🚨 Hack Alert!
Target: Stake
What happened: Incident Summary:
A suspicious transaction targeting an unknown contract named Stake on the Binance Smart Chain (BSC) led to a financial loss of approximately $133K.
Root Cause:
The issue stemmed from a vulnerable spot-price dependency in the Stake contract.
Attack Flow:
1. The attacker manipulated the TUR price in the TUR–NOBEL pool.
2. They staked TUR in the Stake contract, which triggered reward calculations based on the inflated price.
3. Amplified rewards were claimed through referred accounts, draining all TUR from the contract.
4. The attacker swapped the stolen TUR for USDT as profit.
Forensic Details:
- Attacker Addresses:
• 0xC93A5Ab3737081F00788B61DA42281955d3dF692
• Referrer account 1: 0xFd11c78A2fFC9102080F1AcCFb2c9Cd2ce2AcEaB
• Referrer account 2: 0x9007983C0b1db337e3c0FF29771027b8E2bE550B
• Referrer account 3: 0xEf79bbD4EFaC4bE248aF6525971002F80eB251e0
- Attack Transaction: Link to transaction
Tweet URL: View Tweet
Target: Stake
What happened: Incident Summary:
A suspicious transaction targeting an unknown contract named Stake on the Binance Smart Chain (BSC) led to a financial loss of approximately $133K.
Root Cause:
The issue stemmed from a vulnerable spot-price dependency in the Stake contract.
Attack Flow:
1. The attacker manipulated the TUR price in the TUR–NOBEL pool.
2. They staked TUR in the Stake contract, which triggered reward calculations based on the inflated price.
3. Amplified rewards were claimed through referred accounts, draining all TUR from the contract.
4. The attacker swapped the stolen TUR for USDT as profit.
Forensic Details:
- Attacker Addresses:
• 0xC93A5Ab3737081F00788B61DA42281955d3dF692
• Referrer account 1: 0xFd11c78A2fFC9102080F1AcCFb2c9Cd2ce2AcEaB
• Referrer account 2: 0x9007983C0b1db337e3c0FF29771027b8E2bE550B
• Referrer account 3: 0xEf79bbD4EFaC4bE248aF6525971002F80eB251e0
- Attack Transaction: Link to transaction
Tweet URL: View Tweet
🚨 Hack Alert!
Target:
What happened: A total of approximately $18.2 million has been lost by a Kraken user due to a suspected social engineering scam. The scam involved multiple transactions rather than a single event, with on-chain data indicating that the victim began transferring funds to the scammer on February 23.
This information has been reported by @zachxbt and involves significant financial loss, highlighting the ongoing risks of social engineering attacks in the crypto space.
Tweet URL: View Tweet
Target:
What happened: A total of approximately $18.2 million has been lost by a Kraken user due to a suspected social engineering scam. The scam involved multiple transactions rather than a single event, with on-chain data indicating that the victim began transferring funds to the scammer on February 23.
This information has been reported by @zachxbt and involves significant financial loss, highlighting the ongoing risks of social engineering attacks in the crypto space.
Tweet URL: View Tweet
🚨 Hack Alert!
Target: DolaSavings
What happened: On March 2, an attacker targeted the DolaSavings contract on Ethereum.
The attack method involved a large flashloan, draining a vault and making a brief donation to spoof a healthy price. Initially, it was difficult to identify what was being attacked. When the dust settled, $240K was confirmed stolen from the contract.
Interestingly, one protocol in the blast radius reported no losses.
More details can be found in the tweet.
Tweet URL: View Tweet
Target: DolaSavings
What happened: On March 2, an attacker targeted the DolaSavings contract on Ethereum.
The attack method involved a large flashloan, draining a vault and making a brief donation to spoof a healthy price. Initially, it was difficult to identify what was being attacked. When the dust settled, $240K was confirmed stolen from the contract.
Interestingly, one protocol in the blast radius reported no losses.
More details can be found in the tweet.
