Posts by Dmitry Serdyuk | Blog

Home/Blog/Dmitry Serdyuk

Posts by Dmitry SerdyukClear filter

Cutaway of a machined reserve vessel packed with teal ingots, one band of which is a hollow facade behind flush faces, while a gloved hand widens the red end-stop on its gauge

Nomic's 40.65 BTC nBTC Mint: An Escrow Self-Transfer Left Osmosis allBTC 36% Unbacked

An escrow self-transfer on Nomic minted 40.650602 BTC of counterfeit nBTC in one block. Almost all of it sat inside Osmosis allBTC as collateral for 74 days before anyone checked the reserve.

Dmitry Serdyuk·Sep 15, 2026

Dark abstract extreme close-up of a rack of engraved teal metal cache plates each stamped with a circular approval seal, the foreground plate carrying two mismatched ridge patterns joined by a thin glowing red seam directly under its seal, a gloved hand at the lower right lifting the seal press

exploits

Liquid Network's $320M Peg-Out: The Cache Key That Skipped the Range Proof

4,000 unbacked L-BTC left Liquid through a valid peg-out on September 6, 2026. The hole was a verification cache key with no field separators, merged five days earlier and in no release.

Dmitry Serdyuk·Sep 9, 2026

Dark abstract top-down render of a machined rotor disc ringed with twenty-three milled seating pockets, twenty-one holding a single flush teal disc while two pockets four positions apart each hold a doubled stack standing proud under hard red light, a cropped gloved hand entering at the lower right

exploits

Core DAO's 255M CORE Reward Replay: When the Coinbase Account Learned to Answer Back

Two addresses joined Core's block-producing set twelve seconds apart, credited the same block rewards more than once for three days, and left with 69M CORE. An EIP-7702 delegation made it possible.

Dmitry Serdyuk·Sep 7, 2026

Dark industrial cutaway: a brass calibration gauge reading true above a coin die cut deeper than its reference seat, thicker struck blanks spilling out and overlapping a thin reference token

exploits

How a 1:1 ankrFLOW Mint Drained More Markets of 15.5M WFLOW on Flow EVM

On August 31, 2026 an attacker emptied the More Markets WFLOW reserve on Flow EVM. The oracle priced the collateral correctly. The bug was one layer upstream, in how ankrFLOW gets minted.

Dmitry Serdyuk·Sep 2, 2026

A vast teal wall of stacked machined deposit cells resting on a single small red counterweight whose steel base plate is buckling under the load

exploits

Tectonic's $75M Exploit: A $1.34M Token Underwrote $119M of Loans

An attacker pumped Tectonic's own governance token about 100x in 20 minutes, borrowed against it, and emptied the largest lending market on Cronos. Validators halted the chain.

Dmitry Serdyuk·Aug 31, 2026

Dark isometric illustration of a signing machine seen from a raised corner: ranks of interlock stations with red locking bars and one empty socket, a teal engraved notch-plate lit under glass on a reading stand, a different red-inked notch-plate clamped in the press bed directly below it, and a cropped gloved hand sliding a second brass plate into the open station

technical

Ledger's Clear Signing Race: One Extra APDU Could Swap the Transaction You Approved

Ledger shipped twenty-one fixes in Ethereum app 1.22.2 under a two-word changelog line. The git history shows what they closed: a second command could replace the transaction behind the screen.

Dmitry Serdyuk·Aug 25, 2026

Dark top-down illustration of a records table packed edge to edge with identical teal registration cards, one card near the centre set back rotated with a red re-struck stamp panel and an off-centre re-punched hole, a gloved hand entering at the bottom edge

exploits

Tornado Cash Frontend Phishing: 810 ETH Drained After the Domain Lapsed

Reports put the loss at 1,010 ETH. The pools tell a tighter story: nine withdrawals, 810 ETH, eight minutes, and a collection wallet the attacker funded out of the mixer itself six days earlier.

