Posts by Dmitry Serdyuk | Blog

Posts by Dmitry SerdyukClear filter

A small crisp teal block set against a vast red striated volume that runs past the frame, a size comparison between a short secured window and a far longer unwatched one

Triple-A's $11.8M Hot Wallet Drain: Seven Chains, and 31 Hours Nobody Closed the Tap

Triple-A's treasury wallets were swept across seven chains starting July 24, 2026. The theft took hours. Deposits kept arriving and kept being swept for 31.

Dmitry Serdyuk·Jul 30, 2026

A large teal machined ring seen head on against black, its inner core replaced by a mismatched dull red disc whose engraving does not line up with the ring, joined by a clean hairline seam

exploits

B2 Network $3.86M Staking Drain: The Upgrade Key Did All the Work

B2 Network lost 8.59M B2 tokens, about $3.86M, when someone used the staking contract's upgrade authority. That privilege had sat on the same wallet since 2025.

Dmitry Serdyuk·Jul 27, 2026

Five identical validator signature keys emerging from a single compromised red enclosure, together opening a bridge gate as teal value drains across the span into one dark vault

exploits

AFX Trade $24.15M Bridge Exploit: Compromised Validator Keys Signed a Valid Drain

AFX Trade's bridge lost $24.15M in USDC on Arbitrum. No contract bug: five operator-held validator keys signed a real quorum, and the bridge did exactly as told.

Dmitry Serdyuk·Jul 24, 2026

A teal wireframe repository lattice with one cracked block exposing a dense red core, splitting into three red filaments that converge on a single pulsing red node

exploits

The Fake Recruiter Repo That Hid Its Malware in a Tailwind Config

A fake Web3 recruiter sends a GitHub repo to try before the interview. The malware hides as a 4 MB Tailwind plugin, fires on the dev command, and hunts wallets, SSH keys, and seed phrases.

Dmitry Serdyuk·Jul 23, 2026

A counterfeit code-editor plugin icon glowing red, its data filaments feeding a chain of teal hexagonal blocks with one attacker-controlled node pulsing red, branching to three compromised endpoints

exploits

The TRAE Extension Backdoor That Ran Its C2 on an Ethereum Contract

A fake Solidity plugin, juannegro.solidity, backdoors Windows, macOS, and Linux dev machines and reads its C2 address from an Ethereum contract the attacker updates on-chain.

Dmitry Serdyuk·Jul 22, 2026

Abstract illustration of a flash loan pool manipulation: two teal stablecoin streams share one tilted basin while a looping bright pulse skews their balance and red value drains across a dark gap to a distant chain node, over dark circuitry.

exploits

Allbridge Core $1.65M Exploit: A 2023 Flash Loan Fix That Missed Solana

Allbridge Core lost $1.65M on Solana to the same flash loan trick it said it fixed in 2023. The one-pool promise held on BNB Chain and not on Solana.

Dmitry Serdyuk·Jul 21, 2026

Triple-A's $11.8M Hot Wallet Drain: Seven Chains, and 31 Hours Nobody Closed the Tap

B2 Network $3.86M Staking Drain: The Upgrade Key Did All the Work

AFX Trade $24.15M Bridge Exploit: Compromised Validator Keys Signed a Valid Drain

The Fake Recruiter Repo That Hid Its Malware in a Tailwind Config

The TRAE Extension Backdoor That Ran Its C2 on an Ethereum Contract

Allbridge Core $1.65M Exploit: A 2023 Flash Loan Fix That Missed Solana

Injective npm SDK Backdoored to Steal Wallet Keys: Anatomy of a Near Miss

Summer.fi's $6M Lazy Summer Exploit: When a Donation Broke the Vault Math

BonkDAO's $20M Governance Takeover: When Buying the Vote Beats Hacking the Code

Aztec Connect's $2.19M Exploit: A ZK-Rollup Settlement Bug in a Contract No One Could Patch

Humanity Protocol's $36M Key Compromise: A Runbook for Wallets That Touch Contracts

Audit the Release Pipeline Like a Smart Contract

Copy Fail: When a Linux Bug Becomes Protocol Risk

Smart Contract Audit Checklist: What to Prepare Before Your Engagement

Claude Code Security vs Codex Security: What Each AI Vulnerability Scanner Actually Delivers