Exploits Articles

Dark top-down view of a heavy machined teal disc-lock on a steel bench, a red articulated arm curving out of the lock's own casing and seating its tip into the lock's own keyway with the tumblers beneath rotated open, ringed by small dark approval plates, a gloved hand cropping in at the lower right

rsETH $7.8M Safe Drain: The Router That Authorized Itself, and the Bot That Took the Payout

2,900 rsETH left a Gnosis Safe on September 15, 2026. The Safe worked exactly as designed. The router behind its enabled module approved any call that pointed at the router itself.

Alex Rybalko·Sep 17, 2026

Cutaway of a machined reserve vessel packed with teal ingots, one band of which is a hollow facade behind flush faces, while a gloved hand widens the red end-stop on its gauge

exploits

Nomic's 40.65 BTC nBTC Mint: An Escrow Self-Transfer Left Osmosis allBTC 36% Unbacked

An escrow self-transfer on Nomic minted 40.650602 BTC of counterfeit nBTC in one block. Almost all of it sat inside Osmosis allBTC as collateral for 74 days before anyone checked the reserve.

Dmitry Serdyuk·Sep 15, 2026

Dark isometric illustration of a three-tier vault seen from a raised corner, the two upper tiers gutted with their cell doors swung open and studs dark behind a drawn roll-down shutter that stops above the packed teal lower tier, where one forced cell burns red with its trays pulled out

exploits

Notional Finance $1.73M Exploit: A Debt of 2^128 That Read as Zero

An attacker minted two fCash liabilities summing to exactly 2^128 against Notional's 2020-era V1 escrow. An unchecked uint128 downcast truncated the debt to zero, and the collateral check passed.

Aron Turner·Sep 10, 2026

Dark abstract extreme close-up of a rack of engraved teal metal cache plates each stamped with a circular approval seal, the foreground plate carrying two mismatched ridge patterns joined by a thin glowing red seam directly under its seal, a gloved hand at the lower right lifting the seal press

exploits

Liquid Network's $320M Peg-Out: The Cache Key That Skipped the Range Proof

4,000 unbacked L-BTC left Liquid through a valid peg-out on September 6, 2026. The hole was a verification cache key with no field separators, merged five days earlier and in no release.

Dmitry Serdyuk·Sep 9, 2026

Dark abstract top-down render of a machined rotor disc ringed with twenty-three milled seating pockets, twenty-one holding a single flush teal disc while two pockets four positions apart each hold a doubled stack standing proud under hard red light, a cropped gloved hand entering at the lower right

exploits

Core DAO's 255M CORE Reward Replay: When the Coinbase Account Learned to Answer Back

Two addresses joined Core's block-producing set twelve seconds apart, credited the same block rewards more than once for three days, and left with 69M CORE. An EIP-7702 delegation made it possible.

Dmitry Serdyuk·Sep 7, 2026

Dark industrial cutaway: a brass calibration gauge reading true above a coin die cut deeper than its reference seat, thicker struck blanks spilling out and overlapping a thin reference token

exploits

How a 1:1 ankrFLOW Mint Drained More Markets of 15.5M WFLOW on Flow EVM

On August 31, 2026 an attacker emptied the More Markets WFLOW reserve on Flow EVM. The oracle priced the collateral correctly. The bug was one layer upstream, in how ankrFLOW gets minted.

Dmitry Serdyuk·Sep 2, 2026

A vast teal wall of stacked machined deposit cells resting on a single small red counterweight whose steel base plate is buckling under the load

exploits

Tectonic's $75M Exploit: A $1.34M Token Underwrote $119M of Loans

An attacker pumped Tectonic's own governance token about 100x in 20 minutes, borrowed against it, and emptied the largest lending market on Cronos. Validators halted the chain.

Dmitry Serdyuk·Aug 31, 2026

Dark top-down illustration of a records table packed edge to edge with identical teal registration cards, one card near the centre set back rotated with a red re-struck stamp panel and an off-centre re-punched hole, a gloved hand entering at the bottom edge

exploits

Tornado Cash Frontend Phishing: 810 ETH Drained After the Domain Lapsed

Reports put the loss at 1,010 ETH. The pools tell a tighter story: nine withdrawals, 810 ETH, eight minutes, and a collection wallet the attacker funded out of the mixer itself six days earlier.

Dmitry Serdyuk·Aug 24, 2026

$Dark abstract extreme close-up of a struck teal metal token whose deep embossed concentric seal is split by a hairline red-lit fracture, through which the interior shows hollow, a sanctioned mark backed by an empty core$

exploits

Maya Protocol $1.7M Exploit: Six Chained Bugs Became One Uncapped Slash Subsidy

One 23-message transaction chained six medium bugs into a critical: a false theft alert minted 49.45M CACAO into a thin pool the attacker then owned 99.93% of, draining 20.83 BTC.