Dmitry Serdyuk·Aug 24, 2026

$Dark abstract extreme close-up of a struck teal metal token whose deep embossed concentric seal is split by a hairline red-lit fracture, through which the interior shows hollow, a sanctioned mark backed by an empty core$

exploits

Maya Protocol $1.7M Exploit: Six Chained Bugs Became One Uncapped Slash Subsidy

One 23-message transaction chained six medium bugs into a critical: a false theft alert minted 49.45M CACAO into a thin pool the attacker then owned 99.93% of, draining 20.83 BTC.

Dmitry Serdyuk·Aug 20, 2026

Cutaway of a price gauge: a teal needle frozen against a tick mark, disconnected by a severed brass rod from two tilted reserve chambers below, one glowing red

exploits

FoxMarket $119K Exploit: A Stale LP Bond Price Minted Free FOX

FoxMarket lost about $119K on BNB Chain when its LP bond pool priced a mint from a PancakeSwap spot quote read before the attacker's own swap moved that same pool.

Dmitry Serdyuk·Aug 19, 2026

Dark abstract illustration of a machined inspection hall receding into depth, twenty-eight identical teal verification armatures clamped on brass tally plates in ranked bays, with a small red slip in a foreground guide channel whose retaining notch was never cut

exploits

Coreum Bridge $200K Exploit: 17 Signers and One Missing Destination Check

The tx XRPL bridge lost 199,916 XRP in 94 multisig payments because its relayer confirmed that a memo appeared in the bridge's transaction history, never that money reached the bridge.

Dmitry Serdyuk·Aug 18, 2026

Top-down view of a dense residential district model in cold teal, rooftops packed edge to edge, dozens of red map pins with small blank tags standing out of scattered houses, a cropped gloved hand pressing another pin into one roof, and opened delivery cartons stacked at one corner.

exploits

SafePal Order Data Leak: 39,798 Wallet Buyers Exposed by an Authorization Flaw

An authorization flaw in a third-party order-tracking plug-in let anyone read another SafePal customer's order by changing the order number. What left the building was the hardware wallet buyer list.

Dmitry Serdyuk·Aug 17, 2026

Macro close-up of a small brass tag riveted to rough unmachined cast iron, marked with a circular inspection punch struck into the tag itself and a red grease-pencil check, beside faint teal scribe lines and a polished machined corner of a neighbouring part

exploits

Ravencoin's KAWPOW Bug: A Block That Lies About Its Own Height Skips the Mining Work

A header field nodes never checked let blocks skip ProgPoW entirely and mine at a fraction of the honest cost. Two mining pools answered by rewinding about three days of chain history.

Dmitry Serdyuk·Aug 14, 2026

Dark abstract cutaway of layered machined strata seen from a raised corner, a clean bored shaft passing untouched through a reinforced teal shutter lattice at the top and ending at a single red-lit cell with a missing retaining bracket deep in the oldest layer, a cropped gloved hand entering at the lower right

exploits

Harmony's 4 Billion ONE Mint: The Replay Fix the Attacker Could Switch Off

An attacker minted about 4 billion ONE, roughly 26% of supply. Harmony's replay defense read its activation epoch from inside the proof, so the proof decided whether the defense applied.

Dmitry Serdyuk·Aug 13, 2026

Cross-lit dark scene: an enormous teal wall of key drawers recedes into depth, each with a lock and a milled notch tab, while a small red cabinet in the foreground holds only a few dozen drawers bearing the same tabs, pulled open, with two back-turned figures reaching into the same one.

exploits

Ill Bloom: A 12-Year-Old CryptoJS PRNG Bug Drained $5.7M in Guessable Seeds

CryptoJS seeded its randomness from Math.random(), cutting 128-bit wallet entropy to about 2^39. Attackers enumerated the phrases and swept 1,034 accounts. Upgrading does not fix a key already made.

Dmitry Serdyuk·Aug 11, 2026

A dense wall of identical machined steel verification bays, each holding a teal credential token in a keyed socket below a lit teal indicator lamp. One bay's socket is a dark empty recess while its lamp still burns the same bright teal as its neighbours, and a red duplicate of the token lies askew on a shelf to its lower left.

exploits

BTCPay Server's Stolen Macaroons: Why Updating to 2.4.2 Does Not End It

Attackers stole LND macaroon credentials from BTCPay servers, closed merchant Lightning channels and swept the funds. Version 2.4.2 shuts the door. It does not revoke the keys already copied.

