BlockThreat - Week 40, 2026
This week in blockchain security: 8 exploits, a $3.8M hack that came back in full within a day, a Wasm sandbox escape, and a new open-weights model built for security research.
Please open Telegram to view this post
VIEW IN TELEGRAM
🚨SlowMist TI Alert🚨
💸 @SetProtocol Loss: ~5.08 ETH
🔍 Root Cause: actualizeFee() recalculated unitShares with upward rounding even though no fee was minted, raising it from 4,927 to 4,928. The attacker issued before the update and redeemed the same quantity afterward, extracting collateral from the rounding-induced unit increase. Uniswap v4 flash accounting supplied temporary liquidity to scale the exploit.
📌 Attacker (EOA): 0x506440728d84eb22809dc9464bc8189618a1c5b6
📌 Attack Contract: 0x016feaaa25ab8325e233bc8a2c25055bee0b2f6e
📌 Victim (Set Protocol Vault): 0x5b67871c3a857de81a1ca0f9f7945e5670d986dc
📌 Vulnerable Contract: 0x54e8371c1ec43e58fb53d4ef4ed463c17ba8a6be
Powered by http://SlowMist.AI
Tx: https://etherscan.io/tx/0xaca5f83ff3a206209f3d213c33d04e6febe345f6ad52ef476bd1c0ee1505ba65
Please open Telegram to view this post
VIEW IN TELEGRAM
Forwarded from Defimon Signals
🚨 MakerDAO ETH-A Liquidation Keeper Bot - Loss ~$538K (2026-10-06)
Token: $WETH
Network: Ethereum
Type: Access Control (missing auth on keeper proxy)
A Tornado-funded fresh EOA drained a dormant (2020) MakerDAO flip-keeper proxy. The keeper (upgradeable proxy 0x9c05…8273, impl 0x6839…5546) had won four ETH-A liquidation auctions (#1457–1460, 50 WETH each) back in 2020 and never called deal(), leaving 200 WETH of collateral locked in the ETH-A Flipper. The impl's drain routine (sel 0x8804d1de) was NOT protected by ds-auth (owner=0xadc374e7, authority=0x0), so any caller could invoke it: it calls Flipper.deal() on the keeper's old auctions → Vat.flux the collateral to the keeper → GemJoin.exit() 200 WETH to an attacker-supplied recipient → unwrap to 200 ETH. MakerDAO core (Vat/Flipper/GemJoin) behaved as designed; the flaw is the third-party keeper's unprotected exit function.
TX: https://etherscan.io/tx/0xbb6940f7c2a1e68cafbae7bb9b94d09af9af06ec3a114f6996f2cab993f3a88c
Attacker: https://etherscan.io/address/0x01eb957e5c7dcddd60f3c875956ccc6fb9bda5fa
Victim: https://etherscan.io/address/0x9c05a05893ada984fc20d0da0c046de5cc0e8273 (unverified impl)
@defimon_subscription_bot
Token: $WETH
Network: Ethereum
Type: Access Control (missing auth on keeper proxy)
A Tornado-funded fresh EOA drained a dormant (2020) MakerDAO flip-keeper proxy. The keeper (upgradeable proxy 0x9c05…8273, impl 0x6839…5546) had won four ETH-A liquidation auctions (#1457–1460, 50 WETH each) back in 2020 and never called deal(), leaving 200 WETH of collateral locked in the ETH-A Flipper. The impl's drain routine (sel 0x8804d1de) was NOT protected by ds-auth (owner=0xadc374e7, authority=0x0), so any caller could invoke it: it calls Flipper.deal() on the keeper's old auctions → Vat.flux the collateral to the keeper → GemJoin.exit() 200 WETH to an attacker-supplied recipient → unwrap to 200 ETH. MakerDAO core (Vat/Flipper/GemJoin) behaved as designed; the flaw is the third-party keeper's unprotected exit function.
