BraveNewDeFi

Lights, camera, action! 🎬 Catch our Head of BD @MontBlancDeFi's interview with @FINTECHTVglobal at @DeFinition_evt How can we fix DeFi's trust problem? terminal.fintech.tv/fintecht…

Onchain Security Roundup: Oct 19 - Oct 26 CoinDCX Retired Deposit Wallets Drained on TRON On October 21st, 15.9M USDT (plus a reported 5,784 TRX) left 40 TRON addresses that the Indian exchange CoinDCX had retired after its July 2025 breach. CoinDCX first called the reports a possible false alarm, then on October 25th confirmed a $16 million loss, blamed a failed automated sweeping service, and absorbed the loss. It has not said how the funds were taken. Tether reportedly froze $2.2M. X100 Global Flash Loan Governance Takeover On October 24th, an attacker used a 1.9M USDT Aave flash loan to buy two of the three seats on X100 Global's "Senate," pass a proposal in the same transaction, and sell 400,000 treasury X tokens at 35.68 USDT. Blockaid valued the loss across two transactions at $4.85 million, with another pulling 550,000 X of liquidity. Two onchain bounty offers followed. No funds have been recovered to date. Initia MoveVM Script Cache Bug and Unbacked Bridge Withdrawals On October 23rd, an attacker exploited a script-caching bug in Initia's MoveVM to credit itself with WETH, iUSD, and USDC balances that no deposit backed, then bridged $2.7 million out over LayerZero, Noble, and CCTP before Initia halted its L1 and rollups. Initia says a fix and audit will take days and has set no restart date. No funds have been recovered to date. BloomTrading Bot Wallet Drains on Solana On October 26th, 9,408 SOL ($947,000) was drained from 49 Solana wallets. Bloom, the Telegram trading bot that generated and held the keys, says a remote code execution flaw in a third-party module was exploited, no private keys were compromised, nine users across 49 wallets were affected, and that it will reimburse them fully. No funds have been recovered to date. NEM Token Skim-and-Burn Reserve Manipulation On October 21st an attacker drained 821,920 USDT from the PancakeSwap USDT/NEM pool on BNB Chain in a single transaction. The NemTokenV2 contract credited tokens sent to the pool as pending sells before any swap settled, and a permissionless function then burned NEM out of the pool against that stale credit and resynced the reserve. It ran 42 times with flash-loaned USDT, pushing the price up before the attacker swapped out. No funds have been recovered to date. WAX Bridge Negative Fee Withdrawals On October 22nd, a freshly created WAX account submitted five bridge withdrawals with a negative max_fee equal to the withdrawal amount, so the WAX side debited nothing while the bridge still recorded full withdrawals. Solana then paid 52,986.50 USDC and Ethereum released 21,558 USDT, 840 DAI, 2.55 WETH, and 0.11 WBTC ($90,500). No funds have been recovered to date. Swell Network Hot Key Compromise (No Confirmed Loss) On October 21st, an unknown actor controlled Swell Network's operational hot keys, including the oracle bot for swETH and rswETH, and raised both exchange rates by the 1%-per-hour maximum with no ETH behind the increase. Per @spreekaway's incident report, four upgrade payloads capable of sweeping 2,513 ETH ($6.2 million) were deployed but never installed, and no ETH left the core contracts. Swell paused deposits and withdrawals on October 23rd and queued key revocations on its timelock. The investigation is ongoing. Read the full roundup below 👇

