🚨 Hack Alert!
Target: More Markets
What happened: An exploit has been detected on More Markets (More Labs) on the Flow EVM.
The attacker utilized Ankr bonded LST along with E-mode to drain the WFLOW lending reserve.
In total, 15.5 million WFLOW was emptied from the mFlowWFLOW, which translates to approximately $9.3 million in impact.
The attack transaction cluster includes post-exploit exfiltration details.
More details are provided in the thread.
🔗Tweet URL: View Tweet
Target: More Markets
What happened: An exploit has been detected on More Markets (More Labs) on the Flow EVM.
The attacker utilized Ankr bonded LST along with E-mode to drain the WFLOW lending reserve.
In total, 15.5 million WFLOW was emptied from the mFlowWFLOW, which translates to approximately $9.3 million in impact.
The attack transaction cluster includes post-exploit exfiltration details.
More details are provided in the thread.
🔗Tweet URL: View Tweet
❤1
🚨 Hack Alert!
Target: Visor/Gamma
What happened: An exploit has been reported involving the draining of approximately 10.7 ETH from two legacy Visor/Gamma FLOAT-ETH Hypervisor vaults. The incident details a significant vulnerability related to the Hypervisor's minting process of LP shares based on the Uniswap V3 pool's instantaneous spot price without proper checks. The attacker took advantage of this flaw to execute a flash-loan price manipulation exploit.
🔗Tweet URL: View Tweet
Target: Visor/Gamma
What happened: An exploit has been reported involving the draining of approximately 10.7 ETH from two legacy Visor/Gamma FLOAT-ETH Hypervisor vaults. The incident details a significant vulnerability related to the Hypervisor's minting process of LP shares based on the Uniswap V3 pool's instantaneous spot price without proper checks. The attacker took advantage of this flaw to execute a flash-loan price manipulation exploit.
🔗Tweet URL: View Tweet
❤1
🚨 Hack Alert!
Target: FloatProtocol
What happened: 🚨 SlowMist TI Alert
💰 @FloatProtocol Loss: ~$28,000 (10.71 ETH)
🔍 Root Cause: Uniswap V3 spot price (
📌 Attacker:
📌 Attack Contract:
📌 Vulnerable Contracts:
-
-
📌 Underlying Pool:
Attackers manipulated
Transaction details can be found at: https://t.co/8CDnQ4ZjEo.
🔗Tweet URL: View Tweet
Target: FloatProtocol
What happened: 🚨 SlowMist TI Alert
💰 @FloatProtocol Loss: ~$28,000 (10.71 ETH)
🔍 Root Cause: Uniswap V3 spot price (
slot0) manipulation via flash loans enabled incorrect LP share pricing in Hypervisor contracts. Critical functions lacked TWAP/oracle validation and slippage protection.📌 Attacker:
0xaea29218262dc6b0904ca077f6527c49dfd426d9📌 Attack Contract:
0xb46655eb5b77de277063a75586d1883e951b6c54📌 Vulnerable Contracts:
-
0x85cbed523459b7f6f81c11e710df969703a8a70c-
0xc86b1e7fa86834cac1468937cdd53ba3ccbc1153📌 Underlying Pool:
0xe8c2036068fc3b0161ee1def0e8d01df4eac0acAttackers manipulated
currentTick()/getTotalAmounts() by swapping large amounts on the V3 pool to distort slot0, then repeatedly deposited and withdrew with inflated share values.Transaction details can be found at: https://t.co/8CDnQ4ZjEo.
🔗Tweet URL: View Tweet
❤1
🚨 Hack Alert!
Target: Aquifer
What happened: Aquifer on Solana was reportedly exploited for approximately $2.5 million across over 90 attack transactions, draining its vaults.
Due to the unavailability of the source code, this analysis is based on preliminary on-chain data. The likely root cause of the exploit was a caller-controlled input-side token program that was not linked to the canonical SPL Token Program. This allowed the attacker to receive actual output tokens without providing the necessary input, as Aquifer trusted the result from the call without validating the actual token balance changes.
