DCI-2026-416
A recovery setter lacked effective access control and could wrap the recovery deadline into the past using a crafted period and valid guardian signature. The execution module also accepted reused signed payloads.
A recovery setter lacked effective access control and could wrap the recovery deadline into the past using a crafted period and valid guardian signature. The execution module also accepted reused signed payloads.
Primary source：Public verification source · x.comNon-cryptographic Math.random seed generation exposed predictable wallet identities rather than a consensus failure. Officially affected environments were any iPhone/iPad browser and Mac Safari before October 18, plus the Qubic iOS app before July 2025.
Primary source：Public verification source · x.comA public test account remained on a production whitelist, while new stakes could collect historical rewards they had not earned. The weaknesses combined access control and reward accounting.
Primary source：Public verification source · x.comThe foundation preliminarily attributed unauthorized bridge-database access to forged mint messages accepted by bridge processing logic. The complete entry vector remained under investigation.
Primary source：Public verification source · x.comAn expiring buyback lacked effective slippage protection and spent protocol reserves at a manipulated spot price.
Primary source：Public verification source · x.comCoin-import validation and output-script classification flaws allowed creation of coins without backing. Official source changes document the validation repairs.
Primary source：Public verification source · x.comPublic vesting actions made pooled token balances diverge from recorded shares, permitting excess withdrawals without using administrator functions.
Primary source：Public verification source · uncx.networkGamdom confirmed an unauthorized connection to an automation server used by its hot-wallet system. The initial entry point and any private-key compromise remain unresolved.
Primary source：Public verification source · itokenly.comAutheo confirmed unauthorized THEO minting and suspended affected relayers and mainnet block production. Whether a relay key was stolen, configuration failed, or another privilege was abused remained unresolved.
Primary source：Public verification source · x.comUnauthorized posts from COLDCARD’s account promoted a false firmware vulnerability and migration link. The company said its offline 2FA and credentials remained secure and it could not find a corresponding login/session.
Primary source：Public verification source · x.comPapertrade priced high-leverage synthetics directly from Hyperliquid’s live BBO midpoint while launch-period open-interest limits were unusually broad.
Primary source：Public verification source · www.blockchainposts.comGenuine devices were opened and fitted with separate display-reading and eSIM/LTE hardware to capture recovery phrases during initialization. Ledger said the Secure Element and OS were not modified.
Primary source：Bitquery on-chain investigationEtherVistaPair swap multiplied uint112 reserves for its K check, allowing wraparound to pass despite a real decline in the reserve product.
Primary source：SlowMist security researchUsdcDaiV4Vault withdrew the contract’s entire token balance when liquidity was zero instead of a caller’s proportional share.
Primary source：SlowMist security researchclaimRewards added current balance minus lastETHBalance to rewards on each call but updated lastETHBalance only when a positive claim was paid.
Primary source：Public verification source · smartcontractshacking.comSigned strategy reports bound strategy, nonce, and chain ID but omitted amount fields, allowing reported assets/debt and the share price to be inflated.
Primary source：Public verification source · blackpaper.wikiFrogman publicly reported that two wallets were emptied while he was in Singapore. Independent monitoring identified multiple tokens moved and sold, but the entry vector remains unknown.
Primary source：Public verification source · x.comA lookalike historical recipient induced a victim-signed USDC transfer rather than a passive authorization drain.
Primary source：Public verification source · x.comAn operator hot-wallet private key and OPERATOR_ROLE privileges were compromised, permitting privileged withdrawal of 79AU from the trading pool.
Primary source：Public verification source · x.comArmed intruders restrained and assaulted a cryptocurrency holder and forced a wallet transfer. This was a physical coercion incident rather than a protocol exploit.
Primary source：Public verification source · www.pattayamail.comA lookalike address sharing the head and tail of a prior recipient induced a victim-signed token transfer.
Primary source：Public verification source · x.comThe same zero-fee actualizeFee rounding weakness affected a different ETHMACOAPY victim vault. Donating base Set backing raised currentSetAmount per outstanding share before recalculation.
Primary source：Public verification source · x.comA third-party keeper proxy exposed a drain function without authorization checks, allowing an attacker-chosen worker to move collateral from old won auctions.
Primary source：Public verification source · x.comRebalancingSetTokenV3 actualizeFee recalculated unitShares upward even when no fee was minted, enabling issuance at the old backing ratio and redemption at the new one.
Primary source：SlowMist security researchAn unauthorized party accessed a card-management dashboard; some KYC data may have been exposed.
Primary source：Public verification source · x.comA malicious Permit2 approval from August 2025 remained active and was used in October 2026. The old approval date is not the theft date.
Primary source：Public verification source · x.comA lookalike historical recipient induced a victim to send DAI to an incorrect address.
Primary source：Public verification source · x.comMALT’s swap called a below-peg rebalanceHook before its invariant check, which treated treasury DAI injected into the pool as if supplied by the caller.
Primary source：SlowMist security researchMicrosoft confirmed unauthorized account access.
Primary source：Public verification source · www.theverge.comGPXHooks rebalanced through a shared flash-accounted PositionManager without ensuring GPX/USDC deltas were isolated from an already open attacker unlock.
Primary source：SlowMist security researchA holder wallet’s malicious Permit2 authorization enabled token transfer without exposing a private key. This did not establish a LinqAI protocol compromise.
Primary source：Public verification source · x.comA bug in the Omni deposit/withdrawal interaction allowed credited balances to survive a failed oversized refund/log callback. Official repository regression tests and later CertiK analysis describe the failure path.
Primary source：Public verification source · x.comFlashLoopAdapter trusted a caller-controlled Safe authentication response and accepted attacker-chosen router/calldata, allowing execution through a module enabled on real victim Safes.
Primary source：SlowMist security researchMetaMask confirmed an incident in part of its staking infrastructure. On-chain research observed fee-recipient changes; no withdrawal-key theft or loss of customer principal was established.
Primary source：Public verification source · x.comSKYDAO’s sell path sent tax to a controller and burned/synchronized pool tokens before the seller’s net tokens reached the pair, creating a stale-reserve gap.
Primary source：DeFiHackLabs technical recordMUSystem counted the first-deposit bonus both in an immediate ETH refund and in redeemable MUS allocation, without limiting total redemption to the deposited amount.
Primary source：SlowMist security researchA PositionManager valued existing positions using the manipulable PancakeSwap V3 USDT/BTCB spot price, underestimating NAV and minting excess shares.
Primary source：DeFiHackLabs technical recordReward accrual used a manipulated low MSN reserve, while withdrawal applied the restored higher reserve to the same LP weight.
Primary source：SlowMist security researchScammers operated a private chain and Ethereum bridge using GIWA’s real Chain ID, exploiting a false early-mainnet narrative. The genuine GIWA mainnet had not launched.
Primary source：Bitquery on-chain investigationMEXC’s CEO confirmed a user account takeover and said a surviving API key allowed transfers after email/authenticator recovery and an account freeze.
Primary source：Public verification source · x.comAn unrestricted shared UController registration path let a fabricated Avatar reference Genesis Alpha’s existing Reputation contract and obtain voting control.
Primary source：DeFiHackLabs technical recordA phishing-related NFT buy offer enabled a third party to accept it and receive XRP; the successful transaction was NFTokenAcceptOffer, not a normal Payment.
Primary source：Public verification source · x.comA lookalike address in transaction history induced a transfer to the wrong recipient; the token contract was not compromised.
Primary source：Public verification source · x.comIndependent investigations described exploitation of a third-party security product, credential extraction, lateral movement, and a custom withdrawal tool. Direct private-key and cold-wallet compromise were excluded.
Primary source：Bitget CEO initial noticePayment Processor V2 allowed unauthorized settlement against stale marketplace approvals, enabling zero-price NFT sales and reverse WETH charges. V2 could not be paused; V3 response differed across networks.
