GoPlus has issued a security alert regarding a suspected theft involving the x402 cross-chain protocol, known as @402bridge. The contract creator, identified by the address starting with 0xed1A, transferred ownership to 0x2b8F. The new owner exploited the transferUserToken method to move all remaining USDC from user wallets that had authorized the contract. This incident affected over 200 users, resulting in the unauthorized transfer of 17,693 USDC, which was subsequently converted to ETH and moved to Arbitrum via multiple cross-chain transactions. Users are advised to immediately revoke any authorizations related to the project. GoPlus emphasizes the importance of verifying that authorization addresses are official, authorizing only necessary amounts, and avoiding unlimited authorizations. Regular checks and cancellations of unnecessary authorizations are also recommended to prevent similar incidents.