Tweet URL: View Tweet
🚨 Hack Alert!
Target: DriftProtocol
What happened: The @DriftProtocol experienced a significant security incident, with an initial estimated loss of $285 million reported.
Details are likely available in the linked breakdown for further forensic information.
This incident highlights the severe financial impact and implications for the protocol involved.
Tweet URL: View Tweet
Target: DriftProtocol
What happened: The @DriftProtocol experienced a significant security incident, with an initial estimated loss of $285 million reported.
Details are likely available in the linked breakdown for further forensic information.
This incident highlights the severe financial impact and implications for the protocol involved.
Tweet URL: View Tweet
🚨 Hack Alert!
Target: Drift Protocol
What happened: Drift Protocol suffered an exploit resulting in approximately $280 million stolen, highlighting significant issues in trust and visibility within the project’s security framework.
In this incident, there was no smart contract failure; instead, attackers focused on the human layer, employing social engineering to compromise multisig signer accounts. The attackers meticulously executed their plan over several days, initiating setup for durable nonce accounts by March 23 and exploiting weaknesses during the multisig migration by March 27, which culminated in the execution of the exploit on April 1.
As a direct result of this coordinated effort, 20+ Solana protocols were affected, causing additional millions in secondary losses and ongoing cross-chain laundering. The incident bears similarity to the Bybit hack, as in both attackers manipulated multisig approvals resulting in unintentional authorization of malicious transactions.
The significance of this event transcends just a security breach; it questions governance structures within the protocol. With a 2-out-of-5 multisig setup lacking a timelock, this reflects a critical point of failure rather than decentralization. The attack highlights a worrying trend where human compromise is becoming the primary attack vector in Web3 environments.
Tweet URL: View Tweet
Target: Drift Protocol
What happened: Drift Protocol suffered an exploit resulting in approximately $280 million stolen, highlighting significant issues in trust and visibility within the project’s security framework.
In this incident, there was no smart contract failure; instead, attackers focused on the human layer, employing social engineering to compromise multisig signer accounts. The attackers meticulously executed their plan over several days, initiating setup for durable nonce accounts by March 23 and exploiting weaknesses during the multisig migration by March 27, which culminated in the execution of the exploit on April 1.
As a direct result of this coordinated effort, 20+ Solana protocols were affected, causing additional millions in secondary losses and ongoing cross-chain laundering. The incident bears similarity to the Bybit hack, as in both attackers manipulated multisig approvals resulting in unintentional authorization of malicious transactions.
The significance of this event transcends just a security breach; it questions governance structures within the protocol. With a 2-out-of-5 multisig setup lacking a timelock, this reflects a critical point of failure rather than decentralization. The attack highlights a worrying trend where human compromise is becoming the primary attack vector in Web3 environments.
Tweet URL: View Tweet
🚨 Hack Alert!
Target: Drift Protocol
What happened: $285M was drained in under 12 minutes from the Drift Protocol exploit.
The exploit did not involve a contract bug or code vulnerability, but rather privileged access without limits, allowing unrestricted actions.
A detailed breakdown of the incident explains how the exploit was staged over several weeks and how legitimate approvals were weaponized.
The content also discusses the need for a stronger architecture to prevent such attacks in the future, emphasizing the purpose of Guardian.
Tweet URL: View Tweet
Target: Drift Protocol
What happened: $285M was drained in under 12 minutes from the Drift Protocol exploit.
The exploit did not involve a contract bug or code vulnerability, but rather privileged access without limits, allowing unrestricted actions.
A detailed breakdown of the incident explains how the exploit was staged over several weeks and how legitimate approvals were weaponized.
The content also discusses the need for a stronger architecture to prevent such attacks in the future, emphasizing the purpose of Guardian.
Tweet URL: View Tweet
🚨 Hack Alert!
Target: DriftProtocol
What happened: The @DriftProtocol exploiter has been identified as having stolen $285 million worth of cryptocurrency. Recently, they moved 185 $SOL, equivalent to $15,000, to #ChangeNow. This transaction is linked directly to the exploit involving the Drift Protocol, confirming a significant financial impact on the project.
