DCI-2026-481
Threshold operator fee-account theft
Incident overview
An operator’s broader infrastructure suffered a separate security incident affecting an Ethereum fee account. The official account distinguished this from the Linux vulnerability.
Text incident index
Expand the chronological list of incident titles, summaries, and primary sources.338 records
- DCI-2026-481
Threshold operator fee-account theft
An operator’s broader infrastructure suffered a separate security incident affecting an Ethereum fee account. The official account distinguished this from the Linux vulnerability.
Primary source：Verification source · x.com - DCI-2026-480
Solana Mobile publishing-portal compromise and malicious SKR Claim
Unauthorized publishing-portal access altered App Spotlight and Quests to recommend a malicious SKR Claim app asking for seed phrases. A bug allowed linking incompletely published apps.
Primary source：Verification source · x.com - DCI-2026-477
Premia V3 option-pool collateral-accounting exploit
Researchers described an empty option pool drawing vault collateral through flash-funded option purchases and letting that collateral exit as actor-owned liquidity. A final official function-level account was unavailable.
Primary source：Verification source · x.com - DCI-2026-483
Step Drainer multi-domain DNS and frontend hijacking campaign
Compromised domain/frontend routing sent users to malicious clones running Step Drainer. Name.com was a shared registrar; specific Vercel versus registrar responsibility requires a final root-cause account.
Primary source：Verification source · www.theblock.co - DCI-2026-478
VergeX AI withdrawal-anomaly incident and stated return
The project reported an attack triggering abnormal withdrawal-verification emails without publishing the entry vector, compromised credentials or contract mechanism.
Primary source：Verification source · x.com - DCI-2026-476
Troves legacy-rebalancer residual-permission exploit
An old replaced rebalancer retained vault authority, allowing its legacy code to move assets. The official explanation concerned permission lifecycle, with exact called functions still requiring a complete postmortem.
Primary source：Verification source · x.com - DCI-2026-475
b14g zero-amount staking-order withdrawal exploit
Researchers found that zero-amount requests triggered Core staking’s full-exit semantics without binding withdrawals to the caller’s actual ownership. The project confirmed unauthorized exits but had not issued a final technical postmortem.
Primary source：Verification source · x.com - DCI-2026-474
Talis Injective NFT escrow-market exploit
A flaw in marketplace and auction escrow contracts allowed theft of held NFTs; the project did not publish a verified function-level root cause.
Primary source：Verification source · x.com - DCI-2026-479
Chainalysis internal-system and customer-identity incident
Chainalysis confirmed unauthorized access to internal systems/tools, describing offensive agentic techniques without a disclosed exploit or proof of fully autonomous operation.
Primary source：Verification source · www.chainalysis.com - DCI-2026-472
Polymarket International DebugBear script supply-chain incident
A compromised DebugBear monitoring script reused active clients, signers and official relayer access to sell or transfer user positions. This was session/supply-chain abuse, not demonstrated seed or private-key exfiltration.
Primary source：Verification source · status.polymarket.com - DCI-2026-470
Binance multi-chain hot-wallet signing-infrastructure compromise
Binance initially described a compromised DevOps laptop and service-container entry without evidence of leaked wallet private keys; later investigation found additional compromise points. Researchers observed unauthorized but normally signed payments across different signature systems. EIP-7702 is one Ethereum execution mechanism, not proof of an Ethereum cryptographic break or a universal explanation for all chains.
Primary source：Verification source · x.com - DCI-2026-473
Hifi DAO malicious proposals and governance-control loss
Four coordinated addresses gained sufficient last-minute votes in low-participation governance. Proposed BalanceSheetV2 code treated old collateral as idle and redirected it to a single-owner Safe, with further supply-control proposals.
Primary source：Verification source · github.com - DCI-2026-471
zkLink Nova bridge authentication-context reuse
Arbitrator retained a transient finalizeMessageHash after processing and did not authenticate each use; a publicly callable authorized relayer could prime then reuse that context.
Primary source：Verification source · github.com - DCI-2026-482
Ethereum poisoning transfer of 50,059.470651 USDT
A lookalike recipient matched the first four and last six hex characters of the intended address, according to Scam Sniffer; this is not a USDT contract flaw.
Primary source：Verification source · x.com - DCI-2026-444
Solflare staking-provider validator-key incident
Solflare confirmed a provider-side incident affecting validator keys held on its behalf, distinct from users’ stake-account withdrawal authority or wallet seeds.
Primary source：Verification source · x.com - DCI-2026-441
Amplitude supplier incident affecting Coinbase contact data
Coinbase described a third-party analytics-provider incident affecting a small subset of contact data, without evidence of unauthorized access to Coinbase systems.
Primary source：Verification source · x.com - DCI-2026-435
TranchePool day-rollover duplicate withdrawal
Settlement treated scheduled principal as paid despite no USDC receipt, reducing outstanding principal and reopening the same draw capacity. The named Valinor/Oatfi/Fence association is security-source attribution.
Primary source：Verification source · x.com - DCI-2026-452
Iron Fish Base wIRON issuance anomaly
The official draft described a Merkle construction duplicating the left branch into an empty right branch. Different position/direction representations could preserve a root but change nullifiers, enabling repeated spending of one owned note. This supersedes an unproven stolen-relayer-key theory.
Primary source：Verification source · x.com - DCI-2026-445
Individual wallet outflows on Ethereum and Base
ScamSniffer reported an approximately $1.58 million theft and suspected private-key exposure; the initial vector was not forensically established.
Primary source：Verification source · x.com - DCI-2026-442
Bithumb employee groupware intrusion
Unauthorized DowOffice access exposed customer identity documents stored by staff, not demonstrated entry into the trading or wallet infrastructure.
Primary source：Verification source · www.coindesk.com - DCI-2026-438
ApeSTR arbitrary-call and NFT-swap exploit
Insufficient validation in buyTargetNFT permitted arbitrary calls and NFT substitutions through a previously known strategy weakness. The internal listing state diverged from physical NFT holdings.
Primary source：Verification source · x.com - DCI-2026-437
Diamante confirmed unauthorized activity
Later accounts attribute the DIAM contract takeover to stolen company access keys on BNB Chain, rather than a BNB consensus failure; the full final root cause remained incomplete.
Primary source：Verification source · x.com - DCI-2026-450
Avalanche Safe stale empty-address approval exploit and returns
A 2-of-7 Safe had approved assets to an address with code on other networks but none on Avalanche. A public CreateCall factory’s thirteenth deployment could install spending code there; signer-key theft was not required.
Primary source：Verification source · snowscan.xyz - DCI-2026-447
Bloom Trading third-party RCE and wallet drains
Bloom attributed unauthorized transfers to a third-party module’s RCE and stated that private keys were not accessed or leaked. The module supplier, vulnerability and exact signing-service path were not disclosed.
Primary source：Verification source · x.com - DCI-2026-484
Fake Padre Terminal iOS app and Solana wallet theft
A counterfeit iOS app impersonating the web-based service induced private-key import. Iris directly associated one victim with that app; other cluster members’ entry vectors were not all established.
Primary source：Verification source · mezha.net - DCI-2026-440
Foundation Passport customer-data and email-system compromise
Legacy WooCommerce copies retained PII despite redacted front-end records and incomplete cleanup; Shopify automatic deletion had not been activated. Compromised mail credentials enabled personalized phishing.
Primary source：Verification source · x.com - DCI-2026-433
Yapeswap governance takeover and fake-vault drain
Zero proposal and voting thresholds allowed tiny voting power to transfer the factory role. A malicious registry reported fake latest vaults while retaining genuine vault listings, and pairs failed to verify redeemable farming shares.
Primary source：Verification source · x.com - DCI-2026-434
X100 Senate flash-loan governance exploit
A three-seat Senate used live token-lock rankings without snapshots or a minimum proposal delay. Two controlled seats could authorize a treasury trade into an actor-created thin pool.
Primary source：Verification source · x.com - DCI-2026-436
Initia unbacked minting and bridge-reserve extraction
Custom code created unbacked representations and redeemed part against genuine bridge reserves. A MoveVM zero-day is researcher attribution; the precise VM rule bypass remained undisclosed.
Primary source：Verification source · bitquery.io - DCI-2026-449
Predict.fun user smart-wallet unauthorized transfers
Predict.fun confirmed unauthorized user-wallet transfers and preliminarily investigated a third-party API documentation site. The precise private-key exposure path remained unresolved.
Primary source：Verification source · x.com - DCI-2026-430
WAX multi-chain bridge negative-fee exploit
A WAX withdrawal accepted a negative maximum fee, producing a withdrawal log without the corresponding debit; destination chains released real backing.
Primary source：Verification source · x.com - DCI-2026-448
CoinDCX new loss from deprecated compromised wallets
Deprecated infrastructure from the July 2025 compromise remained relevant to new October outflows; a fresh signing-key compromise was not established.
Primary source：Verification source · apilist.tronscanapi.com - DCI-2026-431
NemTokenV2 reserve-burning manipulation
Transfers into the PancakeSwap pair created pending sell-recycle credits without verifying real swap settlement. Skimming the temporary input did not cancel those credits.
Primary source：Verification source · x.com - DCI-2026-446
Railway secret exposure and researcher-linked wallet drains
Railway confirmed unauthorized internal access and exposure of encrypted secrets, with some decrypted. Researchers separately linked swept wallets to private keys stored in the platform; Railway did not confirm their crypto-loss accounting.
Primary source：Verification source · blog.railway.com - DCI-2026-439
Keystone customer data and device-authentication key exposure
Keystone attributed website privilege escalation to a third-party monitoring-tool flaw. Exposed WebAuth keys authenticate devices, not wallet seed generation, derivation or transaction signing. Failed retention cleanup left historical customer data accessible.
Primary source：Verification source · x.com - DCI-2026-432
Slice FundsModule fabricated-release exploit
FundsModule trusted nonzero release amounts from caller-selected source contracts without checking that ETH or USDC actually arrived.
Primary source：Verification source · x.com - DCI-2026-416
Argent-style smart-wallet recovery and replay exploit
A recovery setter lacked effective access control and could wrap the recovery deadline into the past using a crafted period and valid guardian signature. The execution module also accepted reused signed payloads.
Primary source：Public verification source · x.com - DCI-2026-443
NGRAVE LIQUID fake-security-push phishing
A compromised third-party push-provider credential exposed another higher-privilege key, allowing official-looking security pushes to direct users to a fake seed/Perfect Key collection page.
Primary source：Verification source · x.com - DCI-2026-418
Qubic weak-seed wallet theft
Non-cryptographic Math.random seed generation exposed predictable wallet identities rather than a consensus failure. Officially affected environments were any iPhone/iPad browser and Mac Safari before October 18, plus the Qubic iOS app before July 2025.
Primary source：Public verification source · x.com - DCI-2026-417
AlpsCon AI Trade Hub test-account and reward exploit
A public test account remained on a production whitelist, while new stakes could collect historical rewards they had not earned. The weaknesses combined access control and reward accounting.
Primary source：Public verification source · x.com - DCI-2026-414
Cysic bridge forged-message minting incident
The foundation preliminarily attributed unauthorized bridge-database access to forged mint messages accepted by bridge processing logic. The complete entry vector remained under investigation.
Primary source：Public verification source · x.com - DCI-2026-415
KolanHook buyback slippage exploit
An expiring buyback lacked effective slippage protection and spent protocol reserves at a manipulated spot price.
Primary source：Public verification source · x.com - DCI-2026-413
Pirate Chain unauthorized ARRR issuance
Coin-import validation and output-script classification flaws allowed creation of coins without backing. Official source changes document the validation repairs.
Primary source：Public verification source · x.com - DCI-2026-412
UNCX Network Vesting V2 share-accounting exploit
Public vesting actions made pooled token balances diverge from recorded shares, permitting excess withdrawals without using administrator functions.