TX: https://etherscan.io/tx/0xbb6940f7c2a1e68cafbae7bb9b94d09af9af06ec3a114f6996f2cab993f3a88c
Attacker: https://etherscan.io/address/0x01eb957e5c7dcddd60f3c875956ccc6fb9bda5fa
Victim: https://etherscan.io/address/0x9c05a05893ada984fc20d0da0c046de5cc0e8273 (unverified impl)
@defimon_subscription_bot
An attacker moved ~$6.07M from @Duelbits hot wallets across five chains in a suspected private-key compromise, including the replacement wallet named after its $4.6M theft in 2024. It reopened days later, cause still undisclosed. What changed since 2024?
https://rekt.news/duelbits-rekt
Please open Telegram to view this post
VIEW IN TELEGRAM
#CertiKInsight 🚨
On 6 Oct, a MakerDAO liquidation keeper bot was exploited resulting in a loss of 200 ETH (~$542k).
Read our full analysis here👇
https://www.certik.com/blog/makerdao-legacy-auction-keeper-incident-analysis
Find all our stats on our CertiK Security Report Dashboard 👇
https://www.certik.com/certik-report/dashboard
Please open Telegram to view this post
VIEW IN TELEGRAM
⚠️ PoeLLM has infected 3,400+ servers in a crypto-mining campaign targeting exposed AI/LLM infrastructure.
The malware hides its C2 address inside a GitHub-hosted poem and repurposes some compromised hosts to scan for more vulnerable systems.
Read more: https://thehackernews.com/2026/10/poellm-malware-infects-3400-servers-to.html
Please open Telegram to view this post
VIEW IN TELEGRAM
🚨 Tensorlake’s npm SDK (12K weekly downloads) was compromised in a ChainDrop / Shai-Hulud attack.
Version 0.5.144 contains a credential-stealing worm with a dead-man switch designed to execute attacker code when a stolen GitHub token is revoked.
https://socket.dev/blog/tensorlake-compromise
Please open Telegram to view this post
VIEW IN TELEGRAM
🚨 SlowMist TI Alert: Beware of bookmark-based phishing attacks targeting the @fomo web interface 🚨
The phishing page tricks users into completing a fake CAPTCHA, then instructs them to drag malicious JavaScript code into the browser’s bookmarks. After just 2–3 clicks on the malicious bookmark, attackers can hijack a previously logged-in FOMO account and immediately steal its crypto assets.
This is not a new technique. It’s an old exploitation method previously.
Stay alert, and watch for our upcoming analysis.
Please open Telegram to view this post
VIEW IN TELEGRAM
Please open Telegram to view this post
VIEW IN TELEGRAM
🚨 $8,200 paid to ransomware attackers. $150,000 billed to the victim.
DOJ charges MonsterCloud’s owner with fraud, alleging he secretly paid attackers for decryptors while claiming to use proprietary recovery tools.
Over $19 million in client charges.
Read - https://thehackernews.com/2026/10/monstercloud-owner-accused-of-billing.html
Please open Telegram to view this post
VIEW IN TELEGRAM
🚨 #CertiKInsights
We have seen suspicious movement from @79thVault .
2.01M 79AU were sold via a privileged function, moving 16.2k BNB (~$12.5M) to attacker: https://bscscan.com/tx/0xee0e44167518ff0071ede02a03b3710a1a8438d52616aad4bf1d5e417b37b0df
~90% held at: https://bscscan.com/address/0xa9537B40b02Af7Af8f1543aea3691992B2174F89 to which a 10% bounty was offered.
Stay Vigilant!
Please open Telegram to view this post
VIEW IN TELEGRAM
#PeckShieldAlert @79thVault was exploited, with 10K $79AU drained and swapped for 16.249K $BNB (~$12.51M). The exploiter has since deposited 30 $BNB to #Kucoin.
