gate.io

Cause: Recently, I've been doing some research on the tokens under Aptos and the Move contracts. I discovered that the token balance exists within an object, and this object is transferable!
Vulnerability: On a whim, I started testing how to create transfer records on the object, and then moved the object to the deposit address of an exchange. At this point, the owner of the object was already the exchange's deposit address. I tested multiple exchanges, and only g*te managed to sweep this object and recognized the previously created transfer records as deposits. (Similar issues exist on Solana, and many folks are likely aware of this.)