Posts by Aron Turner | Blog

Posts by Aron TurnerClear filter

Cutaway of a teal stopwatch-style performance gauge on a trading terminal, revealing a red mechanical arm inside pressing a signing seal onto a stack of order tickets while a trader's hand rests on the keyboard

Polymarket $2.65M Drain: A Hijacked DebugBear Monitoring Script Traded on Users' Behalf

A performance-monitoring script on Polymarket.com turned into a wallet drainer on October 29, 2026. It used traders' own sessions and Polymarket's relayer to move about $2.65M.

Aron Turner·Oct 30, 2026

Dark perspective grid of identical teal towers on building plots, with one bare plot in the foreground holding four teal keys on red-staked ground and two hooded figures closing in from opposite sides

exploits

Avalanche Safe $7.45M: The Approval That Waited 233 Days for Code to Appear

A 2-of-7 Safe on Avalanche approved four tokens to an address with no code. 233 days later anyone could deploy there, and an MEV bot beat the attacker to $7.45M.

Aron Turner·Oct 28, 2026

Cutaway of a vault frozen solid in red ice, with one clear teal pneumatic tube running through it holding eight sealed capsules, and a gloved hand lifting the first capsule out of the open hatch

exploits

Sui Bridge $392K: A Claim Bot Paid the Cetus Attacker From 17-Month-Old Withdrawals

Eight Sui Bridge withdrawals the Cetus attacker never claimed sat signed for 17 months. On October 16, 2026, a tip-seeking rescue bot claimed them and delivered about $392K to the attacker.

Aron Turner·Oct 19, 2026

Cutaway of an old vault wall with four teal ingots sealed under bands of dust, a row of padlocked hatches, and one hatch with an empty hasp where a gloved hand pushes a red probe inside

exploits

MakerDAO Keeper $543K: Black Thursday Auction Wins That Sat Unclaimed for Six Years

A 2020 auction keeper won four 50 ETH lots on Black Thursday and never settled them. In October 2026, one function without an auth check let a stranger settle them and take all 200 ETH.

Aron Turner·Oct 12, 2026

Top-down view of a steel desk tiled with identical teal access badges, where one slot holds a red-framed mirror reflecting the badges and bearing a teal approval stamp, as a gloved hand slides it into place

exploits

FlashLoopAdapter $305K: A Safe Module That Took the Caller's Word for It

A Safe module for looped Aave v3 positions asked its caller whether it was enabled, and believed the answer. A fake Safe said yes, and 114 ETH of equity left two real Safes in one transaction.

Aron Turner·Oct 8, 2026

Cutaway of a dark vault door showing seven key cylinders, three turned red and four teal, retracted bolts, a rack of teal allowlist cards with one new red card, and a gloved hand sliding ingots out through the open gap

exploits

Base wstETH Vault: $6M Drained Through a Whitelist Its Own 3-of-7 Safe Signed

Three valid Safe signatures whitelisted an attacker contract 85 minutes old. Six outflows later, 1,783 wstETH was gone, and 15 hours on, the Safe had sent no revocation.

Aron Turner·Oct 5, 2026

Polymarket $2.65M Drain: A Hijacked DebugBear Monitoring Script Traded on Users' Behalf

Avalanche Safe $7.45M: The Approval That Waited 233 Days for Code to Appear

Sui Bridge $392K: A Claim Bot Paid the Cetus Attacker From 17-Month-Old Withdrawals

MakerDAO Keeper $543K: Black Thursday Auction Wins That Sat Unclaimed for Six Years

FlashLoopAdapter $305K: A Safe Module That Took the Caller's Word for It

Base wstETH Vault: $6M Drained Through a Whitelist Its Own 3-of-7 Safe Signed

Neutron's $9.4M Governance Takeover: How $20K of NTRN Bought Admin Over Astroport and Drop

Notional Finance $1.73M Exploit: A Debt of 2^128 That Read as Zero

Coldcard's $88.6M Entropy Failure: Five Years of Guessable Bitcoin Seeds

DefiTuna Exploit: $580K Drained From Solana Lending Pool

JaredFromSubway MEV Bot Drained for $7.5M in a Counter-MEV Honeypot

The $3.2M SquidRouterModule Exploit: How a Public String Drained 86 Safe Wallets

GitHub's 3,800-Repo Breach: How a Poisoned VS Code Extension Burned the World's Biggest Code Host

Kelp DAO's $292M Hack and Aave's $6B Fallout: One Config Parameter Broke DeFi

Drift Protocol's $270M Exploit: How Solana's Durable Nonces Became a Social Engineering Weapon

What Does a Smart Contract Audit Actually Cost in 2026

Aave's $27M Liquidation Incident: How a Stale Oracle Parameter Wiped Out 34 Users

What to Expect From a Smart Contract Audit Report

AI's Growing Role in Auditing and Cybersecurity