Primary source：Public verification source · uncx.network - DCI-2026-411
Gamdom hot-wallet server compromise
Gamdom confirmed an unauthorized connection to an automation server used by its hot-wallet system. The initial entry point and any private-key compromise remain unresolved.
Primary source：Public verification source · itokenly.com - DCI-2026-386
Autheo THEO trusted-relayer configuration and unbacked minting
Autheo confirmed unauthorized THEO minting and suspended affected relayers and mainnet block production. Whether a relay key was stolen, configuration failed, or another privilege was abused remained unresolved.
Primary source：Public verification source · x.com - DCI-2026-384
Unauthorized migration-phishing posts on COLDCARD’s official X account
Unauthorized posts from COLDCARD’s account promoted a false firmware vulnerability and migration link. The company said its offline 2FA and credentials remained secure and it could not find a corresponding login/session.
Primary source：Public verification source · x.com - DCI-2026-380
Papertrade leveraged BBO reference-price manipulation
Papertrade priced high-leverage synthetics directly from Hyperliquid’s live BBO midpoint while launch-period open-interest limits were unusually broad.
Primary source：Public verification source · www.blockchainposts.com - DCI-2026-381
CryptoBilis-distributed Ledger hardware implants and multi-chain theft
Genuine devices were opened and fitted with separate display-reading and eSIM/LTE hardware to capture recovery phrases during initialization. Ledger said the Secure Element and OS were not modified.
Primary source：Bitquery on-chain investigation - DCI-2026-379
EtherVista Pair uint112 reserve-product overflow
EtherVistaPair swap multiplied uint112 reserves for its K check, allowing wraparound to pass despite a real decline in the reserve product.
Primary source：SlowMist security research - DCI-2026-378
BitBay StableVault zero-liquidity withdrawal paid the full balance
UsdcDaiV4Vault withdrew the contract’s entire token balance when liquidity was zero instead of a caller’s proportional share.
Primary source：SlowMist security research - DCI-2026-377
X7Pioneer claimRewards repeatedly credited the same balance
claimRewards added current balance minus lastETHBalance to rewards on each call but updated lastETHBalance only when a positive claim was paid.
Primary source：Public verification source · smartcontractshacking.com - DCI-2026-375
Locus Finance cross-chain strategy report omitted signed amounts
Signed strategy reports bound strategy, nonce, and chain ID but omitted amount fields, allowing reported assets/debt and the share price to be inflated.
Primary source：Public verification source · blackpaper.wiki - DCI-2026-383
Frogman two-wallet multi-chain theft
Frogman publicly reported that two wallets were emptied while he was in Singapore. Independent monitoring identified multiple tokens moved and sold, but the entry vector remains unknown.
Primary source：Public verification source · x.com - DCI-2026-382
Ethereum address poisoning transferred 12,000 USDC
A lookalike historical recipient induced a victim-signed USDC transfer rather than a passive authorization drain.
Primary source：Public verification source · x.com - DCI-2026-376
79th Vault operator-key compromise and pool drain
An operator hot-wallet private key and OPERATOR_ROLE privileges were compromised, permitting privileged withdrawal of 79AU from the trading pool.
Primary source：Public verification source · x.com - DCI-2026-385
Pattaya home invasion coerced a USDT transfer
Armed intruders restrained and assaulted a cryptocurrency holder and forced a wallet transfer. This was a physical coercion incident rather than a protocol exploit.
Primary source：Public verification source · www.pattayamail.com - DCI-2026-372
Ethereum address poisoning transferred 30,004.290614 USDT
A lookalike address sharing the head and tail of a prior recipient induced a victim-signed token transfer.
Primary source：Public verification source · x.com - DCI-2026-364
Set Protocol ETHMACOAPY second-vault rounding exploit
The same zero-fee actualizeFee rounding weakness affected a different ETHMACOAPY victim vault. Donating base Set backing raised currentSetAmount per outstanding share before recalculation.
Primary source：Public verification source · x.com - DCI-2026-363
MakerDAO ETH-A third-party dormant keeper collateral drain
A third-party keeper proxy exposed a drain function without authorization checks, allowing an attacker-chosen worker to move collateral from old won auctions.
Primary source：Public verification source · x.com - DCI-2026-362
Set Protocol ETHEMAAPY actualizeFee rounding exploit
RebalancingSetTokenV3 actualizeFee recalculated unitShares upward even when no fee was minted, enabling issuance at the old backing ratio and redemption at the new one.
Primary source：SlowMist security research - DCI-2026-387
Based Visa Card internal-dashboard unauthorized access
An unauthorized party accessed a card-management dashboard; some KYC data may have been exposed.
Primary source：Public verification source · x.com - DCI-2026-371
Historical Permit2 approval used to steal LINK
A malicious Permit2 approval from August 2025 remained active and was used in October 2026. The old approval date is not the theft date.
Primary source：Public verification source · x.com - DCI-2026-370
Ethereum address poisoning transferred about 305,560 DAI
A lookalike historical recipient induced a victim to send DAI to an incorrect address.
Primary source：Public verification source · x.com - DCI-2026-360
MALT rebalanceHook treated treasury funding as swap input
MALT’s swap called a below-peg rebalanceHook before its invariant check, which treated treasury DAI injected into the pool as if supplied by the caller.
Primary source：SlowMist security research - DCI-2026-388
Microsoft X account used for unauthorized Clippy-token promotion
Microsoft confirmed unauthorized account access.
Primary source：Public verification source · www.theverge.com - DCI-2026-359
GoldPesa GPXHooks shared-delta accounting exploit
GPXHooks rebalanced through a shared flash-accounted PositionManager without ensuring GPX/USDC deltas were isolated from an already open attacker unlock.
Primary source：SlowMist security research - DCI-2026-369
LNQ holder wallet drained through Permit2 authorization
A holder wallet’s malicious Permit2 authorization enabled token transfer without exposing a private key. This did not establish a LinqAI protocol compromise.
Primary source：Public verification source · x.com - DCI-2026-361
NEAR Intents / HOT Omni refund-callback exploit and fund return
A bug in the Omni deposit/withdrawal interaction allowed credited balances to survive a failed oversized refund/log callback. Official repository regression tests and later CertiK analysis describe the failure path.
Primary source：Public verification source · x.com - DCI-2026-358
FlashLoopAdapter third-party Safe-module authorization bypass
FlashLoopAdapter trusted a caller-controlled Safe authentication response and accepted attacker-chosen router/calldata, allowing execution through a module enabled on real victim Safes.
Primary source：SlowMist security research - DCI-2026-367
MetaMask Staking infrastructure compromise and fee-recipient diversion
MetaMask confirmed an incident in part of its staking infrastructure. On-chain research observed fee-recipient changes; no withdrawal-key theft or loss of customer principal was established.
Primary source：Public verification source · x.com - DCI-2026-357
SKYDAO sell-tax and reserve-sync exploit
SKYDAO’s sell path sent tax to a controller and burned/synchronized pool tokens before the seller’s net tokens reached the pair, creating a stale-reserve gap.
Primary source：DeFiHackLabs technical record - DCI-2026-356
MUSystem first-deposit bonus double-refund exploit
MUSystem counted the first-deposit bonus both in an immediate ETH refund and in redeemable MUS allocation, without limiting total redemption to the deposited amount.
Primary source：SlowMist security research - DCI-2026-355
PositionManager spot-valuation and share-manipulation exploit
A PositionManager valued existing positions using the manipulable PancakeSwap V3 USDT/BTCB spot price, underestimating NAV and minting excess shares.
Primary source：DeFiHackLabs technical record - DCI-2026-354
MCN Labs / LPBonus reward-reserve manipulation
Reward accrual used a manipulated low MSN reserve, while withdrawal applied the restored higher reserve to the same LP weight.
Primary source：SlowMist security research - DCI-2026-365
Fake GIWA network and bridge scam
Scammers operated a private chain and Ethereum bridge using GIWA’s real Chain ID, exploiting a false early-mainnet narrative. The genuine GIWA mainnet had not launched.
Primary source：Bitquery on-chain investigation - DCI-2026-373
MEXC single-user account incident involving a surviving API key
MEXC’s CEO confirmed a user account takeover and said a surviving API key allowed transfers after email/authenticator recovery and an account freeze.
Primary source：Public verification source · x.com - DCI-2026-353
DAOstack Genesis Alpha governance takeover
An unrestricted shared UController registration path let a fabricated Avatar reference Genesis Alpha’s existing Reputation contract and obtain voting control.
Primary source：DeFiHackLabs technical record - DCI-2026-374
XRP malicious NFT-offer payment phishing
A phishing-related NFT buy offer enabled a third party to accept it and receive XRP; the successful transaction was NFTokenAcceptOffer, not a normal Payment.
Primary source：Public verification source · x.com - DCI-2026-368
Ethereum address poisoning transferred 67,588.202768 USDT
A lookalike address in transaction history induced a transfer to the wrong recipient; the token contract was not compromised.
Primary source：Public verification source · x.com - DCI-2026-339
Bitget wallet-backend compromise and multi-chain asset transfers
Independent investigations described exploitation of a third-party security product, credential extraction, lateral movement, and a custom withdrawal tool. Direct private-key and cold-wallet compromise were excluded.
Primary source：Bitget CEO initial notice - DCI-2026-366
Limit Break PaymentProcessor stale-approval theft campaign
Payment Processor V2 allowed unauthorized settlement against stale marketplace approvals, enabling zero-price NFT sales and reverse WETH charges. V2 could not be paused; V3 response differed across networks.
Primary source：Public verification source · x.com - DCI-2026-340
Meter Passport unbacked-token minting exploit on BNB Chain
Blockaid reported an ongoing unbacked wMTRG mint through Meter Passport on BNB Chain. Roughly two mints had a nominal estimate near $2.3 million, and some tokens were sold on PancakeSwap. SlowMist listed it as an attack; realized proceeds and final net loss remain unverified.
Primary source：Blockaid alert - DCI-2026-338
Duelbits multi-chain hot-wallet unauthorized transfers
Duelbits’ later update concerns restoring services and funding new wallets after the original hot-wallet theft.
Primary source：Duelbits official security notice - DCI-2026-337
Payy Ethereum RollupV1 bridge batch forged-withdrawal exploit
Payy’s later preliminary postmortem said an invalid burn proof appeared to be accepted by its deployed Noir/Barretenberg verifier, superseding early key-compromise speculation.
Primary source：Payy official incident notice - DCI-2026-336
Malicious browser extension led to theft from a MetaMask user on two chains
Four stablecoin transfers totaling $1,063.980000 in face value left the same victim wallet on Ethereum and Polygon. Successful transactions support the in-window theft; the malicious-extension path comes from the victim’s account.
Primary source：Victim incident report - DCI-2026-335
Nano Labs founder’s X account compromised to promote a fake token
Nano Labs confirmed unauthorized control of its founder’s personal X account to promote a fake AI-trading token, $BWA. The company denied issuing or endorsing it; no victim transfer or loss amount was verified.
Primary source：Nano Labs official correction - DCI-2026-334
Neutron governance takeover affected Astroport and Drop
Neutron proposal #9 transferred control of Astroport and Drop contracts to an attacker, who migrated about ten contracts and drained assets. SlowMist estimated roughly $4.9 million and $4.4 million for the two protocols, about $9.3 million combined; the roughly $1.96 million bridged out and ATOM moved to a recovery multisig are response subsets.
Primary source：Astroport initial notice - DCI-2026-344
DoinGud Diamond bid record reuse exploit
DoinGud’s Diamond bidding contract on Polygon failed to clear a bid after payout. The attacker reused the same bid and drained about $35,486 USDC.e.
Primary source：SlowMist Hacked Zone incident record - DCI-2026-343
GaslessReservoirEnabler authorization flaw drained tokens
GaslessReservoirEnabler on Polygon failed to bind transferFrom calls to the authorized owner. The attacker spent existing WETH and ZED allowances; about 997 addresses were drained, with SlowMist estimating a loss near $23,000.
