend returned 402 Insufficient funds. No sats moved. The same IP then called convert and invoice. Thank you to everyone who uses v4v.app and KeepSats. ------- ## Value for Value For the last few months while building @v4vapp I was generously supported by the DHF. Going forward I have a much more modest support which covers direct server costs and a little of my time. If you appreciate the work I do on and around Hive, you can express this directly: upvoting posts on Hive is great. Also consider a direct donation (there's a Tip button on Hive or a Lightning Address) on all my posts.


https://images.hive.blog/130x130/http://hivebuzz.me/badges/birthday-6.png

**[Vote for Brianoflondon's Witness KeyChain or HiveSigner](https://vote.hive.uno/@brianoflondon)**  -------


- [Find me on Telegram](https://t.me/brianoflondon) - [V4VAPP Support on Telegram](https://t.me/brianoflondon) - [Vote for Brianoflondon's Witness KeyChain or HiveSigner](https://vote.hive.uno/@brianoflondon) - [Vote for Brianoflondon's Witness direct with HiveSigner](https://hivesigner.com/sign/account-witness-vote?witness=brianoflondon&approve=1) - [Find my videos on 3speak](https://3speak.tv/user/brianoflondon)