Please open Telegram to view this post
VIEW IN TELEGRAM
🚨SlowMist TI Alert🚨
💸 @X7_Finance Loss: ~6.78 ETH
🔍 Root Cause: In
claimRewards(), totalRewards is incremented by (address(this).balance - lastETHBalance) on every call, but lastETHBalance is only updated when claimable > 0. Calling with an empty array leaves claimable at 0, so the same unaccounted balance is repeatedly added to totalRewards, inflating the per-token reward. The attacker also donated ETH to amplify the delta before draining funds.📌 Attacker: 0xc79352119a7cf6efbfabbd7e6b013b79687bacf2
📌 Victim: 0x70000299ee8910ccacd97b1bb560e34f49c9e4f7
📌 Vulnerable Contract: 0x70000299ee8910ccacd97b1bb560e34f49c9e4f7 (X7Pioneer)
Powered by http://SlowMist.AI
Tx: https://etherscan.io/tx/0xc98056d6ab55ef898189da5fa1fb08b968cb84ca99528d171f8240836b21766d
Please open Telegram to view this post
VIEW IN TELEGRAM
A wallet funded with 10 USDT drained $3.87M from a BNB Chain vault serving @near_intents using valid signed authorizations. After 48-hour ultimatum, team announced a full recovery & closed its investigation; the full story of the failure remains unclear.
https://rekt.news/near-intents-rekt
Please open Telegram to view this post
VIEW IN TELEGRAM
🚨SlowMist TI Alert🚨
💸 @BitBayofficial Loss: ~$14K
🔍 Root Cause: The Vault's
_withdraw() function transfers its entire token balance when liquidity == 0, without limiting the payout to the user's proportional share. The attacker exploited this flaw by triggering a zero-liquidity state via reposition(), then redeeming just 1 minimal share unit to drain approximately 14,838.47 DAI.📌 Attacker: 0x59Ae3c8dd50063429D86BdaEBbC350fB64e9884B
📌 Victim: 0x048E88311ca84876aeA086125825492e2AF2e5A0
📌 Vulnerable Contract: 0x048E88311ca84876aeA086125825492e2AF2e5A0
Powered by http://SlowMist.AI
Tx: https://polygonscan.com/tx/0x5b795dc5c5e1665b712c7ccf478c1d8c59a162d698f4e0bfb40bd303e04a7ff2
Please open Telegram to view this post
VIEW IN TELEGRAM
🚨SlowMist TI Alert🚨
💸 @ethervista Loss: ~18.6K
🔍 Root Cause: The EtherVistaPair.swap() function suffers from an integer overflow in its K-invariant check. Since both reserves are uint112, their multiplication overflows and wraps around, allowing the invariant check to pass even when the actual reserve product decreases significantly. The attacker exploited this flaw through an attacker-controlled contract registered as the authorized router, executing two crafted swaps to drain WETH and VISTA from the pool.
📌 Attacker: 0xbbf8f3fe8e4fdf6b594e6107144d78293d2018fa
📌 Attack Contract (Router): 0x469424b628a9d2036e41496e814db500d683b120
📌 Vulnerable Contract: 0xfdd05552f1377aa488afed744c8024358af02041
Powered by http://SlowMist.AI
Tx: https://etherscan.io/tx/0xb2c7332d9e1be6a86d9d37083aa4cc0d94b60eb95cc9b29494555a3c09764930
Please open Telegram to view this post
VIEW IN TELEGRAM
#CertiKInsight 🚨
On 30 Sept, HOT Omni Bridge on NEAR was exploited resulting in five observed BSC treasury payouts totaling $3.86M, which was later returned.
Read our full analysis here👇
https://www.certik.com/blog/hot-bridge-near-intents
CertiK Report Security Dashboard 👇
https://certik.com/certik-report/dashboard
Please open Telegram to view this post
VIEW IN TELEGRAM
🚨 A new GhostAction wave has hit hundreds of GitHub repos, including Uber’s athenadriver and Pyxel.
Attackers used compromised maintainer accounts to plant fake “security audit” workflows that steal GitHub Actions secrets.
Please open Telegram to view this post
VIEW IN TELEGRAM
🚨 DarkSword's new P7 iOS variant goes beyond data theft.
Its implant can extract iCloud Keychain and crypto wallet data, execute attacker commands, and poll for new commands every 15 seconds.
Details: https://thehackernews.com/2026/10/p7-darksword-ios-exploit-kit-adds.html
Please open Telegram to view this post
VIEW IN TELEGRAM
BlockThreat - September, 2026
$780M stolen across 76 incidents. Worst month of 2026.
DPRK crossed $1B for the year with another exchange super hack.
Two hacks did 91% of the damage. They are not what concerns me most. 🧵
Please open Telegram to view this post
VIEW IN TELEGRAM