During the attack, both the USDC and HYPE token mints were presented as swap parameters, suggesting that the attacker was buying HYPE with USDC. However, the changes in balance and execution trace reveal that only the HYPE vault transferred tokens to the attacker, confirming that there was no actual USDC inflow.
Aquifer erroneously permitted callers to supply the tokenProgramA during the swap process, enabling the attacker to replace it with a malicious program, which accepted and processed the token transfer instructions without conducting a real transfer.
Attack transaction: https://t.co/ItnJUp7QxH
🔗Tweet URL: View Tweet
Target: Aquifer
What happened: Aquifer on Solana was reportedly exploited for approximately $2.5 million across over 90 attack transactions, draining its vaults.
Due to the unavailability of the source code, this analysis is based on preliminary on-chain data. The likely root cause of the exploit was a caller-controlled input-side token program that was not linked to the canonical SPL Token Program. This allowed the attacker to receive actual output tokens without providing the necessary input, as Aquifer trusted the result from the call without validating the actual token balance changes.
During the attack, both the USDC and HYPE token mints were presented as swap parameters, suggesting that the attacker was buying HYPE with USDC. However, the changes in balance and execution trace reveal that only the HYPE vault transferred tokens to the attacker, confirming that there was no actual USDC inflow.
Aquifer erroneously permitted callers to supply the tokenProgramA during the swap process, enabling the attacker to replace it with a malicious program, which accepted and processed the token transfer instructions without conducting a real transfer.
Attack transaction: https://t.co/ItnJUp7QxH
🔗Tweet URL: View Tweet
❤1
🚨 Hack Alert!
Target: Reflexer
What happened: 🚨 ALERT — Exploit on Ethereum
A GEB/RAI-style CDP deployment (Reflexer's GEB framework, in Global Settlement since Jan 2021) was just drained of its leftover ETH-A collateral. Approximately 5.94 ETH, valued at around $14k, was stolen.
Root cause: Several SAFEs were owned by the shared GebProxyActions library itself (0x84fe452d9fb495a335c74a225e6ad52c35eb8616), rather than by user proxies. Its quitSystem() is public and unauthenticated, allowing the attacker to call it directly. The GebSafeManager's msg.sender check passed as the library was acting as itself, enabling the migration of other users' collateral to the attacker, followed by freeCollateral and exit operations.
Attack transaction: https://t.co/KAmU46mQB8
Attacker address: 0xb929c7215c0ec8ebad5fbf73b1da63bccfff1896
Exploit contract: 0x6a213f0b5bd9eed865d3e2efc867b73dfe9039e7
Lesson: Never allow a stateless, shared 'proxy-actions' contract to become the registered owner of a position, as its public helpers can become anyone's withdrawal method.
🔗Tweet URL: View Tweet
Target: Reflexer
What happened: 🚨 ALERT — Exploit on Ethereum
A GEB/RAI-style CDP deployment (Reflexer's GEB framework, in Global Settlement since Jan 2021) was just drained of its leftover ETH-A collateral. Approximately 5.94 ETH, valued at around $14k, was stolen.
Root cause: Several SAFEs were owned by the shared GebProxyActions library itself (0x84fe452d9fb495a335c74a225e6ad52c35eb8616), rather than by user proxies. Its quitSystem() is public and unauthenticated, allowing the attacker to call it directly. The GebSafeManager's msg.sender check passed as the library was acting as itself, enabling the migration of other users' collateral to the attacker, followed by freeCollateral and exit operations.
Attack transaction: https://t.co/KAmU46mQB8
Attacker address: 0xb929c7215c0ec8ebad5fbf73b1da63bccfff1896
Exploit contract: 0x6a213f0b5bd9eed865d3e2efc867b73dfe9039e7
Lesson: Never allow a stateless, shared 'proxy-actions' contract to become the registered owner of a position, as its public helpers can become anyone's withdrawal method.
🔗Tweet URL: View Tweet
❤1
🚨 Hack Alert!