Primary source：SlowMist Hacked Zone incident record - DCI-2026-342
RWC Token permissionless-burn and reserve-manipulation exploit
An unrestricted burn function in RWC on BNB Chain was exploited to burn PancakeSwap pool tokens, use sync() to rewrite reserves, inflate price, and sell. SlowMist recorded about 109,460.85 USDT leaving the pool; the attacker netted about $39,964.07 and the remainder went to project wallets.
Primary source：SlowMist Hacked Zone incident record - DCI-2026-341
Internet Token DAO LiquidityUnifier fake-pool callback exploit
Internet Token DAO on Base trusted a caller-supplied Uniswap V3 pool address, allowing a fake-pool callback to mint about 925 million INT. The transaction-specific drain described by SlowMist was 5.847 WETH (about $16,033.55); its $265,000 amount field uses a broader scope and is not treated as realized withdrawal.
Primary source：SlowMist Hacked Zone incident record - DCI-2026-333
MultiversX VM atomicity flaw and network pause
MultiversX suffered invalid state changes from a VM-layer atomicity flaw. The network paused and prepared a limited rollback; no user-asset loss was confirmed.
Primary source：SlowMist Hacked record - DCI-2026-332
Blink Wallet limited custodial-account compromise
Blink Wallet paused service after saying a very small number of custodial accounts were accessed and some funds moved; most funds and non-custodial wallets were unaffected.
Primary source：SlowMist Hacked record - DCI-2026-321
ASI token-conversion infrastructure attack cluster
The same cluster used conversion-authorization signatures to extract about $1.56 million in FET and mint roughly $450,000 worth of NTX from NuNet, then touched SingularityNET / WMTx converters. The confirmed primary loss basis is about $2.01 million; nominal token mints are not added.
Primary source：Fetch official confirmation - DCI-2026-320
FomoPeek iOS malware app stole wallet assets
SlowMist and OKX security teams confirmed malicious code in FomoPeek iOS versions 1.1–1.2. Some users suffered private-key exposure and asset transfers, but no verified total loss was published.
Primary source：SlowMist FomoPeek alert - DCI-2026-319
Likwid Finance margin-lending logic exploit
Likwid's leverage = 0 branch failed to update pairDelta in _executeAddCollateralAndBorrow, leaving the lending path detached from reserves and allowing repeated extraction of 74.31 BNB.
Primary source：SlowMist Likwid alert - DCI-2026-318
Nimiq ERC20PermitHTLCHandler authorization-validation exploit
Nimiq ERC20PermitHTLCHandler failed to validate signature, nonce, and business parameters correctly through RelayHub, allowing an attacker to use legacy allowances and lock and redeem assets worth about $50,463.
Primary source：SlowMist Nimiq alert - DCI-2026-317
Nostra Starknet NSTR oracle-price manipulation
An attacker manipulated the thin NSTR market and used inflated collateral to borrow about $3.5 million from Nostra. About $1.92 million reached Ethereum; final loss and recoveries remain unresolved.
Primary source：Nostra official disclosure - DCI-2026-327
BonfireSwap Router allowance theft
The router transfer lacked from and caller-authorization checks; about 41 approved holders were drained for roughly $50,000.
Primary source：SlowMist Hacked record - DCI-2026-326
Startale ERC-7579 smart-account initialization exploit
A transient-storage lifecycle flaw allowed reinitialization of about 330 funded counterfactual accounts in one transaction, causing about $2,876 loss.
Primary source：SlowMist Hacked record - DCI-2026-316
Flamincome legacy Vault valuation manipulation
Flamincome's legacy Vault counted permissionlessly injected Curve / Convex assets in share valuation. The attacker used a Morpho flash loan to inflate NAV and redeem aUSDT, realizing about 345,902.67 USDT.
Primary source：SlowMist Flamincome alert - DCI-2026-315
Ethereum Safe custom-module rsETH theft and MEV front-run
An Ethereum Safe custom LP module and Uniswap V4 hook path were exploited to extract about 2,900 rsETH, estimated at $7.73 million to $7.81 million. A Yoink bot front-ran the main transaction, and Kelp temporarily paused the receiver.
Primary source：PeckShield Safe / rsETH alert - DCI-2026-331
Long Bridge forged-withdrawal event through third-party RPC
A third-party RPC pushed a forged Arc withdrawal event to a keeper, causing a 46.7928 WETH overpayment. The project paused the keeper and refilled the vault, with no user loss.
Primary source：SlowMist Hacked record - DCI-2026-330
SpiralHookV2 spot-price manipulation borrowing exploit
SpiralHookV2 used slot0 without TWAP or price limits; multiple EOAs bypassed the same-block guard and borrowed about 10.7 ETH.
Primary source：SlowMist Hacked record - DCI-2026-314
Optim Finance / Splash OADA pool liquidity drain
Optim / Splash OADA-related pools on Cardano were exploited and operations paused, after which other OADA pools were emptied. Final ADA / OADA quantities were not disclosed and TVL is not treated as loss.
Primary source：Optim / Splash incident report - DCI-2026-313
Chainflip TRON USDT duplicate-payout exploit
Chainflip's TRON USDT deposit handling treated memo-modified requests as new swaps, producing six unauthorized payouts totaling 736,442.17 USDT over about 90 minutes.
Primary source：Chainflip recovery update - DCI-2026-325
ORBToken tax-free sell and LP-burn exploit
ORBToken automatic allowance, tax-exempt whitelist, and missing reentrancy protection were combined to burn LP, sync reserves, and extract about $32,610.72.
Primary source：SlowMist Hacked record - DCI-2026-324
Dominion Market SILV treasury multisig compromise
The attacker obtained 3 of 5 SILV treasury signatures, emptied the treasury, and sold about 46,909 SILV, realizing about $238,000.
Primary source：SlowMist Hacked record - DCI-2026-323
ether.fi Liquid AtomicQueue authorization theft
Missing access control on the caller-supplied solver parameter in AtomicQueue.solve() let an attacker use existing ERC-20 allowances from about 11 users, losing about 15.45 ETH.
Primary source：SlowMist Hacked record - DCI-2026-304
Symbiosis Finance syBTC BridgeV2 unauthorized mint exploit
Symbiosis BridgeV2 accepted an abnormal message and minted about 2^62 raw syBTC. The beneficiary then sold about 4.39 WBTC on Ethereum, realizing roughly $336,000.
Primary source：Blockaid initial Symbiosis alert - DCI-2026-303
OMNI404 / O404 ERC-404 accounting exploit
OMNI404 accounting handled small tokenId values and fixed-unit transfers inconsistently across its ERC-20 / ERC-721 hybrid logic. The attacker looped the mismatch to extract WETH; SlowMist's primary basis was 2.4 WETH.
Primary source：SlowMist OMNI404 alert - DCI-2026-305
Brevo login-authorization flaw enabled crypto-email supply-chain phishing
Attackers exploited a Brevo login-authorization boundary to access legitimate customer organizations and send security-themed phishing emails impersonating Trezor, BitBox, and CoinTracking. About 347,000 Trezor newsletter addresses were at risk, with no confirmed on-chain loss.
Primary source：Trezor Brevo incident notice - DCI-2026-329
BeatXswap LiquidityVestingConvert spot-price manipulation
Using only a V3 slot0 spot price, the attacker flash-dumped BTX, minted LP at the manipulated quote, and drained about 2,984,557 BTX worth $77,512.
Primary source：SlowMist Hacked record - DCI-2026-328
Zentra Finance repayWithATokens accounting-edge exploit
The repayWithATokens path could clear debt while reducing the matching aToken burn to zero. About $140,030 was drained before markets paused.
Primary source：SlowMist Hacked record - DCI-2026-302
Enso Finance DPI Strategy Vault oracle valuation exploit
Enso Finance DPI Strategy Vault used an imbalanced Uniswap V3 spot path for valuation. The attacker swapped 0.683 WETH for FARM, minted excess shares, and redeemed about 5.6 ETH.
Primary source：SlowMist Enso alert - DCI-2026-301
Amnext / AMC anomalous Ticket mint extracted about 154.02 WBNB
Amnext's no-loss lottery / pool contract on BNB Chain allowed anomalous Ticket AMC minting. The attacker extracted about 154.02 WBNB through PancakeSwap, valued near $116,100.
Primary source：TenArmor AMC alert - DCI-2026-300
WealthManagementV2 owner-privilege abuse extracted 26,414 USDT
After WealthManagementV2 owner authority was unlawfully transferred, the attacker set a zero period and extreme multipliers, then invested, redeemed, and withdrew 26,414 USDT.
Primary source：SlowMist WealthManagementV2 alert - DCI-2026-299
Hemi Genesis Drop MerkleBox reentrancy drained about 124.5 million HEMI
Hemi Genesis Drop MerkleBox created lockups before updating claimable balances. A malicious lockup reentered claim 63 times, extracting about 124.5 million HEMI and bridging roughly $255,000 in stablecoin proceeds.
Primary source：Hemi official postmortem - DCI-2026-298
Unnamed BSC DEX Router callback-authentication exploit
An unnamed BNB Chain DEX Router did not verify that uniswapV3SwapCallback came from a real V3 pool. The attacker used victims' existing allowances to transfer about 62.28 WBNB, valued near $46,070.
Primary source：SlowMist BSC Router alert - DCI-2026-297
Cozy Finance protection-market oracle-trigger abuse
Cozy Finance protection markets accepted an uncontested YES result from UMA Optimistic Oracle without independently verifying a real underlying attack. The attacker burned PTokens, claimed USDC.e, and bridged it out; SlowMist's primary estimate was about $160,000.
Primary source：Cozy Finance incident report - DCI-2026-293
Rocket / RCKT Foundation perpetual-market manipulation and bridge withdrawal
A low-liquidity dormant Rocket perpetual market was manipulated through self-trading, creating false positive PnL before about $287,000 was withdrawn through the Bridge. Deposits, withdrawals, and trading were paused.
Primary source：Rocket official update - DCI-2026-292
Liquid Network / Blockstream Elements rangeproof-cache exploit
An ambiguity in Elements confidential-transaction rangeproof caching enabled roughly 4,000 unbacked L-BTC to be minted and pegged out through the normal federation reserve. About 3,400 BTC was publicly reported returned, while the remaining balance is unresolved.
Primary source：CertiK Liquid incident analysis - DCI-2026-296
Dream Health Chain staking-reward state-machine exploit
Dream Health Chain's reward state machine could be reset with a tiny or effectively zero DHC deposit. The attacker repeatedly claimed fixed rewards and sold about 542,070 DHC, for a loss of about 71,851 USDT.
Primary source：SlowMist Dream Health Chain alert - DCI-2026-295
Reddio RedSonic Vault double-counting accounting exploit
RedSonic Vault allowed permissionless asset registration and counted the same stETH in both rsvETH and rsvstETH vaults. A Balancer flash loan amplified share pricing and extracted about 9.25 ETH, valued near $22,800.
Primary source：SlowMist Reddio technical alert - DCI-2026-294
Secured Finance fixed-rate lending order-book accounting exploit
Secured Finance order-book accounting treated unfilled or manipulated orders as valid price inputs. The attacker combined flash loans and self-trading to extract funds; Ethereum, Arbitrum, and Filecoin markets were paused, with a primary loss basis of about $180,000.
Primary source：Secured Finance official update - DCI-2026-288
Notional V1 Escrow arithmetic truncation exploit caused about $1.73 million in losses
Notional confirmed that a legacy V1 contract was exploited. An integer truncation in the free-collateral path allowed checks to be bypassed, leading to withdrawals of about 69,257 DAI and 1,658,525 USDC that were converted into roughly 689.2 ETH.
Primary source：Notional official incident confirmation - DCI-2026-289
GebProxyActions access-control flaw enabled the theft of about 5.94 ETH
Several historical SAFEs registered the shared GebProxyActions contract as owner. An attacker directly called the unauthenticated quitSystem helper and withdrew residual collateral from four SAFEs, totaling about 5.9436 ETH.