Dmitry Serdyuk·Aug 10, 2026

A dense dark wall of racked teal authorization plates, each stamped with an identical blank seal in its upper corner and a shallow value channel along its lower edge, crossed by a rigid reader bar whose contact fingers touch only the seal corners; one plate glows red with a matching seal and a value channel cut into a deep trench the reader never reaches.

exploits

Swan Treasury's $625K Signer Key Leak: One Key, Three Contracts, Five Cents of Gas

A leaked off-chain signer key let an attacker sign their own discount. Swan Treasury's buy() function checked who signed the message and never checked what the message asked for.

Dmitry Serdyuk·Aug 7, 2026

Dark abstract illustration of a dense teal machined register plate whose rows of milled cells are indexed from two opposite edges, with one cell duplicated in a single row and its second copy raised and lit red

exploits

Verus Bridge $7.5M Exploit: When Two Chains Read the Same Bytes Differently

An attacker poisoned Verus notarizations with duplicate state roots that Verus and Ethereum parsed differently, draining $7.5M from a bridge already drained for $11.58M nine weeks earlier.

Dmitry Serdyuk·Aug 6, 2026

A small crisp teal block set against a vast red striated volume that runs past the frame, a size comparison between a short secured window and a far longer unwatched one

exploits

Triple-A's $11.8M Hot Wallet Drain: Seven Chains, and 31 Hours Nobody Closed the Tap

Triple-A's treasury wallets were swept across seven chains starting July 24, 2026. The theft took hours. Deposits kept arriving and kept being swept for 31.

Dmitry Serdyuk·Jul 30, 2026

A large teal machined ring seen head on against black, its inner core replaced by a mismatched dull red disc whose engraving does not line up with the ring, joined by a clean hairline seam

exploits

B2 Network $3.86M Staking Drain: The Upgrade Key Did All the Work

B2 Network lost 8.59M B2 tokens, about $3.86M, when someone used the staking contract's upgrade authority. That privilege had sat on the same wallet since 2025.

Dmitry Serdyuk·Jul 27, 2026

Five identical validator signature keys emerging from a single compromised red enclosure, together opening a bridge gate as teal value drains across the span into one dark vault

exploits

AFX Trade $24.15M Bridge Exploit: Compromised Validator Keys Signed a Valid Drain

AFX Trade's bridge lost $24.15M in USDC on Arbitrum. No contract bug: five operator-held validator keys signed a real quorum, and the bridge did exactly as told.

Dmitry Serdyuk·Jul 24, 2026

A teal wireframe repository lattice with one cracked block exposing a dense red core, splitting into three red filaments that converge on a single pulsing red node

exploits

The Fake Recruiter Repo That Hid Its Malware in a Tailwind Config

A fake Web3 recruiter sends a GitHub repo to try before the interview. The malware hides as a 4 MB Tailwind plugin, fires on the dev command, and hunts wallets, SSH keys, and seed phrases.

Dmitry Serdyuk·Jul 23, 2026

A counterfeit code-editor plugin icon glowing red, its data filaments feeding a chain of teal hexagonal blocks with one attacker-controlled node pulsing red, branching to three compromised endpoints

exploits

The TRAE Extension Backdoor That Ran Its C2 on an Ethereum Contract

A fake Solidity plugin, juannegro.solidity, backdoors Windows, macOS, and Linux dev machines and reads its C2 address from an Ethereum contract the attacker updates on-chain.

Dmitry Serdyuk·Jul 22, 2026

Abstract illustration of a flash loan pool manipulation: two teal stablecoin streams share one tilted basin while a looping bright pulse skews their balance and red value drains across a dark gap to a distant chain node, over dark circuitry.

exploits

Allbridge Core $1.65M Exploit: A 2023 Flash Loan Fix That Missed Solana

Allbridge Core lost $1.65M on Solana to the same flash loan trick it said it fixed in 2023. The one-pool promise held on BNB Chain and not on Solana.