Onchain Security Roundup: Oct 12 - 18 Gamdom and a Server Breach That Reached the Hot Wallets On October 13th the crypto casino Gamdom lost its hot-wallet balances on nine chains after an intruder reached one of its servers. The founder puts the loss at just over $3 million; onchain investigator @vxdb counts $4.2 million using @arkham data. The site was offline for almost three days. No attacker addresses were published. Autheo and a Bridge That Trusted One Relayer On October 12th an attacker on Base minted 19,000,000 and then 100,000,000 THEO, the token of the layer-1 network Autheo, through the project's Hyperlane warp route and sold into the pools. @peckshield traced 700.8 ETH ($1.76 million) to Ethereum; TokenPost's reading attributes only 291.7 ETH ($730,000) to the exploit. THEO fell more than 90%. The root cause is unconfirmed by Autheo. Qubic and 1,404 Wallets with Guessable Seeds Starting at 23:42 UTC on October 17th, an attacker emptied 1,404 wallets on Qubic, a non-EVM network whose accounts are controlled by a 55-character seed, taking 2.94 trillion QU in 104 minutes, which press valued at $1.3-1.4 million. Qubic blames weak randomness in seed generation on some Apple browsers and a legacy iOS app, halted the chain and says 87.1% of the funds are frozen. UNCX Vesting and a Cancel That Deducted the Wrong Number On October 14th attackers drained Smart Token Vesting V2, a shared vesting service run by the token-locker provider UNCX (formerly Unicrypt) that holds tokens for third-party projects, on Ethereum, BNB Chain, Base, and Robinhood Chain. UNCX's recap puts verified losses at $807,600 across 11 transactions; @blockaid_ had tallied $1.49 million. The bug is a share-accounting error in cancel(). A white hat returned 82.1 million X tokens and 23.87 ETH. Cysic and a Forged Mint Message On October 17th an attacker minted 10,000,000 CYS on BNB Chain through the bridge of Cysic, a layer-1 for zero-knowledge proof generation, after accessing a database used by bridge services and exploiting a message-processing flaw. The attacker sold 7.2 million CYS and bridged the proceeds to Ethereum as 306.6 ETH, $727,000 at the time. Cysic froze 2.8 million CYS and suspended the bridge. BiFi and Interest That Accrued Twice On October 17th the idle USDT market of the BiFi lending protocol on Ethereum was exploited for $165,400 through a stale interest-accounting delta that was re-applied on every action within a block. The original attacker was front-run by the MEV operator c0ffeebabe.eth, who took the proceeds with a 40.5 million USDT Morpho flash loan. XPR Network and a System Contract Nobody Had Read Since 2022 On October 17th an attacker used a flaw in the webauthn wallet system contract of XPR Network, an Antelope-based chain run by Metallicus, to make 67 accounts borrow 1,143,288 USDC on LOAN Protocol, the chain's lending market, in one transaction, then drained a third-party escrow. The USDC never left the bridge and was returned; block producers replaced the attacker's keys by multisig. User liquidation losses are unquantified. Pirate Chain and an Issuance Check That Did Not Check On October 14th the privacy chain Pirate Chain found that 39.8 million ARRR, 20% of maximum supply, had been minted without authorization through flaws in the Ironwood turnstile activated on October 3rd. The coins went into the shielded pool. A rollback was announced and withdrawn within a day. No realized loss figure exists.

Onchain Security Roundup: Oct 5 - 11 Ledger Reseller Devices and a Supply-Chain Seed Capture On October 9th, wallets set up on Ledger devices bought through the reseller CryptoBilis were emptied across 6 chains, with $93.2 million taken from 315 wallets. Ledger confirmed an unauthorized hardware implant in a single device and says its own systems were not compromised. Tether froze $10.0 million of USDT, per @Bitquery_io. 79thVault and a Privileged Pool Withdrawal On October 7th, an operator-role key in the 79AU token on BNB Chain pulled 2.51 million 79AU out of the PancakeSwap 79AU/USDT pair over 8 transfers to two attacker addresses, which sold it for a combined 18,534 BNB. The main cash-out was 16,249 BNB ($12.5 million, per @CertiK). The project blames a stolen operator key. The attacker returned 15,000 BNB on October 9th. MakerDAO Legacy Keeper and an Unprotected Exit On October 6th, a Tornado Cash-funded address drained 200 ETH ($542,982, per CertiK) from a dormant third-party MakerDAO liquidation keeper. The keeper had won 4 ETH-A auctions in 2020 and never claimed the collateral, and its proxy exposed an exit routine with no access control. Maker's core contracts behaved as designed and were not impacted. No funds have been recovered to date. Papertrade and a Movable Reference Price Hours after Papertrade launched on HyperEVM on October 10th, traders were accused of abusing an alleged design flaw: moving Hyperliquid's ETH mid price with large orders to profit on Papertrade positions priced off that mid. One wallet withdrew a net profit of $1.28 million. Papertrade tightened limits and says it was defending against manipulation attempts. It has not publicly confirmed a loss.

