❌

Visualização normal

Antes de ontemBlockchain Threat Intelligence
  • ✇Blockchain Threat Intelligence
  • BlockThreat - Week 4, 2026 Peter Kacherginsky
    Greetings!More than $28M was stolen this week across eight incidents. From arbitrary call vulnerabilities to infinite mint bugs, it was a particularly rough week. Let’s break down a few of the most notable hacks.HypuurFi, SwapNet, and Aperture Finance were hit by arbitrary external call exploits, draining users of roughly $17 million in a single day. Notably, the last two had no source code and were exploited shortly after deployment. We’ve long observed that attackers are becoming increasingly
     
  • ↗️

BlockThreat - Week 4, 2026

✇Blockchain Threat Intelligence
Por:Peter Kacherginsky
27 de Janeiro de 2026, 13:42

Greetings!

More than $28M was stolen this week across eight incidents. From arbitrary call vulnerabilities to infinite mint bugs, it was a particularly rough week. Let’s break down a few of the most notable hacks.

HypuurFi, SwapNet, and Aperture Finance were hit by arbitrary external call exploits, draining users of roughly $17 million in a single day. Notably, the last two had no source code and were exploited shortly after deployment. We’ve long observed that attackers are becoming increasingly sophisticated with onchain vulnerability scanners. Now, we see they not only can detect bugs in raw EVM code but also wait patiently for the most opportune moment to strike exactly as I discussed in my recent DSS talk on watering hole contracts.

If you are not familiar with this attack vector, below is a snippet from the vulnerable HypuurFi contract:

function swapAndDeposit(
    address swapRouter,      // arbitrary call address
    bytes calldata swapData, // malicious input
    address vault,
    address tokenIn,
    uint256 amountIn,
    address tokenOut,
    address receiver
) public payable {
    // Execute swap (tokens come to gateway)
    if (!_isNativeToken(tokenIn)) {
        IERC20(tokenIn).safeTransferFrom(msg.sender, address(this), amountIn);
        IERC20(tokenIn).safeIncreaseAllowance(swapRouter, amountIn);
    }

    // VULNERABILITY:      v----- Tainted user input  ----v
    (bool success,) = swapRouter.call{value: msg.value}(swapData);
    require(success, "Swap failed");

    // Deposit swapped tokens
    uint256 balance = IERC20(tokenOut).balanceOf(address(this));
    _deposit(vault, tokenOut, balance, receiver);
}

The easiest way for developers to catch this bug class is to consider all user input malicious and never pass it along without any constraints to call() or equivalent.

It’s hard to blame users for this hack as they were using DeFi protocols exactly as we encourage them including infinite allowances without any mechanism to revoke them. Perhaps it should be up to wallets to step up and help users clean up these long-lasting approvals just like our password managers frequently remind us to change compromised or weak passwords. In the meantime, bookmark http://revoke.cash and try to visit it on a quarterly/monthly basis.

There’s some hope that the attackers behind these incidents will eventually slip up and face swift justice. It happens to all of them sooner or later. In the meantime, check out this week’s sponsor and the good guys behind Anchain.ai, who are working hard to track down bad actors and help make our ecosystem a bit safer for us all.

AI-native Crypto Intelligence Data

AnChain.AI Data delivers institution grade cryptocurrency data API and MCP for AML, fraud compliance, growth analytics and beyond.

$200 Promo Code (By 2/28): AINATIVECRYPTODATA

https://www.anchain.ai/data

Cosmos ecosystem is know for some of the nastiest blockchain-level bugs including infinite minting, reentrancy, and others. This week, SagaEVM became the victim to one such critical vulnerability. Attackers exploited an infinite-mint bug to generate assets out of thin air, stealing over $7M. Although the chain was halted, the attackers had already bridged out the available liquidity.

In other news, son of a company owner tasked with managing US Marshal Service’s seized crypto assets (including from Bitfinex hack) managed to steal $40M. ZachXBT was able to pin down the perp after he leaked his wallets on Telegram.

Let’s dive into the news!

News

Crime

Policy

Phishing

Malware

Media

Research

Tools

Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.

Premium Content

Read more

  • ✇Blockchain Threat Intelligence
  • BlockThreat - Week 2, 2026 Peter Kacherginsky
    Greetings!Nearly $30M was stolen this week across ten incidents. Quite a way to start the year with exchanges and DeFi protocols alike getting compromised, while users lost hundreds of millions more to well known support scams. Let’s take a closer look at a few of the most impactful cases.The TrueBit protocol hack continues a troubling trend of older smart contracts being exploited. More than $26M was drained through a classic integer overflow bug, triggering a wave of copycat attacks. The hard
     
  • ↗️

BlockThreat - Week 2, 2026

✇Blockchain Threat Intelligence
Por:Peter Kacherginsky
23 de Janeiro de 2026, 18:18

Greetings!

Nearly $30M was stolen this week across ten incidents. Quite a way to start the year with exchanges and DeFi protocols alike getting compromised, while users lost hundreds of millions more to well known support scams. Let’s take a closer look at a few of the most impactful cases.

The TrueBit protocol hack continues a troubling trend of older smart contracts being exploited. More than $26M was drained through a classic integer overflow bug, triggering a wave of copycat attacks. The hard lesson here is longevity does not equal safety. This vulnerability sat undiscovered in a Solidity v0.5.3 contract for nearly four years before being exploited, likely as part of a broader campaign targeting legacy deployments. If you are still hesitant about re auditing older onchain code, now is the time. Otherwise, attackers will be happy to perform that audit for you.

Exchange hacks are relatively rare, which made the compromise of Kontigo particularly notable. The incident occurred just two days after US captured Venezuelan president Maduro. While there is no evidence linking the two events, the timing raised eyebrows given Kontigo’s previously reported ties to Maduro and Venezuela. It is another reminder that real world politics can sometimes spill into the crypto ecosystem in unexpected ways.

Let’s dive into the news!

News

Crime

Phishing

Scams

Malware

Media

Research

Tools

Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.

Premium Content

Read more

  • ✇Blockchain Threat Intelligence
  • BlockThreat - Week 50, 2025 Peter Kacherginsky
    Greetings!Almost $3.5M were stolen this week across eight projects. Unfortunately, the week also marked the appearance of all three emerging threat classes I discussed in my talk at DSS 2025.Watering Hole Contracts are particularly dangerous because they target not the protocols themselves, but their users. Victims are users who previously approved their funds to a vulnerable or compromised contract, often long forgotten. That was the case this week with Jill Gunter, who had an old unlimited tok
     
  • ↗️

BlockThreat - Week 50, 2025

✇Blockchain Threat Intelligence
Por:Peter Kacherginsky
15 de Dezembro de 2025, 11:01

Greetings!

Almost $3.5M were stolen this week across eight projects. Unfortunately, the week also marked the appearance of all three emerging threat classes I discussed in my talk at DSS 2025.

Watering Hole Contracts are particularly dangerous because they target not the protocols themselves, but their users. Victims are users who previously approved their funds to a vulnerable or compromised contract, often long forgotten. That was the case this week with Jill Gunter, who had an old unlimited token approval to a ThirdWeb contract containing an insidious msgSender spoofing vulnerability from nearly two years ago. Attackers patiently waited for a user with a sufficiently large balance to appear, then exploited the vulnerability to drain the funds.

What makes this incident especially unfortunate is that Thirdweb could have prevented the loss by disabling the vulnerable contract, but it appears this step was overlooked. As I mentioned in my talk, users should regularly review and revoke token approvals that are no longer needed. Even better, they should avoid infinite approvals altogether for the massive security risk that it is.

Speaking of predicted threats, another legacy contract was attacked this week. Ribbon Finance lost $2.7M after an attacker successfully forged an update to its price oracle feed. This was a subtle and sophisticated exploit, emblematic of a new generation of attackers who specialize in uncovering deep vulnerabilities hidden in older codebases.

If we can’t reaudit every legacy project, then at the very least we should apply modern tooling capable of analyzing older codebases against latest attack patterns. This week’s sponsor, Ackee, has built exactly such a tool with Wake Arena, designed to hunt down deep and hard to find vulnerabilities. Be sure to check them out!

Wake Arena identified 43 of 94 high-severity vulnerabilities in benchmark tests on historical audit competitions. In 3 production Ackee audits in November 2025 for Lido, Printr, and Everstake, it discovered 26/79 (33%) of all findings, including 5/10 (50%) of the critical findings in Printr, and six unique vulnerabilities. Read the full report.

Let’s dive into the news!

News

Crime

Policy

Phishing

Malware

Media

Contests

Research

Tools

  • Tornado Cash Withdrawal Viewer by IOCOfficial. Analyse withdrawals from Tornado Cash ETH pools using the Etherscan API. View recipient addresses with withdrawal counts, totals, and date ranges across all three ETH pools.

