exploit
Qubic halts network after 1,404 wallets drained via weak iOS seeds
Attackers drained 2.94T QU (~$1.3M) from 1,404 Qubic wallets created with weak 55-character seeds in Safari and the iOS app; validators halted the chain at tick 85,371,949.
Stories tagged: #exploit
exploit
Cysic halts BNB-chain bridge after unauthorized 10M CYS mint
Cysic says 10M CYS were minted on BNB Smart Chain at 12:31 UTC on October 17; the bridge is offline indefinitely and most of the tokens left the recipient address before blacklisting.
exploit
Ledger's Donjon describes LTE-eSIM implant; MediaMarktSaturn pulls devices across Europe
Ledger's security team says a CryptoBilis implant reads the 24-word setup screen and exfiltrates via LTE through an eSIM. MediaMarktSaturn removes Ledger from every store it operates.
exploit
Papertrade loses control of its Hyperliquid price feed on launch day; one wallet nets $1.28M
A single wallet booked about $1.28M on Papertrade in its first hours by moving Hyperliquid's ETH midpoint. The 1000x venue says it is tightening open-interest caps.
exploit
Ledger confirms hardware implant in affected device; CryptoBilis pauses all wallet brands
Ledger says at least one affected user's device contained a hardware implant. The CryptoBilis reseller widens its pause to all hardware wallet brands, not just Ledger.
exploit
Ledger-theft funds swap into USDD on SUN.io, past Tether's freeze reach
On-chain tracing by Specter and MistTrack shows the Ledger / CryptoBilis cluster swapping USDT for USDD through SUN.io on October 9, moving the stolen float onto a stablecoin Tether cannot blacklist.
exploit
Ledger halts CryptoBilis sales after $86M in reported wallet drains
Ledger paused shipments through Southeast Asian reseller CryptoBilis after on-chain investigators traced over $86M in suspected thefts across BTC, ETH and Tron.
regulation
'Crypto Godfather' Adam Iza gets 78 months for $37M Meta ad-credit fraud
Federal judge Percy Anderson sentenced Zort founder Adam Iza to 78 months and $23.4M restitution for a Meta ad-credit scheme, concurrent with his prior 15-year sentence.
on-chain
ZachXBT fronts $349,700 to infiltrate Chinese launderers linked to Bybit hack
On-chain investigator ZachXBT ran six months of controlled transactions through a Chinese OTC syndicate operating for Lazarus, surfacing a Tron collection address and a $12M Bybit-linked cluster.
exploit
Base vault loses 1,783 wstETH ($6M) after multisig signs attacker twice in 90 seconds
An unidentified Base vault's 3-of-7 Safe approved an attacker contract, let it drain 1,783 wstETH via Aave V3, then re-approved it — $31.7M still exposed under the same multisig.
exploit
NEAR Intents recovers full $3.8M after 48-hour ultimatum to exploiter
General Manager Alex Shevchenko issued a public 48-hour deadline on X; the attacker returned the funds and NEAR Intents closed its investigation on October 4.
exploit
Chainalysis attributes $387M Bitget heist to DPRK, pushing 2026 crypto theft past $1B
Chainalysis formally pins the September Bitget hack on North Korea-linked actors, says in-house AI compressed 20 hours of bridge reconciliation to minutes. Bitget publicly credits Near Intents.
infrastructure
MetaMask Staking exits Lido validators on infrastructure compromise
MetaMask disclosed an infrastructure incident Sept 30 and is exiting all its ETH validators from Lido by Oct 7, ~45-day return cycle. Sentora Morpho vaults shed ~$136M PYUSD/RLUSD.
exploit
NEAR Intents drained for $3.8M via Omni deposit-layer bug
NEAR Intents paused cross-chain swaps on 11 networks Oct 1 after a bug in its Omni deposit/withdrawal layer let an attacker drain ~$3.8M. Contract patched; full reimbursement pledged.
exploit
Bitget attacker moves 2,700 ZEC to Zcash Ironwood after Near SHIELD rejects $50M in swaps
ZachXBT flags 2,700 ZEC (~$3.8M) into Zcash's Ironwood shielded pool after Near Intents' SHIELD system blocks $50M of the Bitget hacker's cross-chain swaps.
