Posts by Dmitry Serdyuk | Blog

Home/Blog/Dmitry Serdyuk

Posts by Dmitry SerdyukClear filter

A tiered voting chamber of empty teal seats seen from above at an angle, one hooded figure raising the only red paddle, and an open vault door behind the unattended dais spilling red light over teal ingots.

Arkadiko's $1.09M Governance Takeover: $51K of DIKO Bought the Vaults

One wallet bought about $51K of DIKO, cast the only vote on a proposal that installed its own vault contract, and drained $1.09M from Arkadiko two minutes after voting closed.

Dmitry Serdyuk·Oct 29, 2026

Top-down isometric bank booth: a hooded figure slides teal banknotes with red-glowing edges through a counter slot to a gloved teller whose counting machine shows a teal approval lamp, while the vault shelves behind stand mostly bare under red light

exploits

Initia's $2.7M Exploit: A MoveVM Cache Bug Printed Balances the Bridges Paid For

A MoveVM script-caching bug let one wallet credit itself unbacked tokens on Initia. LayerZero and CCTP paid out $2.7M of real assets on Ethereum before the chain halted, 42 minutes later.

Dmitry Serdyuk·Oct 27, 2026

$A dark hall of giant notched tumbler wheels receding into the distance, all pierced by one steel axle that ends in a tiny red-lit knob turned by a gloved hand$

exploits

Qubic $1.4M Drain: Math.random() Wallet Seeds, and Why Only Apple Users Were Hit

An attacker drained 2.94 trillion QU from 1,404 Qubic wallets whose seeds came from Math.random(). Only Apple browsers were hit, and WebKit's source points to why.

Dmitry Serdyuk·Oct 22, 2026

A dusty gunmetal hourglass with a tall heap of teal sand in its lower bulb, while a gloved hand twists a red rate dial bolted to its frame, the needle pinned at maximum

exploits

BiFi $165K: A 36-Day Idle Market Let One Caller Inflate the Rate on a Month of Interest

BiFi's Ethereum USDT market sat idle for 36 days. Per Defimon, one block then re-priced that gap at a flash-loaned rate, and c0ffeebabe.eth ran the drain a block after another deployer.

Dmitry Serdyuk·Oct 20, 2026

A gloved hand sets a tiny red block on a small teal staircase of price levels, while a giant mirrored copy of the staircase behind it shows the same block as a colossal red slab tipping the whole structure

exploits

Papertrade's $1.28M BBO Manipulation: $3 ETH Pushes Against a 1,000x Venue

Within eight hours of launch, one wallet moved Hyperliquid's ETH quote about $3 at a time while holding nine-figure 1,000x positions on Papertrade, and took $1.28M from the pool.

Dmitry Serdyuk·Oct 15, 2026

Dark oblique still-life of gloved fingertips lowering a machined teal animal figurine into a rail of bookmark tabs, red key teeth cut into the figurine's underside, a tray of identical figurines below

exploits

Fomo $48K Drain: A Fake Human Check That Ran a Bookmarklet on the Logged-In Wallet

A Fomo user lost about $48,000 without connecting a wallet, signing, or typing a seed phrase. A fake human check got them to run a bookmarklet on the logged-in Fomo page.

Dmitry Serdyuk·Oct 9, 2026

A dark, closed auction hall seen down its aisle, dust-sheeted chairs and lit display plinths tethered by teal cords to a riveted machine whose control panel has a red-rimmed socket with no shutoff lever, while a gloved hand lifts a framed artwork

exploits

Limit Break Payment Processor V2: An Estimated $2.8M Lost to a Forged ERC-2771 Sender

A calldata offset of zero let attackers trade as any wallet that ever approved Payment Processor V2. The contract could not be paused, so a whitehat raced them for 23,155 NFTs.

Dmitry Serdyuk·Oct 1, 2026

Top-down view of a casino cashier's tray: a grid of compartments filled with teal chip stacks, one center compartment holding a red key under a gloved fingertip, and a thin red line running from it around the whole tray's edge

exploits

Duelbits' $7M Hack: Its Ethereum Hot Wallet Emptied in 132 Seconds, a Repeat of 2024

A suspected key compromise emptied Duelbits' Ethereum hot wallet in five transfers over 132 seconds. We traced the $7M on-chain: swaps, a 2,234 ETH stash, then 1,370 ETH into Tornado Cash.