  • Slotscan. Human readable storage viewer.

Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.

Premium Content

Read more

  • ✇Blockchain Threat Intelligence
  • BlockThreat - Week 47, 2025 Peter Kacherginsky
    Greetings!As many of us were out enjoying the warm weather and people of Buenos Aires, the DeFi ecosystem was hit with four exploits totaling nearly $4M in losses. The biggest impact came from GANA, which lost more than $3M in a private key theft. Close behind was the DNS hijacking attack on Aerodrome/Velodrome, resulting in roughly $700K stolen from users who unknowingly signed malicious transactions delivered through a compromised front-end. It’s a stark reminder of the persistent centralizati
     
  • ↗️

BlockThreat - Week 47, 2025

✇Blockchain Threat Intelligence
Por:Peter Kacherginsky
7 de Dezembro de 2025, 01:23

Greetings!

As many of us were out enjoying the warm weather and people of Buenos Aires, the DeFi ecosystem was hit with four exploits totaling nearly $4M in losses. The biggest impact came from GANA, which lost more than $3M in a private key theft. Close behind was the DNS hijacking attack on Aerodrome/Velodrome, resulting in roughly $700K stolen from users who unknowingly signed malicious transactions delivered through a compromised front-end. It’s a stark reminder of the persistent centralization risks across DeFi, where critical infrastructure still depends on components never designed to withstand the high-risk environment we’ve grown accustomed to onchain.

Speaking of 3rd party infrastructure risk, the entire internet including blockchain infrastructure were hit by Cloudflare outage. A simple database mistake on the part of some 3rd party company and suddenly all of our RPC servers and wallet front-ends were out. Between hacks and outages, may be it’s time to start moving to more resilient tech such as IPFS and Lava network (or similar) for hosting critical onchain infrastructure.

DeFi Security Summit was simply outstanding this year. From the venue to the quality of the talks, it is clear that the blockchain security community is thriving. I have added links to the published recordings in the Media section.

Be sure to check out The State of DeFi Security 2025 Edition, which goes beyond the now customary discussion of Top 10 DeFi attack vectors. This year I focused more on emerging threats, the kinds of potential billion dollar failure modes we have narrowly avoided one too many times. These are the areas we need to prioritize before they turn into something more than a dodged bullet.

One topic I had too little time to cover is competitive incident response. The idea comes from the massive success of competitive bug hunting, including bug bounties, competitions, and similar community driven efforts. Why can’t we adapt the same approach for incident response?

Some tasks are difficult to crowdsource, such as incident management, mitigations, communications, coordination with law enforcement, and other responsibilities traditionally handled by an incident commander. These should remain within a tight group of warroom participants. But there are other tasks that, when outsourced, could become a real asset to already stressed and overstretched incident responders.

Even before an incident unfolds there is always a race to detect, triage, and assign severity to potential problems. Teams must deal with constant noise and false positives from onchain monitoring systems, no matter what their marketing claims suggest. In practice many projects rely on third party companies like Peckshield to publicly or privately notify them with an exploit transaction hash. These companies are motivated to be the first to announce a hack because early visibility brings clients, a form of ambulance chasing. Instead of this dynamic, why not create incentives for a wider community to share confirmed incidents through an incident response bounty platform? Crowdsourcing challenges remain such as low quality submissions and high volume, but those could be addressed with the same reputation and triage processes used in mature bug bounty programs.

During an ongoing incident there is a race to identify the root cause. This is an extremely time sensitive task and can be the difference between successful containment or a complete disaster. Researchers already compete on social media to publish the first accurate root cause, so why not incentivize a bounty for the first correct analysis and allow the impacted team to focus on containment and managing the incident. Imagine a well motivated security community diving into an incident with the same energy we see during top security competitions. Every minute saved in analysis could prevent millions in stolen assets.

After an incident the onchain tracking effort often becomes a multi month or even multi year process that many projects eventually abandon. Yet as cases like the Oasis recovery show, it often pays to follow stolen funds and intervene as early as possible. More projects are beginning to offer bounties for help with tracking and asset recovery, so why not formalize this and unleash an army of onchain sleuths without waiting for a public plea.

Below are some of the bounties we could offer at different stages of an incident:

I have seen many pieces of competitive incident response emerge in the incidents I track week after week. The recent Balancer recovery is one example where well aligned incentives helped the defenders succeed. I believe we are now at the point where a new uniquely DeFi security discipline is forming. Imagine a world where we make it significantly harder for attackers not only to find bugs but also to successfully execute attacks and escape with stolen funds. Competitive incident response may be the path that gets us there.

Let’s dive into the news!

News

Crime

Policy

Phishing

Scams

Malware

Media

Contests

Research

Tools

Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.

Premium Content

Read more

  • ✇Blockchain Threat Intelligence
  • BlockThreat - Week 45, 2025 Peter Kacherginsky
    Greetings!More than $132M were stolen this week across seven incidents. Smart contract exploits, systemic stablecoin depegs and liquidity crunches, kidnappings, and much more happened last week. However, this edition focuses on the largest smart contract exploit this year - the Balancer hack.On November 3, 2025, Balancer experienced a highly coordinated attack across seven chains. A bad actor exploited a subtle rounding error to steal more than $128M. There are plenty of excellent writeups on th
     
  • ↗️

BlockThreat - Week 45, 2025

✇Blockchain Threat Intelligence
Por:Peter Kacherginsky
17 de Novembro de 2025, 03:34

Greetings!

More than $132M were stolen this week across seven incidents. Smart contract exploits, systemic stablecoin depegs and liquidity crunches, kidnappings, and much more happened last week. However, this edition focuses on the largest smart contract exploit this year - the Balancer hack.

On November 3, 2025, Balancer experienced a highly coordinated attack across seven chains. A bad actor exploited a subtle rounding error to steal more than $128M. There are plenty of excellent writeups on the exploit itself and you can find much more in the premium section below. Instead, I want to focus on something positive amid all of this destruction. The story of how the community, blockchain security companies, chain and protocol operators worked together with remarkable coordination to fight back against the attacker and in many instances win!

Here are just some of the incident response actions by Balancer and many affected chains and protocols:

  • Balancer paused affected pools, gauges, incentives across chains in 20min.

  • Stakewise executed emergency multisig to claw back $20.7M in osETH and osGNO tokens.

  • Monerium froze attacker’s 1.3M EURe.

  • Berachain quickly disabled affected pools while coordinating gradual shutdown of bridges and eventually halting the chain.

  • Sonic immediately froze* attacker’s addresses using a built-in safety mechanism.

  • Polygon chain started to sensor attackers’ addresses.

  • Gnosis chain partially halted canonical bridge.

*Simply freezing ERC20 transfers was not sufficient since attackers were able to bypass them with permit approvals.

Balancer responded within a twenty minute window by pausing pools. It slowed the attacker a bit, but they were still able to redeploy and continue a second wave almost an hour after the first attack. Protocols with centralized control over their tokens such as osETH, osGNO, and EURe were able to intervene and freeze specific stolen tokens. And that was when the nuclear option was activated. Multiple chains patched their validators to either censor the attacker’s transactions or halt their chain entirely. This level of control is normally frowned upon since the original Dao hack. However, these were exceptional measures for an exceptional scenario.

While the protocols were busy defending themselves, whitehats stepped in and began actively attacking the attacker:

  • Bitfinding bot frontran exploiter on Base chain to recover almost $1M.

  • A frontrunning bot operator on Berachain was able to intercept $12M worth of stolen funds and agreed to return funds.

  • Another frontrunning bot operator on Base returned $150K.

  • Yet another frontrunning bot operator on Arbitrum returned about $82K.

  • SEAL/Certora rescue operation recovered $4.1M across Ethereum, Optimism (Beets), Arbitrum chains a few days after the hack.

Just as the attacker was trying to execute their exploit on different chains, various financial and a dedicated defensive bots activated to immediately intercept $13M. In one case, a Bitfinding bot was able to deploy an exploit contract on Base minutes before the attacker. SEAL and Certora teamed up to execute a separate $4.1M rescue for the yet unexploited vulnerability in Balancer.

After the dust settled, almost $18M were intercepted or returned relative to the $128M stolen. A disastrous incident, yet it offers ideas for what worked or could work in the future.

  • Balancer had an emergency action script ready. If only it had triggered immediately after the first exploit on mainnet. There is an opportunity for projects to improve automation and perhaps err on the side of caution, pausing first and asking questions later.

  • Warrooms worked perfectly with chains, protocols, and security researchers all coordinating the best possible actions to slow the exploit and fight back. Protocols should regularly practice fictional warroom scenarios to build up their incident response muscle.

  • The real winners in this incident were the bots and Bitfinding’s bot in particular. Building dedicated defensive bots is truly the next frontier which is barely explored in our industry and yet already shows how effective it can be. The Berachain bot alone intercepted the majority of the attacker’s funds, an astounding $12.6M!