Primary source：Public verification source · x.comBlockaid reported an ongoing unbacked wMTRG mint through Meter Passport on BNB Chain. Roughly two mints had a nominal estimate near $2.3 million, and some tokens were sold on PancakeSwap. SlowMist listed it as an attack; realized proceeds and final net loss remain unverified.
Primary source：Blockaid alertDuelbits’ later update concerns restoring services and funding new wallets after the original hot-wallet theft.
Primary source：Duelbits official security noticePayy’s later preliminary postmortem said an invalid burn proof appeared to be accepted by its deployed Noir/Barretenberg verifier, superseding early key-compromise speculation.
Primary source：Payy official incident noticeFour stablecoin transfers totaling $1,063.980000 in face value left the same victim wallet on Ethereum and Polygon. Successful transactions support the in-window theft; the malicious-extension path comes from the victim’s account.
Primary source：Victim incident reportNano Labs confirmed unauthorized control of its founder’s personal X account to promote a fake AI-trading token, $BWA. The company denied issuing or endorsing it; no victim transfer or loss amount was verified.
Primary source：Nano Labs official correctionNeutron proposal #9 transferred control of Astroport and Drop contracts to an attacker, who migrated about ten contracts and drained assets. SlowMist estimated roughly $4.9 million and $4.4 million for the two protocols, about $9.3 million combined; the roughly $1.96 million bridged out and ATOM moved to a recovery multisig are response subsets.
Primary source：Astroport initial noticeDoinGud’s Diamond bidding contract on Polygon failed to clear a bid after payout. The attacker reused the same bid and drained about $35,486 USDC.e.
Primary source：SlowMist Hacked Zone incident recordGaslessReservoirEnabler on Polygon failed to bind transferFrom calls to the authorized owner. The attacker spent existing WETH and ZED allowances; about 997 addresses were drained, with SlowMist estimating a loss near $23,000.
Primary source：SlowMist Hacked Zone incident recordAn unrestricted burn function in RWC on BNB Chain was exploited to burn PancakeSwap pool tokens, use sync() to rewrite reserves, inflate price, and sell. SlowMist recorded about 109,460.85 USDT leaving the pool; the attacker netted about $39,964.07 and the remainder went to project wallets.
Primary source：SlowMist Hacked Zone incident recordInternet Token DAO on Base trusted a caller-supplied Uniswap V3 pool address, allowing a fake-pool callback to mint about 925 million INT. The transaction-specific drain described by SlowMist was 5.847 WETH (about $16,033.55); its $265,000 amount field uses a broader scope and is not treated as realized withdrawal.
Primary source：SlowMist Hacked Zone incident recordMultiversX suffered invalid state changes from a VM-layer atomicity flaw. The network paused and prepared a limited rollback; no user-asset loss was confirmed.
Primary source：SlowMist Hacked recordBlink Wallet paused service after saying a very small number of custodial accounts were accessed and some funds moved; most funds and non-custodial wallets were unaffected.
Primary source：SlowMist Hacked recordThe same cluster used conversion-authorization signatures to extract about $1.56 million in FET and mint roughly $450,000 worth of NTX from NuNet, then touched SingularityNET / WMTx converters. The confirmed primary loss basis is about $2.01 million; nominal token mints are not added.
Primary source：Fetch official confirmationSlowMist and OKX security teams confirmed malicious code in FomoPeek iOS versions 1.1–1.2. Some users suffered private-key exposure and asset transfers, but no verified total loss was published.
Primary source：SlowMist FomoPeek alertLikwid's leverage = 0 branch failed to update pairDelta in _executeAddCollateralAndBorrow, leaving the lending path detached from reserves and allowing repeated extraction of 74.31 BNB.
Primary source：SlowMist Likwid alertNimiq ERC20PermitHTLCHandler failed to validate signature, nonce, and business parameters correctly through RelayHub, allowing an attacker to use legacy allowances and lock and redeem assets worth about $50,463.
Primary source：SlowMist Nimiq alertAn attacker manipulated the thin NSTR market and used inflated collateral to borrow about $3.5 million from Nostra. About $1.92 million reached Ethereum; final loss and recoveries remain unresolved.
Primary source：Nostra official disclosureThe router transfer lacked from and caller-authorization checks; about 41 approved holders were drained for roughly $50,000.
Primary source：SlowMist Hacked recordA transient-storage lifecycle flaw allowed reinitialization of about 330 funded counterfactual accounts in one transaction, causing about $2,876 loss.
Primary source：SlowMist Hacked recordFlamincome's legacy Vault counted permissionlessly injected Curve / Convex assets in share valuation. The attacker used a Morpho flash loan to inflate NAV and redeem aUSDT, realizing about 345,902.67 USDT.
Primary source：SlowMist Flamincome alertAn Ethereum Safe custom LP module and Uniswap V4 hook path were exploited to extract about 2,900 rsETH, estimated at $7.73 million to $7.81 million. A Yoink bot front-ran the main transaction, and Kelp temporarily paused the receiver.
Primary source：PeckShield Safe / rsETH alertA third-party RPC pushed a forged Arc withdrawal event to a keeper, causing a 46.7928 WETH overpayment. The project paused the keeper and refilled the vault, with no user loss.
Primary source：SlowMist Hacked recordSpiralHookV2 used slot0 without TWAP or price limits; multiple EOAs bypassed the same-block guard and borrowed about 10.7 ETH.
Primary source：SlowMist Hacked recordOptim / Splash OADA-related pools on Cardano were exploited and operations paused, after which other OADA pools were emptied. Final ADA / OADA quantities were not disclosed and TVL is not treated as loss.
Primary source：Optim / Splash incident reportChainflip's TRON USDT deposit handling treated memo-modified requests as new swaps, producing six unauthorized payouts totaling 736,442.17 USDT over about 90 minutes.
Primary source：Chainflip recovery updateORBToken automatic allowance, tax-exempt whitelist, and missing reentrancy protection were combined to burn LP, sync reserves, and extract about $32,610.72.
Primary source：SlowMist Hacked recordThe attacker obtained 3 of 5 SILV treasury signatures, emptied the treasury, and sold about 46,909 SILV, realizing about $238,000.
Primary source：SlowMist Hacked recordMissing access control on the caller-supplied solver parameter in AtomicQueue.solve() let an attacker use existing ERC-20 allowances from about 11 users, losing about 15.45 ETH.
Primary source：SlowMist Hacked recordSymbiosis BridgeV2 accepted an abnormal message and minted about 2^62 raw syBTC. The beneficiary then sold about 4.39 WBTC on Ethereum, realizing roughly $336,000.
Primary source：Blockaid initial Symbiosis alertOMNI404 accounting handled small tokenId values and fixed-unit transfers inconsistently across its ERC-20 / ERC-721 hybrid logic. The attacker looped the mismatch to extract WETH; SlowMist's primary basis was 2.4 WETH.
Primary source：SlowMist OMNI404 alertAttackers exploited a Brevo login-authorization boundary to access legitimate customer organizations and send security-themed phishing emails impersonating Trezor, BitBox, and CoinTracking. About 347,000 Trezor newsletter addresses were at risk, with no confirmed on-chain loss.
Primary source：Trezor Brevo incident noticeUsing only a V3 slot0 spot price, the attacker flash-dumped BTX, minted LP at the manipulated quote, and drained about 2,984,557 BTX worth $77,512.
Primary source：SlowMist Hacked recordThe repayWithATokens path could clear debt while reducing the matching aToken burn to zero. About $140,030 was drained before markets paused.
Primary source：SlowMist Hacked recordEnso Finance DPI Strategy Vault used an imbalanced Uniswap V3 spot path for valuation. The attacker swapped 0.683 WETH for FARM, minted excess shares, and redeemed about 5.6 ETH.
Primary source：SlowMist Enso alertAmnext's no-loss lottery / pool contract on BNB Chain allowed anomalous Ticket AMC minting. The attacker extracted about 154.02 WBNB through PancakeSwap, valued near $116,100.
