Posts by Dmitry Serdyuk | Blog

Posts by Dmitry SerdyukClear filter

Abstract illustration of a DeFi vault: an external glowing token dropped into a side strategy module inflates a red share-price gauge past its safe band while value siphons out through a redemption channel, over dark teal circuitry.

Summer.fi's $6M Lazy Summer Exploit: When a Donation Broke the Vault Math

An attacker donated an asset into a Summer.fi Lazy Summer vault, inflated its totalAssets() share price, and redeemed a flash loan for a $6M profit. No key was stolen. The accounting was the hole.

Dmitry Serdyuk·Jul 8, 2026

An oversized hand drops a stack of votes that outweighs a scattered crowd on a tipping scale, swinging open a treasury vault as coins stream out.

exploits

BonkDAO's $20M Governance Takeover: When Buying the Vote Beats Hacking the Code

An attacker spent about $4M buying BONK, took a voting majority on BonkDAO's Realms governance, and passed one proposal that moved $20M out of the treasury. No contract was hacked. The rules were.

Dmitry Serdyuk·Jul 7, 2026

A deprecated on-chain vault whose guard inspects only one of thirty-two settlement slots, with forged teal deposit blocks slipping through the unverified gap while a single red slot drains assets from the sealed pool.

exploits

Aztec Connect's $2.19M Exploit: A ZK-Rollup Settlement Bug in a Contract No One Could Patch

A deprecated Aztec Connect contract was drained of $2.19M when its L1 settlement loop and its ZK proof disagreed on how many slots were real. Its keys were renounced, so no one could pause it.

Dmitry Serdyuk·Jul 5, 2026

One compromised laptop holding seven signing keys that cleared a 3-of-6 and a 3-of-5 multisig across two chains

exploits

Humanity Protocol's $36M Key Compromise: A Runbook for Wallets That Touch Contracts

One compromised laptop held seven keys and cleared two multisigs, draining $36M+ from Humanity Protocol. A runbook for segregating, monitoring, and revoking project wallets that touch contracts.

Dmitry Serdyuk·Jun 10, 2026

Web3 release pipeline audit checklist for npm provenance, lifecycle hooks, cache poisoning, and deployer-key exposure

research

Audit the Release Pipeline Like a Smart Contract

Your contracts are audited. Your release pipeline isn't. Mini Shai-Hulud proved npm provenance signs whatever a compromised workflow ships. Here's the checklist Web3 teams should run on their own pipeline.

Dmitry Serdyuk·May 19, 2026

Linux kernel privilege escalation mapped to Web3 infrastructure risk

research

Copy Fail: When a Linux Bug Becomes Protocol Risk

Copy Fail is a Linux kernel privilege escalation, not a smart contract bug. For Web3 teams running validators, CI runners, deployer hosts, and signing infrastructure, that's exactly why it matters.

Dmitry Serdyuk·May 5, 2026

Summer.fi's $6M Lazy Summer Exploit: When a Donation Broke the Vault Math

BonkDAO's $20M Governance Takeover: When Buying the Vote Beats Hacking the Code

Aztec Connect's $2.19M Exploit: A ZK-Rollup Settlement Bug in a Contract No One Could Patch

Humanity Protocol's $36M Key Compromise: A Runbook for Wallets That Touch Contracts

Audit the Release Pipeline Like a Smart Contract

Copy Fail: When a Linux Bug Becomes Protocol Risk

Smart Contract Audit Checklist: What to Prepare Before Your Engagement

Claude Code Security vs Codex Security: What Each AI Vulnerability Scanner Actually Delivers