It is a dark day for the industry and Balancer in particular. But we will take time to patch ourselves up and most importantly learn valuable lessons from these incidents that will ultimately make the industry stronger and more resilient for the fights ahead.

Enjoy reading BlockThreat? Each edition takes more than ten hours of careful research and preparation every week. Consider sponsoring an upcoming issue or becoming a paid subscriber to unlock the premium section with detailed analyses of hacks, vulnerabilities, special reports, and a fully searchable newsletter archive.

In other news, a mistrial was declared in the case against Anton and James Peraire Bueno after the jury failed to reach a unanimous verdict and reported sleepless nights and crying. As you recall, the brothers used their validator to send a specially crafted block that exploited a vulnerability in a relay which tricked it into revealing normally hidden block transactions. They then used those transactions to sandwich other bots. The defense, and surprisingly Coin Center, chose to omit the small detail that a software flaw was exploited and instead framed the issue as nothing more than greedy MEV operators who should accept a bad trade. In other words, the classic Code is Law argument.

Unsurprisingly, all of this overwhelmed the jurors. Now we may end up with a legal precedent that could legitimize blockchain exploits. This is a case the entire industry should watch closely, since the wrong precedent could blur the line between fair trades and intentional exploitation in ways that would introduce significant long-term risks.

Let’s dive into the news!

News

Crime

Policy

Phishing

Scams

Malware

Media

Contests

Research

Tools

Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.

Premium Content

The content presented below is intended for personal, non-commercial use only and is protected by copyright laws. Any unauthorized distribution, reproduction, or inclusion of this content in public or commercial products, databases, publications, and other mediums is strictly prohibited without the express written permission of the author.

Hacks

Balancer, Beets Finance, Beethoven X

Date: November 03, 2025
Attack Vector: Rounding Error
Impact: $128,640,000
Chain: Ethereum, Arbitrum, Base, Polygon, Sonic, Optimism, Berachain

Indicators:

Read more

  • ✇Blockchain Threat Intelligence
  • BlockThreat - Week 41, 2025 Peter Kacherginsky
    Greetings!More than $22M were stolen this week across 9 incidents. The majority of losses came from a single Hyperliquid user compromise which cost them $21M. A devastating loss and a continued trend of user attacks across the ecosystem.A more concerning event was an ecosystem-wide meltdown sparked by tariff panic. Binance was among the platforms affected when a relatively small $60M USDe sell-off caused its price feed to misreport values, triggering a chain reaction of forced liquidations acros
     
  • ↗️

BlockThreat - Week 41, 2025

✇Blockchain Threat Intelligence
Por:Peter Kacherginsky
14 de Outubro de 2025, 14:42

Greetings!

More than $22M were stolen this week across 9 incidents. The majority of losses came from a single Hyperliquid user compromise which cost them $21M. A devastating loss and a continued trend of user attacks across the ecosystem.

A more concerning event was an ecosystem-wide meltdown sparked by tariff panic. Binance was among the platforms affected when a relatively small $60M USDe sell-off caused its price feed to misreport values, triggering a chain reaction of forced liquidations across collateral assets such as wBETH and BNSOL. The flawed oracle relied too heavily on Binance’s own orderbook without sufficient cross-exchange validation or time weighting, turning a localized price move into a $19B cascade of liquidations. Binance later compensated users for roughly $230M in losses, acknowledging that this was an internal systemic failure rather than user error.

We usually focus on security exploits, but market-wide incidents like these can be just as destructive when circuit breakers fail, prices are misreported, and traders are unfairly liquidated. It is a strong reminder that financial safeguards are just as critical as security controls, since their failure can just as easily destroy a protocol.

Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.

Let’s dive into the news!

News

Crime

Phishing

Malware

Media

Research

Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.

Premium Content

The content presented below is intended for personal, non-commercial use only and is protected by copyright laws. Any unauthorized distribution, reproduction, or inclusion of this content in public or commercial products, databases, publications, and other mediums is strictly prohibited without the express written permission of the author.

Hacks

TokenHolder

Date: October 07, 2025
Attack Vector: Insufficient Function Access Control
Impact: $26,000
Chain: BSC

Read more

  • ✇Blockchain Threat Intelligence
  • BlockThreat - Week 39, 2025 Peter Kacherginsky
    Greetings!This week felt like a bucket of cold water after last week’s relative calm. More than $51M was stolen across 10 incidents, many of them entirely preventable had projects paid closer attention to the well known attack vectors that threat actors continue to exploit time and time again.The most severe incident this week was the multisig hijacking of UXLINK, where attackers stole a massive $44.4M after taking control of the project’s contracts across multiple chains. The multisig had been
     
  • ↗️

BlockThreat - Week 39, 2025

✇Blockchain Threat Intelligence
Por:Peter Kacherginsky
29 de Setembro de 2025, 15:02

Greetings!

This week felt like a bucket of cold water after last week’s relative calm. More than $51M was stolen across 10 incidents, many of them entirely preventable had projects paid closer attention to the well known attack vectors that threat actors continue to exploit time and time again.

The most severe incident this week was the multisig hijacking of UXLINK, where attackers stole a massive $44.4M after taking control of the project’s contracts across multiple chains. The multisig had been configured with a 2/x threshold but lacked basic safeguards such as guardians, timelocks, or any kind of governance review process. On September 22, the attackers exploited this weak setup to reassign themselves as owners with a threshold of 1 and proceeded to pillage the protocol.

In an ironic twist, the attackers themselves later fell victim to an Inferno Drainer attack, losing 542M freshly stolen UXLINK. No honor among thieves, indeed.

Some critical lessons from the compromise:

  • Avoid weak thresholds. A 2/x setup is far too low. For anything beyond a few hundred thousand dollars, raise the threshold to at least 5/x.

  • Add timelocks. There’s no reason to allow immediate upgrades or parameter changes on multisigs. A multi-day timelock provides a critical buffer to detect and stop malicious activity.

  • Use guardians. Guardians serve as the last line of defense, even if all core developers are compromised and a malicious transaction is about to be executed.

Speaking of preventable hacks, Griffin AI fell victim to yet another LayerZero OFT hijack. If that sounds familiar, it’s because just two weeks ago Yala suffered the exact same fate where a temporary bridge deployment was configured with a malicious token.

Just because you aren’t paying attention to active attack vectors doesn’t mean attackers aren’t. They absolutely are and they will reuse the same techniques until projects finally close the door. So pretty please with a sugar on top, lock down your OFTs and don’t give attackers the keys to print money.

The premium portion of the newsletter contains detailed write ups and indicators for the remainder of 10 hacks this week including UXLINK, Griffin AI, Hyperdrive, Linea, Seedify, Ideal Protocol, dTrinity, Cool, and others.

Amid all these stories of hacks, it’s worth highlighting the unsung heroes and sponsors of this week’s edition - ChainPatrol. The good folks at ChainPatrol are doing simply amazing work protecting protocols’ brands, fighting the barrage of X phishing attacks, and quickly taking down scammers before they can do real damage.

Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.

An important update about the newsletter. I will be adjusting the paid subscription rates to better support the ongoing research and time that goes into every issue. Starting next month, the premium tier will be increased to $99 per month or $999 per year. I’m deeply grateful to the sponsors and paid subscribers who have made it possible to keep this newsletter running for so many years.

Let’s dive into the news!

News

Crime

Policy

Phishing

Scams

Malware

Media

Research

Tools

  • Introducing V12 by Zellic. An autonomous Solidity auditor designed to find critical bugs consistently and automatically.

Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.

Premium Content

The content presented below is intended for personal, non-commercial use only and is protected by copyright laws. Any unauthorized distribution, reproduction, or inclusion of this content in public or commercial products, databases, publications, and other mediums is strictly prohibited without the express written permission of the author.