Dmitry Serdyuk·Aug 20, 2026

Cutaway of a price gauge: a teal needle frozen against a tick mark, disconnected by a severed brass rod from two tilted reserve chambers below, one glowing red

exploits

FoxMarket $119K Exploit: A Stale LP Bond Price Minted Free FOX

FoxMarket lost about $119K on BNB Chain when its LP bond pool priced a mint from a PancakeSwap spot quote read before the attacker's own swap moved that same pool.

Dmitry Serdyuk·Aug 19, 2026

Dark abstract illustration of a machined inspection hall receding into depth, twenty-eight identical teal verification armatures clamped on brass tally plates in ranked bays, with a small red slip in a foreground guide channel whose retaining notch was never cut

exploits

Coreum Bridge $200K Exploit: 17 Signers and One Missing Destination Check

The tx XRPL bridge lost 199,916 XRP in 94 multisig payments because its relayer confirmed that a memo appeared in the bridge's transaction history, never that money reached the bridge.

Dmitry Serdyuk·Aug 18, 2026

Top-down view of a dense residential district model in cold teal, rooftops packed edge to edge, dozens of red map pins with small blank tags standing out of scattered houses, a cropped gloved hand pressing another pin into one roof, and opened delivery cartons stacked at one corner.

exploits

SafePal Order Data Leak: 39,798 Wallet Buyers Exposed by an Authorization Flaw

An authorization flaw in a third-party order-tracking plug-in let anyone read another SafePal customer's order by changing the order number. What left the building was the hardware wallet buyer list.

Dmitry Serdyuk·Aug 17, 2026

Macro close-up of a small brass tag riveted to rough unmachined cast iron, marked with a circular inspection punch struck into the tag itself and a red grease-pencil check, beside faint teal scribe lines and a polished machined corner of a neighbouring part

exploits

Ravencoin's KAWPOW Bug: A Block That Lies About Its Own Height Skips the Mining Work

A header field nodes never checked let blocks skip ProgPoW entirely and mine at a fraction of the honest cost. Two mining pools answered by rewinding about three days of chain history.

Dmitry Serdyuk·Aug 14, 2026

Dark abstract cutaway of layered machined strata seen from a raised corner, a clean bored shaft passing untouched through a reinforced teal shutter lattice at the top and ending at a single red-lit cell with a missing retaining bracket deep in the oldest layer, a cropped gloved hand entering at the lower right

exploits

Harmony's 4 Billion ONE Mint: The Replay Fix the Attacker Could Switch Off

An attacker minted about 4 billion ONE, roughly 26% of supply. Harmony's replay defense read its activation epoch from inside the proof, so the proof decided whether the defense applied.

Dmitry Serdyuk·Aug 13, 2026

Cross-lit dark scene: an enormous teal wall of key drawers recedes into depth, each with a lock and a milled notch tab, while a small red cabinet in the foreground holds only a few dozen drawers bearing the same tabs, pulled open, with two back-turned figures reaching into the same one.

exploits

Ill Bloom: A 12-Year-Old CryptoJS PRNG Bug Drained $5.7M in Guessable Seeds

CryptoJS seeded its randomness from Math.random(), cutting 128-bit wallet entropy to about 2^39. Attackers enumerated the phrases and swept 1,034 accounts. Upgrading does not fix a key already made.

Dmitry Serdyuk·Aug 11, 2026

A dense wall of identical machined steel verification bays, each holding a teal credential token in a keyed socket below a lit teal indicator lamp. One bay's socket is a dark empty recess while its lamp still burns the same bright teal as its neighbours, and a red duplicate of the token lies askew on a shelf to its lower left.

exploits

BTCPay Server's Stolen Macaroons: Why Updating to 2.4.2 Does Not End It

Attackers stole LND macaroon credentials from BTCPay servers, closed merchant Lightning channels and swept the funds. Version 2.4.2 shuts the door. It does not revoke the keys already copied.

Dmitry Serdyuk·Aug 10, 2026

A dense dark wall of racked teal authorization plates, each stamped with an identical blank seal in its upper corner and a shallow value channel along its lower edge, crossed by a rigid reader bar whose contact fingers touch only the seal corners; one plate glows red with a matching seal and a value channel cut into a deep trench the reader never reaches.

exploits

Swan Treasury's $625K Signer Key Leak: One Key, Three Contracts, Five Cents of Gas

A leaked off-chain signer key let an attacker sign their own discount. Swan Treasury's buy() function checked who signed the message and never checked what the message asked for.