explainer
What you missed: biggest blockchain stories, August–September 2026
Ten weeks in one post — the Coldcard $116M drain, the Liquid Network and Bitget breaches, SEC's Regulation Crypto Assets, THORChain's Monero swaps and more.
exploit
Allbridge Core paused on Solana after Kamino flash-loan drains ~$1.65M
Allbridge Core paused its Solana deployment on July 19 after an attacker used a $1.12M Kamino flash loan and USDC/USDT swaps to drain roughly $1.65M and bridged to Ethereum.
exploit
Across Protocol takes first hit on Solana, loss lands on Risk Labs relayer
Across said its Solana deployment was attacked at ~5:30 AM UTC on July 17. Users were kept whole; the loss sits with the Risk Labs relayer. Solana deposits paused.
exploit
DeFiTuna suspends Solana lending after $580K USDC pool drained via zero-round
DeFiTuna disclosed on July 16 that an attacker used a self-created illiquid TUNA/USDC pool routed through Jupiter to round a position's asset value to zero, bypassing the solvency check.
exploit
Ostium halts Arbitrum trading after OLP vault drained via oracle signer key
An attacker used a compromised Ostium oracle signer to push future-dated prices through the protocol's PriceUpKeep forwarder on July 15, draining $18–24M from the OLP vault.
exploit
Cascade's Arbitrum CLS vault drained for ~$1.34M USDC before the platform ever went live
Polychain/Variant-backed neo-brokerage Cascade lost 1.34M USDC from pre-launch First Wave deposits on July 16; funds were bridged Arbitrum→Solana→Ethereum and swapped into unfreezable DAI.
exploit
Ostium's Arbitrum perp DEX drained for up to $18M USDC after oracle-signer key compromise
An attacker with an authorized oracle-signer key and a registered PriceUpKeep forwarder booked twenty round-trip BTC/USD trades, draining ~28% of Ostium's OLP vault; trading paused.
governance
EMURGO exits Cardano's Pentad governance to focus on SecondFi hack recovery
EMURGO, one of Cardano's five Pentad governance entities, stepped down on July 8 to lead recovery for its SecondFi wallet, drained of 16M ADA (~$2.4M) via an Ed25519 signer flaw.
exploit
Bonzo Lend loses $9.05M on Hedera after Supra oracle accepts zeroed BLS signature
Bonzo Lend drained of ~$9.05M on July 11 after a Supra oracle verifier accepted a zeroed BLS signature. Attacker inflated SAUCE price 12 orders of magnitude, bridged $5.25M via LayerZero.
exploit
Summer.fi drained of $6M as attacker donates stale-priced Silo token into Lazy Summer vault
Summer.fi's Lazy Summer vaults lose $6.04M in an ERC-4626 donation attack. Root cause: a Silo Varlamore USDC vault token stale-priced since November's Stream Finance collapse. Vaults paused.
governance
BonkDAO treasury drained of ~$20M in BONK via BIP-76 'Sowellian' governance attack
BonkDAO confirmed a ~$20M treasury drain on July 6, 2026 after malicious proposal BIP-76 'Sowellian BonkDAO' passed on its own governance platform. Upbit and Kraken paused BONK.
exploit
Summer.fi loses $6M as attacker manipulates FleetCommander totalAssets()
A flash-loaned donation to Summer.fi's Ark inflated FleetCommander.totalAssets() and let an attacker redeem $70.9M from a $64.8M deposit. Lazy Summer vaults paused; funds are moving to Tornado Cash.
exploit
Aptos patched a Move VM stale-cache bug Hexens says risked ~$70B in cross-chain value
Security firm Hexens disclosed a stale-cache type-confusion in the Aptos Move VM in late February. Aptos patched within days; no funds lost. Coverage went public on July 4.
exploit
Hinkal drained for ~$820K on Ethereum after proofless-deposit bug bypasses ZK verification
An attacker skipped Hinkal's zk verification with a 'Proofless Deposit', drained ~$820K in USDC on Ethereum, and laundered 410 ETH via Tornado Cash plus 44.7 ETH bridged to Bitcoin over THORChain.
exploit
Edel Finance halts V1 after wGOOGLx wrapping bug drains $403K to Tornado Cash
A flash-loan-assisted exchange-rate manipulation between GOOGLx and wGOOGLx on Edel's xStock lending market inflated collateral 78×, opening ~$403K of bad debt routed through Tornado Cash.