Hacks

UXLINK

Date: September 22, 2025
Attack Vector: Multisig Hijacking
Impact: $44,400,000
Chain: Arbitrum, Ethereum, BSC

Indicators:

Ethereum: 0x6385eb73faE34bF90Ed4c3d4c8aFBC957FF4121C
Ethereum: 0xeff9cefdedb2a34b9e9e371bda0bf8db8b7eb9a7
Ethereum: 0x7277c705b5b1963b602cb4e3ab8e188d925bed00
Ethereum: 0xac77b44a5f3acc54e3844a609fffd64f182ef931
Ethereum: 0x64ab9377a2b3bbb61dd79f8997e7f8c1cc1a4de8
Ethereum: 0x5210bfdf0cfe6471322d597d16cf440f5ac59309
Ethereum: 0x714dda349ef43326791f923e8389a21d11378c67
Ethereum: 0xd7aa2bd9e9407f682a379bed346088b0849b6434
Ethereum: 0xdde8cb0c5b05784093c9027519ba3d1f0326d303
Ethereum: 0xf35dde49a1bbe7a8883a8f35d48fb33c20a69b39
Ethereum: 0xa3ce95ac672b62ed75afbe6f50285c28ef717a44
Ethereum: 0x0313706aabffef64fa7168c1f272f4fc15bec8b1
Ethereum: 0x7e1f34418e2da204a8eabdb29eddf7c09a494a3f
Ethereum: 0xaade027d63ea859a4993961a8a8cc5aae3f020f3
Ethereum: 0x2ef43c1d0c88c071d242b6c2d0430e1751607b87
Ethereum: 0x000086ed37d35c731553fe7e85e6535d320d0000

References:

https://x.com/lookonchain/status/1970330298568319083
https://x.com/CyversAlerts/status/1970167036002132425
https://x.com/exvulsec/status/1970187483498553732
https://x.com/UXLINKofficial/status/1970181382107476362
https://x.com/UXLINKofficial/status/1970318681931669825
https://x.com/UXLINKofficial/status/1970323705856495980
https://x.com/P3b7_/status/1970209897129353546
https://x.com/tayvano_/status/1971296769167515992
https://research.blockscope.co/uxlink-exploit-analysis
https://rekt.news/uxlink-rekt

Phished:

https://x.com/realScamSniffer/status/1970322013597450609
https://x.com/evilcos/status/1970332831890248173
https://arbiscan.io/tx/0xa70674ccc9caa17d6efaf3f6fcbd5dec40011744c18a1057f391a822f11986ee
https://protos.com/uxlink-goes-from-bad-to-worse-to-weird-after-hacker-loses-stolen-tokens/

Exploit:

https://arbiscan.io/tx/0x35edac40767f65d4d1382f0f55cda2f4db321313e16fe059079f0113f9cb5696
https://etherscan.io/tx/0x618e914f8c0afccaaf9be2d502730aa9c89f6cb0cc63aa6e700ef7e1d659b093

Read more

  • ✇Blockchain Threat Intelligence
  • BlockThreat - Week 38, 2025 Peter Kacherginsky
    Greetings!Over $3M was stolen across three incidents this week, a relative breather compared to last week’s ecosystem pillaging. Let’s take the moment to shore up our defenses, dive into a strong set of research articles, and highlight some positive news.A stage four cancer patient was drained of $32K after downloading a malicious Steam game. Fortunately, a group of security researchers noticed an absolutely appalling crime and got together to track down the malware operator, and enabled a promp
     
  • ↗️

BlockThreat - Week 38, 2025

✇Blockchain Threat Intelligence
Por:Peter Kacherginsky
24 de Setembro de 2025, 15:06

Greetings!

Over $3M was stolen across three incidents this week, a relative breather compared to last week’s ecosystem pillaging. Let’s take the moment to shore up our defenses, dive into a strong set of research articles, and highlight some positive news.

A stage four cancer patient was drained of $32K after downloading a malicious Steam game. Fortunately, a group of security researchers noticed an absolutely appalling crime and got together to track down the malware operator, and enabled a prompt arrest with likely deportation. Interestingly, Valentin Lopez, aka “The Pope” has been linked to the same cryptocurrency theft ring behind the $230M crypto heist last year. Every single person who played a role in uncovering the crime, coordinating the investigation, and bringing the operator to justice deserves enormous respect and admiration. You are true heroes!

The big lesson here is to separate your banking/crypto machine from a daily driver where you play games and interact on social media.

Amid all these stories of hacks, it’s worth highlighting the unsung heroes and sponsors of this week’s edition - ChainPatrol. The good folks at ChainPatrol are doing simply amazing work protecting protocols’ brands, fighting the barrage of X phishing attacks, and quickly taking down scammers before they can do real damage.

Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.

An important update about the newsletter. I will be adjusting the paid subscription rates to better support the ongoing research and time that goes into every issue. Starting next month, the premium tier will be increased to $99 per month or $999 per year. I’m deeply grateful to the sponsors and paid subscribers who have made it possible to keep this newsletter running for so many years.

In other news, happy 30th anniversary of the movie Hackers!

Let’s dive into the news!

News

Crime

Policy

Phishing

Malware

Media

Contests

Research

Tools

Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.

Premium Content

The content presented below is intended for personal, non-commercial use only and is protected by copyright laws. Any unauthorized distribution, reproduction, or inclusion of this content in public or commercial products, databases, publications, and other mediums is strictly prohibited without the express written permission of the author.

Hacks

LyraDepositWrapper

Date: September 16, 2025
Attack Vector: Function Parameter Validation
Impact: $1,000,000
Chain: Ethereum

Indicators:

Ethereum: 0x62005500af4cfb0077ac0090002f630055ba001d

References:

https://x.com/TenArmorAlert/status/1968138774551969874

Exploit:

https://etherscan.io/tx/0xc2bab117b6cb95e12c14eb57deb2cdd592370e2eb614e6d37502dea1480db0ba

Read more

  • ✇Blockchain Threat Intelligence
  • BlockThreat - Week 37, 2025 Peter Kacherginsky
    Greetings!This week was a bloodbath. More than $57.5M was stolen across nine incidents with breached custodial staking providers, hacked frontends, backdoored supply chains, phished of individuals, chain reorged, bridges exploited, and plenty of DeFi protocol drained. All elements of our ecosystem were hit in one of the worst weeks this year.But one exploit in particular could have caused losses in the billions were it not for an early discovery by the community. An NPM supply chain attack that
     
  • ↗️

BlockThreat - Week 37, 2025

✇Blockchain Threat Intelligence
Por:Peter Kacherginsky
22 de Setembro de 2025, 18:05

Greetings!

This week was a bloodbath. More than $57.5M was stolen across nine incidents with breached custodial staking providers, hacked frontends, backdoored supply chains, phished of individuals, chain reorged, bridges exploited, and plenty of DeFi protocol drained. All elements of our ecosystem were hit in one of the worst weeks this year.

But one exploit in particular could have caused losses in the billions were it not for an early discovery by the community. An NPM supply chain attack that compromised several extremely popular packages (billions of downloads per week) allowed attackers to inject a backdoor designed to drain users’ wallets. By sheer luck and plenty of onchain mockery the attack was detected early enough and community mobilized which left attackers with under $1k in profit from what could easily have been a Safe/Bybit-scale exploit. The biggest takeaway is that they will be back. So please implement proper package freezing and review into your dev pipelines.

Speaking of near catastrophes, the massive $41.5M Kiln/SwissBorg compromise is a stark reminder of the risks of trusting a third-party managed treasury or staking provider. In general, it’s sensible to let professional teams manage assets; however, it does not absolve one of prudent monitoring and in depth discussions about what security controls can be added to minimize risk. Since the incident, Kiln initiated an exit of all of its Ethereum validators.

Another interesting exploit this week was the Yala LayerZero OFT bridge hijack, which took advantage of a temporary deployment that used a known “local key.” Attackers raced to configure a recently deployed bridge on Solana to a malicious OFT contract on Polygon and started minting legitimate $YU tokens.

The last but not least, mass bridge compromises are back with the $3M Shibarium Bridge hack. One positive outcome was that a large portion of the attackers’ funds were blacklisted or locked out. However, how do you compromise 10(!) of 12 signer keys unless they’re stored and managed in the same place defeating the whole point?

Amid all these stories of hacks, it’s worth highlighting the unsung heroes and sponsors of this week’s edition - ChainPatrol. The good folks at ChainPatrol are doing simply amazing work protecting protocols’ brands, fighting the barrage of X phishing attacks, and quickly taking down scammers before they can do real damage.

Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.

An important update about the newsletter. I will be adjusting the paid subscription rates to better support the ongoing research and time that goes into every issue. Starting next month, the premium tier will be increased to $99 per month or $999 per year. I’m deeply grateful to the sponsors and paid subscribers who have made it possible to keep this newsletter running for so many years.

Let’s dive into the news!

News

Crime

Policy

Phishing

Scams

Malware

Media

Research

Tools

Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.

Premium Content

The content presented below is intended for personal, non-commercial use only and is protected by copyright laws. Any unauthorized distribution, reproduction, or inclusion of this content in public or commercial products, databases, publications, and other mediums is strictly prohibited without the express written permission of the author.