Tweet URL: View Tweet
Target: DriftProtocol
What happened: The @DriftProtocol exploiter has been identified as having stolen $285 million worth of cryptocurrency. Recently, they moved 185 $SOL, equivalent to $15,000, to #ChangeNow. This transaction is linked directly to the exploit involving the Drift Protocol, confirming a significant financial impact on the project.
Tweet URL: View Tweet
🚨 Hack Alert!
Target: SquidMulticall
What happened: A series of suspicious transactions were detected targeting a specific victim address (0xaCc0c1f672B03B9a5fED4535f840f09B85f40E98) across multiple chains including Arbitrum, BSC, Avalanche, Optimism, and Base.
The estimated total losses amount to approximately $517K.
The victim had pre-existing MAXUINT approvals to a SquidMulticall-related contract at the same address (0xaD6Cea45f98444a922a2b4fE96b8C90F0862D2F4), which allowed the attacker to exploit these approvals. The attacker leveraged the permissionless run() entrypoint to execute crafted multicalls with transferFrom payloads, enabling the transfer of tokens directly from the victim's address.
🔗*Tweet URL:* [View Tweet](https://twitter.com/Phalconxyz/status/2041463211493662942)
Target: SquidMulticall
What happened: A series of suspicious transactions were detected targeting a specific victim address (0xaCc0c1f672B03B9a5fED4535f840f09B85f40E98) across multiple chains including Arbitrum, BSC, Avalanche, Optimism, and Base.
The estimated total losses amount to approximately $517K.
The victim had pre-existing MAXUINT approvals to a SquidMulticall-related contract at the same address (0xaD6Cea45f98444a922a2b4fE96b8C90F0862D2F4), which allowed the attacker to exploit these approvals. The attacker leveraged the permissionless run() entrypoint to execute crafted multicalls with transferFrom payloads, enabling the transfer of tokens directly from the victim's address.
🔗*Tweet URL:* [View Tweet](https://twitter.com/Phalconxyz/status/2041463211493662942)
🚨 Hack Alert!
Target: HLP
What happened: A PeckShield alert indicates that HLP has suffered approximately $1.5 million in losses over the past 24 hours. The attacker managed to accumulate a long position of $15 million in $Fartcoin, equating to 145.24 million tokens, distributed across four wallets.
In a low-liquidity market, the attacker executed a "suicide" liquidation, which triggered the Accidental Liquidation (ADL) mechanism to activate. This forced HLP to absorb the resulting toxic asset, resulting in a significant amount of bad debt incurred.
On paper, the loss amounts to $3 million. However, it is suggested that the attacker may have secured a much larger net profit by cross-venue hedging.
Tweet URL: View Tweet
Target: HLP
What happened: A PeckShield alert indicates that HLP has suffered approximately $1.5 million in losses over the past 24 hours. The attacker managed to accumulate a long position of $15 million in $Fartcoin, equating to 145.24 million tokens, distributed across four wallets.
In a low-liquidity market, the attacker executed a "suicide" liquidation, which triggered the Accidental Liquidation (ADL) mechanism to activate. This forced HLP to absorb the resulting toxic asset, resulting in a significant amount of bad debt incurred.
On paper, the loss amounts to $3 million. However, it is suggested that the attacker may have secured a much larger net profit by cross-venue hedging.
Tweet URL: View Tweet
🚨 Hack Alert!
Target: Polkadot Hyperbridge
What happened: The tweet discusses the specific exploit of the Polkadot Hyperbridge that resulted in significant financial loss.
A forged proof was accepted due to a failure in the verification function, which didn't check the proof bound to its payload. Subsequently, an admin role change was executed instantaneously without any time delay or secondary authorization.
Additionally, a whopping 1 billion DOT tokens were minted against a circulating supply of only 356,000, and there was no supply cap to prevent this. The exploit culminated in the full pool being drained in a single transaction, devoid of any rate limits.