Target: Notional Finance
What happened: PeckShield has reported that the Notional Finance escrow contract may have been exploited.
This incident has resulted in the loss of $1.7M, with funds stolen in both Ethereum and $USDC.
The exploiter has swapped the stolen funds into 689.2 $ETH and deposited them into Tornado Cash.
Forensic details include the transaction address: 0x6b175474e89094c44da98b954eedeac495271d0f.
🔗Tweet URL: View Tweet
Target: Notional Finance
What happened: PeckShield has reported that the Notional Finance escrow contract may have been exploited.
This incident has resulted in the loss of $1.7M, with funds stolen in both Ethereum and $USDC.
The exploiter has swapped the stolen funds into 689.2 $ETH and deposited them into Tornado Cash.
Forensic details include the transaction address: 0x6b175474e89094c44da98b954eedeac495271d0f.
🔗Tweet URL: View Tweet
❤2
🚨 Hack Alert!
Target: DHC
What happened: Skyeye Alert details an exploit on the BNB Chain involving the DHC (Dream Health Chain) staking or "pledge" pool.
The attack drained the pool's reward reserve, leading to the minting of approximately 568,370 DHC from thin air, which was sold for about 71,851 USDT (~$71.8K). This incident caused a significant crash in DHC's value, plummeting by approximately 91% from $0.34 to $0.03.
The root cause of the exploit was identified as a flaw in the pool's reward-claim function. This function pays a fixed reward from the reserve for every call without tracking claims or elapsed time, allowing the attacker to repeatedly claim rewards. The attacker utilized a strategy of looping pledge and claim actions, supported by minimal initial capital through flash loans.
The transaction details indicate that the attacker executed the same reward payout 18 times on one position before dumping the DHC for USDT on PancakeSwap.
Key forensic details include:
- Attack tx: https://t.co/nPsKCnyxnO
- Attacker address: 0xD3A8D0A9F55cf679fff6F277E49AfC95B49D2B07
- Exploit contract: 0x226923D34A10f3D54B57b9F4b685E82c6Cba968A
- Victim pool address: 0xe2a047aaDbac51b0116Af1cE91EbdAe4b4202094
🔗Tweet URL: View Tweet
Target: DHC
What happened: Skyeye Alert details an exploit on the BNB Chain involving the DHC (Dream Health Chain) staking or "pledge" pool.
The attack drained the pool's reward reserve, leading to the minting of approximately 568,370 DHC from thin air, which was sold for about 71,851 USDT (~$71.8K). This incident caused a significant crash in DHC's value, plummeting by approximately 91% from $0.34 to $0.03.
The root cause of the exploit was identified as a flaw in the pool's reward-claim function. This function pays a fixed reward from the reserve for every call without tracking claims or elapsed time, allowing the attacker to repeatedly claim rewards. The attacker utilized a strategy of looping pledge and claim actions, supported by minimal initial capital through flash loans.
The transaction details indicate that the attacker executed the same reward payout 18 times on one position before dumping the DHC for USDT on PancakeSwap.
Key forensic details include:
- Attack tx: https://t.co/nPsKCnyxnO
- Attacker address: 0xD3A8D0A9F55cf679fff6F277E49AfC95B49D2B07
- Exploit contract: 0x226923D34A10f3D54B57b9F4b685E82c6Cba968A
- Victim pool address: 0xe2a047aaDbac51b0116Af1cE91EbdAe4b4202094
🔗Tweet URL: View Tweet
❤1
🚨 Hack Alert!
Target: RedSonic Vault
What happened: An exploit occurred on the Ethereum network affecting the RedSonic Vault. The attacker drained approximately 9.25 ETH using a sophisticated method involving a flash loan. The attack was carried out by borrowing 1,139 WETH from Balancer, which manipulated the vault's share price. The attacker took advantage of a permissionless function that allowed them to register stETH as an additional asset, inflating the value of the vault's share class. The sequence of the attack involved executing a single transaction where the attacker inflated the rsvETH price and redeemed it at an inflated rate to extract more ETH than was initially deposited. This strategic move allowed them to profit from the vault's balance multiple times. This incident highlights significant vulnerabilities in the vault’s pricing mechanism and execution logic.