Hacks

Kiln, SwissBorg

Date: September 08, 2025
Attack Vector: API Key Theft
Impact: $41,500,000
Chain: Solana

Indicators:

Solana: tyfwg3hvvxwms2kxek8cdujcsxeyks65eeqpd9p4mk1

References:

https://x.com/SolanaFloor/status/1965116689907089782
https://x.com/swissborg/status/1965123506477359471
https://x.com/CertiKAlert/status/1965122507687755803
https://x.com/shoucccc/status/1965126091334713838
https://swissborg.com/blog/joint-statement-kiln-x-swissborg-regarding-sol-incident
https://www.kiln.fi/post/kiln-responds-to-infrastructure-issue-with-validator-exit-funds-remain-protected
https://protos.com/swissborg-ceo-blames-41m-loss-on-staking-partner-kiln/
https://www.theblock.co/post/370141/kiln-exits-ethereum-validators
https://rekt.news/swissborg-rekt

Exploit:

https://solscan.io/tx/5DCPDEVrnVdM4jHgxYGtuuzvSubg15sSpkBCxexfuApRAfXEmNfokiTyj6bxE52QNGVbPnwm9L3YzcEoMHHEpLV

Read more

  • ✇Blockchain Threat Intelligence
  • BlockThreat - Week 32, 2025 Peter Kacherginsky
    Greetings!Tornado Cash remains at the center of regulatory battles, with developers and researchers facing mounting legal risks across borders. Roman Storm was convicted of unlicensed money transmission, a charge in direct conflict with recent federal precedent affirming that noncustodial DeFi developers should not be treated as money transmitters. At the same time, Turkey nearly repeated the Tigran Gambaryan playbook by detaining Federico Carrone, an incident defused only after swift internatio
     
  • ↗️

BlockThreat - Week 32, 2025

✇Blockchain Threat Intelligence
Por:Peter Kacherginsky
28 de Agosto de 2025, 18:12

Greetings!

Tornado Cash remains at the center of regulatory battles, with developers and researchers facing mounting legal risks across borders. Roman Storm was convicted of unlicensed money transmission, a charge in direct conflict with recent federal precedent affirming that noncustodial DeFi developers should not be treated as money transmitters. At the same time, Turkey nearly repeated the Tigran Gambaryan playbook by detaining Federico Carrone, an incident defused only after swift international pressure. Together, these cases highlight the escalating legal dangers anyone working in the crypto privacy space.

Google just released a detailed report on the tactics used by a DPRK threat actor to breach the backend infrastructure of cryptocurrency projects, including the Safe Wallet compromise. Some high level TTPs:

  • Initial vector is social engineering to execute malicious docker container.

  • Social engineering occurred over Telegram and LinkedIn (job offer).

  • Installed credential stealing malware.

  • Bypassed cloud MFA through admin access and stolen cookies

  • Injected malicious JS to subvert key signing by the quorum.

Key technical controls that failed in the two case studies:

  • Failed endpoint detection.

  • Unsecure cloud credentials.

  • Unsecure processes for code review and CI/CD pipelines.

It’s time to train up personnel to recognize the latest social engineering tactics and harden infrastructure before these gaps are exploited.

Speaking of user security be sure to check out this week’s sponsor Coinspect.

Coinspect’s Wallet Security Ranking is an objective, transparent, and regularly updated evaluation of leading cryptocurrency wallets. It focuses on critical security features like anti-phishing defenses, transaction clarity, and protection against blind signing, helping users choose wallets that prioritize their safety.

Link: https://www.coinspect.com/wallets/

Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.

Let’s dive into the news!

Contests

News

Crime

Policy

Phishing

Scams

Malware

Media

Research

Tools

Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.

Premium Content

Read more

  • ✇Blockchain Threat Intelligence
  • BlockThreat - Week 28, 2025 Peter Kacherginsky
    Greetings!More than $46M were stolen this week across seven incidents. We will focus on a sophisticated mass compromise followed by a whitehat recovery operation took place this week. For months, an unknown actor had been running scanners across multiple EVM chains, looking for new ERC1967Proxy contract deployments. If a proxy was deployed and left uninitialized, the attacker would quickly step in and initialize it first with a backdoor. The vulnerability itself was relatively simple, but the ex
     
  • ↗️

BlockThreat - Week 28, 2025

✇Blockchain Threat Intelligence
Por:Peter Kacherginsky
16 de Julho de 2025, 02:09

Greetings!

More than $46M were stolen this week across seven incidents. We will focus on a sophisticated mass compromise followed by a whitehat recovery operation took place this week. For months, an unknown actor had been running scanners across multiple EVM chains, looking for new ERC1967Proxy contract deployments. If a proxy was deployed and left uninitialized, the attacker would quickly step in and initialize it first with a backdoor. The vulnerability itself was relatively simple, but the execution showed an impressive level of stealth and precision.

Let’s look at a case study involving one protocol affected by this campaign. On July 10, 2025, Kinto Protocol lost $1.55 million after the attacker upgraded the proxy to a backdoored implementation and minted K tokens. The exploit timeline is below:

2025-03-19 20:24:40 - Kinto devs deploy the contract without initializing it(!) Implementation is set to 0x1a16bc [0x35d5fc]
2025-03-19 20:24:42 - Attacker initializes the contract with their admin account 0x2fc427. Implementation is set to the backdoor at 0x7382bc. All transactions will now pass through the backdoor to the decoy slot. [0xd17330]
2025-03-19 20:28:11 - Developers finish initialization with token name and their own admin account values. [0x1443ab]
2025-03-25 01:20:51 - Developers perform an upgrade. Implementation is now set to 0x7382bc. [0x18d7a5]
2025-07-10 08:33:11 - Exploit transaction to upgrade the decoy implementation to 0x3bcdf5 and backdoor implementation to 0xe343c3 while also updating storage slots for a few addresses to mint tokens [0x579f0d].
2025-07-10 08:33:32 - First illicit transfer to 0xde86b4 [0x07f516].
2025-07-10 08:33:40 - Starting to drain the Morpho vault [0x4635f0].
2025-07-15 12:12:16 - Attackers upgrade the contract with new implementation 0x25d1f4 to include ransom logic [0x178dcd].
2025-07-15 12:18:22 - Attackers sent a ransom offer to recover contract implementation address by sending 5 ETH. That’s a new one! [0x552fd2]

The backdoor was cleverly designed to survive reinitialization and multiple upgrades, lying dormant until the day the attackers finally decided to pull the trigger. I’ll leave the deep-dive analysis of the compromise to the reader using the resources above. Instead, I want to focus on what makes this exploit both uniquely sophisticated and particularly malicious.

Some of the stealth techniques used:

  • The attackers carefully reset all initialized parameters and storage in the victim contracts, while preserving pointers to the original implementation contracts to make everything appear untouched.

  • As noted by pcaversaccio, the attacker exploited a zero-day in the Etherscan family of blockchain explorers, spoofing the implementation by layering an OpenZeppelin proxy on top of an EIP-1967 proxy and the backdoor itself. Three proxies stacked in one.

  • Rather than triggering a noisy mint() function, the attacker wrote tokens directly into storage slots tied to fake addresses.

  • Vault draining was done rapidly but in small increments

  • The operation was active for months, likely waiting for the juiciest target or perhaps preparing to drain all victims at once. All the infrastructure needed for extraction was in place well in advance.

We are dealing with a highly advanced threat actor with deep knowledge of proxy patterns, EVM storage mechanics, and the ability to drop zero-days in critical on-chain infrastructure. According to deebeez, thousands of smart contracts were compromised with over $10M at risk.

That brings us to the second half of this story, one that reminds me why this community is so special and why I keep coming back week after week to research and document its history. deebeez and the team at VennBuild discovered the vulnerability before widespread damage occurred and quickly partnered with pcaversaccio, Dedaub, and the SEAL 911 team to launch a 36-hour war room, reaching out to vulnerable projects and recovering most of the funds at risk. A few were unfortunately missed, but the outcome could have been far worse. Hurray!

Some lessons learned from this incident:

  • I’m noticing an alarming rise in ecosystem-wide incidents. We got lucky this time, but it feels like a far more devastating event could be just around the corner. Stay vigilant and pay attention to emerging attack vectors.

  • Always use atomic create-and-initialize transactions when deploying proxies. Doing so would have prevented this mass exploitation from happening in the first place.

  • Do not rely solely on public infrastructure like blockchain explorers. Always verify state independently by querying the blockchain directly using automated tests or tools such as cast.

  • Similarly understand the limits of blockchain detection and alerting. Simple transaction or log monitoring is no longer sufficient. For example, attackers easily bypassed monitors for admin functions like minting by modifying storage slots directly. Instead focus on invariant detection (e.g. pool value dropped, total supply increase beyond expected, etc.)

  • Attackers are exploring new ways to profit by now building ransom logic into compromised contracts. I’ve never seen anything like this before!

  • Despite some of the notes, this threat actor’s TTPs really don’t look like DPRK.

Speaking of good security advice, check out this week’s sponsor and get your protocols audited before disaster strikes.

Oak Security has operated in Web3 Security since 2017, providing security services throughout a project's lifecycle. This includes audits, penetration testing, operational security training, and advisory services. Our signature blinded process emphasises redundancy: Every line of code is reviewed by multiple auditors with a multi-disciplinary background in parallel.

