GMX V1's $42M Reentrancy Scare Turns Out to Be a Rescue in Disguise
On July 9th, roughly $42 million left GMX's V1 GLP pool on Arbitrum through a cross-contract reentrancy flaw that had gone unnoticed despite two years of live operation and two sep…
Latest
Fresh from the desk
TON's UAE Golden Visa Pitch Collapses Within 48 Hours of Regulatory Pushback
TON's leadership floated a plan to trade crypto staking for UAE residency rights. It took federal regulators less than two days to dismantle it publicly. The pitch On July 6th, TON…
A Leaked RPC Endpoint Exposed Rowan Energy's Hidden 400 Million Token Mint
Rowan Energy marketed itself as a bridge between rooftop solar and blockchain rewards: carbon-neutral mining, "SmartMiner" hardware, and a private ledger that would pay homeowners …
How Cork Protocol's $12M Hacker Ended Up Correcting Its Auditors
Cork Protocol lost $12 million on May 28, 2025, when an attacker exploited two separate flaws to drain its wstETH:weETH market. The technical breakdown that followed should have cl…
How a Two-Hour-Old Vault Cost Resupply $9.8 Million
On June 25th, Resupply launched a new lending market with the usual fanfare of governance votes and audit sign-offs. Within roughly two hours of that market going live, an attacker…
Hacken's Own Bridge Key Leak Wipes Out 99% of HAI's Value
Web3 security firm Hacken built its reputation auditing other people's protocols. On June 20th, its own infrastructure was the one that failed: a compromised bridge private key led…
A Compromised Admin Key Drains $500K From Zunami Protocol — Its Fourth Exploit Since 2023
Zunami Protocol lost roughly $500,000 in collateral on May 14th after control over its admin privileges ended up in the wrong hands. Rather than a technically sophisticated attack,…
A Fake Token Named After a Cartoon Toy Drained $16M From AlexLab's Vaults
Just over a year after a compromised private key cost it $4.3 million , AlexLab — Bitcoin's self-described finance layer — was hit again, this time for more than $16 million. The s…
Nervos' Force Bridge Drained for $3.76M One Day After Its Retirement Was Announced
Force Bridge lost $3.76 million to an access-control exploit on June 1st, in a sequence of events whose timing invites scrutiny: the protocol's sunset had been announced barely a d…
How Vesu Caught and Patched a Starknet Lending Flaw Before Anyone Could Exploit It
Not every DeFi security story ends with a drained treasury. Vesu , a lending protocol built on Starknet , identified a critical vulnerability, disclosed it, and shipped a fix — all…
Counterfeit Tokens Let Attacker Siphon $12M From Cork Protocol's wstETH Market
An attacker used self-deployed counterfeit tokens to manipulate how Cork Protocol calculated exchange rates, walking away with roughly $12 million drawn from the project's wstETH m…
Marinade Finance's Inverted Unstaking Logic Drained $5 Million From mSOL Holders Over Six Months
A single inverted piece of logic in Marinade Finance's validator auction system quietly turned a mechanism designed to reward performance into one that rewarded doing the opposite.…
Investigation alerts
Get new scam files the moment we publish them — usually 2–3 emails a week.