Primary source：SlowMist technical alert - DCI-2026-287
Two phishing approvals from 2024 enabled about $187,000 in theft
Two Ethereum users had not revoked malicious approvals signed in 2024. After SYN and USDC reached the wallets, the old approvals were used to transfer assets worth a reported total of $187,046.
Primary source：Scam Sniffer original alert - DCI-2026-286
Float Protocol lost about $28,000 to spot-price manipulation
An attacker used flash loans to distort a Uniswap V3 spot price, causing Float Protocol Hypervisors to misprice shares and allowing about 10.71 ETH to be extracted through repeated deposits and withdrawals.
Primary source：SlowMist technical alert - DCI-2026-285
Ankr ankrFLOW exploit affected MORE Markets reserves
A flaw in Ankr's ankrFLOW contract allowed about 8.6 million unbacked tokens to be created and deposited into MORE Markets, where roughly 15.5 million WFLOW was borrowed. Flow corrected the spot-value reserve impact to about $410,000.
Primary source：Flow official incident statement - DCI-2026-284
Aquifer one-sided swap flaw drained about $2.47 million
Aquifer's Solana swap program accepted attacker-controlled token accounts and a fake token program, completing 212 swaps with real output and no real input. About $2.47 million was converted to SOL and bridged to Ethereum.
Primary source：Bitquery on-chain reconstruction - DCI-2026-276
Balancer V1 BPool reserve-compression rounding exploit
SlowMist reported that after compressing a Balancer V1 BPool's WBTC reserve, rounding in joinswapPoolAmountOut allowed the attacker to mint BPT with minimal input and exit with multiple assets, for an estimated loss of about $234,000.
Primary source：SlowMist Balancer V1 alert - DCI-2026-275
Tectonic Cronos TONIC price manipulation and chain halt
Tectonic on Cronos was exploited after the attacker inflated the price of thinly traded TONIC and borrowed liquid assets. Security researchers estimated $66 million to $75 million, with about $6 million bridged to Ethereum and most remaining on Cronos after the halt.
Primary source：Cronos Network official halt notice - DCI-2026-274
Ajna v2 multi-pool liquidation accounting exploit on Ethereum
Internal liquidation accounting across several Ajna v2 lending pools on Ethereum was manipulated through repeated liquidation paths. Ajna told users to withdraw and stop interacting; external monitoring estimated about $775,000 in losses.
Primary source：Ajna official risk disclosure - DCI-2026-270
Fogo Foundation wallet compromise moved 400 million FOGO
Fogo Foundation confirmed that an unknown actor moved 400 million FOGO from assets under foundation control, about 4% of total supply. The chain continued operating; the token amount was valued at about $3.88 million, while complete addresses and transaction hashes remain unpublished.
Primary source：Fogo official notice - DCI-2026-269
Avici / Rain Solana card-balance contract authorization exploit
An outdated Rain Solana card-balance contract was exploited through its authorization path, allowing batch withdrawals after crafted signature and administrator calls. Avici confirmed 1,685 users and $500,859.22 in affected card balances and announced refunds; a broader on-chain estimate of about $1.02 million is not additive.
Primary source：Avici initial official disclosure - DCI-2026-273
Moonwell Base MAMO thin-liquidity price manipulation exploit
The price of thinly traded MAMO collateral in Moonwell's Base lending markets was inflated, allowing the attacker to borrow real assets such as cbBTC and USDC. Security researchers estimated about $8.79 million, and Moonwell restricted the affected markets.
Primary source：Moonwell official response - DCI-2026-272
CCC Token LP accounting exploit on BNB Chain
A CCC Token sell path on BNB Chain could alter the token reserve held by its LP. The attacker used the accounting behavior to create a price anomaly and extract liquidity; TenArmor estimated about $117,000 at stake.
Primary source：TenArmor CCC alert - DCI-2026-271
TRON address-poisoning campaign affected 15 victims
Specter disclosed a four-week TRON address-poisoning campaign affecting 15 victims with an aggregate loss of about $9.4 million. Verifiable in-window USDD inflows totaled about 3,191,402.34, but cannot be treated as new net loss for the window.
Primary source：Specter campaign analysis - DCI-2026-265
Enjin Managed Delegate Proxy storage collision enabled an administrative takeover
An Enjin Managed Delegate Proxy on Ethereum was taken over through a DELEGATECALL storage collision and an unprotected initializer. The attacker registered a malicious adapter and transferred assets; SlowMist estimated about $162,000 in losses.
Primary source：SlowMist Enjin technical alert - DCI-2026-268
CometDEX BLND-USDC pool exploited on Stellar
CometDEX's BLND-USDC pool on Stellar was exploited through a reserve-accounting flaw involving repeated USDC-to-USDC swaps. SlowMist reported about $717,518.92; Blend's ordinary deposit pools were unaffected, while backstop depositors were impacted.
Primary source：Blend initial warning - DCI-2026-267
PacaSwap SWAP / DAG pools drained through a metagraph vulnerability
PacaSwap confirmed that its SWAP / DAG liquidity pools were drained through a metagraph vulnerability and paused the Bridge. The project said it would cover affected LP losses, but disclosed no USD amount, attacker address, or transaction hash.
Primary source：PacaSwap initial security notice - DCI-2026-266
Trezor confirms a new phishing wave using data leaked from multiple crypto services
Trezor confirmed a new targeted phishing wave using data leaked from multiple crypto services. No new on-chain loss has been publicly confirmed, but the campaign is an active malicious distribution threat to multi-chain wallet users.
Primary source：Trezor official phishing response - DCI-2026-264
FH / FHToken PancakeSwap V2 sell-tax logic exploit
The FH / USDT PancakeSwap V2 pool on BNB Chain was exploited through repeated buy-and-sell calls. A FHToken sell-tax flaw corrupted pool reserves, with security researchers estimating about $20,000 in losses.
Primary source：SlowMist FH technical alert - DCI-2026-263
Realio / realio.fund custody wallets drained across multiple chains
Realio-controlled realio.fund wallets showed continuing anomalous outflows across five chains from August 25. A community ledger recorded 127,918,788 RIO and about $263,596 in liquid assets; Realio confirmed an attack and paused the affected WebApp.
Primary source：Realio official incident notice - DCI-2026-256
Arrakis V1 G-UNI vault suffered an atomic liquidity-sandwich attack
An attacker exploited state-dependent Uniswap V3 mint/burn accounting in a 2021 legacy G-UNI ENS–WETH vault, extracting about 2.94 WETH valued near $7,100 through atomic liquidity operations. Arrakis Pro vaults were unaffected.
Primary source：SlowMist Arrakis alert - DCI-2026-255
Term Labs / Term Meta Vaults governance attack drained about $8.5 million
An attacker used a low-cost tmvETH / gtmvETH voting-power path to influence Term Vault governance and drain about $8.5 million, including about 2,843 ETH and $1.68 million in stablecoins. Term closed Meta Vaults, revoked DAO roles, and blocked new deposits while withdrawals remain available.
Primary source：Term Labs initial confirmation - DCI-2026-254
The Sandbox SAND OFT suffered delegate hijacking and unauthorized minting
The Base SAND OFT approveAndCall / LayerZero delegate path was abused to mint large amounts of unbacked SAND. The Sandbox confirmed containment; SAND on Ethereum and Polygon was unaffected. GoPlus estimated actual loss constrained by liquidity and reserves at about $670,000.
Primary source：Blockaid SAND OFT initial report - DCI-2026-253
Bofur Capital-labeled address lost about $2 million USDC to address poisoning
Dust transfers and look-alike addresses polluted transaction history. After a Bofur Capital-labeled Ethereum address withdrew from Compound, it mis-sent 2,000,000 USDC to the poisoned address, which was later swapped into about 1,999,939.4763 DAI.
Primary source：ScamSniffer Bofur alert - DCI-2026-252
MANTRA Chain Cosmos-EVM vulnerability exploitation caused a mainnet pause
MANTRA confirmed exploitation of an upstream Cosmos-EVM module vulnerability. The mainnet paused near block 17,449,398 and two MANTRA management wallets were affected. MANTRA said user, exchange, and partner funds were not directly affected; the chain later resumed block production with v8.4.0.
Primary source：MANTRA initial announcement - DCI-2026-251
Malicious Rust crates.io packages compromised the developer supply chain
Rust security response confirmed malicious versions of arrayref, internment, and append-only-vec were published and could execute a malicious dependency during builds. The versions were removed and the account was locked; no specific crypto project or on-chain loss was confirmed.
Primary source：Rust official security response - DCI-2026-246
Solidity Pro VS Code extension poisoning targeted Web3 developers
SlowMist disclosed malicious activity in historical Solidity Pro VS Code extension versions, exposing browser wallets, local private keys and seed phrases, API keys, SSH keys, and source-control credentials. It is a disclosed malicious developer-tool supply-chain campaign, but no single on-chain victim transaction has been confirmed.
Primary source：SlowMist Solidity Pro X alert - DCI-2026-245
MAYAChain false-subsidy accounting and composable cross-chain liquidity attack
MAYAChain suffered a composable protocol attack in which false-subsidy and accounting-validation flaws created unsupported internal ARB.LINK balances. The attacker extracted CACAO and LINK through liquidity operations and moved value to Bitcoin, Ethereum, Arbitrum, and THORChain. Confirmed L1 outflows were about $1,356,218, while total attacker-held value was estimated at about $1,647,599.
Primary source：Aaluxx MAYA incident statement - DCI-2026-238
BitMart Chinese official X account was taken over
A BitMart-linked executive confirmed that the Chinese official X account was compromised and that the abnormal content was not posted by a current employee. The original malicious post is unavailable, and no verifiable on-chain theft or user-asset loss was found.
Primary source：BitMart Chinese-account takeover confirmation - DCI-2026-237
New Solana wallet was drained of about 6.209 SOL
An on-chain transaction shows a Solana wallet sending 6.209202768 SOL to a receiving address. The private key had been imported into a trading bot, but public evidence does not identify the bot, clipboard, endpoint malware, or social engineering as the specific leak path.
Primary source：Solana wallet-drain source post - DCI-2026-234
SafePal order-tracking plugin data breach affected about 39,798 customers
SafePal disclosed unauthorized access in its order-tracking plugin, affecting information for about 39,798 historical customers, including names, emails, delivery addresses, phone numbers, and purchase details. Seeds, private keys, wallet passwords, payment cards, and government IDs were not involved.
Primary source：SafePal official disclosure - DCI-2026-233
FoxLpBondsPool spot-price manipulation and stale accounting caused about $118,700 in loss
On BNB Chain, FoxLpBondsPool read a manipulable PancakePair spot price and reused a stale _stakeAmount, causing Treasury to mint excessive Fox rewards. The attacker sold the new Fox in the same transaction for an estimated $118,700 gain.
Primary source：SlowMist Fox root-cause analysis - DCI-2026-232
Trezor logistics provider ShipMonk data breach affected 13,689 customers
Trezor disclosed unauthorized access in a third-party ShipMonk logistics environment. Full names, emails, phone numbers, and delivery addresses were exposed for 11,742 customers, while names, cities, and emails were exposed for another 1,947. Wallets, devices, and backup words were not identified as compromised.
Primary source：Trezor official disclosure - DCI-2026-231
Malicious increaseAllowance approval drained about $550,000 in USDC on Arbitrum
After a victim signed an effectively unlimited increaseAllowance, the attacker used multicall to execute three transferFrom calls six seconds later and moved about 550,019.146870 USDC. The alert rounded the amount to 549,744 USDC; the on-chain Transfer sum is retained as the precise basis.