Link: https://www.oaksecurity.io/

In other news attackers returned combined almost $40M in stolen assets from GMX and Texture hacks this week after taking the usual “bounty”. We also learned about a whitehat recovery and a responsible disclosure of a reentrancy vulnerability in Cove from about a month ago. No ransom or endless negotiations about the “bounty” size, just a bug bounty program working as it should.

Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerabilities, indicators, special reports, and searchable newsletter archives.

Let’s dive into the news!

News

Crime

Policy

Phishing

Scams

Malware

Media

Research

Contests

Tools

  • Bastet - a comprehensive dataset of common smart contract vulnerabilities in DeFi along with an AI-driven automated detection process to enhance vulnerability detection accuracy and optimize security lifecycle management.

  • HyperIndex - fast, developer-friendly multichain indexer, optimized for both local development and reliable hosted deployment. It empowers developers to effortlessly build robust backends for blockchain applications.Developed by Envio.

  • Investigate your dependencies with Deptective by Trail of Bits.

  • Picus is an implementation of the QED2 tool, which checks the uniqueness property (under-constrained signals) of ZKP circuits.

Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerabilities, indicators, special reports, and searchable newsletter archives.

Premium Content

Read more

  • ✇Blockchain Threat Intelligence
  • BlockThreat - Week 27, 2025 Peter Kacherginsky
    Greetings!Over $5.5 million was stolen this week across three protocols, using familiar attack vectors like price oracle manipulation and private key theft. But it was the controversy surrounding the massive 80,000 BTC transfer that truly stole the spotlight.A mysterious on-chain campaign was spotted targeting dormant 2011-era Bitcoin wallets. It uses OP_RETURN transactions to send legal notices along with links to an online form that collects sensitive wallet data. One of the recipients moved 8
     
  • ↗️

BlockThreat - Week 27, 2025

✇Blockchain Threat Intelligence
Por:Peter Kacherginsky
14 de Julho de 2025, 03:00

Greetings!

Over $5.5 million was stolen this week across three protocols, using familiar attack vectors like price oracle manipulation and private key theft. But it was the controversy surrounding the massive 80,000 BTC transfer that truly stole the spotlight.

A mysterious on-chain campaign was spotted targeting dormant 2011-era Bitcoin wallets. It uses OP_RETURN transactions to send legal notices along with links to an online form that collects sensitive wallet data. One of the recipients moved 80,000 BTC ($8.6B) which triggered a wave of speculative frenzy. Theories emerged, ranging from a hack or ECDSA nonce reuse exploit to a coordinated legal seizure. A questionable legal entity calling itself Salomon Brothers shared a statement that their client “seeks to mitigate global security issues presented by the abandoned wallets.” Despite all the noise, there is still no concrete evidence of what would have been the largest hack in Bitcoin’s history.

Oak Security has operated in Web3 Security since 2017, providing security services throughout a project's lifecycle. This includes audits, penetration testing, operational security training, and advisory services. Our signature blinded process emphasises redundancy: Every line of code is reviewed by multiple auditors with a multi-disciplinary background in parallel.

Link: https://www.oaksecurity.io/

Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.

Let’s dive into the news!

News

Crime

Phishing

Scams

Malware

Media

Research

Tools

  • LISA - An LLM-powered Intelligent Security Analyzer.

  • Quimera - feedback-driven exploit generation for Ethereum smart contracts using LLMs.

  • AI Auditor Primers by Dacian. This repository contains open-source Primer documents to be ingested by AI prior to conducting smart contract audits.

  • Audit Contests Rewards Calculator by valuevalk.

  • deployment_validation - Simplified Deployment Validation of EVM-Based Smart Contracts by ChainSecurity.

Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.

Premium Content

Read more

  • ✇Blockchain Threat Intelligence
  • BlockThreat - Week 24, 2025 Peter Kacherginsky
    Greetings!A rare week with no major incidents which means we finally get a chance to catch up on long-queued articles, tools, and competitions. My favorites this week include a few solid supply chain security guides, a personal security guide from SEAL, and of course an awesome use of AI to waste scammers’ time. And don’t forget to brush up on the latest phishing incidents to keep those attack vectors fresh.Before jumping into all of the excellent research papers below be sure check out the exce
     
  • ↗️

BlockThreat - Week 24, 2025

✇Blockchain Threat Intelligence
Por:Peter Kacherginsky
19 de Junho de 2025, 17:42

Greetings!

A rare week with no major incidents which means we finally get a chance to catch up on long-queued articles, tools, and competitions. My favorites this week include a few solid supply chain security guides, a personal security guide from SEAL, and of course an awesome use of AI to waste scammers’ time. And don’t forget to brush up on the latest phishing incidents to keep those attack vectors fresh.

Before jumping into all of the excellent research papers below be sure check out the excellent work by our sponsor, Coinspect.

Coinspect’s Wallet Security Ranking is an objective, transparent, and regularly updated evaluation of leading cryptocurrency wallets. It focuses on critical security features like anti-phishing defenses, transaction clarity, and protection against blind signing, helping users choose wallets that prioritize their safety.

Link: https://www.coinspect.com/wallets/

Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.

Let’s dive into the news!

News

Crime

Phishing

Scams

  • SIPSentinel - AI-powered scam detection and response system that automatically deploys conversational agents to waste scammers' time. You can find a sample scammer call here and a sample panel here. Rad!

Malware

Media

Research

Tools

Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.

Premium Content

Read more

  • ✇Blockchain Threat Intelligence
  • BlockThreat - Week 23, 2025 Peter Kacherginsky
    Greetings!Over $17M was stolen this week across four separate incidents, with the majority of losses stemming from the compromise of Alex Lab on the Stacks blockchain. This exploit once again highlights how chain- or contract-specific quirks can quietly erode trust assumptions. In Alex Lab’s case, the protocol allowed users to create their own markets—but due to insufficient verification logic, attackers were able to rapidly drain funds. It’s a particularly unfortunate event, as Alex Lab also su
     
  • ↗️

BlockThreat - Week 23, 2025

✇Blockchain Threat Intelligence
Por:Peter Kacherginsky
9 de Junho de 2025, 18:33

Greetings!

Over $17M was stolen this week across four separate incidents, with the majority of losses stemming from the compromise of Alex Lab on the Stacks blockchain. This exploit once again highlights how chain- or contract-specific quirks can quietly erode trust assumptions. In Alex Lab’s case, the protocol allowed users to create their own markets—but due to insufficient verification logic, attackers were able to rapidly drain funds. It’s a particularly unfortunate event, as Alex Lab also suffered a $4.3M private key theft by Lazarus just over a year ago.

One of blockchain’s defining features is its radical transparency: hacks are often immediately visible. Detailed technical post-mortems appear within hours before the affected team has even responded. This level of openness is one of the ecosystem’s core strengths.

But what happens when theft occurs beyond the reach of on-chain sleuths or on chains few are watching? This week offered two stark reminders. Bitopro, a centralized exchange, disclosed an $11.5M breach that occurred a month ago after suspicious mixing activity was flagged by ZachXBT. Meanwhile, Marinade Finance suffered a $5M market manipulation scheme that went undetected for months.

How many other attacks remain unseen—either due to the opacity of centralized entities or simply because no one is paying attention? Most blockchain monitoring firms ignore incidents under a few hundred thousand dollars. Yet time and again, we see mass campaigns siphoning small amounts over time, flying just below the radar.

Speaking of transparency, check out the excellent work by our sponsor, Coinspect. From in-depth wallet security reviews to uncovering the latest wallet-draining techniques, the team at Coinspect is focused on protecting one of the most important and vulnerable parts of the ecosystem: the users.

Coinspect’s Wallet Security Ranking is an objective, transparent, and regularly updated evaluation of leading cryptocurrency wallets. It focuses on critical security features like anti-phishing defenses, transaction clarity, and protection against blind signing, helping users choose wallets that prioritize their safety.

Link: https://www.coinspect.com/wallets/

Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.

Let’s dive into the news!

News

Crime

Policy

Phishing

Malware

Media

Contests

Research

Tools

  • eBurger - a static analysis tool that provides a way to quickly query and analyze solidity smart contracts by forefy. A great tool and action to include in your CI pipeline.

  • Radar - A static analysis tool for anchor rust programs by Auditware. Another great tool for the Solana/Rust CI pipeline.

Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.

Premium Content

Read more

  • ✇Blockchain Threat Intelligence
  • BlockThreat - Week 22, 2025 Peter Kacherginsky
    Greetings!More than $12M was stolen this week across six incidents. The largest loss came from the Cork Protocol exploit, which featured a kill chain involving at least three well-known vulnerability classes including insufficient function access control and reward manipulation. The remaining incidents followed a similar pattern of more access control failures and price oracle manipulation.What’s becoming increasingly clear is that the same attack vectors keep resurfacing. These are not novel bu
     
  • ↗️

BlockThreat - Week 22, 2025

✇Blockchain Threat Intelligence
Por:Peter Kacherginsky
5 de Junho de 2025, 03:35

Greetings!