Primary source：TenArmor AMC alertAfter WealthManagementV2 owner authority was unlawfully transferred, the attacker set a zero period and extreme multipliers, then invested, redeemed, and withdrew 26,414 USDT.
Primary source：SlowMist WealthManagementV2 alertHemi Genesis Drop MerkleBox created lockups before updating claimable balances. A malicious lockup reentered claim 63 times, extracting about 124.5 million HEMI and bridging roughly $255,000 in stablecoin proceeds.
Primary source：Hemi official postmortemAn unnamed BNB Chain DEX Router did not verify that uniswapV3SwapCallback came from a real V3 pool. The attacker used victims' existing allowances to transfer about 62.28 WBNB, valued near $46,070.
Primary source：SlowMist BSC Router alertCozy Finance protection markets accepted an uncontested YES result from UMA Optimistic Oracle without independently verifying a real underlying attack. The attacker burned PTokens, claimed USDC.e, and bridged it out; SlowMist's primary estimate was about $160,000.
Primary source：Cozy Finance incident reportA low-liquidity dormant Rocket perpetual market was manipulated through self-trading, creating false positive PnL before about $287,000 was withdrawn through the Bridge. Deposits, withdrawals, and trading were paused.
Primary source：Rocket official updateAn ambiguity in Elements confidential-transaction rangeproof caching enabled roughly 4,000 unbacked L-BTC to be minted and pegged out through the normal federation reserve. About 3,400 BTC was publicly reported returned, while the remaining balance is unresolved.
Primary source：CertiK Liquid incident analysisDream Health Chain's reward state machine could be reset with a tiny or effectively zero DHC deposit. The attacker repeatedly claimed fixed rewards and sold about 542,070 DHC, for a loss of about 71,851 USDT.
Primary source：SlowMist Dream Health Chain alertRedSonic Vault allowed permissionless asset registration and counted the same stETH in both rsvETH and rsvstETH vaults. A Balancer flash loan amplified share pricing and extracted about 9.25 ETH, valued near $22,800.
Primary source：SlowMist Reddio technical alertSecured Finance order-book accounting treated unfilled or manipulated orders as valid price inputs. The attacker combined flash loans and self-trading to extract funds; Ethereum, Arbitrum, and Filecoin markets were paused, with a primary loss basis of about $180,000.
Primary source：Secured Finance official updateNotional confirmed that a legacy V1 contract was exploited. An integer truncation in the free-collateral path allowed checks to be bypassed, leading to withdrawals of about 69,257 DAI and 1,658,525 USDC that were converted into roughly 689.2 ETH.
Primary source：Notional official incident confirmationSeveral historical SAFEs registered the shared GebProxyActions contract as owner. An attacker directly called the unauthenticated quitSystem helper and withdrew residual collateral from four SAFEs, totaling about 5.9436 ETH.
Primary source：SlowMist technical alertTwo Ethereum users had not revoked malicious approvals signed in 2024. After SYN and USDC reached the wallets, the old approvals were used to transfer assets worth a reported total of $187,046.
Primary source：Scam Sniffer original alertAn attacker used flash loans to distort a Uniswap V3 spot price, causing Float Protocol Hypervisors to misprice shares and allowing about 10.71 ETH to be extracted through repeated deposits and withdrawals.
Primary source：SlowMist technical alertA flaw in Ankr's ankrFLOW contract allowed about 8.6 million unbacked tokens to be created and deposited into MORE Markets, where roughly 15.5 million WFLOW was borrowed. Flow corrected the spot-value reserve impact to about $410,000.
Primary source：Flow official incident statementAquifer's Solana swap program accepted attacker-controlled token accounts and a fake token program, completing 212 swaps with real output and no real input. About $2.47 million was converted to SOL and bridged to Ethereum.
Primary source：Bitquery on-chain reconstructionSlowMist reported that after compressing a Balancer V1 BPool's WBTC reserve, rounding in joinswapPoolAmountOut allowed the attacker to mint BPT with minimal input and exit with multiple assets, for an estimated loss of about $234,000.
Primary source：SlowMist Balancer V1 alertTectonic on Cronos was exploited after the attacker inflated the price of thinly traded TONIC and borrowed liquid assets. Security researchers estimated $66 million to $75 million, with about $6 million bridged to Ethereum and most remaining on Cronos after the halt.
Primary source：Cronos Network official halt noticeInternal liquidation accounting across several Ajna v2 lending pools on Ethereum was manipulated through repeated liquidation paths. Ajna told users to withdraw and stop interacting; external monitoring estimated about $775,000 in losses.
Primary source：Ajna official risk disclosureFogo Foundation confirmed that an unknown actor moved 400 million FOGO from assets under foundation control, about 4% of total supply. The chain continued operating; the token amount was valued at about $3.88 million, while complete addresses and transaction hashes remain unpublished.
Primary source：Fogo official noticeAn outdated Rain Solana card-balance contract was exploited through its authorization path, allowing batch withdrawals after crafted signature and administrator calls. Avici confirmed 1,685 users and $500,859.22 in affected card balances and announced refunds; a broader on-chain estimate of about $1.02 million is not additive.
Primary source：Avici initial official disclosureThe price of thinly traded MAMO collateral in Moonwell's Base lending markets was inflated, allowing the attacker to borrow real assets such as cbBTC and USDC. Security researchers estimated about $8.79 million, and Moonwell restricted the affected markets.
Primary source：Moonwell official responseA CCC Token sell path on BNB Chain could alter the token reserve held by its LP. The attacker used the accounting behavior to create a price anomaly and extract liquidity; TenArmor estimated about $117,000 at stake.
Primary source：TenArmor CCC alertSpecter disclosed a four-week TRON address-poisoning campaign affecting 15 victims with an aggregate loss of about $9.4 million. Verifiable in-window USDD inflows totaled about 3,191,402.34, but cannot be treated as new net loss for the window.
Primary source：Specter campaign analysisAn Enjin Managed Delegate Proxy on Ethereum was taken over through a DELEGATECALL storage collision and an unprotected initializer. The attacker registered a malicious adapter and transferred assets; SlowMist estimated about $162,000 in losses.
Primary source：SlowMist Enjin technical alertCometDEX's BLND-USDC pool on Stellar was exploited through a reserve-accounting flaw involving repeated USDC-to-USDC swaps. SlowMist reported about $717,518.92; Blend's ordinary deposit pools were unaffected, while backstop depositors were impacted.
Primary source：Blend initial warningPacaSwap confirmed that its SWAP / DAG liquidity pools were drained through a metagraph vulnerability and paused the Bridge. The project said it would cover affected LP losses, but disclosed no USD amount, attacker address, or transaction hash.
Primary source：PacaSwap initial security noticeTrezor confirmed a new targeted phishing wave using data leaked from multiple crypto services. No new on-chain loss has been publicly confirmed, but the campaign is an active malicious distribution threat to multi-chain wallet users.
Primary source：Trezor official phishing responseThe FH / USDT PancakeSwap V2 pool on BNB Chain was exploited through repeated buy-and-sell calls. A FHToken sell-tax flaw corrupted pool reserves, with security researchers estimating about $20,000 in losses.
Primary source：SlowMist FH technical alertRealio-controlled realio.fund wallets showed continuing anomalous outflows across five chains from August 25. A community ledger recorded 127,918,788 RIO and about $263,596 in liquid assets; Realio confirmed an attack and paused the affected WebApp.
Primary source：Realio official incident noticeAn attacker exploited state-dependent Uniswap V3 mint/burn accounting in a 2021 legacy G-UNI ENS–WETH vault, extracting about 2.94 WETH valued near $7,100 through atomic liquidity operations. Arrakis Pro vaults were unaffected.