The tweet emphasizes that implementing hard constraints at any one of these stages could have potentially thwarted the exploit, detailing the operational gaps in the security policy and automated responses.
Overall, this tweet reports on a specific security incident, detailing how the exploit occurred and its implications.
Tweet URL: View Tweet
Target: Polkadot Hyperbridge
What happened: The tweet discusses the specific exploit of the Polkadot Hyperbridge that resulted in significant financial loss.
A forged proof was accepted due to a failure in the verification function, which didn't check the proof bound to its payload. Subsequently, an admin role change was executed instantaneously without any time delay or secondary authorization.
Additionally, a whopping 1 billion DOT tokens were minted against a circulating supply of only 356,000, and there was no supply cap to prevent this. The exploit culminated in the full pool being drained in a single transaction, devoid of any rate limits.
The tweet emphasizes that implementing hard constraints at any one of these stages could have potentially thwarted the exploit, detailing the operational gaps in the security policy and automated responses.
Overall, this tweet reports on a specific security incident, detailing how the exploit occurred and its implications.
Tweet URL: View Tweet
🚨 Hack Alert!
Target: KelpDAO
What happened: A significant incident has affected KelpDAO, involving the transfer of at least ~$290M.
Funds can be traced to two specific addresses: approximately ~$250M has been traced to address 0x5d3919F12bCc35c26Eee5F8226A9bee90c257Ccc, and around ~$2.5M to address 0xCBb24A6B4DAfaAA1a759A2F413eA0eB6AE1455CC.
This indicates a successful exploit impacting the project, with substantial financial loss.
Tweet URL: View Tweet
Target: KelpDAO
What happened: A significant incident has affected KelpDAO, involving the transfer of at least ~$290M.
Funds can be traced to two specific addresses: approximately ~$250M has been traced to address 0x5d3919F12bCc35c26Eee5F8226A9bee90c257Ccc, and around ~$2.5M to address 0xCBb24A6B4DAfaAA1a759A2F413eA0eB6AE1455CC.
This indicates a successful exploit impacting the project, with substantial financial loss.
Tweet URL: View Tweet
❤1
🚨 Hack Alert!
Target: Aave
What happened: A phishing attack resulted in a loss of 3 WBTC, valued at $221K, after a user signed an increaseApproval signature on the Ethereum network.
The stolen WBTC had recently been withdrawn from Aave. This incident is part of a larger scheme where $585K has been drained from four victims within the past 11 hours using the same drainer method.
The victim's address is 0x5d908c88bE270889C0953E7dfF1C8E1D699cEeA3.
Forensic details include an approval transaction linked here: https://t.co/BP0UbotFzh and the drain transaction can be found at: https://t.co/MAscc7rQLz.
Tweet URL: View Tweet
Target: Aave
What happened: A phishing attack resulted in a loss of 3 WBTC, valued at $221K, after a user signed an increaseApproval signature on the Ethereum network.
The stolen WBTC had recently been withdrawn from Aave. This incident is part of a larger scheme where $585K has been drained from four victims within the past 11 hours using the same drainer method.
The victim's address is 0x5d908c88bE270889C0953E7dfF1C8E1D699cEeA3.
Forensic details include an approval transaction linked here: https://t.co/BP0UbotFzh and the drain transaction can be found at: https://t.co/MAscc7rQLz.
Tweet URL: View Tweet
🚨 Hack Alert!
Target: KelpDAO
What happened: The Arbitrum Security Council has taken emergency action to freeze 30,766 ETH, valued at approximately $70 million. This frozen ETH is associated with the recent KelpDAO exploit, indicating a significant security incident involving funds related to this specific project on the Arbitrum One network. The situation reflects a proactive response to a confirmed hack, emphasizing the impact on stakeholders involved.