Primary source：ScamSniffer Arbitrum approval-theft alert - DCI-2026-230
TLBL whale wallets were likely compromised through private-key exposure, losing about $25–25.6 million
Two public Ethereum wallets were drained within approximately 15 minutes, after which the assets were swapped into about 20 million DAI and 3,000 ETH. Security researchers favor likely private-key exposure, but the victim has not published endpoint forensics; $25–25.6 million is a valuation range from different reporting points.
Primary source：ScamSniffer TLBL initial alert - DCI-2026-228
Harmony cross-shard receipt replay caused unauthorized minting
Harmony's forensic update placed the first anomalous activity at Shard 0 block 92,730,036 on August 12, 2026 at 07:25:41. The first wave minted 4 billion ONE in two empty blocks, while a six-transaction, four-wallet reconstruction totals 3,010,000,100,000 ONE. Cross-shard receipt replay is the confirmed primary flaw; the empty-signature quorum issue remains a secondary attribution under review. No final freeze or net USD loss was public.
Primary source：Harmony initial response, patch, and rollback options - DCI-2026-229
Solana address poisoning caused an approximately $100,000 USDT mis-transfer
Cyvers disclosed an address-poisoning incident in which a victim copied an impersonating address from transaction history and mis-sent approximately 100,012.89 USDT. The attacker then swapped the USDT for about 52.8 ETH. The attacker, victim, and loss-transaction identifiers were truncated in the source image and are not guessed.
Primary source：Cyvers address-poisoning alert - DCI-2026-225
Oraichain EVM cross-chain transfer flaw enabled unauthorized ORAI minting
SlowMist Hacked Zone and Oraichain’s official notice describe an EVM cross-chain transfer flaw that enabled unauthorized ORAI minting. The network was paused for remediation, burning, and reconciliation; no verifiable loss amount was disclosed.
Primary source：Oraichain official security notice - DCI-2026-224
Bifrost shared Guardian Vault exploited across three farming pools
Bifrost confirmed exploitation of a shared Guardian Vault across three farming pools involving 881,150 DOT, publicly valued at about $720,000. The underlying vDOT reserve remained 1:1 backed, and complete attack identifiers were not disclosed.
Primary source：Bifrost initial official notice - DCI-2026-222
USM / FUM defund pricing logic exploited through flash loans and split calls
USM / FUM on Ethereum was exploited through flash loans and about 64 split defund calls, with an estimate of 70.83 ETH and a disclosed USD value of about $136,000.
Primary source：CertiK technical alert - DCI-2026-221
Coinsbuy-linked hot wallets drained across Ethereum and TRON for about $7.9 million
Coinsbuy-linked hot wallets suffered concentrated outflows on Ethereum and TRON with a public estimate of about $7.9 million. Some funds moved through ChangeNOW, FixedFloat, and BingX; the root cause and final aggregation route remain incomplete.
Primary source：DarkWebInformer addresses and initial route - DCI-2026-223
Ongoing sponsored-search phishing activity impersonating Trezor and Ledger
The same phishing activity placed sponsored ads in Trezor and Ledger searches and directed users to imitation pages for high-risk wallet actions. Cross-window losses were estimated above $3 million, while the strict-window increment cannot be isolated.
Primary source：CoinDesk Trezor sponsored-ad alert - DCI-2026-214
BTCPay Server flaw exposed Lightning credentials and enabled wallet theft
BTCPay Server / LND nodes were affected by a server flaw or credential exposure, and operators including Foundation and Citadel21 reported Lightning funds being drained. Public reporting has not established a unified victim set or total loss.
Primary source：BTCPay flaw and affected-entity leads - DCI-2026-213
Base phishing authorization theft of approximately 500,000 USDC
A personal wallet on Base lost approximately 500,000 USDC after phishing or malicious authorization. The attacker then swapped through a low-liquidity Uniswap V4 pool and ended with about 67 WETH; most value was captured by MEV and was not returned to the victim.
Primary source：PeckShield alert - DCI-2026-215
ZEUS Bitcoin Lightning infrastructure compromise with no customer-fund loss
SlowMist recorded a compromise of ZEUS Bitcoin Lightning wallet and LSP infrastructure. The incident was mitigated, customer funds were not lost or at risk, and services were temporarily offline.
Primary source：SlowMist Hacked Zone ZEUS record - DCI-2026-212
Keyv / Cacheable npm supply-chain compromise
The Keyv / Cacheable npm release chain was hijacked, allowing malicious versions to target CI/CD and developer credentials. Multiple security teams corroborated the compromise, but no unified direct on-chain loss amount was confirmed by the report cutoff.
Primary source：SlowMist Web3 supply-chain alert - DCI-2026-211
RISEx RWA strategy unauthorized withdrawal of 673,011.56 USDC
An RISEx-linked RWA strategy suffered an unauthorized withdrawal of 673,011.56 USDC. SlowMist records the incident date as August 3; the project said it patched the issue and fully compensated XLP depositors, which is not the same as recovering attacker funds.
Primary source：SlowMist Hacked Zone RISEx record - DCI-2026-204
KRON PEPE pool indexing and accounting were disrupted with no confirmed fund loss
KRON said that re-importing an internal token caused an indexing and accounting mismatch around the PEPE pool. Trading was unavailable for about two hours and LP access was paused longer; the team restored from backup, blocked the path, and said no funds were stolen, drained, or moved.
Primary source：KRON transparency report - DCI-2026-203
MOKE: a complex BSC transaction triggered an estimated $907,700 attack alert
TenArmor flagged a successful transaction with multiple assets and protocol calls and estimated approximately $907,700 at risk. The transaction and tokens are verifiable on BNB Smart Chain, but the root cause, affected-contract boundary, and final net loss require independent analysis.
Primary source：TenArmor original alert - DCI-2026-210
LOOPSDAO / LpdFi spot-oracle manipulation on BNB Chain
ExVul, Backward Labs, and on-chain researchers documented a LpdFi oracle-manipulation attack on BNB Chain. The attacker used flash-loan and spot-price manipulation to remove LP assets; public estimates put the loss at approximately $696,952.81.
Primary source：ExVul initial report and attack transaction - DCI-2026-205
Twenty-two OKX Web3 extension wallets were reportedly drained after a suspected endpoint compromise
A user reported that assets from 22 OKX Web3 extension wallets were moved after downloading several untrusted VPN tools, with about 1,000 USDT reported lost and about 300 USDT moved to safety. Public evidence supports a personal-wallet compromise lead, but no malware sample, complete transaction path, or independent forensic conclusion was available.
Primary source：Victim’s original X post - DCI-2026-199
Swan Treasury off-chain signer key compromise
The attacker used a compromised off-chain signer key to set the discount parameter to 1, bought roughly 687,000 STY for about 19,700 USDT, and sold the tokens for approximately 625,000 USDT in net proceeds. Defimon reported that repeated ecrecover calls resolved to the same hardcoded signer, supporting a key-compromise finding.
Primary source：Defimon Alerts exploit analysis - DCI-2026-208
Base unverified contract exploit drained 16.623 WETH through an unrestricted low-level call
An attacker used an unrestricted low-level CALL in an unverified Base contract to abuse an existing WETH approval and transfer 16.623029776956898128 WETH from a victim. The exploit occurred on July 30 and was disclosed by SlowMist on August 1, making it a prior-case technical disclosure during the window.
Primary source：SlowMist technical alert - DCI-2026-198
Set Protocol ExchangeIssuance state-inflation exploit
An attacker used a malicious SetToken, pre-issue hook, and fake valuer to inflate component units by approximately 93.66 times after quotation, causing ExchangeIssuance to transfer excess real assets. SlowMist estimated the loss at about $9,600.
Primary source：SlowMist full exploit analysis - DCI-2026-197
COLDCARD weak-entropy flaw linked to multistage BTC theft
Coinkite confirmed a weak-entropy flaw in seed generation on older COLDCARD firmware. The first three waves confirmed approximately 1,367.05 BTC; on August 12, 2026, SlowMist disclosed a cross-wave cumulative total of at least 1,719 BTC, about $111M, across more than 5,200 addresses. The initial 388.92748828 BTC fourth-wave figure from August 3 remains under review and is not added again.
Primary source：Coinkite seed-generation security warning - DCI-2026-194
Relay AI meeting-tool recruitment malware campaign
SlowMist MistEye disclosed a recruitment-scam campaign targeting Web3 professionals. Attackers impersonated recruiters and induced targets to install malware disguised as the Relay AI meeting tool on macOS or Windows in order to steal endpoint credentials.
Primary source：SlowMist recruitment-malware alert - DCI-2026-193
LULA recycle() reserve-manipulation exploit
The privileged recycle() function in the LULA Rental contract could move LULA directly from a PancakeSwap V2 pool and call sync(). The attacker combined flash liquidity, reward claims, and reserve updates to obtain 578,295.907588061 USDT.
Primary source：BlockSec Phalcon analysis - DCI-2026-191
TheIndexFi former-member delegated-access incident
TheIndexFi’s X account published abnormal wallet-connection content. The project said this was not an external takeover: a former member still retained delegated access. The team removed the content and revoked access. No victim transaction or loss has been confirmed.
Primary source：TheIndexFi abnormal post - DCI-2026-190
CryptoDAO Global / PRO access-control exploit
In CryptoDAO Global’s previous PRO implementation, exec() lacked a caller check. The attacker repeatedly invoked the function through an attack contract and distorted the PRO/USDT price, earning approximately $52,000. The proxy was later upgraded to an implementation with caller validation.
Primary source：GoPlus attack analysis - DCI-2026-196
ChainConnect bridge suffered unauthorized access
SlowMist recorded approximately $650,000 drained from ChainConnect bridge contracts across Ethereum, BNB Chain, Avalanche, and Polygon in 23 transactions. Venom Foundation later confirmed a bridge security incident and the suspension of all bridge operations.
Primary source：SlowMist Hacked Zone incident record - DCI-2026-114
Malicious multicall concealed an unlimited approval and drained alphaUSDCDeltaV2
After the victim signed a transaction presented as multicall, an inner call granted an attacker unlimited approval. About 36 seconds later, the attacker used transferFrom to remove 332,787 alphaUSDCDeltaV2, valued at approximately $340,463.
Primary source：Scam Sniffer primary alert - DCI-2026-111
Garden Finance HTLC and solver infrastructure exploitation
An independent Garden Finance solver’s off-chain database was compromised and populated with fraudulent records, causing HTLC flows on Ethereum, Base, Arbitrum, and BNB Chain to release approximately 450,000 USDT improperly. The project said its core protocol and smart contracts were not compromised and took the application offline.
Primary source：Blockaid primary alert - DCI-2026-110
WEMIX$ contract authority compromise and unauthorized minting
WEMIX confirmed that ownership of a WEMIX$-related contract was compromised. The attacker minted approximately 5.2255 million WEMIX$ without authorization and swapped it into 30,736 WEMIX and 724,198.27 USDC.e. Reported loss uses an approximately $730,000 realized-value basis and does not add nominal minted value.
Primary source：Initial WEMIX security notice - DCI-2026-189
Projekt reward-allocation logic exploit
Projekt’s GREEN/GOLD reward vault used permissionless trackPurchase() to allocate rewards from token-balance changes without verifying real ETH expenditure. The attacker used flash liquidity and skim() to create fake purchase records, then withdrew approximately 301.7 ETH, valued near $560,000, through massWithdraw().
Primary source：Defimon technical analysis - DCI-2026-188
Bankrbot X account and project wallet compromise
Bankrbot’s X account was taken over despite an on-device passkey and used to publish fake airdrop links. In the same incident window, a project wallet without multifactor authentication was drained of approximately 1.5 billion BNKR. SlowMist Hacked Zone records a loss of about $479,885.
Primary source：Bankrbot team account-compromise notice - DCI-2026-112
Triple-A multi-chain hot-wallet outflow
Triple-A confirmed unauthorized access to company hot wallets across multiple chains and a final loss of approximately $11.8 million. Client and merchant funds were unaffected. Assets were swapped, bridged, and consolidated on Ethereum, and services resumed after security checks.
