- ERC1271 Replay - 15+ Teams Affected - Audit of a ZK application on example: Tornado Cash - Merkle Trees in Blockchain: A Study of Collision Probability and Security Implications @EthSecurity1

unilend exploited 197.6 $k. https://etherscan.io/tx/0x44037ffc0993327176975e08789b71c1058318f48ddeff25890a577d6555b6ba @EthSecurity1

cyvers 2024 Web3 Security Report


CertiK The Web3 Security Report 2024

Slowmist stolen fund analysis
@EthSecurity1

- Blockchain Bribing Attacks and the Efficacy of Counterincentives. - Undetectable Selfish Mining
- Bribe & Fork: Cheap Bribing Attacks via Forking Threat
- Optimism superchain audit report
@EthSecurity1

odosprotocol on ETH and Base, hacked for ~$50k . The root cause is arbitrary call vulnerability. attack tx: https://app.blocksec.com/explorer/tx/base/0xd10faa5b33ddb501b1dc6430896c966048271f2510ff9ed681dd6d510c5df9f6 @EthSecurity1

- Generating unit tests from broken stateful invariant tests - The Fuzzing Book: Tools and Techniques for Generating Software Tests @EthSecurity1

DeepSeek has been hacked: all of their data in the public domain - secret keys, unencrypted chats, logs, and even the backend.

Researchers from wiz.io were performing a normal infrastructure check when they unintentionally uncovered a database that is fully open, allowing anyone to obtain access.

I cannot confirm or deny their conclusions at this time. But I think it's interesting enough news to share: x.com/officer_cia/status/1884740598579540060

#ai #news #security

1 Million Deepseek Data Breach

DeepSeek AI Data Breach Exposes Over 1 Million Logs and Sensitive Secrets - Chinese AI startup DeepSeek left a database exposed online, leaking over 1 million log lines, chat histories, API keys, and sensitive backend details

Seems service had backdoor
@EthSecurity1

- Uniswap V4: Hooks Security Considerations
- kyberswap hacker arrested - crypto losses in janurary 2025 @EthSecurity1

New Patrick Collins course

https://m.youtube.com/watch?v=nWsLw_1OpE0&pp=ygUMRnJlZWNvZGVjYW1w
@EthSecurity1

250 LBTC hacked form ionicmoney. why? because ionic listed fake LBTC on mode chain

Thus, the attacker can call mint() with fabricated inputs and pass the check. @EthSecurity1

Web3 Security Auditor's 2024 Rewind - The Highlights https://blog.openzeppelin.com/web3-security-auditors-2024-rewind @EthSecurity1

Zklend been hacked for ~3600 ETH on starknet @EthSecurity1

ZKlend Hack rootcause: The attacker manipulated the "lending_accumulator" to be very large at 4.069297906051644020, then took advantage of the rounding error during ztoken mint() and withdraw() to repeatedly deposit 4.069297906051644021 wstETH getting 2 wei then withdraw 4.069297906051644020*1.5 -1 = 6.103946859077466029 wstETH to expend just 1 wei. @EthSecurity1

an issue found by zellic in the Cairo VM during a recent audit of Starknet OS.

This bug has been fixed as an immediate patch to Starknet's current version 0.13.3.

https://community.starknet.io/t/remediating-a-potential-sequencer-prover-inconsistency-in-the-cairo-vm/115313
@EthSecurity1

SlowMist founder: we discovered that the hacker who attacked zkLend has a close connection to the hacker who attacked EraLend in July 2023, and we suspect they are the same person: x.com/officer_cia/status/1890132436589445291?12

#security #privacy #investigation

Urgent Update for Geth Users!
Attention validators! If you are running Geth v1.15.1, upgrade to v1.15.2 immediately to prevent potential financial loss! @EthSecurity1

Seems Abstract wallets are being drained !
cardex_space involved
~ 180 ether loss
@EthSecurity1

If you are running LND older than 0.18.5 and/or LITD older than 0.14.1, upgrade immediately. Apparently, affected Lightning nodes can be completely drained by attackers. #Bitcoin @EthSecurity1

Bybit hacked loss ~ $ 1.46 billion
@EthSecurity1

the Lazarus hackers first found the targeted employees through social engineering, added private GitHub repository access to the victims or victimized employees through live chat tools, and tricked the users into running the code that contained the backdoor.
🧵
https://x.com/im23pds/status/1892767073605931065?s=61
High level Attack flow
https://x.com/dhkleung/status/1893073663391604753?s=61

@EthSecurity1