Dmitry Serdyuk·Sep 29, 2026

Dark machined steel plate with two identical bores, one fitted with a brass stop ring narrowing it to a thin slot, the other standing wide open with its matching ring lying loose on the plate beside it

exploits

SingularityNET Bridge Key Compromise: $2.25M Out, 260M AGIX Minted, One Missing Cap

A stolen converter authorizer key emptied SingularityNET's FET float in one call. The same contract stored a 1,000,000 per-transaction cap it never applied to payouts.

Dmitry Serdyuk·Sep 23, 2026

Cutaway of a machined reserve vessel packed with teal ingots, one band of which is a hollow facade behind flush faces, while a gloved hand widens the red end-stop on its gauge

exploits

Nomic's 40.65 BTC nBTC Mint: An Escrow Self-Transfer Left Osmosis allBTC 36% Unbacked

An escrow self-transfer on Nomic minted 40.650602 BTC of counterfeit nBTC in one block. Almost all of it sat inside Osmosis allBTC as collateral for 74 days before anyone checked the reserve.

Dmitry Serdyuk·Sep 15, 2026

Dark abstract extreme close-up of a rack of engraved teal metal cache plates each stamped with a circular approval seal, the foreground plate carrying two mismatched ridge patterns joined by a thin glowing red seam directly under its seal, a gloved hand at the lower right lifting the seal press

exploits

Liquid Network's $320M Peg-Out: The Cache Key That Skipped the Range Proof

4,000 unbacked L-BTC left Liquid through a valid peg-out on September 6, 2026. The hole was a verification cache key with no field separators, merged five days earlier and in no release.

Dmitry Serdyuk·Sep 9, 2026

Dark abstract top-down render of a machined rotor disc ringed with twenty-three milled seating pockets, twenty-one holding a single flush teal disc while two pockets four positions apart each hold a doubled stack standing proud under hard red light, a cropped gloved hand entering at the lower right

exploits

Core DAO's 255M CORE Reward Replay: When the Coinbase Account Learned to Answer Back

Two addresses joined Core's block-producing set twelve seconds apart, credited the same block rewards more than once for three days, and left with 69M CORE. An EIP-7702 delegation made it possible.

Dmitry Serdyuk·Sep 7, 2026

Dark industrial cutaway: a brass calibration gauge reading true above a coin die cut deeper than its reference seat, thicker struck blanks spilling out and overlapping a thin reference token

exploits

How a 1:1 ankrFLOW Mint Drained More Markets of 15.5M WFLOW on Flow EVM

On August 31, 2026 an attacker emptied the More Markets WFLOW reserve on Flow EVM. The oracle priced the collateral correctly. The bug was one layer upstream, in how ankrFLOW gets minted.

Dmitry Serdyuk·Sep 2, 2026

A vast teal wall of stacked machined deposit cells resting on a single small red counterweight whose steel base plate is buckling under the load

exploits

Tectonic's $75M Exploit: A $1.34M Token Underwrote $119M of Loans

An attacker pumped Tectonic's own governance token about 100x in 20 minutes, borrowed against it, and emptied the largest lending market on Cronos. Validators halted the chain.

Dmitry Serdyuk·Aug 31, 2026

Dark isometric illustration of a signing machine seen from a raised corner: ranks of interlock stations with red locking bars and one empty socket, a teal engraved notch-plate lit under glass on a reading stand, a different red-inked notch-plate clamped in the press bed directly below it, and a cropped gloved hand sliding a second brass plate into the open station

technical

Ledger's Clear Signing Race: One Extra APDU Could Swap the Transaction You Approved

Ledger shipped twenty-one fixes in Ethereum app 1.22.2 under a two-word changelog line. The git history shows what they closed: a second command could replace the transaction behind the screen.

Dmitry Serdyuk·Aug 25, 2026

Dark top-down illustration of a records table packed edge to edge with identical teal registration cards, one card near the centre set back rotated with a red re-struck stamp panel and an off-centre re-punched hole, a gloved hand entering at the bottom edge

exploits

Tornado Cash Frontend Phishing: 810 ETH Drained After the Domain Lapsed

Reports put the loss at 1,010 ETH. The pools tell a tighter story: nine withdrawals, 810 ETH, eight minutes, and a collection wallet the attacker funded out of the mixer itself six days earlier.

