TL;DR
- StrongBlock lost approximately $72,000 in STRONG and STRNGR tokens after an attack that exploited its abandoned governance system.
- The attacker accumulated enough voting power to pass a proposal that transferred administrative control of StrongBlock’s Governor proxy contract.
- The incident showed that inactive protocols remain vulnerable as long as their contracts, permissions, and balances stay active on-chain.
The StrongBlock protocol suffered a loss of approximately $72,000 in STRONG and STRNGR tokens after an attacker used its inactive governance system to seize administrative control of key contracts. The blockchain security firm Defimon Alerts documented the incident and explained the mechanism used in detail.
The attacker acquired the majority of the voting power associated with STRONG, a token that had lost much of its value as activity in the project declined. With that accumulated power, they submitted and passed a proposal that redirected the Governor’s Upgrader contract to execute `setPendingAdmin(attacker)`, making their address the proxy’s administrator.
🚨 Governance Takeover of @Strongblock_io – Loss $72K
Token: $STRONG
Network: EthereumThe attacker exploited StrongBlock's abandoned on-chain Governor. Holding a majority of the now near-worthless STRONG vote token, they pushed a proposal calling setPendingAdmin(attacker) on… pic.twitter.com/1FBfWYn9tC
— Defimon Alerts (@DefimonAlerts) August 6, 2026
StrongBlock: the Upgradeable Proxy Trap
Upgradeable proxy systems separate a contract’s stored data from its underlying logic, which allows an authorized administrator to point the proxy toward a new implementation without changing its address.
Once in control of that permission, the attacker replaced the existing implementation with a new, unverified one that contained a `forward(address, bytes)` function executable exclusively from their own account. That function allowed them to carry out arbitrary transactions with the authority of the Governor contract.
With that mechanism in place, the attacker transferred 32,695 STRONG and 383,447 STRNGR from a pool controlled by StrongBlock, totaling more than 416,000 tokens. Defimon Alerts valued the stolen assets at approximately $72,000 at the time of the incident.
Abandoned Governance: a Security Risk
Governance in StrongBlock is token-based, so it is assumed that holders of large amounts have a financial interest in protecting the protocol. That premise breaks down when the governance token depreciates while the contracts it controls continue to hold significant assets or administrative permissions. An attacker can then acquire majority voting power at a cost lower than the value accessible through those contracts, without needing to exploit any software flaw.
This exploit made clear that winding down a project requires more than halting development or shutting down public communications. Revoking upgrade permissions, disabling governance modules, setting meaningful voting thresholds, implementing timelocks, and maintaining active monitoring of pending proposals are necessary measures to prevent on-chain contracts from becoming attack vectors once the community and developers stop overseeing them.