Primary source：SlowMist Arrakis alertAn attacker used a low-cost tmvETH / gtmvETH voting-power path to influence Term Vault governance and drain about $8.5 million, including about 2,843 ETH and $1.68 million in stablecoins. Term closed Meta Vaults, revoked DAO roles, and blocked new deposits while withdrawals remain available.
Primary source：Term Labs initial confirmationThe Base SAND OFT approveAndCall / LayerZero delegate path was abused to mint large amounts of unbacked SAND. The Sandbox confirmed containment; SAND on Ethereum and Polygon was unaffected. GoPlus estimated actual loss constrained by liquidity and reserves at about $670,000.
Primary source：Blockaid SAND OFT initial reportDust transfers and look-alike addresses polluted transaction history. After a Bofur Capital-labeled Ethereum address withdrew from Compound, it mis-sent 2,000,000 USDC to the poisoned address, which was later swapped into about 1,999,939.4763 DAI.
Primary source：ScamSniffer Bofur alertMANTRA confirmed exploitation of an upstream Cosmos-EVM module vulnerability. The mainnet paused near block 17,449,398 and two MANTRA management wallets were affected. MANTRA said user, exchange, and partner funds were not directly affected; the chain later resumed block production with v8.4.0.
Primary source：MANTRA initial announcementRust security response confirmed malicious versions of arrayref, internment, and append-only-vec were published and could execute a malicious dependency during builds. The versions were removed and the account was locked; no specific crypto project or on-chain loss was confirmed.
Primary source：Rust official security responseSlowMist disclosed malicious activity in historical Solidity Pro VS Code extension versions, exposing browser wallets, local private keys and seed phrases, API keys, SSH keys, and source-control credentials. It is a disclosed malicious developer-tool supply-chain campaign, but no single on-chain victim transaction has been confirmed.
Primary source：SlowMist Solidity Pro X alertMAYAChain suffered a composable protocol attack in which false-subsidy and accounting-validation flaws created unsupported internal ARB.LINK balances. The attacker extracted CACAO and LINK through liquidity operations and moved value to Bitcoin, Ethereum, Arbitrum, and THORChain. Confirmed L1 outflows were about $1,356,218, while total attacker-held value was estimated at about $1,647,599.
Primary source：Aaluxx MAYA incident statementA BitMart-linked executive confirmed that the Chinese official X account was compromised and that the abnormal content was not posted by a current employee. The original malicious post is unavailable, and no verifiable on-chain theft or user-asset loss was found.
Primary source：BitMart Chinese-account takeover confirmationAn on-chain transaction shows a Solana wallet sending 6.209202768 SOL to a receiving address. The private key had been imported into a trading bot, but public evidence does not identify the bot, clipboard, endpoint malware, or social engineering as the specific leak path.
Primary source：Solana wallet-drain source postSafePal disclosed unauthorized access in its order-tracking plugin, affecting information for about 39,798 historical customers, including names, emails, delivery addresses, phone numbers, and purchase details. Seeds, private keys, wallet passwords, payment cards, and government IDs were not involved.
Primary source：SafePal official disclosureOn BNB Chain, FoxLpBondsPool read a manipulable PancakePair spot price and reused a stale _stakeAmount, causing Treasury to mint excessive Fox rewards. The attacker sold the new Fox in the same transaction for an estimated $118,700 gain.
Primary source：SlowMist Fox root-cause analysisTrezor disclosed unauthorized access in a third-party ShipMonk logistics environment. Full names, emails, phone numbers, and delivery addresses were exposed for 11,742 customers, while names, cities, and emails were exposed for another 1,947. Wallets, devices, and backup words were not identified as compromised.
Primary source：Trezor official disclosureAfter a victim signed an effectively unlimited increaseAllowance, the attacker used multicall to execute three transferFrom calls six seconds later and moved about 550,019.146870 USDC. The alert rounded the amount to 549,744 USDC; the on-chain Transfer sum is retained as the precise basis.
Primary source：ScamSniffer Arbitrum approval-theft alertTwo public Ethereum wallets were drained within approximately 15 minutes, after which the assets were swapped into about 20 million DAI and 3,000 ETH. Security researchers favor likely private-key exposure, but the victim has not published endpoint forensics; $25–25.6 million is a valuation range from different reporting points.
Primary source：ScamSniffer TLBL initial alertHarmony's forensic update placed the first anomalous activity at Shard 0 block 92,730,036 on August 12, 2026 at 07:25:41. The first wave minted 4 billion ONE in two empty blocks, while a six-transaction, four-wallet reconstruction totals 3,010,000,100,000 ONE. Cross-shard receipt replay is the confirmed primary flaw; the empty-signature quorum issue remains a secondary attribution under review. No final freeze or net USD loss was public.
Primary source：Harmony initial response, patch, and rollback optionsCyvers disclosed an address-poisoning incident in which a victim copied an impersonating address from transaction history and mis-sent approximately 100,012.89 USDT. The attacker then swapped the USDT for about 52.8 ETH. The attacker, victim, and loss-transaction identifiers were truncated in the source image and are not guessed.
Primary source：Cyvers address-poisoning alertSlowMist Hacked Zone and Oraichain’s official notice describe an EVM cross-chain transfer flaw that enabled unauthorized ORAI minting. The network was paused for remediation, burning, and reconciliation; no verifiable loss amount was disclosed.
Primary source：Oraichain official security noticeBifrost confirmed exploitation of a shared Guardian Vault across three farming pools involving 881,150 DOT, publicly valued at about $720,000. The underlying vDOT reserve remained 1:1 backed, and complete attack identifiers were not disclosed.
Primary source：Bifrost initial official noticeUSM / FUM on Ethereum was exploited through flash loans and about 64 split defund calls, with an estimate of 70.83 ETH and a disclosed USD value of about $136,000.
Primary source：CertiK technical alertCoinsbuy-linked hot wallets suffered concentrated outflows on Ethereum and TRON with a public estimate of about $7.9 million. Some funds moved through ChangeNOW, FixedFloat, and BingX; the root cause and final aggregation route remain incomplete.
Primary source：DarkWebInformer addresses and initial routeThe same phishing activity placed sponsored ads in Trezor and Ledger searches and directed users to imitation pages for high-risk wallet actions. Cross-window losses were estimated above $3 million, while the strict-window increment cannot be isolated.
Primary source：CoinDesk Trezor sponsored-ad alertBTCPay Server / LND nodes were affected by a server flaw or credential exposure, and operators including Foundation and Citadel21 reported Lightning funds being drained. Public reporting has not established a unified victim set or total loss.
Primary source：BTCPay flaw and affected-entity leadsA personal wallet on Base lost approximately 500,000 USDC after phishing or malicious authorization. The attacker then swapped through a low-liquidity Uniswap V4 pool and ended with about 67 WETH; most value was captured by MEV and was not returned to the victim.
Primary source：PeckShield alertSlowMist recorded a compromise of ZEUS Bitcoin Lightning wallet and LSP infrastructure. The incident was mitigated, customer funds were not lost or at risk, and services were temporarily offline.
Primary source：SlowMist Hacked Zone ZEUS recordThe Keyv / Cacheable npm release chain was hijacked, allowing malicious versions to target CI/CD and developer credentials. Multiple security teams corroborated the compromise, but no unified direct on-chain loss amount was confirmed by the report cutoff.
Primary source：SlowMist Web3 supply-chain alertAn RISEx-linked RWA strategy suffered an unauthorized withdrawal of 673,011.56 USDC. SlowMist records the incident date as August 3; the project said it patched the issue and fully compensated XLP depositors, which is not the same as recovering attacker funds.
Primary source：SlowMist Hacked Zone RISEx recordKRON said that re-importing an internal token caused an indexing and accounting mismatch around the PEPE pool. Trading was unavailable for about two hours and LP access was paused longer; the team restored from backup, blocked the path, and said no funds were stolen, drained, or moved.