Dmitry Serdyuk·Aug 24, 2026

$Dark abstract extreme close-up of a struck teal metal token whose deep embossed concentric seal is split by a hairline red-lit fracture, through which the interior shows hollow, a sanctioned mark backed by an empty core$

exploits

Maya Protocol $1.7M Exploit: Six Chained Bugs Became One Uncapped Slash Subsidy

One 23-message transaction chained six medium bugs into a critical: a false theft alert minted 49.45M CACAO into a thin pool the attacker then owned 99.93% of, draining 20.83 BTC.

Dmitry Serdyuk·Aug 20, 2026

Cutaway of a price gauge: a teal needle frozen against a tick mark, disconnected by a severed brass rod from two tilted reserve chambers below, one glowing red

exploits

FoxMarket $119K Exploit: A Stale LP Bond Price Minted Free FOX

FoxMarket lost about $119K on BNB Chain when its LP bond pool priced a mint from a PancakeSwap spot quote read before the attacker's own swap moved that same pool.

Dmitry Serdyuk·Aug 19, 2026

Dark abstract illustration of a machined inspection hall receding into depth, twenty-eight identical teal verification armatures clamped on brass tally plates in ranked bays, with a small red slip in a foreground guide channel whose retaining notch was never cut

exploits

Coreum Bridge $200K Exploit: 17 Signers and One Missing Destination Check

The tx XRPL bridge lost 199,916 XRP in 94 multisig payments because its relayer confirmed that a memo appeared in the bridge's transaction history, never that money reached the bridge.

Dmitry Serdyuk·Aug 18, 2026

Top-down view of a dense residential district model in cold teal, rooftops packed edge to edge, dozens of red map pins with small blank tags standing out of scattered houses, a cropped gloved hand pressing another pin into one roof, and opened delivery cartons stacked at one corner.

exploits

SafePal Order Data Leak: 39,798 Wallet Buyers Exposed by an Authorization Flaw

An authorization flaw in a third-party order-tracking plug-in let anyone read another SafePal customer's order by changing the order number. What left the building was the hardware wallet buyer list.

Dmitry Serdyuk·Aug 17, 2026

Macro close-up of a small brass tag riveted to rough unmachined cast iron, marked with a circular inspection punch struck into the tag itself and a red grease-pencil check, beside faint teal scribe lines and a polished machined corner of a neighbouring part

exploits

Ravencoin's KAWPOW Bug: A Block That Lies About Its Own Height Skips the Mining Work

A header field nodes never checked let blocks skip ProgPoW entirely and mine at a fraction of the honest cost. Two mining pools answered by rewinding about three days of chain history.

Dmitry Serdyuk·Aug 14, 2026

Dark abstract cutaway of layered machined strata seen from a raised corner, a clean bored shaft passing untouched through a reinforced teal shutter lattice at the top and ending at a single red-lit cell with a missing retaining bracket deep in the oldest layer, a cropped gloved hand entering at the lower right

exploits

Harmony's 4 Billion ONE Mint: The Replay Fix the Attacker Could Switch Off

An attacker minted about 4 billion ONE, roughly 26% of supply. Harmony's replay defense read its activation epoch from inside the proof, so the proof decided whether the defense applied.

Dmitry Serdyuk·Aug 13, 2026

Cross-lit dark scene: an enormous teal wall of key drawers recedes into depth, each with a lock and a milled notch tab, while a small red cabinet in the foreground holds only a few dozen drawers bearing the same tabs, pulled open, with two back-turned figures reaching into the same one.

exploits

Ill Bloom: A 12-Year-Old CryptoJS PRNG Bug Drained $5.7M in Guessable Seeds

CryptoJS seeded its randomness from Math.random(), cutting 128-bit wallet entropy to about 2^39. Attackers enumerated the phrases and swept 1,034 accounts. Upgrading does not fix a key already made.