Dmitry Serdyuk·Aug 7, 2026

Dark abstract illustration of a dense teal machined register plate whose rows of milled cells are indexed from two opposite edges, with one cell duplicated in a single row and its second copy raised and lit red

exploits

Verus Bridge $7.5M Exploit: When Two Chains Read the Same Bytes Differently

An attacker poisoned Verus notarizations with duplicate state roots that Verus and Ethereum parsed differently, draining $7.5M from a bridge already drained for $11.58M nine weeks earlier.

Dmitry Serdyuk·Aug 6, 2026

Cutaway cross-section of a hardware wallet board: the hardware random number generator die sits dark with its bond wires ending at bare pads, while a small brass counter wheel is wired into its place and the seed register beside it stays mostly empty.

exploits

Coldcard's $88.6M Entropy Failure: Five Years of Guessable Bitcoin Seeds

A March 2021 build error routed Coldcard seed generation to a software PRNG instead of the hardware RNG. Five years later, attackers swept 1,367 BTC from 4,585 addresses without touching a device.

Aron Turner·Aug 3, 2026

A small crisp teal block set against a vast red striated volume that runs past the frame, a size comparison between a short secured window and a far longer unwatched one

exploits

Triple-A's $11.8M Hot Wallet Drain: Seven Chains, and 31 Hours Nobody Closed the Tap

Triple-A's treasury wallets were swept across seven chains starting July 24, 2026. The theft took hours. Deposits kept arriving and kept being swept for 31.

Dmitry Serdyuk·Jul 30, 2026

A large teal machined ring seen head on against black, its inner core replaced by a mismatched dull red disc whose engraving does not line up with the ring, joined by a clean hairline seam

exploits

B2 Network $3.86M Staking Drain: The Upgrade Key Did All the Work

B2 Network lost 8.59M B2 tokens, about $3.86M, when someone used the staking contract's upgrade authority. That privilege had sat on the same wallet since 2025.

Dmitry Serdyuk·Jul 27, 2026

Five identical validator signature keys emerging from a single compromised red enclosure, together opening a bridge gate as teal value drains across the span into one dark vault

exploits

AFX Trade $24.15M Bridge Exploit: Compromised Validator Keys Signed a Valid Drain

AFX Trade's bridge lost $24.15M in USDC on Arbitrum. No contract bug: five operator-held validator keys signed a real quorum, and the bridge did exactly as told.

Dmitry Serdyuk·Jul 24, 2026

A teal wireframe repository lattice with one cracked block exposing a dense red core, splitting into three red filaments that converge on a single pulsing red node

exploits

The Fake Recruiter Repo That Hid Its Malware in a Tailwind Config

A fake Web3 recruiter sends a GitHub repo to try before the interview. The malware hides as a 4 MB Tailwind plugin, fires on the dev command, and hunts wallets, SSH keys, and seed phrases.

Dmitry Serdyuk·Jul 23, 2026

A counterfeit code-editor plugin icon glowing red, its data filaments feeding a chain of teal hexagonal blocks with one attacker-controlled node pulsing red, branching to three compromised endpoints

exploits

The TRAE Extension Backdoor That Ran Its C2 on an Ethereum Contract

A fake Solidity plugin, juannegro.solidity, backdoors Windows, macOS, and Linux dev machines and reads its C2 address from an Ethereum contract the attacker updates on-chain.

Dmitry Serdyuk·Jul 22, 2026

Abstract illustration of a flash loan pool manipulation: two teal stablecoin streams share one tilted basin while a looping bright pulse skews their balance and red value drains across a dark gap to a distant chain node, over dark circuitry.

exploits

Allbridge Core $1.65M Exploit: A 2023 Flash Loan Fix That Missed Solana

Allbridge Core lost $1.65M on Solana to the same flash loan trick it said it fixed in 2023. The one-pool promise held on BNB Chain and not on Solana.

Dmitry Serdyuk·Jul 21, 2026

Abstract illustration of a lending exploit: teal concentrated-liquidity bands meet a translucent vault of stacked cells, and red value drains through the misaligned seam where the two accounting systems meet, over dark circuitry.

exploits

DefiTuna Exploit: $580K Drained From Solana Lending Pool

DefiTuna's USDC lending pool lost $580K to a July 2026 exploit on Solana, leaving it in bad debt. Inside the attack, the Sec3 audit gap, and the lessons.

Aron Turner·Jul 20, 2026

Abstract teal circuit board where one npm package node fans out into eighteen child nodes, with a single red corrupted trace smuggling a key-shaped glyph through a stream of benign teal telemetry packets toward a distant server

exploits

Injective npm SDK Backdoored to Steal Wallet Keys: Anatomy of a Near Miss

A compromised maintainer account backdoored 18 @injectivelabs npm packages on July 8, 2026, harvesting wallet seed phrases at key-derivation time. It failed by minutes. Here is how it nearly worked.