Onchain Security Roundup: Sep 21 - Oct 5 Bitget Wallet-Infrastructure Compromise On the evening of 24 September Bitget's hot and warm wallets on six chains sent most of their balances to one attacker in two hours. Bitget puts the loss at $387.5 million. Bitget says a compromised backend spoofed transaction data through its normal authorisation flow, no private key was stolen, and user balances are unaffected. Neutron Governance Takeover Drains Astroport and Drop On 22 September an attacker drained $9.4 million from Astroport and Drop on Neutron after passing an expedited governance proposal that handed them admin rights over 11 contracts. Cosmos Hub validators halted for a day and moved 1,227,121 ATOM of proceeds into a validator multisig, where it remains pending a refund vote. The $1.96 million bridged out is unrecovered. Duelbits Hot Wallet Drain The crypto casino Duelbits confirmed a $7 million drain from its hot wallets on 24 September. Funds left across five chains within 20 minutes. A private-key compromise is the suspected root cause. Duelbits says user funds are safe. No recovery has been reported. NEAR Intents Omni Vault Accounting Exploit on BNB Chain Between 30 September and 1 October an attacker withdrew 3,865,000 USDT from NEAR Intents' BNB Chain hot vault in five signature-authorised withdrawals, exploiting a deposit-refund accounting bug in its Omni infrastructure. The team paused eleven chains, patched the contract and pledged full compensation. NEAR says the exploiter returned all funds on 2 October. Meter Unbacked MTRG Mint through the Passport Bridge On 23 September a block-validation flaw on Meter’s mainnet let an attacker mint unbacked MTR and MTRG, bridge them to BNB Chain through Meter Passport and sell them on PancakeSwap. Blockaid estimates $2.3 million of unbacked wrapped MTRG minted; realised proceeds are unknown. Meter paused the chain and bridge. Payy Network Rollup Proof-Verification Exploit At 04:21 UTC on 24 September a single call to verifyRollup on Payy Network's Ethereum rollup contract released 1,832,149 USDC, the bridge's full balance, to attacker addresses. Phalcon counts $1.93 million across two transactions. Burn records with all-zero hashes point at the proof-verification logic. Payy paused everything and says a compromised key is ruled out. Limit Break Payment Processor V2 Legacy-Approval Exploit From 24 September an attacker exploited a sender-spoofing bug in Limit Break's Payment Processor V2 to spend token approvals Magic Eden users granted in 2024, taking 530.7 WETH from 911 wallets per Cryptoticker. Whitehat 0xQuit swept 23,155 NFTs worth $5.7 million to safety. BeInCrypto reports $3.4 million of the $6.6 million at risk has since been returned. TradeWiz Telegram Bot Private Key Compromise on Solana On 30 September an attacker swept 20,933 user wallets of the Solana Telegram trading bot TradeWiz, taking 3,523 SOL plus rent and tokens worth $459,000 per Bitquery. TradeWiz attributed the loss to a private-key export feature of sister product $SOL PVP, began refunds that evening, and filed a police report. Two Safes Drained through Third-Party FlashLoopAdapter Module On 1 October an attacker extracted 114.096 ETH ($305,000) from two Safe wallets running leveraged weETH loops on Aave V3 through a third-party module called FlashLoopAdapter. The module authenticated callers by trusting the caller's own claim that it was enabled, which any attacker contract could fake. No return has been observed. GoldPesa Uniswap v4 Hook Exploit on Base On 2 October an attacker drained GoldPesa's protocol-owned GPX/USDC liquidity on Base by triggering its Uniswap v4 hook's hourly rebalance from inside their own transaction, clearing 114,428 USDC profit and swapping it to 96,389 USDT. Uniswap v4 behaved as designed. MetaMask Staking Infrastructure Compromise MetaMask disclosed on 30 September that part of its validator infrastructure, formerly Consensys Staking, had been compromised, and began precautionary exits of affected Ethereum validators, including those run for Lido. Researcher 0xKaden reports 0.36 ETH of block rewards were diverted to a Tornado-funded address; no stake was lost. Lido says stETH holders need take no action.

Great turnout today at @AccountableData's @DeFinition_evt! Thank you to everyone who came out to our panel with @monad @Securitize @centrifuge and @chainlink 🙌 And stay tuned for @MontBlancDeFi's interview with @FINTECHTVglobal...