Dmitry Serdyuk·Aug 11, 2026

A dense wall of identical machined steel verification bays, each holding a teal credential token in a keyed socket below a lit teal indicator lamp. One bay's socket is a dark empty recess while its lamp still burns the same bright teal as its neighbours, and a red duplicate of the token lies askew on a shelf to its lower left.

exploits

BTCPay Server's Stolen Macaroons: Why Updating to 2.4.2 Does Not End It

Attackers stole LND macaroon credentials from BTCPay servers, closed merchant Lightning channels and swept the funds. Version 2.4.2 shuts the door. It does not revoke the keys already copied.

Dmitry Serdyuk·Aug 10, 2026

A dense dark wall of racked teal authorization plates, each stamped with an identical blank seal in its upper corner and a shallow value channel along its lower edge, crossed by a rigid reader bar whose contact fingers touch only the seal corners; one plate glows red with a matching seal and a value channel cut into a deep trench the reader never reaches.

exploits

Swan Treasury's $625K Signer Key Leak: One Key, Three Contracts, Five Cents of Gas

A leaked off-chain signer key let an attacker sign their own discount. Swan Treasury's buy() function checked who signed the message and never checked what the message asked for.

Dmitry Serdyuk·Aug 7, 2026

Dark abstract illustration of a dense teal machined register plate whose rows of milled cells are indexed from two opposite edges, with one cell duplicated in a single row and its second copy raised and lit red

exploits

Verus Bridge $7.5M Exploit: When Two Chains Read the Same Bytes Differently

An attacker poisoned Verus notarizations with duplicate state roots that Verus and Ethereum parsed differently, draining $7.5M from a bridge already drained for $11.58M nine weeks earlier.

Dmitry Serdyuk·Aug 6, 2026

A small crisp teal block set against a vast red striated volume that runs past the frame, a size comparison between a short secured window and a far longer unwatched one

exploits

Triple-A's $11.8M Hot Wallet Drain: Seven Chains, and 31 Hours Nobody Closed the Tap

Triple-A's treasury wallets were swept across seven chains starting July 24, 2026. The theft took hours. Deposits kept arriving and kept being swept for 31.

Dmitry Serdyuk·Jul 30, 2026

A large teal machined ring seen head on against black, its inner core replaced by a mismatched dull red disc whose engraving does not line up with the ring, joined by a clean hairline seam

exploits

B2 Network $3.86M Staking Drain: The Upgrade Key Did All the Work

B2 Network lost 8.59M B2 tokens, about $3.86M, when someone used the staking contract's upgrade authority. That privilege had sat on the same wallet since 2025.

Dmitry Serdyuk·Jul 27, 2026

Five identical validator signature keys emerging from a single compromised red enclosure, together opening a bridge gate as teal value drains across the span into one dark vault

exploits

AFX Trade $24.15M Bridge Exploit: Compromised Validator Keys Signed a Valid Drain

AFX Trade's bridge lost $24.15M in USDC on Arbitrum. No contract bug: five operator-held validator keys signed a real quorum, and the bridge did exactly as told.

Dmitry Serdyuk·Jul 24, 2026

A teal wireframe repository lattice with one cracked block exposing a dense red core, splitting into three red filaments that converge on a single pulsing red node

exploits

The Fake Recruiter Repo That Hid Its Malware in a Tailwind Config

A fake Web3 recruiter sends a GitHub repo to try before the interview. The malware hides as a 4 MB Tailwind plugin, fires on the dev command, and hunts wallets, SSH keys, and seed phrases.

Dmitry Serdyuk·Jul 23, 2026

A counterfeit code-editor plugin icon glowing red, its data filaments feeding a chain of teal hexagonal blocks with one attacker-controlled node pulsing red, branching to three compromised endpoints

exploits

The TRAE Extension Backdoor That Ran Its C2 on an Ethereum Contract

A fake Solidity plugin, juannegro.solidity, backdoors Windows, macOS, and Linux dev machines and reads its C2 address from an Ethereum contract the attacker updates on-chain.

Dmitry Serdyuk·Jul 22, 2026

Abstract illustration of a flash loan pool manipulation: two teal stablecoin streams share one tilted basin while a looping bright pulse skews their balance and red value drains across a dark gap to a distant chain node, over dark circuitry.

exploits

Allbridge Core $1.65M Exploit: A 2023 Flash Loan Fix That Missed Solana

Allbridge Core lost $1.65M on Solana to the same flash loan trick it said it fixed in 2023. The one-pool promise held on BNB Chain and not on Solana.