Dmitry Serdyuk·Jul 14, 2026

Abstract illustration of a DeFi vault: an external glowing token dropped into a side strategy module inflates a red share-price gauge past its safe band while value siphons out through a redemption channel, over dark teal circuitry.

exploits

Summer.fi's $6M Lazy Summer Exploit: When a Donation Broke the Vault Math

An attacker donated an asset into a Summer.fi Lazy Summer vault, inflated its totalAssets() share price, and redeemed a flash loan for a $6M profit. No key was stolen. The accounting was the hole.

Dmitry Serdyuk·Jul 8, 2026

An oversized hand drops a stack of votes that outweighs a scattered crowd on a tipping scale, swinging open a treasury vault as coins stream out.

exploits

BonkDAO's $20M Governance Takeover: When Buying the Vote Beats Hacking the Code

An attacker spent about $4M buying BONK, took a voting majority on BonkDAO's Realms governance, and passed one proposal that moved $20M out of the treasury. No contract was hacked. The rules were.

Dmitry Serdyuk·Jul 7, 2026

A deprecated on-chain vault whose guard inspects only one of thirty-two settlement slots, with forged teal deposit blocks slipping through the unverified gap while a single red slot drains assets from the sealed pool.

exploits

Aztec Connect's $2.19M Exploit: A ZK-Rollup Settlement Bug in a Contract No One Could Patch

A deprecated Aztec Connect contract was drained of $2.19M when its L1 settlement loop and its ZK proof disagreed on how many slots were real. Its keys were renounced, so no one could pause it.

Dmitry Serdyuk·Jul 5, 2026

Autonomous MEV bot following teal approval streams into a red honeypot trap of counterfeit token contracts as an attacker coordinator sweeps funds

exploits

JaredFromSubway MEV Bot Drained for $7.5M in a Counter-MEV Honeypot

JaredFromSubway, Ethereum's most prolific MEV sandwich bot, was drained of $7.5M when an attacker turned its own logic into a counter-MEV honeypot. How the dangling-approval attack worked.

Aron Turner·Jun 23, 2026

One compromised laptop holding seven signing keys that cleared a 3-of-6 and a 3-of-5 multisig across two chains

exploits

Humanity Protocol's $36M Key Compromise: A Runbook for Wallets That Touch Contracts

One compromised laptop held seven keys and cleared two multisigs, draining $36M+ from Humanity Protocol. A runbook for segregating, monitoring, and revoking project wallets that touch contracts.

Dmitry Serdyuk·Jun 10, 2026

Third-party Safe module bypassing intact signature shields with a public hardcoded authorization key

exploits

The $3.2M SquidRouterModule Exploit: How a Public String Drained 86 Safe Wallets

A third-party module named SquidRouterModule drained $3.2M from 86 Gnosis Safe wallets on Ethereum and Base. Full attack chain, the auth flaw, and the lesson.

Aron Turner·May 26, 2026

Poisoned developer IDE extension exfiltrating internal repositories and secrets into an external archive vault

exploits

GitHub's 3,800-Repo Breach: How a Poisoned VS Code Extension Burned the World's Biggest Code Host

One poisoned VS Code extension on one GitHub employee's laptop cost the company ~3,800 internal repositories. Here is the attack chain, the Mini Shai-Hulud worm internals, and the rotate-everything checklist that follows.

Aron Turner·May 21, 2026

Breached cyberpunk vault door with a single compromised lock: the 1-of-1 LayerZero DVN that let $292M leave Kelp DAO

exploits

Kelp DAO's $292M Hack and Aave's $6B Fallout: One Config Parameter Broke DeFi

A 1-of-1 LayerZero DVN let attackers drain 116,500 rsETH ($292M) from Kelp DAO, loop it through Aave V3 for $266M in ETH, and wipe $6B in Aave TVL in 24 hours. No Solidity bug. One config parameter broke DeFi.

Aron Turner·Apr 20, 2026

Drift Protocol $270M exploit breakdown — Solana durable nonces weaponized in DPRK-attributed multisig attack

exploits

Drift Protocol's $270M Exploit: How Solana's Durable Nonces Became a Social Engineering Weapon

An attacker drained $270M from Drift Protocol by abusing Solana's durable nonce feature to pre-sign malicious multisig transactions weeks before execution.

Aron Turner·Apr 3, 2026

Aave oracle liquidation incident breakdown

exploits

Aave's $27M Liquidation Incident: How a Stale Oracle Parameter Wiped Out 34 Users

A desynchronized oracle parameter caused Aave to undervalue wstETH by 2.85%, triggering $27M in wrongful liquidations across 34 users. Full technical breakdown.

Aron Turner·Mar 12, 2026