More than $12M was stolen this week across six incidents. The largest loss came from the Cork Protocol exploit, which featured a kill chain involving at least three well-known vulnerability classes including insufficient function access control and reward manipulation. The remaining incidents followed a similar pattern of more access control failures and price oracle manipulation.

What’s becoming increasingly clear is that the same attack vectors keep resurfacing. These are not novel bugs. We should know them by now! So this week, I’m stepping back to highlight the Top 10 recurring attack vectors. Understanding these trends is essential to finally break the cycle of repeating the same mistakes.

Stolen private keys continue to top the charts. Addressing these operational security failures requires more than traditional code audits. Unfortunately, a holistic approach—one that includes analysis of both on-chain and off-chain components like endpoint security, cloud infrastructure, and key management—is still far from standard practice.

More concerning, however, is the rise of a deadly triad: Reward Manipulation, Price Oracle Manipulation, and Insufficient Function Access Controls. These three attack classes show up in the majority of high-impact incidents including this week’s $12M Cork Protocol exploit.

Notably, Reward Manipulation has clawed its way back into the #3 spot after a relative decline over the past year. This vector targets flawed incentive mechanisms, allowing attackers to extract protocol rewards such as fees, yield, or emissions without providing corresponding economic value or taking on real risk.

To help catch this vulnerability class consider adopting the following audit/code review practices and study respective case studies.

As in previous years, there’s always one standout hack that revives an attack vector we thought was mostly behind us. In 2025, it was Cetus on Sui that forced the industry to revisit the classic integer overflow—a bug class we haven't seen dominate in quite some time.

The rest of the Top 10 attack vectors remained largely consistent with prior years, with one notable exception: the appearance of the supply chain attack. This Web2-style operational security vector highlights the growing risks in our build and deployment pipelines. So please lock down your repos, audit your CI/CD workflows, and clean up your dependencies before attackers beat you to it.

Blockchain security demands staying constantly vigilant to emerging threats while prioritizing the most critical risks to address. I hope you will use the list above to build a safer and more resilient ecosystem.

Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.

Let’s dive into the news!

News

Crime

Phishing

Scams

Malware

Media

Contests

  • RethMatch - An onchain tournament for bots, inspired by Pac-Man and Agar.io.

Research

Tools

  • Sui Trace - Visualize token transfer patterns and track blockchain transactions with our advanced network graph.

Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.

Premium Content

Read more

  • ✇Blockchain Threat Intelligence
  • BlockThreat - Week 20, 2025 Peter Kacherginsky
    Greetings!More than $2.6M was stolen from DeFi projects across eight incidents this week. However, we’re focusing on a much more troubling case: a malicious insider breach at Coinbase—a sobering case study for anyone in security. But first a quick word from this week’s sponsor - Recon.Get a Recon Invariant Audit: a powerful testing suite plus world-class auditors to catch what others miss. Open-source, no vendor lock-in, and proven to find severe bugs. Before spending millions on audits, invest
     
  • ↗️

BlockThreat - Week 20, 2025

✇Blockchain Threat Intelligence
Por:Peter Kacherginsky
21 de Maio de 2025, 02:57

Greetings!

More than $2.6M was stolen from DeFi projects across eight incidents this week. However, we’re focusing on a much more troubling case: a malicious insider breach at Coinbase—a sobering case study for anyone in security. But first a quick word from this week’s sponsor - Recon.

Get a Recon Invariant Audit: a powerful testing suite plus world-class auditors to catch what others miss. Open-source, no vendor lock-in, and proven to find severe bugs. Before spending millions on audits, invest in tests that evolve over time that catch bugs and keep them from coming back. Use promo code BLOCKTHREAT for a 5k discount on your first engagement.

See our portfolio: https://getrecon.xyz/blockthreat

In a May 14 SEC 8-K filing, Coinbase disclosed it had received a $20M ransom demand from a threat actor who had obtained a significant amount of sensitive customer data and internal documentation. The company traced the breach to customer support agents based in India who were bribed by these actors.

The leaked data includes customer names, the last four digits of Social Security numbers, masked bank account numbers, government ID images, account balances and transactions, and internal documentation. According to Brian Armstrong, Coinbase began notifying affected customers as early as April 11, 2025. Unfortunately, the stolen data has already been used in targeted social engineering attacks.

The exact financial impact to users hasn’t been disclosed, but Coinbase announced plans to spend up to $400M on customer reimbursements and incident remediation—pointing to a likely impact in the hundreds of millions.

In DeFi, $100M+ hacks are surfaced almost instantly. Even attacks over $100K often draw rapid, public investigations by the community. Not so in CeFi. According to ZachXBT, scammers were using highly detailed personal info to target Coinbase customers as far back as December 2024. Reports of widespread customer theft steadily increased, culminating in the ransom email that finally triggered public disclosure. If these attacks had been going on for months, why did it take a ransom demand to bring them to light? How many customers would have been saved with an earlier guidance on the incident and customer support scams?

The ransom email reportedly arrived right after the S&P 500 listing announcement—a moment when companies have a strong incentive to avoid negative news. It’s worth noting that Uber’s CISO was recently criminally charged and sentenced for concealing a breach. Instead of risking the same, Coinbase went public—then offered a $20M bounty for information leading to the attackers’ arrest, along with a video statement from Brian Armstrong.

Was this a publicity move? Maybe. The DoJ is already investigating, and it’s likely they’ll be the ones to catch the perpetrators. Still, public contributions could help.

As ZachXBT noted, the most likely culprits include scammer groups in India and individuals linked to APT groups like The Com and Scattered Spider (aka 0ktapus). Recent arrests show these actors are often US or EU-based, in their late teens or early 20s, and specialize in social engineering. I personally received one of these “Coinbase security” calls. The flawless American accent and young-sounding voice were striking.

Expect to see more names and arrests in the Crimes section of this newsletter. Until then, stay extra vigilant—both online and offline.

Key takeaways from the incident

  • Security incidents happen. Disclosing them—and your response—is a sign of maturity that helps the broader ecosystem.

  • Outsourcing support is fine, but only with strict access controls and monitoring.

  • Assume a malicious insider already works for you. What controls do you have to detect and stop them? Can your project survive a single bad actor?

  • Train employees regularly on phishing and social engineering threats.

Oh and be sure to check this week’s sponsor to brush up on your opsec practices:

Is your team safe from sophisticated threat actors?

More than 98% of stolen funds in the Web3 ecosystem are hacked without breaking code but by breaking people. Opsek will train your team to become paranoid, and harden your complete operational security stack.

You are already a target, don't get rekt.

Link: https://opsek.io/

Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.

Let’s dive into the news!

News

Crime

Policy

Phishing

Scams

Malware

Media

Contests

Research

Tools

  • DNS Monitor Bot by wavey0x. A simple to configure, pre-built Cloudflare Worker that monitors DNS records for any list of user-specified domains and sends notifications via Telegram when changes are detected.

  • Alloy 1.0 - Rust toolkit for the EVM.

Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.

Premium Content

Read more

  • ✇Blockchain Threat Intelligence
  • BlockThreat - Week 15, 2025 Peter Kacherginsky
    Greetings!Over $3M stolen this week across six incidents. The bulk of the losses came from the Morpho hack, which lost $2.6M due to an exploit introduced during a front-end upgrade. A misconfiguration in how users were prompted to sign transactions led one user to unknowingly sign an unlimited permit to a multicall contract—allowing anyone to drain it. Fortunately, a known whitehat MEV bot frontran the attacker.This incident is a stark reminder: even in the world of smart contract exploits, we o
     
  • ↗️

BlockThreat - Week 15, 2025

✇Blockchain Threat Intelligence
Por:Peter Kacherginsky
14 de Abril de 2025, 10:03

Greetings!

Over $3M stolen this week across six incidents. The bulk of the losses came from the Morpho hack, which lost $2.6M due to an exploit introduced during a front-end upgrade. A misconfiguration in how users were prompted to sign transactions led one user to unknowingly sign an unlimited permit to a multicall contract—allowing anyone to drain it. Fortunately, a known whitehat MEV bot frontran the attacker.

This incident is a stark reminder: even in the world of smart contract exploits, we often overlook trust assumptions in the underlying infrastructure—including the websites that generate complex transactions for users to sign.

The remaining exploits targeted a range of systems—from vulnerable MEV bots to a nine-year-old contract left exposed and carelessly exploitable just last week. Details on each hack are available in the premium section.

One under-the-radar vulnerability report worth highlighting: Supremacy intern Yi discovered a critical flaw in Ping.pub, the Cosmos blockchain explorer. Yi found a way to compromise the hosting server including skeleton SSH keys. If we want to avoid another Wallet/Bybit hack, it’s crucial we give Web2 infra the attention they deserve.