Primary source：KRON transparency reportTenArmor flagged a successful transaction with multiple assets and protocol calls and estimated approximately $907,700 at risk. The transaction and tokens are verifiable on BNB Smart Chain, but the root cause, affected-contract boundary, and final net loss require independent analysis.
Primary source：TenArmor original alertExVul, Backward Labs, and on-chain researchers documented a LpdFi oracle-manipulation attack on BNB Chain. The attacker used flash-loan and spot-price manipulation to remove LP assets; public estimates put the loss at approximately $696,952.81.
Primary source：ExVul initial report and attack transactionA user reported that assets from 22 OKX Web3 extension wallets were moved after downloading several untrusted VPN tools, with about 1,000 USDT reported lost and about 300 USDT moved to safety. Public evidence supports a personal-wallet compromise lead, but no malware sample, complete transaction path, or independent forensic conclusion was available.
Primary source：Victim’s original X postThe attacker used a compromised off-chain signer key to set the discount parameter to 1, bought roughly 687,000 STY for about 19,700 USDT, and sold the tokens for approximately 625,000 USDT in net proceeds. Defimon reported that repeated ecrecover calls resolved to the same hardcoded signer, supporting a key-compromise finding.
Primary source：Defimon Alerts exploit analysisAn attacker used an unrestricted low-level CALL in an unverified Base contract to abuse an existing WETH approval and transfer 16.623029776956898128 WETH from a victim. The exploit occurred on July 30 and was disclosed by SlowMist on August 1, making it a prior-case technical disclosure during the window.
Primary source：SlowMist technical alertAn attacker used a malicious SetToken, pre-issue hook, and fake valuer to inflate component units by approximately 93.66 times after quotation, causing ExchangeIssuance to transfer excess real assets. SlowMist estimated the loss at about $9,600.
Primary source：SlowMist full exploit analysisCoinkite confirmed a weak-entropy flaw in seed generation on older COLDCARD firmware. The first three waves confirmed approximately 1,367.05 BTC; on August 12, 2026, SlowMist disclosed a cross-wave cumulative total of at least 1,719 BTC, about $111M, across more than 5,200 addresses. The initial 388.92748828 BTC fourth-wave figure from August 3 remains under review and is not added again.
Primary source：Coinkite seed-generation security warningSlowMist MistEye disclosed a recruitment-scam campaign targeting Web3 professionals. Attackers impersonated recruiters and induced targets to install malware disguised as the Relay AI meeting tool on macOS or Windows in order to steal endpoint credentials.
Primary source：SlowMist recruitment-malware alertThe privileged recycle() function in the LULA Rental contract could move LULA directly from a PancakeSwap V2 pool and call sync(). The attacker combined flash liquidity, reward claims, and reserve updates to obtain 578,295.907588061 USDT.
Primary source：BlockSec Phalcon analysisTheIndexFi’s X account published abnormal wallet-connection content. The project said this was not an external takeover: a former member still retained delegated access. The team removed the content and revoked access. No victim transaction or loss has been confirmed.
Primary source：TheIndexFi abnormal postIn CryptoDAO Global’s previous PRO implementation, exec() lacked a caller check. The attacker repeatedly invoked the function through an attack contract and distorted the PRO/USDT price, earning approximately $52,000. The proxy was later upgraded to an implementation with caller validation.
Primary source：GoPlus attack analysisSlowMist recorded approximately $650,000 drained from ChainConnect bridge contracts across Ethereum, BNB Chain, Avalanche, and Polygon in 23 transactions. Venom Foundation later confirmed a bridge security incident and the suspension of all bridge operations.
Primary source：SlowMist Hacked Zone incident recordAfter the victim signed a transaction presented as multicall, an inner call granted an attacker unlimited approval. About 36 seconds later, the attacker used transferFrom to remove 332,787 alphaUSDCDeltaV2, valued at approximately $340,463.
Primary source：Scam Sniffer primary alertAn independent Garden Finance solver’s off-chain database was compromised and populated with fraudulent records, causing HTLC flows on Ethereum, Base, Arbitrum, and BNB Chain to release approximately 450,000 USDT improperly. The project said its core protocol and smart contracts were not compromised and took the application offline.
Primary source：Blockaid primary alertWEMIX confirmed that ownership of a WEMIX$-related contract was compromised. The attacker minted approximately 5.2255 million WEMIX$ without authorization and swapped it into 30,736 WEMIX and 724,198.27 USDC.e. Reported loss uses an approximately $730,000 realized-value basis and does not add nominal minted value.
Primary source：Initial WEMIX security noticeProjekt’s GREEN/GOLD reward vault used permissionless trackPurchase() to allocate rewards from token-balance changes without verifying real ETH expenditure. The attacker used flash liquidity and skim() to create fake purchase records, then withdrew approximately 301.7 ETH, valued near $560,000, through massWithdraw().
Primary source：Defimon technical analysisBankrbot’s X account was taken over despite an on-device passkey and used to publish fake airdrop links. In the same incident window, a project wallet without multifactor authentication was drained of approximately 1.5 billion BNKR. SlowMist Hacked Zone records a loss of about $479,885.
Primary source：Bankrbot team account-compromise noticeTriple-A confirmed unauthorized access to company hot wallets across multiple chains and a final loss of approximately $11.8 million. Client and merchant funds were unaffected. Assets were swapped, bridged, and consolidated on Ethereum, and services resumed after security checks.
Primary source：PeckShieldAlert multi-chain outflow alertAfter the SOLID collateral feed failed, Solido Cash incorrectly fell back to a CASH price near $1 and severely overvalued low-priced SOLID. The attacker minted 809,051.55 CASH and obtained approximately 293,705,544.97 SUPRA.
Primary source：Solido forensic-report announcementLien Finance’s exchangeEquivalentBonds compared only aggregate anomaly counts and did not verify each bondID multiplicity. The attacker duplicated a bondID in the output, minted undercollateralized BondToken, and redeemed 542,144.63 USDC through preapproved endpoints.
Primary source：SlowMist TI alert and root-cause analysisEvan Jawad said an unknown file led to compromise of his PC, multiple accounts, and X account, followed by the transfer of more than $600 in wallet assets and NFTs, for a total loss exceeding $1,000. This is a first-party report without public addresses, transaction IDs, sample, or independent forensics.
Primary source：Evan Jawad first-party statementRobinhood confirmed that Vlad Tenev’s X account was compromised and used to promote a fake VLAD token before access was restored. GoPlus associated address 0xd70627fd9ee5b70906620a6f2001ba74457b438d with the token deployment and an estimated $1.2 million to $1.3 million in attacker profit; that profit is not confirmed victim net loss.
Primary source：Robinhood Comms confirmationThe attacker exploited different handling of duplicate proofRoots on Verus and Ethereum, allowing a malicious state root to overwrite the genuine root. A fabricated import proof based on a 0.01 VRSC export then released approximately $7.44 million from bridge reserves.
Primary source：BlockSec Phalcon root-cause updateB² Network confirmed unauthorized access to its staking-contract upgrade authority. Approximately 8.591 million B2 was withdrawn; nominal value was about $3.86 million and realized proceeds were about 5,409 BNB, or $3.01 million.
Primary source：x.com sourceApproximately 24.15 million USDC left the AFX custodial bridge and was converted into about 12,467.44 ETH. On July 25, 2026, monitoring showed 655.4 ETH converted through THORChain into 18.86 BTC, while about 11,812 ETH remained at related addresses; no freeze, return, or recovery was confirmed.
Primary source：x.com sourceAn unrevoked Permit was reused to steal 75,780 USDC; the two known thefts total about 77,405 USDC.
Primary source：x.com sourceAn abnormally low BTCB oracle price triggered immediate liquidations, causing an estimated $912,000-$915,000 loss.
Primary source：x.com sourceFlashTrade confirmed an unauthorized $98,000 withdrawal from an ephemeral instance. Newly deployed withdrawal batching and monitoring detected and contained the event quickly. The team said it would cover the amount in full and that user funds were unaffected.