🔗Tweet URL: View Tweet
Target: RedSonic Vault
What happened: An exploit occurred on the Ethereum network affecting the RedSonic Vault. The attacker drained approximately 9.25 ETH using a sophisticated method involving a flash loan. The attack was carried out by borrowing 1,139 WETH from Balancer, which manipulated the vault's share price. The attacker took advantage of a permissionless function that allowed them to register stETH as an additional asset, inflating the value of the vault's share class. The sequence of the attack involved executing a single transaction where the attacker inflated the rsvETH price and redeemed it at an inflated rate to extract more ETH than was initially deposited. This strategic move allowed them to profit from the vault's balance multiple times. This incident highlights significant vulnerabilities in the vault’s pricing mechanism and execution logic.
🔗Tweet URL: View Tweet
❤1
🚨 Hack Alert!
Target: LiquidBTC
*What happened:* A significant unauthorized withdrawal has been reported involving SideSwap PAK at @LiquidBTC.
Approximately 4,000 BTC, valued at around $320 million, was withdrawn.
The incident includes the hacker leaving a message claiming to be whitehats and requested to be contacted on-chain.
Forensic details include the transaction address: bc1qdlld6antmv4xug242ed83q7k4rqw50cwfns38szx4qu2f4jwaxxsuhwxxr.
This event indicates a major security breach with substantial financial impact.
🔗Tweet URL: View Tweet
Target: LiquidBTC
*What happened:* A significant unauthorized withdrawal has been reported involving SideSwap PAK at @LiquidBTC.
Approximately 4,000 BTC, valued at around $320 million, was withdrawn.
The incident includes the hacker leaving a message claiming to be whitehats and requested to be contacted on-chain.
Forensic details include the transaction address: bc1qdlld6antmv4xug242ed83q7k4rqw50cwfns38szx4qu2f4jwaxxsuhwxxr.
This event indicates a major security breach with substantial financial impact.
🔗Tweet URL: View Tweet
❤1
🚨 Hack Alert!
Target: cozyfinance
What happened: Community alert: Blockaid has detected an ongoing exploit on Cozy Finance on the Optimism network.
So far, $170,000 has been drained as a result of this incident.
Further details are expected to follow in the thread.
🔗Tweet URL: View Tweet
Target: cozyfinance
What happened: Community alert: Blockaid has detected an ongoing exploit on Cozy Finance on the Optimism network.
So far, $170,000 has been drained as a result of this incident.
Further details are expected to follow in the thread.
🔗Tweet URL: View Tweet
❤2
🚨 Hack Alert!
Target: WealthManagementV2
What happened: An alert from SlowMist on a significant security incident involving WealthManagementV2 has been issued.
A total of 26,414 USDT was stolen due to exploited owner privileges of the contract, suspected to be caused by a leaked private key.
The attacker gained control of the contract, allowing them to manipulate plan parameters through
The attacker address is noted as
For further details, here are the transaction links:
- Transaction 1
- Transaction 2
🔗Tweet URL: View Tweet
Target: WealthManagementV2
What happened: An alert from SlowMist on a significant security incident involving WealthManagementV2 has been issued.
A total of 26,414 USDT was stolen due to exploited owner privileges of the contract, suspected to be caused by a leaked private key.
The attacker gained control of the contract, allowing them to manipulate plan parameters through
updatePlanConfig without any timelock or restrictions, enabling them to mint inflated interest and withdraw funds.The attacker address is noted as
0xe439422afdd247503f75b4143c4a973eced04a36. The victim contract involved in this incident is WealthManagementV2 with address 0x7b5dda5135811ec0870a75a04d0e1807edc3c93d.For further details, here are the transaction links:
- Transaction 1
- Transaction 2
🔗Tweet URL: View Tweet