Also notable this week: a spike in phishing campaigns targeting crypto developers via malicious npm, Python, and VS Code packages, as well as code repositories like SourceForge. Be vigilant and lock down your dependencies.

Before we dive into the news, a special thank you to this week’s sponsor—Recon.

Get a Recon Invariant Audit: a powerful testing suite plus world-class auditors to catch what others miss. Open-source, no vendor lock-in, and proven to find severe bugs. Before spending millions on audits, invest in tests that evolve over time that catch bugs and keep them from coming back.

See our portfolio: https://getrecon.xyz/#services.

Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.

Let’s dive into the news!

News

Crime

Policy

Phishing

Scams

Malware

Media

Research

Tools

Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.

Premium Content

Read more

  • ✇Blockchain Threat Intelligence
  • BlockThreat - Week 14, 2025 Peter Kacherginsky
    Greetings!Just three exploits this week, totaling around $70M in losses—most of it from a single victim of private key theft, UPCX. Interestingly, the project reported that all stolen funds were back under their control just a few days later.We’re wrapping up a brutal Q1, marked by record-breaking hacks, sophisticated North Korean campaigns targeting the entire ecosystem, hundreds of millions lost to phishing, and plenty of other nastiness. Hang in there, folks. The fight is worth it.Before we d
     
  • ↗️

BlockThreat - Week 14, 2025

✇Blockchain Threat Intelligence
Por:Peter Kacherginsky
7 de Abril de 2025, 10:02

Greetings!

Just three exploits this week, totaling around $70M in losses—most of it from a single victim of private key theft, UPCX. Interestingly, the project reported that all stolen funds were back under their control just a few days later.

We’re wrapping up a brutal Q1, marked by record-breaking hacks, sophisticated North Korean campaigns targeting the entire ecosystem, hundreds of millions lost to phishing, and plenty of other nastiness. Hang in there, folks. The fight is worth it.

Before we dive into the news, a special thank you to this week’s sponsor—Recon.

Get a Recon Invariant Audit: a powerful testing suite plus world-class auditors to catch what others miss. Open-source, no vendor lock-in, and proven to find severe bugs. Before spending millions on audits, invest in tests that evolve over time that catch bugs and keep them from coming back.

See our portfolio: https://getrecon.xyz/#services.

Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.

Let’s dive into the news!

News

Crime

Policy

Phishing

Scams

Malware

Contests

Media

Research

Tools

Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.

Premium Content

Read more

  • ✇Blockchain Threat Intelligence
  • BlockThreat - Week 13, 2025 Peter Kacherginsky
    Greetings!A tough week in blockchain security. More than $20M was stolen across five protocols this week. We’ll dive into a few case studies shortly, but first, we need to cover something even more concerning—the latest DPRK campaign.DPRK’s Long Game: A Security Researcher Turned Threat ActorIt’s time to update your project’s threat models. Last week, it was revealed that a fairly well-known blockchain security researcher, Nick L Franklin, was actually a North Korean threat actor. His goal? Not
     
  • ↗️

BlockThreat - Week 13, 2025

✇Blockchain Threat Intelligence
Por:Peter Kacherginsky
2 de Abril de 2025, 16:35

Greetings!

A tough week in blockchain security. More than $20M was stolen across five protocols this week. We’ll dive into a few case studies shortly, but first, we need to cover something even more concerning—the latest DPRK campaign.

DPRK’s Long Game: A Security Researcher Turned Threat Actor

It’s time to update your project’s threat models. Last week, it was revealed that a fairly well-known blockchain security researcher, Nick L Franklin, was actually a North Korean threat actor. His goal? Not just to infiltrate projects but also to compromise security researchers themselves.

For over a year, “Nick” built trust within the community—regularly posting analyses of recent compromises and engaging with researchers. Only recently did he begin exploiting these connections by sharing malware-laced vulnerability reports. Here are some key takeaways from this latest threat:

  • DPRK actors are playing an even longer game. We already knew they were patient, but this level of dedication is unprecedented. Be cautious—trust is their weapon.

  • DPRK has smart contract exploitation capabilities but uses them selectively—such as in the original Radiant Capital compromise last January. The next smart contract exploit could be DPRK-linked.

  • OpenZeppelin, Hyperliquid, 1inch, and others appear to be on DPRK’s target list. “Nick” inquired about them, confirming previous warnings from Tay. A potential mass supply chain attack through OpenZeppelin is particularly concerning, lock down those dependencies.

  • Security researchers including SEAL team are now targets. Just as DPRK targets traditional infosec pros, they’re now actively targeting blockchain security researchers—likely to gain early insights into unpatched vulnerabilities. Our community is collaborative, but be wary of unsolicited PoC reviews or vulnerability reports.

If you ever feel bad about being deceived by these actors, know that even experienced researchers—including myself—have been caught off guard. Stay vigilant!

Exploits in DeFi: New Attack Techniques Emerging

Several high-profile exploits shook DeFi this week. Here are some of the most notable:

  • SIR Trading ($355K loss): This hack leveraged the newly introduced EVM transient storage feature. The attacker exploited a collision between the pool address and transfer amount, using a vanity address to overwrite the amount. A clever and novel technique.

  • Abracadabra ($13M loss): Hit by a complex borrowing/liquidation exploit resembling past Euler and KyberSwap compromises. Stolen funds remain scattered across multiple addresses and haven’t been laundered yet. Abracadabra is offering a massive 25% bounty—let’s see if the attacker takes it.

Detailed breakdowns of these and other exploits—Hyperliquid/Jelly, Alkimiya, and more—are available in the premium section.

Before we dive into the news, a special thank you to this week’s sponsor—Recon. You’re likely already familiar with their groundbreaking research on invariant testing by Nican0r and the team, who in fact is featured in the tools section below.

Get a Recon Invariant Audit: a powerful testing suite plus world-class auditors to catch what others miss. Open-source, no vendor lock-in, and proven to find severe bugs. Before spending millions on audits, invest in tests that evolve over time that catch bugs and keep them from coming back.

See our portfolio: https://getrecon.xyz/#services.

Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.

Let’s dive into the news!

News

Crime

Phishing

Policy

Scams

Malware

Media

Research

Tools

Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.

Premium Content

Read more

  • ✇Blockchain Threat Intelligence
  • BlockThreat - Week 12, 2025 Peter Kacherginsky
    Greetings!More than $8.6M was stolen this week across six incidents. The majority of the funds were taken from Zoth, which had already lost $285K earlier this month in a traditional smart contract exploit. This time, they suffered a full-blown $8.4M private key compromise. Meanwhile, yet another server breach led to the theft of $100K following the hack of the AI trading platform Aixbt.What’s more concerning is learning about the $6.2M Wemix compromise nearly a month after the fact. One of the g
     
  • ↗️

BlockThreat - Week 12, 2025

✇Blockchain Threat Intelligence
Por:Peter Kacherginsky
24 de Março de 2025, 10:01

Greetings!

More than $8.6M was stolen this week across six incidents. The majority of the funds were taken from Zoth, which had already lost $285K earlier this month in a traditional smart contract exploit. This time, they suffered a full-blown $8.4M private key compromise. Meanwhile, yet another server breach led to the theft of $100K following the hack of the AI trading platform Aixbt.

What’s more concerning is learning about the $6.2M Wemix compromise nearly a month after the fact. One of the great things about this industry is that onchain events are eventually uncovered—but delays in disclosure only hurt users who might have taken protective action. I wish Wemix had followed the excellent example set by Bybit, which handled its recent incident with full transparency.

Speaking of Bybit, DPRK has moved to the next phase of its laundering operation, actively obfuscating funds using Wasabi, TC, and other tools. Even more interesting is a new tactic to hide the flow of funds: sandwiching transactions with MEV bots. This creates a layer of misdirection, making it appear as though profits are coming from unprofitable trades while actually funneling them to attacker-controlled block builders.

On a more positive note, Tornado Cash is no longer on the OFAC list—an outcome made possible by the relentless efforts of a dedicated group of individuals. You know who you are. Thank you. However, the battle isn’t over yet, as addresses belonging to TC developers remain sanctioned.

Before we dive into the news, a special thank you to this week’s sponsor—Recon. You’re likely already familiar with their groundbreaking research on invariant testing by Nican0r and the team, frequently featured in past editions. Now, you can tap into their expertise to keep your projects and users safe.

Get a Recon Invariant Audit: a powerful testing suite plus world-class auditors to catch what others miss. Open-source, no vendor lock-in, and proven to find severe bugs. Before spending millions on audits, invest in tests that evolve over time that catch bugs and keep them from coming back.

See our portfolio: https://getrecon.xyz/#services.

Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.

Let’s dive into the news!

Events

News

Crime

Phishing

Scams

Malware

Contests

Media

Research

Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.

Premium Content

Read more

❌
❌