Primary source：FlashTrade initial announcementAbout 515 million NIGHT tokens were exposed; realized swaps and the reported nominal $9-13 million exposure are recorded separately.
Primary source：x.com sourceA malicious IDE extension targeted developer credentials and wallet material through the software supply chain.
Primary source：x.com sourceA cold wallet operated by a Zilliqa partner exchange was compromised; the cited sources did not establish one USD loss figure.
Primary source：x.com sourceAn approval granted about a year earlier was used to steal approximately $84,000 after funds returned to the victim wallet.
Primary source：x.com sourceA protocol weakness caused approximately $118,100 in reported losses.
Primary source：bscscan.com sourceA bridge weakness caused approximately $1.65 million in reported losses.
Primary source：x.com sourceFraudulent recruiting workflows delivered malware through GitHub repositories, creating credential and wallet-theft risk.
Primary source：x.com sourceA smart-contract weakness caused approximately $201,400 in reported losses.
Primary source：bscscan.com sourceA protocol weakness caused approximately $61,300 in reported losses.
Primary source：bscscan.com sourceAcross confirmed that a Solana off-chain event-reading defect caused a Risk Labs relayer to advance real assets against forged deposits, with reported loss of approximately $3.6 million. On July 28, 2026, a labeled attacker address returned 331.8 ETH to the Across Hub Pool Owner Multisig, valued at about $623,900 when disclosed.
Primary source：x.com sourceA pricing weakness enabled abnormal liquidations and approximately $580,000 in reported losses.
Primary source：certik.com sourceA protocol weakness was exploited for approximately $8,500.
Primary source：x.com sourceA vault weakness caused approximately $1.34 million in reported losses.
Primary source：x.com sourceMalware replaced Telegram and Ledger/Trezor software while stealing local credentials; aggregate on-chain loss remains unknown.
Primary source：slowmist.medium.com sourceAn oracle and pricing weakness caused approximately $23.75 million in reported losses.
Primary source：x.com sourceA protocol incident led to approximately $24,883 in reported losses.
Primary source：x.com sourceA contract-level weakness was exploited for approximately $109,600.
Primary source：bscscan.com sourceAn authorization weakness affecting smart accounts enabled approximately $270,000 in unauthorized asset transfers.
Primary source：x.com sourceLiquidity was removed from a PHX Pancake pool, causing approximately $89,600 in reported losses.
Primary source：x.com sourceA long-time Solana holder lost assets estimated at about $14.2 million after a personal wallet compromise.
Primary source：x.com sourceA pricing and liquidation weakness caused approximately $9.05 million in reported losses.
Primary source：x.com sourceA malicious governance path was used to extract approximately 776,600 USDC.
Primary source：x.com sourceA malicious governance action created an exposure estimated at about $20 million and triggered emergency community response.
Primary source：x.com sourceAn attacker manipulated shared vault accounting and price calculations, causing approximately $6.04 million in reported losses.
Primary source：x.com sourceA Gate user reported an account takeover and approximately $1.7 million in disputed losses; responsibility remains contested.
Primary source：etherscan.io sourceA protocol weakness was exploited for approximately $820,000, according to the cited on-chain security disclosures.
Primary source：x.com sourceAn indexer-level attack disrupted data integrity, but the cited sources did not identify a direct asset loss.
Primary source：x.com sourceAt least 30 lookalike Web3 packages carried credential-stealing code; aggregate wallet losses were not publicly established.
Primary source：x.com sourceAttackers manipulated an ERC-4626 share price used as collateral, extracting about $353,000 and leaving roughly $403,000 in bad debt.
Primary source：x.com sourcePublic sources identify Unnamed Base ERC-4626 vault exploit as a on-chain smart-contract exploit incident. No single verifiable USD loss amount was published.
Primary source：Public security alert or project statementPublic sources identify AIDC — on-chain smart-contract exploit as a on-chain smart-contract exploit incident. No single verifiable USD loss amount was published.
Primary source：Public security alert or project statementPublic sources report Cook Finance Issuance — on-chain smart-contract exploit, with a loss of approximately $50,000.
Primary source：Public security alert or project statementMini Shai-Hulud, Miasma, and Hades malware expanded into Go modules in a documented supply-chain campaign; no verified aggregate loss amount was published.
Primary source：Public security alert or project statementCompromise of the czirker developer account contaminated 23 npm packages; no verified aggregate loss amount was published.
Primary source：Public security alert or project statementPublic sources report Polymarket International — Front-end Vulnerability, with a loss of approximately $3,000,000.
Primary source：Public security alert or project statementPublic sources identify Ocean Protocol BPool/SideStaking — on-chain smart-contract exploit as a on-chain smart-contract exploit incident. No single verifiable USD loss amount was published.
Primary source：Public security alert or project statementPublic sources report Lixir Finance forged Permit signature theft, with a loss of approximately $12,300.
Primary source：Public security alert or project statementA wallet drainer was injected into the Yield Yak voting subdomain; no verified aggregate loss amount was published.
Primary source：cryptopolitan.com public sourcePublic sources report DLMC — on-chain smart-contract exploit, with a loss of approximately $222,560.
Primary source：Public security alert or project statementPublic sources report Royal.io/Royal Royalties — on-chain smart-contract exploit, with a loss of approximately $261,163.
Primary source：Public security alert or project statementA wallet drainer was injected into a Gitcoin voting subdomain; no verified aggregate loss amount was published.
Primary source：cryptopolitan.com public sourceA deterministic nonce-derivation flaw in the SecondFi web-wallet software signer made some Cardano private keys derivable from public signatures. Public reporting confirms about 16 million ADA, worth roughly $2.4 million, was stolen.
Primary source：Public security alert or project statementPublic sources identify ATM liquidity-pool transfer front-run by a burn transaction as a on-chain smart-contract exploit incident. No single verifiable USD loss amount was published.
Primary source：Public security alert or project statementPublic sources report Taiko Bridge — Fake Proof Exploit, with a loss of approximately $1,700,000.
Primary source：Public security alert or project statementPublic sources report Quicksilver Zone — Unchecked Proof Minting, with a loss of approximately $3,500.
Primary source：DeFiLlama Hacks databasePublic sources report OLPC/LABUBU — on-chain smart-contract exploit, with a loss of approximately $1,115,904.
Primary source：Public security alert or project statementPublic sources report JaredFromSubway MEV Bot — Reverse MEV Honeypot, with a loss of approximately $7,500,000.
Primary source：Public security alert or project statementPublic sources report mySwap CL — CL Pool Accounting Hack, with a loss of approximately $300,000.
Primary source：DeFiLlama Hacks databasePublic sources report Secret Network — Unbacked Mint via ICS-20, with a loss of approximately $4,670,000.
Primary source：ourcryptotalk.com public sourcePublic sources report Namada Shielded Pools — IBC Transfer Logic Exploit, with a loss of approximately $600,000.
Primary source：DeFiLlama Hacks databasePublic sources report JB — on-chain smart-contract exploit, with a loss of approximately $49,958.
Primary source：Public security alert or project statementPublic sources report WHALE — on-chain smart-contract exploit, with a loss of approximately $3,460.
Primary source：Public security alert or project statementA malicious dependency was inserted across more than 140 Mastra packages; no verified aggregate loss amount was published.
Primary source：Public security alert or project statementPublic sources report Little Boy Plus/LBP — on-chain smart-contract exploit, with a loss of approximately $367,000.
Primary source：Public security alert or project statementPublic sources report Aztec V1 EscapeHatch — on-chain smart-contract exploit, with a loss of approximately $2,200,000.
Primary source：DeFiHackLabs on-chain reproductionPublic sources report RetoSwap — ACK Frontrun Attack, with a loss of approximately $2,700,000.