Primary source：PeckShieldAlert multi-chain outflow alert - DCI-2026-186
Solido Cash oracle misassignment and excess minting
After the SOLID collateral feed failed, Solido Cash incorrectly fell back to a CASH price near $1 and severely overvalued low-priced SOLID. The attacker minted 809,051.55 CASH and obtained approximately 293,705,544.97 SUPRA.
Primary source：Solido forensic-report announcement - DCI-2026-113
Lien Finance multiset-integrity validation exploit
Lien Finance’s exchangeEquivalentBonds compared only aggregate anomaly counts and did not verify each bondID multiplicity. The attacker duplicated a bondID in the output, minted undercollateralized BondToken, and redeemed 542,144.63 USDC through preapproved endpoints.
Primary source：SlowMist TI alert and root-cause analysis - DCI-2026-058
Evan Jawad reports PC and account compromise with cryptocurrency and NFT losses
Evan Jawad said an unknown file led to compromise of his PC, multiple accounts, and X account, followed by the transfer of more than $600 in wallet assets and NFTs, for a total loss exceeding $1,000. This is a first-party report without public addresses, transaction IDs, sample, or independent forensics.
Primary source：Evan Jawad first-party statement - DCI-2026-056
Robinhood CEO Vlad Tenev’s X account was taken over to promote a fake VLAD token
Robinhood confirmed that Vlad Tenev’s X account was compromised and used to promote a fake VLAD token before access was restored. GoPlus associated address 0xd70627fd9ee5b70906620a6f2001ba74457b438d with the token deployment and an estimated $1.2 million to $1.3 million in attacker profit; that profit is not confirmed victim net loss.
Primary source：Robinhood Comms confirmation - DCI-2026-187
Second Verus–Ethereum Bridge exploit of the same flaw
The attacker exploited different handling of duplicate proofRoots on Verus and Ethereum, allowing a malicious state root to overwrite the genuine root. A fabricated import proof based on a 0.01 VRSC export then released approximately $7.44 million from bridge reserves.
Primary source：BlockSec Phalcon root-cause update - DCI-2026-051
Unauthorized access to B² Network staking-contract upgrade authority
B² Network confirmed unauthorized access to its staking-contract upgrade authority. Approximately 8.591 million B2 was withdrawn; nominal value was about $3.86 million and realized proceeds were about 5,409 BNB, or $3.01 million.
Primary source：x.com source - DCI-2026-050
AFX Trade custodial bridge exploited for approximately 24.15 million USDC
Approximately 24.15 million USDC left the AFX custodial bridge and was converted into about 12,467.44 ETH. On July 25, 2026, monitoring showed 655.4 ETH converted through THORChain into 18.86 BTC, while about 11,812 ETH remained at related addresses; no freeze, return, or recovery was confirmed.
Primary source：x.com source - DCI-2026-044
Repeat theft through a 183-day-old malicious Permit
An unrevoked Permit was reused to steal 75,780 USDC; the two known thefts total about 77,405 USDC.
Primary source：x.com source - DCI-2026-043
42DAO / Balance Coin oracle liquidation attack
An abnormally low BTCB oracle price triggered immediate liquidations, causing an estimated $912,000-$915,000 loss.
Primary source：x.com source - DCI-2026-185
FlashTrade ephemeral-instance unauthorized withdrawal
FlashTrade confirmed an unauthorized $98,000 withdrawal from an ephemeral instance. Newly deployed withdrawal batching and monitoring detected and contained the event quickly. The team said it would cover the amount in full and that user funds were unaffected.
Primary source：FlashTrade initial announcement - DCI-2026-041
Wanchain Cardano-BNB Chain NIGHT bridge incident
About 515 million NIGHT tokens were exposed; realized swaps and the reported nominal $9-13 million exposure are recorded separately.
Primary source：x.com source - DCI-2026-040
Malicious TRAE IDE extension
A malicious IDE extension targeted developer credentials and wallet material through the software supply chain.
Primary source：x.com source - DCI-2026-039
Zilliqa partner exchange cold-wallet theft
A cold wallet operated by a Zilliqa partner exchange was compromised; the cited sources did not establish one USD loss figure.
Primary source：x.com source - DCI-2026-038
Delayed theft from a year-old malicious approval
An approval granted about a year earlier was used to steal approximately $84,000 after funds returned to the victim wallet.
Primary source：x.com source - DCI-2026-037
RWT protocol exploit
A protocol weakness caused approximately $118,100 in reported losses.
Primary source：bscscan.com source - DCI-2026-036
Allbridge Core bridge exploit
A bridge weakness caused approximately $1.65 million in reported losses.
Primary source：x.com source - DCI-2026-033
Fake Web3 recruitment GitHub malware
Fraudulent recruiting workflows delivered malware through GitHub repositories, creating credential and wallet-theft risk.
Primary source：x.com source - DCI-2026-032
CrowdRingCircle protocol incident
A smart-contract weakness caused approximately $201,400 in reported losses.
Primary source：bscscan.com source - DCI-2026-031
FCOW protocol exploit
A protocol weakness caused approximately $61,300 in reported losses.
Primary source：bscscan.com source - DCI-2026-030
Across Protocol / Risk Labs relayer forged-deposit incident
Across confirmed that a Solana off-chain event-reading defect caused a Risk Labs relayer to advance real assets against forged deposits, with reported loss of approximately $3.6 million. On July 28, 2026, a labeled attacker address returned 331.8 ETH to the Across Hub Pool Owner Multisig, valued at about $623,900 when disclosed.
Primary source：x.com source - DCI-2026-028
DeFiTuna oracle manipulation
A pricing weakness enabled abnormal liquidations and approximately $580,000 in reported losses.
Primary source：certik.com source - DCI-2026-027
Chi Protocol exploit
A protocol weakness was exploited for approximately $8,500.
Primary source：x.com source - DCI-2026-026
Cascade CLS Vault exploit
A vault weakness caused approximately $1.34 million in reported losses.
Primary source：x.com source - DCI-2026-047
macOS infostealer hijacks Telegram and swaps hardware-wallet apps
Malware replaced Telegram and Ledger/Trezor software while stealing local credentials; aggregate on-chain loss remains unknown.
Primary source：slowmist.medium.com source - DCI-2026-024
Ostium oracle manipulation incident
An oracle and pricing weakness caused approximately $23.75 million in reported losses.
Primary source：x.com source - DCI-2026-022
Drips Network protocol incident
A protocol incident led to approximately $24,883 in reported losses.
Primary source：x.com source - DCI-2026-021
VECAndETH protocol exploit
A contract-level weakness was exploited for approximately $109,600.
Primary source：bscscan.com source - DCI-2026-020
Lumi Finance smart-account authorization flaw
An authorization weakness affecting smart accounts enabled approximately $270,000 in unauthorized asset transfers.
Primary source：x.com source - DCI-2026-048
PHX Pancake LP drain on BNB Chain
Liquidity was removed from a PHX Pancake pool, causing approximately $89,600 in reported losses.
Primary source：x.com source - DCI-2026-019
Solana OG personal wallet theft
A long-time Solana holder lost assets estimated at about $14.2 million after a personal wallet compromise.
Primary source：x.com source - DCI-2026-018
Bonzo Lend oracle manipulation
A pricing and liquidation weakness caused approximately $9.05 million in reported losses.
Primary source：x.com source - DCI-2026-023
BarnBridge SMART Yield governance attack
A malicious governance path was used to extract approximately 776,600 USDC.
Primary source：x.com source - DCI-2026-015
BONK DAO malicious governance proposal
A malicious governance action created an exposure estimated at about $20 million and triggered emergency community response.
Primary source：x.com source - DCI-2026-007
Summer.fi shared-accounting price manipulation
An attacker manipulated shared vault accounting and price calculations, causing approximately $6.04 million in reported losses.
Primary source：x.com source - DCI-2026-046
Gate user account-takeover dispute involving $1.7 million
A Gate user reported an account takeover and approximately $1.7 million in disputed losses; responsibility remains contested.
Primary source：etherscan.io source - DCI-2026-012
Hinkal Protocol exploit
A protocol weakness was exploited for approximately $820,000, according to the cited on-chain security disclosures.
Primary source：x.com source - DCI-2026-045
Alkanes / DIESEL indexer attack
An indexer-level attack disrupted data integrity, but the cited sources did not identify a direct asset loss.
Primary source：x.com source - DCI-2026-009
Malicious npm package supply-chain campaign
At least 30 lookalike Web3 packages carried credential-stealing code; aggregate wallet losses were not publicly established.
Primary source：x.com source - DCI-2026-008
Edel Finance ERC-4626 donation attack
Attackers manipulated an ERC-4626 share price used as collateral, extracting about $353,000 and leaving roughly $403,000 in bad debt.
Primary source：x.com source - DCI-2026-106
Unnamed Base ERC-4626 vault exploit
Public sources identify Unnamed Base ERC-4626 vault exploit as a on-chain smart-contract exploit incident. No single verifiable USD loss amount was published.
Primary source：Public security alert or project statement - DCI-2026-105
AIDC — on-chain smart-contract exploit
Public sources identify AIDC — on-chain smart-contract exploit as a on-chain smart-contract exploit incident. No single verifiable USD loss amount was published.
Primary source：Public security alert or project statement - DCI-2026-104
Cook Finance Issuance — on-chain smart-contract exploit
Public sources report Cook Finance Issuance — on-chain smart-contract exploit, with a loss of approximately $50,000.
Primary source：Public security alert or project statement - DCI-2026-103
Mini Shai-Hulud, Miasma and Hades malware expands into Go modules
Mini Shai-Hulud, Miasma, and Hades malware expanded into Go modules in a documented supply-chain campaign; no verified aggregate loss amount was published.
Primary source：Public security alert or project statement - DCI-2026-102
czirker developer account compromise contaminates 23 npm packages
Compromise of the czirker developer account contaminated 23 npm packages; no verified aggregate loss amount was published.
Primary source：Public security alert or project statement - DCI-2026-101
Polymarket International — Front-end Vulnerability
Public sources report Polymarket International — Front-end Vulnerability, with a loss of approximately $3,000,000.
Primary source：Public security alert or project statement - DCI-2026-100
Ocean Protocol BPool/SideStaking — on-chain smart-contract exploit
Public sources identify Ocean Protocol BPool/SideStaking — on-chain smart-contract exploit as a on-chain smart-contract exploit incident. No single verifiable USD loss amount was published.
Primary source：Public security alert or project statement - DCI-2026-099
Lixir Finance forged Permit signature theft
Public sources report Lixir Finance forged Permit signature theft, with a loss of approximately $12,300.
Primary source：Public security alert or project statement - DCI-2026-098
Wallet drainer injected into Yield Yak voting subdomain
A wallet drainer was injected into the Yield Yak voting subdomain; no verified aggregate loss amount was published.
Primary source：cryptopolitan.com public source - DCI-2026-097
DLMC — on-chain smart-contract exploit
Public sources report DLMC — on-chain smart-contract exploit, with a loss of approximately $222,560.
Primary source：Public security alert or project statement - DCI-2026-096
Royal.io/Royal Royalties — on-chain smart-contract exploit
Public sources report Royal.io/Royal Royalties — on-chain smart-contract exploit, with a loss of approximately $261,163.
Primary source：Public security alert or project statement - DCI-2026-095
Wallet drainer injected into a Gitcoin voting subdomain
A wallet drainer was injected into a Gitcoin voting subdomain; no verified aggregate loss amount was published.
Primary source：cryptopolitan.com public source - DCI-2026-005
SecondFi — Predictable Private Key Exploit
A deterministic nonce-derivation flaw in the SecondFi web-wallet software signer made some Cardano private keys derivable from public signatures. Public reporting confirms about 16 million ADA, worth roughly $2.4 million, was stolen.