🔗Tweet URL: View Tweet
Target: KelpDAO
What happened: The Arbitrum Security Council has taken emergency action to freeze 30,766 ETH, valued at approximately $70 million. This frozen ETH is associated with the recent KelpDAO exploit, indicating a significant security incident involving funds related to this specific project on the Arbitrum One network. The situation reflects a proactive response to a confirmed hack, emphasizing the impact on stakeholders involved.
🔗Tweet URL: View Tweet
❤1
🚨 Hack Alert!
Target: Cork Protocol
What happened: The Cork Protocol fell victim to an exploit involving both a multi-transaction setup and a single atomic transaction, resulting in a loss of $12 million.
Unusual on-chain activity preceded this single transaction, which successfully drained the funds.
While traditional monitoring methods might have detected the unusual activity, they would not have been able to prevent the exploit from executing.
This incident was presented by José Cardoso, the Head of BD at Hypernative, during the Rekt Security Summit in Cannes.
🔗Tweet URL: View Tweet
Target: Cork Protocol
What happened: The Cork Protocol fell victim to an exploit involving both a multi-transaction setup and a single atomic transaction, resulting in a loss of $12 million.
Unusual on-chain activity preceded this single transaction, which successfully drained the funds.
While traditional monitoring methods might have detected the unusual activity, they would not have been able to prevent the exploit from executing.
This incident was presented by José Cardoso, the Head of BD at Hypernative, during the Rekt Security Summit in Cannes.
🔗Tweet URL: View Tweet
❤1
🚨 Hack Alert!
Target: KelpDAO
What happened: A recent security incident involves the @KelpDAO exploiter who has transferred all funds from Ethereum to Bitcoin, with a total amount of $1,979 BTC moved.
Additionally, the @Balancer exploiter has resumed activity after five months, now laundering $700K worth of ETH into BTC via @THORChain.
The incident highlights notable exploits within these DeFi protocols, marking significant fund movements between chains.
🔗Tweet URL: View Tweet
Target: KelpDAO
What happened: A recent security incident involves the @KelpDAO exploiter who has transferred all funds from Ethereum to Bitcoin, with a total amount of $1,979 BTC moved.
Additionally, the @Balancer exploiter has resumed activity after five months, now laundering $700K worth of ETH into BTC via @THORChain.
The incident highlights notable exploits within these DeFi protocols, marking significant fund movements between chains.
🔗Tweet URL: View Tweet
🚨 Hack Alert!
Target: Balancer
What happened: 🚨 The Balancer exploiter, who previously stole approximately $120 million, has been reported active again after five months.
In the past couple of hours, the exploiter transferred 1,100 ETH, valued at $2.55 million, and is in the process of laundering these funds by converting ETH to BTC through THORChain.
The details of the transactions include ETH currently sitting at the following addresses:
1. bc1qlyzhp6en4tk2mkt6sl83lzhxm55ycq2yjcm6u7
2. bc1qx4lwa6ewj5z0t6k4q86yd0gy62ej058hye7y93.
🔗Tweet URL: View Tweet
Target: Balancer
What happened: 🚨 The Balancer exploiter, who previously stole approximately $120 million, has been reported active again after five months.
In the past couple of hours, the exploiter transferred 1,100 ETH, valued at $2.55 million, and is in the process of laundering these funds by converting ETH to BTC through THORChain.
The details of the transactions include ETH currently sitting at the following addresses:
1. bc1qlyzhp6en4tk2mkt6sl83lzhxm55ycq2yjcm6u7
2. bc1qx4lwa6ewj5z0t6k4q86yd0gy62ej058hye7y93.
🔗Tweet URL: View Tweet
🚨 Hack Alert!
Target:
What happened: A suspicious transaction was detected targeting an unverified contract on Ethereum.
An estimated loss of ~$983K occurred due to a missing access-control check in the contract’s execute() function, which allowed arbitrary call execution.
The attacker exploited a pre-existing unlimited yvWETH approval from the victim address, draining 384.67 yvWETH, which was unwound for about 429.2 ETH.
The attack transaction can be viewed here: https://t.co/CjS9S0biHi.