Primary source：DeFiLlama Hacks databasePublic sources report DIP — on-chain smart-contract exploit, with a loss of approximately $111,098.
Primary source：Public security alert or project statementPublic sources report Thetanuts Finance — on-chain smart-contract exploit, with a loss of approximately $105,000.
Primary source：Public security alert or project statementThe fake SStar Agent Web3 AI project distributed malware; no verified aggregate loss amount was published.
Primary source：Public security alert or project statementPublic sources report Aztec Connect — on-chain smart-contract exploit, with a loss of approximately $2,190,000.
Primary source：Public security alert or project statementMalicious PyPI packages including openai_mcp formed a software-supply-chain campaign; no verified aggregate loss amount was published.
Primary source：Public security alert or project statementPublic sources report Raydium AMM — Fake LP Mint Attack, with a loss of approximately $1,340,000.
Primary source：Public security alert or project statementPublic sources report Token of Power/TOP — on-chain smart-contract exploit, with a loss of approximately $1,580,000.
Primary source：Public security alert or project statementPublic sources report NovaBox — on-chain smart-contract exploit, with a loss of approximately $107,000.
Primary source：Public security alert or project statementPublic sources report Asterix — DN404 Forge Loop, with a loss of approximately $40,000.
Primary source：DeFiLlama Hacks databasePublic sources identify Flooring Protocol — DN404 Forge Loop as a DN404 Forge Loop incident. No single verifiable USD loss amount was published.
Primary source：DeFiLlama Hacks databaseHumanity Protocol’s investigation says phishing and remote-access malware enabled the theft of project keys used for unauthorized transfers, minting, and sales of $H on Ethereum and BNB Chain; the aggregate uses the later loss estimate of approximately $36 million.
Primary source：Humanity Protocol official investigation summaryPublic sources report Syscoin Bridge — Fake Proof Exploit, with a loss of approximately $8,000,000.
Primary source：halborn.com public sourcePublic sources report Ambient CrocSwapDex — on-chain smart-contract exploit, with a loss of approximately $110,000.
Primary source：Public security alert or project statementPublic sources report ATOHook — token-pool smart-contract exploit, with a loss of approximately $2,100,000.
Primary source：Public security alert or project statementPublic sources report BOSS — on-chain smart-contract exploit, with a loss of approximately $10,208.
Primary source：Public security alert or project statementPublic sources report DTXT — on-chain smart-contract exploit, with a loss of approximately $35,041.
Primary source：Public security alert or project statementPublic sources report AISO Presale — on-chain smart-contract exploit, with a loss of approximately $30,315.
Primary source：Public security alert or project statementPublic sources report BY Token — on-chain smart-contract exploit, with a loss of approximately $87,402.
Primary source：DeFiHackLabs on-chain reproductionPublic sources report ATM Token — on-chain smart-contract exploit, with a loss of approximately $243,543.
Primary source：DeFiHackLabs on-chain reproductionPublic sources report GPU.NET — Social Engineering, with a loss of approximately $10,600.
Primary source：DeFiLlama Hacks databaseThe Red Hat Cloud Services npm publishing chain was compromised; no verified aggregate loss amount was published.
Primary source：Public security alert or project statementPublic sources report TSR — Infinite Mint and Dump, with a loss of approximately $2,500,000.
Primary source：Public security alert or project statementPublic sources identify Gnosis Pay — Zodiac Delay Module Exploit as a Zodiac Delay Module Exploit incident. No single verifiable USD loss amount was published.
Primary source：DeFiLlama Hacks databaseFluid Lending reward-list operational-key compromise was reported on 2026-05-31. Evidence indicates that an operational key controlling the reward list was compromised. Reported loss is approximately $215,000.
Primary source：fluid.io public sourceAFI Protocol afiUSD Vault theft was reported on 2026-05-31. Evidence indicates that afiUSD Vault authority was used to transfer assets without authorization. Reported loss is approximately $480,000.
Primary source：x.com official statementAROS price-manipulation incident was reported on 2026-05-31. Evidence indicates that the AROS market was manipulated through a pricing or liquidity path. Reported loss is approximately $295,000.
Primary source：defillama.com public sourceGravity Bridge compromise was reported on 2026-05-30. Evidence indicates that the bridge validator or signing path was compromised. Reported loss is approximately $5,400,000.
Primary source：x.com public sourceYSDAO reserve manipulation was reported on 2026-05-29. Evidence indicates that reserve accounting was manipulated to extract value. Reported loss is approximately $19,500.00.
Primary source：hacked.slowmist.io public sourceMoneyMon signature-validation bypass was reported on 2026-05-29. Evidence indicates that a signature-validation bypass allowed unauthorized execution. Reported loss is approximately $85,519.47.
Primary source：hacked.slowmist.io public sourceAlephium TokenBridge off-chain guardian exploit was reported on 2026-05-29. Evidence indicates that false off-chain bridge messages bypassed guardian validation. Reported loss is approximately $815,000.
Primary source：x.com public sourceONTR zero-address ownership and hidden-balance exploit was reported on 2026-05-28. Evidence indicates that zero-address ownership and hidden-balance logic enabled unauthorized control. Reported loss is approximately $98,200.00.
Primary source：hacked.slowmist.io public sourceJoe Agent reentrancy exploit was reported on 2026-05-28. Evidence indicates that a reentrancy weakness allowed repeated execution. Reported loss is approximately $45,000.00.
Primary source：hacked.slowmist.io public sourceJINX-0164 macOS malware campaign was reported on 2026-05-28. Evidence indicates that a macOS information-stealing malware family targeted credentials and wallet material. No stable verified USD loss amount was published.
Primary source：x.com public sourceDxSale legacy LP-locker compromise was reported on 2026-05-28. Evidence indicates that legacy administrative authority over the LP-locker path was compromised. Reported loss is approximately $7,300,000.
Primary source：x.com public sourceAI and search-poisoning mining-malware campaign was reported on 2026-05-27. Evidence indicates that search and AI-answer poisoning redirected users to mining malware. No stable verified USD loss amount was published.
Primary source：x.com public sourceStakeDAO vsdCRV unauthorized mint was reported on 2026-05-27. Evidence indicates that unauthorized authority was used to mint vsdCRV. Reported loss is approximately $91,170.00.
Primary source：x.com public sourceSKP Token liquidity-pool exploit was reported on 2026-05-27. Evidence indicates that an abnormal liquidity-pool operation affected SKP Token. Reported loss is approximately $213,000.
Primary source：x.com public sourceSUPERFORTUNE AI multisig transaction-target substitution was reported on 2026-05-27. Evidence indicates that a multisig transaction target was replaced with a lookalike recipient during transaction construction. Reported loss is approximately $15,180,000.
Primary source：x.com public sourceWeak randomness in wallet seed generation enabled private-key enumeration, with more than $5 million in reported multi-chain losses.
Bitmor DCA approval theft was reported on 2026-05-25. Evidence indicates that a malicious approval was used to steal assets from a Bitmor DCA user. Reported loss is approximately $10,000.00.
Primary source：revoke.cash public sourceLazarus RemotePE in-memory RAT campaign was reported on 2026-05-25. Evidence indicates that Lazarus-linked RemotePE malware executed an in-memory remote-access payload. No stable verified USD loss amount was published.
Primary source：x.com public sourceNew Market Trading security incident was reported on 2026-05-25. Evidence indicates that an executed trading-platform incident moved assets without authorization. Reported loss is approximately $3,980,000.
Primary source：x.com public sourceWUSD / GLOVE exploit was reported on 2026-05-25. Evidence indicates that a smart-contract weakness affected WUSD / GLOVE liquidity. Reported loss is approximately $207,000.
Primary source：x.com public sourceFake Uniswap Google Ads phishing campaign was reported on 2026-05-25. Evidence indicates that a paid-search advertisement led users to a fake Uniswap phishing page. Reported loss is approximately $400,000.