Dmitry Serdyuk·Jul 21, 2026

Abstract teal circuit board where one npm package node fans out into eighteen child nodes, with a single red corrupted trace smuggling a key-shaped glyph through a stream of benign teal telemetry packets toward a distant server

exploits

Injective npm SDK Backdoored to Steal Wallet Keys: Anatomy of a Near Miss

A compromised maintainer account backdoored 18 @injectivelabs npm packages on July 8, 2026, harvesting wallet seed phrases at key-derivation time. It failed by minutes. Here is how it nearly worked.

Dmitry Serdyuk·Jul 14, 2026

Abstract illustration of a DeFi vault: an external glowing token dropped into a side strategy module inflates a red share-price gauge past its safe band while value siphons out through a redemption channel, over dark teal circuitry.

exploits

Summer.fi's $6M Lazy Summer Exploit: When a Donation Broke the Vault Math

An attacker donated an asset into a Summer.fi Lazy Summer vault, inflated its totalAssets() share price, and redeemed a flash loan for a $6M profit. No key was stolen. The accounting was the hole.

Dmitry Serdyuk·Jul 8, 2026

An oversized hand drops a stack of votes that outweighs a scattered crowd on a tipping scale, swinging open a treasury vault as coins stream out.

exploits

BonkDAO's $20M Governance Takeover: When Buying the Vote Beats Hacking the Code

An attacker spent about $4M buying BONK, took a voting majority on BonkDAO's Realms governance, and passed one proposal that moved $20M out of the treasury. No contract was hacked. The rules were.

Dmitry Serdyuk·Jul 7, 2026

A deprecated on-chain vault whose guard inspects only one of thirty-two settlement slots, with forged teal deposit blocks slipping through the unverified gap while a single red slot drains assets from the sealed pool.

exploits

Aztec Connect's $2.19M Exploit: A ZK-Rollup Settlement Bug in a Contract No One Could Patch

A deprecated Aztec Connect contract was drained of $2.19M when its L1 settlement loop and its ZK proof disagreed on how many slots were real. Its keys were renounced, so no one could pause it.

Dmitry Serdyuk·Jul 5, 2026

One compromised laptop holding seven signing keys that cleared a 3-of-6 and a 3-of-5 multisig across two chains

exploits

Humanity Protocol's $36M Key Compromise: A Runbook for Wallets That Touch Contracts

One compromised laptop held seven keys and cleared two multisigs, draining $36M+ from Humanity Protocol. A runbook for segregating, monitoring, and revoking project wallets that touch contracts.

Dmitry Serdyuk·Jun 10, 2026

Web3 release pipeline audit checklist for npm provenance, lifecycle hooks, cache poisoning, and deployer-key exposure

research

Audit the Release Pipeline Like a Smart Contract

Your contracts are audited. Your release pipeline isn't. Mini Shai-Hulud proved npm provenance signs whatever a compromised workflow ships. Here's the checklist Web3 teams should run on their own pipeline.

Dmitry Serdyuk·May 19, 2026

Linux kernel privilege escalation mapped to Web3 infrastructure risk

research

Copy Fail: When a Linux Bug Becomes Protocol Risk

Copy Fail is a Linux kernel privilege escalation, not a smart contract bug. For Web3 teams running validators, CI runners, deployer hosts, and signing infrastructure, that's exactly why it matters.

Dmitry Serdyuk·May 5, 2026

Smart contract audit preparation checklist

technical

Smart Contract Audit Checklist: What to Prepare Before Your Engagement

The preparation checklist that separates smooth audit engagements from costly delays. What your team needs to have ready before auditors touch your code.

Dmitry Serdyuk·Mar 20, 2026

Claude Code Security vs OpenAI Codex Security comparison

research

Claude Code Security vs Codex Security: What Each AI Vulnerability Scanner Actually Delivers

Anthropic and OpenAI both shipped AI-powered vulnerability scanners in early 2026. We break down what each tool actually does, where they fall short, and why neither one replaces a smart contract audit.

Dmitry Serdyuk·Mar 18, 2026