Onchain Security Roundup: Sep 14-21 Individual Safe Drained through Custom Module: $7.7M A Safe multisig belonging to an unidentified holder lost 2,882 rsETH ($7.7–7.8 million) on 15 September due to an authorisation flaw in a custom keeper contract; the MEV bot "yoink" spotted the attacker's transaction in the mempool and executed it first, taking the funds. Kelp DAO paused the receiving address for 24 hours, and the funds have not been recovered. Nostra Finance Oracle Manipulation on Starknet: $3.5M On 17 September an attacker pushed the price of NSTR from $0.006 to $49.5 and used it as collateral to borrow ~$3.5 million. Nostra paused the market entirely and says the final loss and any recoveries are not yet known. D'CENT App Wallet Unauthorised Transfers Due to Software Vulnerability: $3.3M Starting on 15 September, "App Wallet" users inside D'CENT's mobile app saw their balances swept to attacker-controlled accounts with 3.3 million XRP flowing into the attacker wallets. IoTrust says only recovery phrases that were entered into the App Wallet and used to sign on app versions older than 8.1.0 are at risk, hardware wallets are unaffected, and the exact cause is still under investigation. SingularityNET Bridge and ASI Conversion-contract Key Compromise: $1.6M An attacker drained 8.72 million FET (~$1.55 million) from Fetch_ai's conversion contract, minted 408.5 million NTX from the NuNet deployer account, and then minted hundreds of millions of unbacked AGIX and WMTx tokens using compromised signing and administrative keys. Fetch_ai has paused AGIX-to-FET conversions and its Ethereum bridge as a precaution, and World Mobile is preparing a pre-exploit snapshot of WMTx. The incident is ongoing. FomoPeek Malicious iOS App Distributed through the App Store: $580K FomoPeek, a "whale-watching" iOS app listed on Apple's App Store on 29 August, shipped two hidden modules in versions 1.1 and 1.2 (9–17 September) containing eight iOS kernel exploits. MistTrack traced ~580,000 USDT to the primary attacker address; total victim losses are unknown. Version 1.3 removed the modules; SlowMist classifies devices that ran 1.1 or 1.2 as exposed, and Apple has not commented publicly. Flamincome Legacy USDT Strategy Share-Price Inflation: $346K On 16 September an attacker extracted ~$346,000 USDT from an old Flamincome yield-vault strategy on Ethereum. The attacker inflated the vault's share price mid-transaction with an $18 million Morpho flash loan and then redeemed shares against the strategy's real Aave aUSDT. Third-party analysis puts the strategy's own loss near $595,000. No team statement or recovery has been reported. Nimiq Stablecoin Swap Handlers on Polygon, OpenGSN Paymaster Bypass: $50K On 16 September an attacker took ~$50,000 in USDC and USDT from a liquidity wallet operated by a Nimiq partner on Polygon. The wallet had approved Nimiq's swap contracts to spend its stablecoins, but those contracts relied on a separately selected OpenGSN paymaster to verify the user's signature. The attacker supplied a paymaster that accepted every request and drained the wallet. Nimiq confirmed the loss, said no other funds were affected, and disabled OpenGSN-based gas abstraction for stablecoins across Nimiq Pay and Nimiq Wallet.

Liquid Network: Incident Report On September 6th, an attacker exploited a software bug in Blockstream's Liquid Network to mint ~3,996 L-BTC that was unbacked, then redeemed it through a federation member for real bitcoin. The attacker drained roughly $319 million from the federation's reserve. No private keys were compromised; a flaw in transaction verification let a counterfeit transaction pass. Our incident report goes into: - How the attack unfolded - How Blockstream responded - Would Nexus Mutual have covered it? Report link: nexusmutual.io/blog/liquid-n…

Onchain Security Roundup, September 7 - 14 XPR Network Metal X Swap Smart Contract Exploit ~1.56 billion XPR (~$4 million at the time) plus stablecoin and other pool assets drained, per community and press; block producers seized ~1.8 billion XPR from the attacker's account. No official XPR Network statement had been made at the time of this report. Chainflip Cross-Chain Swap Exploit 736,442 USDT (protocol-reported); funds flagged, and Chainflip has pledged to make affected users whole. Splash Protocol Smart Contract Exploit (Optim OADA Pool) ~2.43 million ADA and ~1.99 million OADA withdrawn from the pool; the attacker realised roughly 2.55 million ADA (~$520,000) after selling the OADA into a thin market. No recovery had been announced at the time of this report. Symbiosis Bitcoin Bridge Exploit (root cause unpublished) ~369 billion unbacked syBTC minted across two chains; observed attacker proceeds ~309 ETH (~$750,000), of which ~$336,000 came from a single WBTC conversion flagged by Blockaid. Symbiosis reports recovering ~15 BTC and says final accounting is in progress. Zentra Finance Smart Contract Exploit ~$143,000 (protocol-reported) taken from the ctUSD reserve; lending markets paused and a bounty offered to the attacker. No recovery had been reported at the time of writing. YAM Finance Governance Takeover ~48 WETH and ~763 UMA (~$121,000) withdrawn from two legacy farming contracts; the attacker still controls YAM's governance Timelock, and no recovery has been reported. etherfi Legacy Contract Access Control Exploit ~15.45 ETH (~$38,000) taken from about a dozen users, per SlowMist; etherfi says affected users will be reimbursed in full. Nomic Bridge Exploit (June incident disclosed by Osmosis in September) 40.65 nBTC (~$3.1 million) minted with no bitcoin behind it on June 25th, per Osmosis; ~671 ETH (~$1 million) sent through Tornado Cash; 22.65 allBTC frozen in the attacker's account. Osmosis's Alloyed BTC basket is reported to be about 36% unbacked, with a recovery plan under governance discussion. For the full write-ups, keep reading here: nexusmutual.io/blog/onchain-…

Nexus didn't invent the mutual @HughKarp explains what makes mutuals different from insurance, and why they've been around for so long...

See the detailed Security Roundup report on our blog: nexusmutual.io/blog/onchain-…

Onchain Security Roundup August 31st to September 6th Let’s dig in… 👀