Posts by Aron Turner | Blog

Posts by Aron TurnerClear filter

Dark isometric illustration of a three-tier vault seen from a raised corner, the two upper tiers gutted with their cell doors swung open and studs dark behind a drawn roll-down shutter that stops above the packed teal lower tier, where one forced cell burns red with its trays pulled out

Notional Finance $1.73M Exploit: A Debt of 2^128 That Read as Zero

An attacker minted two fCash liabilities summing to exactly 2^128 against Notional's 2020-era V1 escrow. An unchecked uint128 downcast truncated the debt to zero, and the collateral check passed.

Aron Turner·Sep 10, 2026

Cutaway cross-section of a hardware wallet board: the hardware random number generator die sits dark with its bond wires ending at bare pads, while a small brass counter wheel is wired into its place and the seed register beside it stays mostly empty.

exploits

Coldcard's $88.6M Entropy Failure: Five Years of Guessable Bitcoin Seeds

A March 2021 build error routed Coldcard seed generation to a software PRNG instead of the hardware RNG. Five years later, attackers swept 1,367 BTC from 4,585 addresses without touching a device.

Aron Turner·Aug 3, 2026

Abstract illustration of a lending exploit: teal concentrated-liquidity bands meet a translucent vault of stacked cells, and red value drains through the misaligned seam where the two accounting systems meet, over dark circuitry.

exploits

DefiTuna Exploit: $580K Drained From Solana Lending Pool

DefiTuna's USDC lending pool lost $580K to a July 2026 exploit on Solana, leaving it in bad debt. Inside the attack, the Sec3 audit gap, and the lessons.

Aron Turner·Jul 20, 2026

Autonomous MEV bot following teal approval streams into a red honeypot trap of counterfeit token contracts as an attacker coordinator sweeps funds

exploits

JaredFromSubway MEV Bot Drained for $7.5M in a Counter-MEV Honeypot

JaredFromSubway, Ethereum's most prolific MEV sandwich bot, was drained of $7.5M when an attacker turned its own logic into a counter-MEV honeypot. How the dangling-approval attack worked.

Aron Turner·Jun 23, 2026

Third-party Safe module bypassing intact signature shields with a public hardcoded authorization key

exploits

The $3.2M SquidRouterModule Exploit: How a Public String Drained 86 Safe Wallets

A third-party module named SquidRouterModule drained $3.2M from 86 Gnosis Safe wallets on Ethereum and Base. Full attack chain, the auth flaw, and the lesson.

Aron Turner·May 26, 2026

Poisoned developer IDE extension exfiltrating internal repositories and secrets into an external archive vault

exploits

GitHub's 3,800-Repo Breach: How a Poisoned VS Code Extension Burned the World's Biggest Code Host

One poisoned VS Code extension on one GitHub employee's laptop cost the company ~3,800 internal repositories. Here is the attack chain, the Mini Shai-Hulud worm internals, and the rotate-everything checklist that follows.

Aron Turner·May 21, 2026

Notional Finance $1.73M Exploit: A Debt of 2^128 That Read as Zero

Coldcard's $88.6M Entropy Failure: Five Years of Guessable Bitcoin Seeds

DefiTuna Exploit: $580K Drained From Solana Lending Pool

JaredFromSubway MEV Bot Drained for $7.5M in a Counter-MEV Honeypot

The $3.2M SquidRouterModule Exploit: How a Public String Drained 86 Safe Wallets

GitHub's 3,800-Repo Breach: How a Poisoned VS Code Extension Burned the World's Biggest Code Host

Kelp DAO's $292M Hack and Aave's $6B Fallout: One Config Parameter Broke DeFi

Drift Protocol's $270M Exploit: How Solana's Durable Nonces Became a Social Engineering Weapon

What Does a Smart Contract Audit Actually Cost in 2026

Aave's $27M Liquidation Incident: How a Stale Oracle Parameter Wiped Out 34 Users

What to Expect From a Smart Contract Audit Report

AI's Growing Role in Auditing and Cybersecurity