ECRecover and Signature Verification in Ethereum https://coders-errand.com/ecrecover-signature-verification-ethereum/
This blog has great articles about cryptography and ZK

And sure watch this

Ethereum yellow paper
https://youtu.be/e84V1MxRlYs?si=ysB4c21fT9Ce024u
@EthSecurity1

DYDX exploite post-mortem

https://www.theblock.co/post/270275/dydx-publishes-post-mortem-9-million-november-attack

Gamma protocol is third hack in 2024
https://twitter.com/GammaStrategies/status/1742882840247779453
@Ethsecurity1

gamma exploit post_mortem 6.18 m $ loss https://medium.com/gamma-strategies/post-mortem-remediation-plan-9a62f10d90f3 @EthSecurity1

We are glad to opensource our holistic security strategy for Solana dev teams.

Here is a Systematic Security Roadmap for a full lifecycle of Solana applications.

https://github.com/Rektoff/Security-Roadmap-for-Solana-applications

https://x.com/rektoff_xyz/status/1744771734782263613?s=20

2023 web3security Facts:

83% of protocols hacked in 2023 was audited

56.7% rugpulls happened in BSC

Certik-Peckshield-slowmist- Quantstamp are firms that performed security audits on exploited projects(before exploit).

62% projects compensated after exploit

34% projects audited after the exploits

78% attackers accepted bug bounty

@EthSecurity1

Near smart contract security course https://www.youtube.com/playlist?list=PL7Gwuo_MOL740lhKTvouCJvk4sAyuqZqT

Near protocol lay off 50% of staff


ZKP Series: Principles and
Implementation of Extensibility Attacks on Groth16 Proofs https://slowmist.medium.com/zkp-series-principles-and-implementation-of-extensibility-attacks-on-groth16-proofs-aedcd703323a @EthSecurity1

Easy transferfrom(victim,Hacker,3.3 m $)
Bungee Exploit
@EthSecurity1

https://cointelegraph.com/news/trezor-discloses-66k-users-affected-phishing-attack

Seems trustwallet used trezor library too. Code suffers randomness issues

Ethereum Smart Contract Auditor's 2023 Rewind https://ventral.digital/posts/2024/1/19/ethereum-smart-contract-auditors-2023-rewind/ Top 10 Blockchain Hacking Techniques of 2023 https://blog.openzeppelin.com/top-10-blockchain-hacking-techniques-of-2023-submissions-open @EthSecurity1

gmee got hacked https://www.halborn.com/blog/post/explained-the-gamee-token-hack-january-2024 @EthSecurity1

In orbit accident I was wondering how keys compromised. This is post-mortem:
https://medium.com/orbit-chain/official-statement-regarding-orbit-bridge-exploit-551928f3dc52

And MIM hack analysis

https://x.com/kankodu/status/1752581744803680680?s=61
@EthSecurity1

It appears a Ripple insider was hacked for ~213M XRP ($112.5M)

Source address
rJNLz3A1qPKfWCtJLPhmMZAfBkutC2Qojm

So far the stolen funds have been laundered through MEXC, Gate, Binance, Kraken, OKX, HTX, HitBTC, etc

Update: Confirmation of the hack from Chris Larsen (Ripple Co-Founder & Executive Chairman)

Theft addresses
rGhR13XyM43WdDaSMznHd5rZ4cJatybvEg
rHQVKntyfkDCPhEBL2ctryuEAkDZgckmmV
rLsUemhuBZtF44rqqzneb2F9JgyrRYYd4t
rKPERax7t9iFvT3RHXn5nifyNpzp9a4hBa
rpjs4HLX1gJoEenH69PsQmXaXY22QhCYAT
rLRhugR4ysNa2xkt4E6fKN8krs9jatCp6w
rnCyeUNvfDbtTagGEPjBfTCBz6EqJjf2Uj
rHVjfYzTaB8MzSoQGqpzH9barZr85QsZW7

Vitalik wrote about risks of restaking in this article from May 2023.

Good to take a step back sometimes and look at the safety too

👇

https://vitalik.eth.limo/general/2023/05/21/dont_overload.html

Warpcast is strange! Get approves account keys onchain and store eth keys on it's server :(
Eth keys : hold asset(EOA)

@Ethsecurity1

- PlayDapp Heist: Attackers minted 200M PLA tokens, valuing a massive $31M loss. A significant portion, $5.9M worth, found its way to the Gate platform. The exploit was due to a security vulnerability. @EthSecurity1

considering Blast as clone of optimism ToB found only 1 Low on Blast, when Spearbit found 6 Crit, 6 H, 11 M and 14 L https://github.com/trailofbits/publications/blob/master/reviews/2024-01-metalayerblast-securityreview.pdf

https://github.com/spearbit/portfolio/blob/master/pdfs/report-blast-contracts-review-draft.pdf

Blast source code deep dive:
https://twitter.com/jarrodWattsDev/status/1727584394796323042?s=20

@EthSecurity1

#Scam
1- Create Github PR with scam massage
2- Tag targets
3- Scam message will be emailed to targets from Github
@Ethsecurity1

Affine Defi Hack explained https://medium.com/@0kage/hack-series-deep-dive-chapter-2-affine-da2d7b0bbefd and POC: https://github.com/0kage-eth/hacks-poc-database/blob/main/test/02-AffineExploit0224.t.sol Plonky2x Audit Report https://hackmd.io/qS36EcIASx6Gt_2uNwlK4A @EthSecurity1

Seneca Protocol has a critical approval exploit (open external call). $6m+ lost so far across eth/arb ADDRESSES TO REVOKE: 0xbc83f2711d0749d7454e4a9d53d8594df0377c05 (MAINNET)

0x2d99e1116e73110b88c468189aa6af8bb4675ec9 (ARBITRUM)

NOTE: contract was pausable but written in internal functions there is no way to call them.
@EthSecurity1

the "EVM from scratch" book. https://evm-from-scratch.xyz/intro.html ZK proofs ELI5. A fun way to understand circuits and even play with them directly in your browser. eli5.zksync.io @EthSecurity1