Posts by Alex Rybalko | Blog

Posts by Alex RybalkoClear filter

A dark clearing counter in perspective: a brass tray runs through a dividing wall, a mechanical arm pushes teal ingots in, and most of them land on the far side beside a red marker under a gloved hand

GoldPesa $115K: A Uniswap v4 Hook Paid Off the Attacker's Debt

GoldPesa's Uniswap v4 hook rebalanced inside an attacker's unlock. Its 148,868 USDC burn credit cancelled the attacker's unpaid debt, and 115,000 USDC walked out in one Base transaction.

Alex Rybalko·Oct 7, 2026

Top-down view of a dark steel desk where a gloved hand grips an engraved signet stamp beside a stack of teal-stamped slips, one separate slip bearing the same seal in wet red ink, and a chained strongbox left shut

exploits

MetaMask Staking: 0.36 ETH Stolen, $1.4B of ETH Exited After a Fee Recipient Hijack

An attacker redirected 18 block rewards worth 0.36 ETH, and MetaMask exited roughly 17,000 validators holding 523,000 ETH. The small theft proved something got the signing keys to sign.

Alex Rybalko·Oct 2, 2026

A teal suspension bridge seen from a raised angle with a crowd of tiny figures on its deck, its main cables bolted into a stone anchorage where one small red key sits half turned in a lock plate

exploits

Fake GIWA Chain Drains $2M: Right Chain ID, Wrong Operator, One Upgrade Transaction

Scammers stood up a working OP Stack chain under GIWA's reserved chain ID 9134. DYORSWAP listed it, 1,335 addresses bridged in, and one upgrade took 766 ETH.

Alex Rybalko·Sep 30, 2026

Cross-section of a machined signing device: a sealed teal key chamber with intact locks, a red card pushed into the intake slot above it by a gloved hand, and a press stamping a stack of red slips below

exploits

Bitget's $387.5M Hack: Its Own Signer Approved the Drain, and the Keys Were Never Stolen

Attackers never touched Bitget's private keys. They fed its wallet signer forged withdrawal instructions, and it signed $387.5M out of hot and warm wallets over 2h52m.

Alex Rybalko·Sep 28, 2026

Dark top-down view of a heavy machined teal disc-lock on a steel bench, a red articulated arm curving out of the lock's own casing and seating its tip into the lock's own keyway with the tumblers beneath rotated open, ringed by small dark approval plates, a gloved hand cropping in at the lower right

exploits

rsETH $7.8M Safe Drain: The Router That Authorized Itself, and the Bot That Took the Payout

2,900 rsETH left a Gnosis Safe on September 15, 2026. The Safe worked exactly as designed. The router behind its enabled module approved any call that pointed at the router itself.

Alex Rybalko·Sep 17, 2026

Dark founder desk with a glowing digital field guide for Australia's startup ecosystem

research

The Map Already Exists: Building a Digital-Economy Startup in Australia in 2026

Australia ranks 16th on innovation inputs but 27th on outputs. The gap is not talent, it is plumbing. A field guide to the grants, funds and pathways open today, and what to copy from abroad.

Alex Rybalko·Jun 17, 2026

45m

GoldPesa $115K: A Uniswap v4 Hook Paid Off the Attacker's Debt

MetaMask Staking: 0.36 ETH Stolen, $1.4B of ETH Exited After a Fee Recipient Hijack

Fake GIWA Chain Drains $2M: Right Chain ID, Wrong Operator, One Upgrade Transaction

Bitget's $387.5M Hack: Its Own Signer Approved the Drain, and the Keys Were Never Stolen

rsETH $7.8M Safe Drain: The Router That Authorized Itself, and the Bot That Took the Payout

The Map Already Exists: Building a Digital-Economy Startup in Australia in 2026

Solana Smart Contract Vulnerabilities: The Patterns Behind $500M in Exploits

Reserve Manipulation Isn't Dead

The Delve Scandal: How a $300M Compliance Startup Sold Fake SOC 2 Reports and Got Expelled from YC

What $10.77 Billion in Hacks Reveals About Audit Effectiveness