Primary source：x.com public sourceSquidRouterModule third-party module compromise was reported on 2026-05-25. Evidence indicates that a third-party router module was compromised and used against connected liquidity. Reported loss is approximately $3,100,000.
Primary source：x.com public sourceTrapDoor supply-chain campaign was reported on 2026-05-24. Evidence indicates that malicious code was distributed through a software supply-chain campaign. No stable verified USD loss amount was published.
Primary source：x.com public sourceFractal Protocol security incident was reported on 2026-05-24. Evidence indicates that public monitoring confirmed an executed protocol exploit but did not establish a complete root cause. Reported loss is approximately $13,700.00.
Primary source：x.com public sourceMure security incident was reported on 2026-05-23. Evidence indicates that public monitoring confirmed an executed protocol exploit but did not establish a complete root cause. Reported loss is approximately $11,700.00.
Primary source：x.com public sourceStablR stablecoin mint-authority compromise was reported on 2026-05-23. Evidence indicates that stablecoin mint authority was used without authorization. Reported loss is approximately $2,800,000.
Primary source：x.com public sourceBased Apparel website wallet-drainer injection was reported on 2026-05-22. Evidence indicates that wallet-draining code was injected into the Based Apparel website. No stable verified USD loss amount was published.
Primary source：x.com public sourcePolymarket UMA CTF Adapter operational-key compromise was reported on 2026-05-22. Evidence indicates that an operational key used by the UMA CTF Adapter was compromised. Reported loss is approximately $520,000.
Primary source：x.com public sourceMAP / Butter Bridge exploit was reported on 2026-05-20. Evidence indicates that a bridge contract or message-validation path was exploited. Reported loss is approximately $110,000.
Primary source：x.com public sourceRetoSwap / Haveno multisig-path exploit was reported on 2026-05-20. Evidence indicates that the RetoSwap / Haveno multisig path was exploited. Reported loss is approximately $2,700,000.
Primary source：x.com public sourceHermesVault security incident was reported on 2026-05-19. Evidence indicates that a vault weakness was exploited before most assets were returned. Reported loss is approximately $4,000.00.
Primary source：x.com public sourceEcho Protocol / eBTC admin-key compromise was reported on 2026-05-19. Evidence indicates that administrative signing authority was compromised. Reported loss is approximately $5,130,000.
Primary source：x.com public sourceOn May 18, 2026, Verus–Ethereum Bridge validation failed to enforce value equality between source-side input and destination-side output, allowing low-value input to release high-value reserves. Initial exposure was approximately $11.58 million, and about 4,052.4 ETH, publicly valued near $8.5 million, was later returned.
Primary source：x.com public sourceLedger physical-letter seed phishing campaign was reported on 2026-05-17. Evidence indicates that physical letters impersonating Ledger attempted to steal wallet seed phrases. No stable verified USD loss amount was published.
Primary source：x.com public sourceSEA Token security incident was reported on 2026-05-17. Evidence indicates that public monitoring confirmed an executed protocol exploit but did not establish a complete root cause. Reported loss is approximately $153,000.
Primary source：x.com public sourceAdshares Bridge exploit was reported on 2026-05-17. Evidence indicates that the Adshares bridge validation path was exploited. Reported loss is approximately $88,000.00.
Primary source：x.com public sourceTHORChain multichain vault theft was reported on 2026-05-15. Evidence indicates that a malicious validator used threshold-signing interactions to recover vault signing material. Reported loss is approximately $10,350,000.
Primary source：x.com public sourceFake job-interview JobStealer campaign was reported on 2026-05-14. Evidence indicates that fake job interviews delivered credential and wallet-stealing malware. No stable verified USD loss amount was published.
Primary source：x.com public sourceShapeShift Colony meta-transaction exploit was reported on 2026-05-13. Evidence indicates that a meta-transaction validation weakness allowed unauthorized execution. Reported loss is approximately $132,000.
Primary source：x.com public sourceTransit Finance legacy-contract exploit was reported on 2026-05-13. Evidence indicates that a legacy Transit Finance contract path remained exploitable. Reported loss is approximately $1,880,000.
Primary source：x.com public sourceSQ Protocol ownership compromise was reported on 2026-05-12. Evidence indicates that contract ownership was taken over and used against the staking contract. Reported loss is approximately $346,100.
Primary source：x.com public sourceAurellion Labs Diamond-proxy malicious-facet exploit was reported on 2026-05-12. Evidence indicates that a malicious Diamond proxy facet was installed through administrative authority. Reported loss is approximately $456,000.
Primary source：halborn.com public sourceTAC Protocol TON–EVM bridge incident was reported on 2026-05-12. Evidence indicates that a TON–EVM bridge path was exploited and later handled through a negotiated return. Reported loss is approximately $280,000.
Primary source：x.com public sourceHuma Finance V1 BaseCreditPool legacy-contract exploit was reported on 2026-05-11. Evidence indicates that a legacy BaseCreditPool contract path remained exploitable. Reported loss is approximately $101,400.
Primary source：hacked.slowmist.io public sourceTrickMo Android malware variant was reported on 2026-05-11. Evidence indicates that a TrickMo Android malware variant targeted financial and authentication data. No stable verified USD loss amount was published.
Primary source：x.com public sourceINK Finance treasury privilege compromise was reported on 2026-05-11. Evidence indicates that treasury privileges were used without authorization. Reported loss is approximately $140,000.
Primary source：x.com public sourceRenegade security incident was reported on 2026-05-10. Evidence indicates that public monitoring confirmed an executed protocol exploit and later reported returned funds. Reported loss is approximately $209,000.
Primary source：x.com public sourceTrustedVolumes RFQ proxy exploit was reported on 2026-05-07. Evidence indicates that an RFQ proxy authorization path allowed unauthorized asset movement. Reported loss is approximately $6,300,000.
Primary source：x.com public sourceClickFix fake macOS tool campaign was reported on 2026-05-06. Evidence indicates that a ClickFix social-engineering flow delivered a fake macOS tool. No stable verified USD loss amount was published.
Primary source：x.com public sourceEkubo Protocol extension callback exploit was reported on 2026-05-05. Evidence indicates that an extension callback path allowed reentrant or unauthorized execution. Reported loss is approximately $1,400,000.
Primary source：x.com public sourceSmartCredit security incident was reported on 2026-05-04. Evidence indicates that public monitoring confirmed an executed protocol exploit but did not establish a complete root cause. Reported loss is approximately $72,000.00.
Primary source：x.com public sourceBankr / Grok wallet AI-agent attack was reported on 2026-05-04. Evidence indicates that an AI-agent wallet workflow was manipulated to authorize asset movement. Reported loss is approximately $175,000.
Primary source：x.com public sourceFEMITBOT Telegram Mini Apps malware campaign was reported on 2026-05-03. Evidence indicates that malicious Telegram Mini Apps distributed the FEMITBOT payload. No stable verified USD loss amount was published.
Primary source：x.com public sourceSharwa Finance security incident was reported on 2026-05-01. Evidence indicates that public monitoring confirmed an executed protocol exploit but did not establish a complete root cause. Reported loss is approximately $32,850.00.
Primary source：x.com public sourceBisq v1 client attack was reported on 2026-05-01. Evidence indicates that a weakness in the Bisq v1 client or trade workflow enabled theft. Reported loss is approximately $858,000.
Primary source：halborn.com public sourceLayerZero’s final report says compromised RPC infrastructure enabled a forged cross-chain message, resulting in the loss of 116,500 rsETH, approximately $292 million; KelpDAO’s single-DVN configuration allowed the destination contract to accept the attestation. May litigation and asset-restriction developments are attached to the same incident.
Primary source：LayerZero final incident reportAttackers compromised multisig operators and tampered with the Safe Wallet transaction interface, causing about $50 million in reported losses.
Primary source：Public incident post-mortemData snapshot Not real-time or complete coverage