Dmitry Serdyuk·Jul 21, 2026

Abstract teal circuit board where one npm package node fans out into eighteen child nodes, with a single red corrupted trace smuggling a key-shaped glyph through a stream of benign teal telemetry packets toward a distant server

exploits

Injective npm SDK Backdoored to Steal Wallet Keys: Anatomy of a Near Miss

A compromised maintainer account backdoored 18 @injectivelabs npm packages on July 8, 2026, harvesting wallet seed phrases at key-derivation time. It failed by minutes. Here is how it nearly worked.

Dmitry Serdyuk·Jul 14, 2026

Abstract illustration of a DeFi vault: an external glowing token dropped into a side strategy module inflates a red share-price gauge past its safe band while value siphons out through a redemption channel, over dark teal circuitry.

exploits

Summer.fi's $6M Lazy Summer Exploit: When a Donation Broke the Vault Math

An attacker donated an asset into a Summer.fi Lazy Summer vault, inflated its totalAssets() share price, and redeemed a flash loan for a $6M profit. No key was stolen. The accounting was the hole.

Dmitry Serdyuk·Jul 8, 2026

An oversized hand drops a stack of votes that outweighs a scattered crowd on a tipping scale, swinging open a treasury vault as coins stream out.

exploits

BonkDAO's $20M Governance Takeover: When Buying the Vote Beats Hacking the Code

An attacker spent about $4M buying BONK, took a voting majority on BonkDAO's Realms governance, and passed one proposal that moved $20M out of the treasury. No contract was hacked. The rules were.

Dmitry Serdyuk·Jul 7, 2026

A deprecated on-chain vault whose guard inspects only one of thirty-two settlement slots, with forged teal deposit blocks slipping through the unverified gap while a single red slot drains assets from the sealed pool.

exploits

Aztec Connect's $2.19M Exploit: A ZK-Rollup Settlement Bug in a Contract No One Could Patch

A deprecated Aztec Connect contract was drained of $2.19M when its L1 settlement loop and its ZK proof disagreed on how many slots were real. Its keys were renounced, so no one could pause it.

Dmitry Serdyuk·Jul 5, 2026

One compromised laptop holding seven signing keys that cleared a 3-of-6 and a 3-of-5 multisig across two chains

exploits

Humanity Protocol's $36M Key Compromise: A Runbook for Wallets That Touch Contracts

One compromised laptop held seven keys and cleared two multisigs, draining $36M+ from Humanity Protocol. A runbook for segregating, monitoring, and revoking project wallets that touch contracts.

Dmitry Serdyuk·Jun 10, 2026

Web3 release pipeline audit checklist for npm provenance, lifecycle hooks, cache poisoning, and deployer-key exposure

research

Audit the Release Pipeline Like a Smart Contract

Your contracts are audited. Your release pipeline isn't. Mini Shai-Hulud proved npm provenance signs whatever a compromised workflow ships. Here's the checklist Web3 teams should run on their own pipeline.

Dmitry Serdyuk·May 19, 2026

Linux kernel privilege escalation mapped to Web3 infrastructure risk

research

Copy Fail: When a Linux Bug Becomes Protocol Risk

Copy Fail is a Linux kernel privilege escalation, not a smart contract bug. For Web3 teams running validators, CI runners, deployer hosts, and signing infrastructure, that's exactly why it matters.

Dmitry Serdyuk·May 5, 2026

Smart contract audit preparation checklist

technical

Smart Contract Audit Checklist: What to Prepare Before Your Engagement

The preparation checklist that separates smooth audit engagements from costly delays. What your team needs to have ready before auditors touch your code.

Dmitry Serdyuk·Mar 20, 2026

Claude Code Security vs OpenAI Codex Security comparison

research

Claude Code Security vs Codex Security: What Each AI Vulnerability Scanner Actually Delivers

Anthropic and OpenAI both shipped AI-powered vulnerability scanners in early 2026. We break down what each tool actually does, where they fall short, and why neither one replaces a smart contract audit.

Dmitry Serdyuk·Mar 18, 2026