Primary source：Public security alert or project statement - DCI-2026-094
ATM liquidity-pool transfer front-run by a burn transaction
Public sources identify ATM liquidity-pool transfer front-run by a burn transaction as a on-chain smart-contract exploit incident. No single verifiable USD loss amount was published.
Primary source：Public security alert or project statement - DCI-2026-093
Taiko Bridge — Fake Proof Exploit
Public sources report Taiko Bridge — Fake Proof Exploit, with a loss of approximately $1,700,000.
Primary source：Public security alert or project statement - DCI-2026-092
Quicksilver Zone — Unchecked Proof Minting
Public sources report Quicksilver Zone — Unchecked Proof Minting, with a loss of approximately $3,500.
Primary source：DeFiLlama Hacks database - DCI-2026-091
OLPC/LABUBU — on-chain smart-contract exploit
Public sources report OLPC/LABUBU — on-chain smart-contract exploit, with a loss of approximately $1,115,904.
Primary source：Public security alert or project statement - DCI-2026-090
JaredFromSubway MEV Bot — Reverse MEV Honeypot
Public sources report JaredFromSubway MEV Bot — Reverse MEV Honeypot, with a loss of approximately $7,500,000.
Primary source：Public security alert or project statement - DCI-2026-089
mySwap CL — CL Pool Accounting Hack
Public sources report mySwap CL — CL Pool Accounting Hack, with a loss of approximately $300,000.
Primary source：DeFiLlama Hacks database - DCI-2026-088
Secret Network — Unbacked Mint via ICS-20
Public sources report Secret Network — Unbacked Mint via ICS-20, with a loss of approximately $4,670,000.
Primary source：ourcryptotalk.com public source - DCI-2026-087
Namada Shielded Pools — IBC Transfer Logic Exploit
Public sources report Namada Shielded Pools — IBC Transfer Logic Exploit, with a loss of approximately $600,000.
Primary source：DeFiLlama Hacks database - DCI-2026-086
JB — on-chain smart-contract exploit
Public sources report JB — on-chain smart-contract exploit, with a loss of approximately $49,958.
Primary source：Public security alert or project statement - DCI-2026-085
WHALE — on-chain smart-contract exploit
Public sources report WHALE — on-chain smart-contract exploit, with a loss of approximately $3,460.
Primary source：Public security alert or project statement - DCI-2026-084
Malicious dependency inserted across more than 140 Mastra packages
A malicious dependency was inserted across more than 140 Mastra packages; no verified aggregate loss amount was published.
Primary source：Public security alert or project statement - DCI-2026-083
Little Boy Plus/LBP — on-chain smart-contract exploit
Public sources report Little Boy Plus/LBP — on-chain smart-contract exploit, with a loss of approximately $367,000.
Primary source：Public security alert or project statement - DCI-2026-082
Aztec V1 EscapeHatch — on-chain smart-contract exploit
Public sources report Aztec V1 EscapeHatch — on-chain smart-contract exploit, with a loss of approximately $2,200,000.
Primary source：DeFiHackLabs on-chain reproduction - DCI-2026-081
RetoSwap — ACK Frontrun Attack
Public sources report RetoSwap — ACK Frontrun Attack, with a loss of approximately $2,700,000.
Primary source：DeFiLlama Hacks database - DCI-2026-080
DIP — on-chain smart-contract exploit
Public sources report DIP — on-chain smart-contract exploit, with a loss of approximately $111,098.
Primary source：Public security alert or project statement - DCI-2026-109
Thetanuts Finance — on-chain smart-contract exploit
Public sources report Thetanuts Finance — on-chain smart-contract exploit, with a loss of approximately $105,000.
Primary source：Public security alert or project statement - DCI-2026-079
SStar Agent fake Web3 AI project malware campaign
The fake SStar Agent Web3 AI project distributed malware; no verified aggregate loss amount was published.
Primary source：Public security alert or project statement - DCI-2026-078
Aztec Connect — on-chain smart-contract exploit
Public sources report Aztec Connect — on-chain smart-contract exploit, with a loss of approximately $2,190,000.
Primary source：Public security alert or project statement - DCI-2026-077
Malicious PyPI packages including openai_mcp
Malicious PyPI packages including openai_mcp formed a software-supply-chain campaign; no verified aggregate loss amount was published.
Primary source：Public security alert or project statement - DCI-2026-075
Raydium AMM — Fake LP Mint Attack
Public sources report Raydium AMM — Fake LP Mint Attack, with a loss of approximately $1,340,000.
Primary source：Public security alert or project statement - DCI-2026-074
Token of Power/TOP — on-chain smart-contract exploit
Public sources report Token of Power/TOP — on-chain smart-contract exploit, with a loss of approximately $1,580,000.
Primary source：Public security alert or project statement - DCI-2026-073
NovaBox — on-chain smart-contract exploit
Public sources report NovaBox — on-chain smart-contract exploit, with a loss of approximately $107,000.
Primary source：Public security alert or project statement - DCI-2026-072
Asterix — DN404 Forge Loop
Public sources report Asterix — DN404 Forge Loop, with a loss of approximately $40,000.
Primary source：DeFiLlama Hacks database - DCI-2026-071
Flooring Protocol — DN404 Forge Loop
Public sources identify Flooring Protocol — DN404 Forge Loop as a DN404 Forge Loop incident. No single verifiable USD loss amount was published.
Primary source：DeFiLlama Hacks database - DCI-2026-004
Humanity Protocol key compromise and unauthorized $H mint
Humanity Protocol’s investigation says phishing and remote-access malware enabled the theft of project keys used for unauthorized transfers, minting, and sales of $H on Ethereum and BNB Chain; the aggregate uses the later loss estimate of approximately $36 million.
Primary source：Humanity Protocol official investigation summary - DCI-2026-070
Syscoin Bridge — Fake Proof Exploit
Public sources report Syscoin Bridge — Fake Proof Exploit, with a loss of approximately $8,000,000.
Primary source：halborn.com public source - DCI-2026-069
Ambient CrocSwapDex — on-chain smart-contract exploit
Public sources report Ambient CrocSwapDex — on-chain smart-contract exploit, with a loss of approximately $110,000.
Primary source：Public security alert or project statement - DCI-2026-068
ATOHook — token-pool smart-contract exploit
Public sources report ATOHook — token-pool smart-contract exploit, with a loss of approximately $2,100,000.
Primary source：Public security alert or project statement - DCI-2026-067
BOSS — on-chain smart-contract exploit
Public sources report BOSS — on-chain smart-contract exploit, with a loss of approximately $10,208.
Primary source：Public security alert or project statement - DCI-2026-066
DTXT — on-chain smart-contract exploit
Public sources report DTXT — on-chain smart-contract exploit, with a loss of approximately $35,041.
Primary source：Public security alert or project statement - DCI-2026-065
AISO Presale — on-chain smart-contract exploit
Public sources report AISO Presale — on-chain smart-contract exploit, with a loss of approximately $30,315.
Primary source：Public security alert or project statement - DCI-2026-064
BY Token — on-chain smart-contract exploit
Public sources report BY Token — on-chain smart-contract exploit, with a loss of approximately $87,402.
Primary source：DeFiHackLabs on-chain reproduction - DCI-2026-063
ATM Token — on-chain smart-contract exploit
Public sources report ATM Token — on-chain smart-contract exploit, with a loss of approximately $243,543.
Primary source：DeFiHackLabs on-chain reproduction - DCI-2026-062
GPU.NET — Social Engineering
Public sources report GPU.NET — Social Engineering, with a loss of approximately $10,600.
Primary source：DeFiLlama Hacks database - DCI-2026-061
Red Hat Cloud Services npm supply-chain compromise
The Red Hat Cloud Services npm publishing chain was compromised; no verified aggregate loss amount was published.
Primary source：Public security alert or project statement - DCI-2026-060
TSR — Infinite Mint and Dump
Public sources report TSR — Infinite Mint and Dump, with a loss of approximately $2,500,000.
Primary source：Public security alert or project statement - DCI-2026-059
Gnosis Pay — Zodiac Delay Module Exploit
Public sources identify Gnosis Pay — Zodiac Delay Module Exploit as a Zodiac Delay Module Exploit incident. No single verifiable USD loss amount was published.
Primary source：DeFiLlama Hacks database - DCI-2026-177
Fluid Lending reward-list operational-key compromise
Fluid Lending reward-list operational-key compromise was reported on 2026-05-31. Evidence indicates that an operational key controlling the reward list was compromised. Reported loss is approximately $215,000.
Primary source：fluid.io public source - DCI-2026-176
AFI Protocol afiUSD Vault theft
AFI Protocol afiUSD Vault theft was reported on 2026-05-31. Evidence indicates that afiUSD Vault authority was used to transfer assets without authorization. Reported loss is approximately $480,000.
Primary source：x.com official statement - DCI-2026-174
AROS price-manipulation incident
AROS price-manipulation incident was reported on 2026-05-31. Evidence indicates that the AROS market was manipulated through a pricing or liquidity path. Reported loss is approximately $295,000.
Primary source：defillama.com public source - DCI-2026-123
Gravity Bridge compromise
Gravity Bridge compromise was reported on 2026-05-30. Evidence indicates that the bridge validator or signing path was compromised. Reported loss is approximately $5,400,000.
Primary source：x.com public source - DCI-2026-180
YSDAO reserve manipulation
YSDAO reserve manipulation was reported on 2026-05-29. Evidence indicates that reserve accounting was manipulated to extract value. Reported loss is approximately $19,500.00.
Primary source：hacked.slowmist.io public source - DCI-2026-179
MoneyMon signature-validation bypass
MoneyMon signature-validation bypass was reported on 2026-05-29. Evidence indicates that a signature-validation bypass allowed unauthorized execution. Reported loss is approximately $85,519.47.
Primary source：hacked.slowmist.io public source - DCI-2026-003
Alephium TokenBridge off-chain guardian exploit
Alephium TokenBridge off-chain guardian exploit was reported on 2026-05-29. Evidence indicates that false off-chain bridge messages bypassed guardian validation. Reported loss is approximately $815,000.
Primary source：x.com public source - DCI-2026-182
ONTR zero-address ownership and hidden-balance exploit
ONTR zero-address ownership and hidden-balance exploit was reported on 2026-05-28. Evidence indicates that zero-address ownership and hidden-balance logic enabled unauthorized control. Reported loss is approximately $98,200.00.
Primary source：hacked.slowmist.io public source - DCI-2026-181
Joe Agent reentrancy exploit
Joe Agent reentrancy exploit was reported on 2026-05-28. Evidence indicates that a reentrancy weakness allowed repeated execution. Reported loss is approximately $45,000.00.
Primary source：hacked.slowmist.io public source - DCI-2026-155
JINX-0164 macOS malware campaign
JINX-0164 macOS malware campaign was reported on 2026-05-28. Evidence indicates that a macOS information-stealing malware family targeted credentials and wallet material. No stable verified USD loss amount was published.
Primary source：x.com public source - DCI-2026-121
DxSale legacy LP-locker compromise
DxSale legacy LP-locker compromise was reported on 2026-05-28. Evidence indicates that legacy administrative authority over the LP-locker path was compromised. Reported loss is approximately $7,300,000.
Primary source：x.com public source - DCI-2026-163
AI and search-poisoning mining-malware campaign
AI and search-poisoning mining-malware campaign was reported on 2026-05-27. Evidence indicates that search and AI-answer poisoning redirected users to mining malware. No stable verified USD loss amount was published.
Primary source：x.com public source - DCI-2026-151
StakeDAO vsdCRV unauthorized mint
StakeDAO vsdCRV unauthorized mint was reported on 2026-05-27. Evidence indicates that unauthorized authority was used to mint vsdCRV. Reported loss is approximately $91,170.00.
Primary source：x.com public source - DCI-2026-136
SKP Token liquidity-pool exploit
SKP Token liquidity-pool exploit was reported on 2026-05-27. Evidence indicates that an abnormal liquidity-pool operation affected SKP Token. Reported loss is approximately $213,000.