Tweet URL: View Tweet
Target:
What happened: A suspicious transaction was detected targeting an unverified contract on Ethereum.
An estimated loss of ~$983K occurred due to a missing access-control check in the contract’s execute() function, which allowed arbitrary call execution.
The attacker exploited a pre-existing unlimited yvWETH approval from the victim address, draining 384.67 yvWETH, which was unwound for about 429.2 ETH.
The attack transaction can be viewed here: https://t.co/CjS9S0biHi.
Tweet URL: View Tweet
🚨 Hack Alert!
Target: KyberSwap
What happened: KyberSwap was subjected to a reentrancy attack on November 23, 2023.
The attack led to a significant financial impact, resulting in a loss of approximately ~$47M.
Following the incident, an exploiter has laundered 2,900 $ETH, equivalent to $6.8M, through Tornado Cash as part of the illicit activities related to this hack.
Tweet URL: View Tweet
Target: KyberSwap
What happened: KyberSwap was subjected to a reentrancy attack on November 23, 2023.
The attack led to a significant financial impact, resulting in a loss of approximately ~$47M.
Following the incident, an exploiter has laundered 2,900 $ETH, equivalent to $6.8M, through Tornado Cash as part of the illicit activities related to this hack.
Tweet URL: View Tweet
🚨 Hack Alert!
Target: syndicateio
What happened: An exploit has occurred involving the project Syndicate through a compromise of the Commons bridge.
Approximately 18.5 million SYND tokens were acquired by the attacker, leading to a financial impact of around $330,000. The stolen funds were subsequently bridged to Ethereum.
This incident highlights the need for increased vigilance in the Web3 space.
🔗Tweet URL: View Tweet
Target: syndicateio
What happened: An exploit has occurred involving the project Syndicate through a compromise of the Commons bridge.
Approximately 18.5 million SYND tokens were acquired by the attacker, leading to a financial impact of around $330,000. The stolen funds were subsequently bridged to Ethereum.
This incident highlights the need for increased vigilance in the Web3 space.
🔗Tweet URL: View Tweet
🚨 Hack Alert!
Target: AftermathFi
What happened: An exploit has been detected involving AftermathFi, resulting in approximately $900,000 worth of USDC being drained from the platform. The situation is currently under investigation.
Users are advised to remain vigilant as details are still emerging regarding this incident.
Further updates will follow as more information becomes available.
🔗Tweet URL: View Tweet
Target: AftermathFi
What happened: An exploit has been detected involving AftermathFi, resulting in approximately $900,000 worth of USDC being drained from the platform. The situation is currently under investigation.
Users are advised to remain vigilant as details are still emerging regarding this incident.
Further updates will follow as more information becomes available.
🔗Tweet URL: View Tweet
🚨 Hack Alert!
Target: Wasabi Protocol
What happened: 🚨 Alert: A significant security incident has been detected involving the Wasabi Protocol.
An address funded via Tornado Cash has deployed a malicious contract on both the Base and Ethereum networks.
This incident has led to the theft of approximately $4.5M across multiple assets, which include $WETH, $PEPE, $MOG, $USDC, $BITCOIN, $VIRTUAL, $ZYN, $REKT, $cbBTC, and $AERO.
The stolen funds were consolidated into $ETH and then bridged to the Ethereum network, followed by distribution across multiple addresses.
🔗Tweet URL: View Tweet
Target: Wasabi Protocol
What happened: 🚨 Alert: A significant security incident has been detected involving the Wasabi Protocol.
An address funded via Tornado Cash has deployed a malicious contract on both the Base and Ethereum networks.
This incident has led to the theft of approximately $4.5M across multiple assets, which include $WETH, $PEPE, $MOG, $USDC, $BITCOIN, $VIRTUAL, $ZYN, $REKT, $cbBTC, and $AERO.
The stolen funds were consolidated into $ETH and then bridged to the Ethereum network, followed by distribution across multiple addresses.
🔗Tweet URL: View Tweet