governance
Tornado Cash DAO flagged for malicious proposal swapping lookalike addresses; ~$23M TORN at stake
Researchers flagged a June 25 Tornado Cash governance proposal that swaps the DAO treasury address for a lookalike — ~$23M in TORN and relayer balances at risk.
exploit
Polymarket frontend vendor compromise drains ~$3.1M in PUSD from 11+ user wallets
A poisoned JS dependency on Polymarket's frontend drained ~$3.1M in PUSD from 11+ wallets on June 25, swapped into ~1,893 ETH. Contracts untouched; refunds promised.
exploit
SecondFi suspends services after wallet-keygen flaw drains 16M ADA
SecondFi disclosed a key-generation bug in its web wallet on June 23, draining ~16M ADA from 178 users; SlowMist puts total exposure at up to 129M ADA.
exploit
Taiko halts L2 block production after bridge proof-verification exploit
Taiko's chain state verification was compromised on June 22; proposers stopped producing blocks, the ERC20 Vault on Ethereum was drained for an estimated $1.7M, and all bridges are flagged unsafe.
exploit
Jaredfromsubway.eth MEV bot drained for $7.5M in counter-MEV trap
Attacker farmed approvals from Ethereum's largest sandwich bot using 66 fake WETH/USDC/USDT tokens, then swept ~1,474 WETH, 2.87M USDC and 2M USDT in a single sweep tx.
exploit
Namada MASP drained for ~$600K via IBC; stale indexer hid the loss
Attacker forged IBC transfers against Namada's shielded pool, swept liquid assets cross-chain and left staked holdings behind. A stale indexer kept showing balances while live RPC reported zero.
exploit
Axelar shuts Secret IBC route after $4.67M forged-packet drain
Forged-packet attack on Secret's ICS-20 contract minted unbacked wrapped tokens, then redeemed them via the legitimate Axelar IBC channel. Caught June 17 when an escrow accounting check failed.
exploit
Aztec Connect's deprecated RollupProcessorV3 drained for $2.19M via ZK proof boundary mismatch
On June 14, an attacker exploited a numRealTxs vs decoded_slots gap in Aztec Connect's immutable rollup contract and drained 909 ETH, 270,513 DAI and 167.89 wstETH.
exploit
Raydium loses $1.34M as forged LP mint drains 5 legacy AMM V3 pools
An attacker minted a counterfeit LP token, called withdraw on Raydium's deprecated AMM V3 program, and drained 150,177 RAY, 5,603 SOL and 893,700 USDC from 5 Serum-era pools.
exploit
Aragon DAO governance takeover drains $1.58M from Token of Power
An attacker bought >50% of a 16,384-supply MiniMeToken, used a no-timelock Aragon Voting app to mint 10B TOP in a single tx, and swapped them for 944.2 WETH from a Balancer V1 pool.
exploit
Humanity Protocol drained ~$36M after multisig keys traced to employee laptop
Coordinated Ethereum + BSC attack on Humanity Protocol's Hyperlane bridge: 141.2M H drained, 200M minted on BSC, ~$36M stolen. Team blames a compromised employee laptop; H down ~86%.
exploit
Yuga Labs whitehats 68 NFTs out of a live Flooring Protocol exploit
Yuga's blockchain lead 0xQuit and researcher Coffee pulled 29 BAYC, 2 CryptoPunks and 37 other blue-chips out of Flooring before an attacker could redeem them through the fpToken bug.
exploit
Gnosis Pay halted after Zodiac Delay Module exploit; Gnosis to cover losses
Gnosis co-founder Martin Köppelmann confirms an active exploit on Gnosis Pay tied to Zodiac Delay Modifier v1.1.0 and Roles Modifier v2; Gnosis pledges to cover all user losses.
exploit
Gravity Bridge halted after $5.4M drain on suspected key compromise
Cosmos-Ethereum Gravity Bridge lost ~$5.4M on May 30. Peckshield and on-chain analyst Specter call it a signing key compromise. Team halted validators; attacker holds ~2,102 ETH.
exploit
Bybit cold wallet drained for ~$1.5B; Lazarus signatures on-chain
Bybit's primary ETH cold wallet lost about 401,000 ETH on Feb 21, 2025 via a Safe{Wallet} UI manipulation. Arkham and the FBI attribute the attack to Lazarus.