Primary source：x.com public source - DCI-2026-119
SUPERFORTUNE AI multisig transaction-target substitution
SUPERFORTUNE AI multisig transaction-target substitution was reported on 2026-05-27. Evidence indicates that a multisig transaction target was replaced with a lookalike recipient during transaction construction. Reported loss is approximately $15,180,000.
Primary source：x.com public source - DCI-2026-006
Ill Bloom weak-randomness wallet vulnerability
Weak randomness in wallet seed generation enabled private-key enumeration, with more than $5 million in reported multi-chain losses.
- DCI-2026-175
Bitmor DCA approval theft
Bitmor DCA approval theft was reported on 2026-05-25. Evidence indicates that a malicious approval was used to steal assets from a Bitmor DCA user. Reported loss is approximately $10,000.00.
Primary source：revoke.cash public source - DCI-2026-156
Lazarus RemotePE in-memory RAT campaign
Lazarus RemotePE in-memory RAT campaign was reported on 2026-05-25. Evidence indicates that Lazarus-linked RemotePE malware executed an in-memory remote-access payload. No stable verified USD loss amount was published.
Primary source：x.com public source - DCI-2026-150
New Market Trading security incident
New Market Trading security incident was reported on 2026-05-25. Evidence indicates that an executed trading-platform incident moved assets without authorization. Reported loss is approximately $3,980,000.
Primary source：x.com public source - DCI-2026-135
WUSD / GLOVE exploit
WUSD / GLOVE exploit was reported on 2026-05-25. Evidence indicates that a smart-contract weakness affected WUSD / GLOVE liquidity. Reported loss is approximately $207,000.
Primary source：x.com public source - DCI-2026-134
Fake Uniswap Google Ads phishing campaign
Fake Uniswap Google Ads phishing campaign was reported on 2026-05-25. Evidence indicates that a paid-search advertisement led users to a fake Uniswap phishing page. Reported loss is approximately $400,000.
Primary source：x.com public source - DCI-2026-124
SquidRouterModule third-party module compromise
SquidRouterModule third-party module compromise was reported on 2026-05-25. Evidence indicates that a third-party router module was compromised and used against connected liquidity. Reported loss is approximately $3,100,000.
Primary source：x.com public source - DCI-2026-154
TrapDoor supply-chain campaign
TrapDoor supply-chain campaign was reported on 2026-05-24. Evidence indicates that malicious code was distributed through a software supply-chain campaign. No stable verified USD loss amount was published.
Primary source：x.com public source - DCI-2026-149
Fractal Protocol security incident
Fractal Protocol security incident was reported on 2026-05-24. Evidence indicates that public monitoring confirmed an executed protocol exploit but did not establish a complete root cause. Reported loss is approximately $13,700.00.
Primary source：x.com public source - DCI-2026-148
Mure security incident
Mure security incident was reported on 2026-05-23. Evidence indicates that public monitoring confirmed an executed protocol exploit but did not establish a complete root cause. Reported loss is approximately $11,700.00.
Primary source：x.com public source - DCI-2026-125
StablR stablecoin mint-authority compromise
StablR stablecoin mint-authority compromise was reported on 2026-05-23. Evidence indicates that stablecoin mint authority was used without authorization. Reported loss is approximately $2,800,000.
Primary source：x.com public source - DCI-2026-160
Based Apparel website wallet-drainer injection
Based Apparel website wallet-drainer injection was reported on 2026-05-22. Evidence indicates that wallet-draining code was injected into the Based Apparel website. No stable verified USD loss amount was published.
Primary source：x.com public source - DCI-2026-131
Polymarket UMA CTF Adapter operational-key compromise
Polymarket UMA CTF Adapter operational-key compromise was reported on 2026-05-22. Evidence indicates that an operational key used by the UMA CTF Adapter was compromised. Reported loss is approximately $520,000.
Primary source：x.com public source - DCI-2026-140
MAP / Butter Bridge exploit
MAP / Butter Bridge exploit was reported on 2026-05-20. Evidence indicates that a bridge contract or message-validation path was exploited. Reported loss is approximately $110,000.
Primary source：x.com public source - DCI-2026-127
RetoSwap / Haveno multisig-path exploit
RetoSwap / Haveno multisig-path exploit was reported on 2026-05-20. Evidence indicates that the RetoSwap / Haveno multisig path was exploited. Reported loss is approximately $2,700,000.
Primary source：x.com public source - DCI-2026-147
HermesVault security incident
HermesVault security incident was reported on 2026-05-19. Evidence indicates that a vault weakness was exploited before most assets were returned. Reported loss is approximately $4,000.00.
Primary source：x.com public source - DCI-2026-141
Echo Protocol / eBTC admin-key compromise
Echo Protocol / eBTC admin-key compromise was reported on 2026-05-19. Evidence indicates that administrative signing authority was compromised. Reported loss is approximately $5,130,000.
Primary source：x.com public source - DCI-2026-052
First Verus–Ethereum Bridge value-conservation exploit
On May 18, 2026, Verus–Ethereum Bridge validation failed to enforce value equality between source-side input and destination-side output, allowing low-value input to release high-value reserves. Initial exposure was approximately $11.58 million, and about 4,052.4 ETH, publicly valued near $8.5 million, was later returned.
Primary source：x.com public source - DCI-2026-159
Ledger physical-letter seed phishing campaign
Ledger physical-letter seed phishing campaign was reported on 2026-05-17. Evidence indicates that physical letters impersonating Ledger attempted to steal wallet seed phrases. No stable verified USD loss amount was published.
Primary source：x.com public source - DCI-2026-146
SEA Token security incident
SEA Token security incident was reported on 2026-05-17. Evidence indicates that public monitoring confirmed an executed protocol exploit but did not establish a complete root cause. Reported loss is approximately $153,000.
Primary source：x.com public source - DCI-2026-132
Adshares Bridge exploit
Adshares Bridge exploit was reported on 2026-05-17. Evidence indicates that the Adshares bridge validation path was exploited. Reported loss is approximately $88,000.00.
Primary source：x.com public source - DCI-2026-120
THORChain multichain vault theft
THORChain multichain vault theft was reported on 2026-05-15. Evidence indicates that a malicious validator used threshold-signing interactions to recover vault signing material. Reported loss is approximately $10,350,000.
Primary source：x.com public source - DCI-2026-161
Fake job-interview JobStealer campaign
Fake job-interview JobStealer campaign was reported on 2026-05-14. Evidence indicates that fake job interviews delivered credential and wallet-stealing malware. No stable verified USD loss amount was published.
Primary source：x.com public source - DCI-2026-139
ShapeShift Colony meta-transaction exploit
ShapeShift Colony meta-transaction exploit was reported on 2026-05-13. Evidence indicates that a meta-transaction validation weakness allowed unauthorized execution. Reported loss is approximately $132,000.
Primary source：x.com public source - DCI-2026-128
Transit Finance legacy-contract exploit
Transit Finance legacy-contract exploit was reported on 2026-05-13. Evidence indicates that a legacy Transit Finance contract path remained exploitable. Reported loss is approximately $1,880,000.
Primary source：x.com public source - DCI-2026-145
SQ Protocol ownership compromise
SQ Protocol ownership compromise was reported on 2026-05-12. Evidence indicates that contract ownership was taken over and used against the staking contract. Reported loss is approximately $346,100.
Primary source：x.com public source - DCI-2026-133
Aurellion Labs Diamond-proxy malicious-facet exploit
Aurellion Labs Diamond-proxy malicious-facet exploit was reported on 2026-05-12. Evidence indicates that a malicious Diamond proxy facet was installed through administrative authority. Reported loss is approximately $456,000.
Primary source：halborn.com public source - DCI-2026-126
TAC Protocol TON–EVM bridge incident
TAC Protocol TON–EVM bridge incident was reported on 2026-05-12. Evidence indicates that a TON–EVM bridge path was exploited and later handled through a negotiated return. Reported loss is approximately $280,000.
Primary source：x.com public source - DCI-2026-183
Huma Finance V1 BaseCreditPool legacy-contract exploit
Huma Finance V1 BaseCreditPool legacy-contract exploit was reported on 2026-05-11. Evidence indicates that a legacy BaseCreditPool contract path remained exploitable. Reported loss is approximately $101,400.
Primary source：hacked.slowmist.io public source - DCI-2026-157
TrickMo Android malware variant
TrickMo Android malware variant was reported on 2026-05-11. Evidence indicates that a TrickMo Android malware variant targeted financial and authentication data. No stable verified USD loss amount was published.
Primary source：x.com public source - DCI-2026-138
INK Finance treasury privilege compromise
INK Finance treasury privilege compromise was reported on 2026-05-11. Evidence indicates that treasury privileges were used without authorization. Reported loss is approximately $140,000.
Primary source：x.com public source - DCI-2026-144
Renegade security incident
Renegade security incident was reported on 2026-05-10. Evidence indicates that public monitoring confirmed an executed protocol exploit and later reported returned funds. Reported loss is approximately $209,000.
Primary source：x.com public source - DCI-2026-122
TrustedVolumes RFQ proxy exploit
TrustedVolumes RFQ proxy exploit was reported on 2026-05-07. Evidence indicates that an RFQ proxy authorization path allowed unauthorized asset movement. Reported loss is approximately $6,300,000.
Primary source：x.com public source - DCI-2026-162
ClickFix fake macOS tool campaign
ClickFix fake macOS tool campaign was reported on 2026-05-06. Evidence indicates that a ClickFix social-engineering flow delivered a fake macOS tool. No stable verified USD loss amount was published.
Primary source：x.com public source - DCI-2026-129
Ekubo Protocol extension callback exploit
Ekubo Protocol extension callback exploit was reported on 2026-05-05. Evidence indicates that an extension callback path allowed reentrant or unauthorized execution. Reported loss is approximately $1,400,000.
Primary source：x.com public source - DCI-2026-143
SmartCredit security incident
SmartCredit security incident was reported on 2026-05-04. Evidence indicates that public monitoring confirmed an executed protocol exploit but did not establish a complete root cause. Reported loss is approximately $72,000.00.
Primary source：x.com public source - DCI-2026-137
Bankr / Grok wallet AI-agent attack
Bankr / Grok wallet AI-agent attack was reported on 2026-05-04. Evidence indicates that an AI-agent wallet workflow was manipulated to authorize asset movement. Reported loss is approximately $175,000.
Primary source：x.com public source - DCI-2026-158
FEMITBOT Telegram Mini Apps malware campaign
FEMITBOT Telegram Mini Apps malware campaign was reported on 2026-05-03. Evidence indicates that malicious Telegram Mini Apps distributed the FEMITBOT payload. No stable verified USD loss amount was published.
Primary source：x.com public source - DCI-2026-142
Sharwa Finance security incident
Sharwa Finance security incident was reported on 2026-05-01. Evidence indicates that public monitoring confirmed an executed protocol exploit but did not establish a complete root cause. Reported loss is approximately $32,850.00.
Primary source：x.com public source - DCI-2026-130
Bisq v1 client attack
Bisq v1 client attack was reported on 2026-05-01. Evidence indicates that a weakness in the Bisq v1 client or trade workflow enabled theft. Reported loss is approximately $858,000.
Primary source：halborn.com public source - DCI-2026-002
KelpDAO rsETH bridge RPC infrastructure compromise
LayerZero’s final report says compromised RPC infrastructure enabled a forged cross-chain message, resulting in the loss of 116,500 rsETH, approximately $292 million; KelpDAO’s single-DVN configuration allowed the destination contract to accept the attestation. May litigation and asset-restriction developments are attached to the same incident.
Primary source：LayerZero final incident report - DCI-2024-001
Radiant Capital multisig operations compromise
Attackers compromised multisig operators and tampered with the Safe Wallet transaction interface, causing about $50 million in reported losses.
Primary source：Public incident post-mortem
Data snapshot Not real-time or complete coverage