Seven Keys, One Laptop: How Humanity Protocol Lost $36 Million
Humanity Protocol marketed itself as a way to separate real people from bots and synthetic identity on-chain, branding itself, in the words of founder and CEO Terence Kwok, as the …
Latest
Fresh from the desk
Malformed Proof, Real Tokens: Inside Syscoin's 5 Billion SYS Bridge Exploit
Five billion SYS appeared out of nowhere on June 7th. No private key was compromised and no cryptographic scheme was cracked — an attacker simply handed Syscoin's bridge relay a pr…
The One Key That Undid TesseraDAO — A $2.49M BNB Chain Drain
TesseraDAO's collapse was not a hack in the conventional sense — no bug was found, no code was broken. It was a protocol run entirely on a single, unrevoked private key, and on Jun…
How a Fake Denom String Let an Attacker Walk Off With $5.4M From Gravity Bridge
Gravity Bridge, the Ethereum-Cosmos connector marketed as a decentralized alternative to multisig-based bridges , was emptied on May 29th . No private key was stolen and no signatu…
A Dormant Admin Key From 2021 Just Cost DxSale $7.3 Million
DxSale's liquidity-locking product was never hacked in the conventional sense. Instead, a wallet that had quietly held administrative control over an old 2021 locker contract used …
A Borrowed Name and a Copied String: How New Market Trading's Clients Lost $3.98 Million
Much of the initial coverage described this as a Squid hack . That framing was wrong from the start. In under two hours, 88 Gnosis Safes spread across Ethereum, Base, and Arbitrum …
A Nine-Day-Old Patch and a Years-Stale Signing Library Cost THORChain $10.7 Million
Background THORChain's relationship with North Korean threat actors has been unusually direct for a protocol its size. Chainalysis data cited by CoinDesk put roughly $1.2 billion i…
How a Trust-Signing Worm Turned TanStack's Own Pipeline Into the Attack
"The survival of cuckoo chicks depends on the ignorance of other species." — Clifford Stoll, The Cuckoo's Egg Security researchers had already flagged the exposure. Instead of a fi…
A Public Signer-Registration Function Let an Attacker Empty TrustedVolumes' Vault for $5.87M
TrustedVolumes, a liquidity provider and resolver working inside 1inch's Fusion ecosystem, lost roughly $5.87 million across four assets in a single Ethereum transaction on May 7, …
One Compromised Key Drained $5.9 Million From Wasabi Protocol Across Four Chains
In the early hours of April 30, 2026, an attacker who already held the private key to Wasabi Protocol's sole administrative wallet put that key to use. Within roughly three minutes…
MCP's Unaudited Middleware Problem: A Year of Breaches Nobody Was Watching For
There was no announcement, no white-hat disclosure, no price crash to serve as a warning sign. The exposure sat quietly for months inside infrastructure that had already been folde…
Sui's Volo Protocol Loses $3.5M to a Leaked Key, Then Recovers Nearly All of It
On April 21, 2026, roughly $3.5 million left Volo, a liquid-staking protocol on Sui, drained from three isolated vaults holding WBTC, XAUm (tokenized gold), and USDC. Volo's own st…
Investigation alerts
Get new scam files the moment we publish them — usually 2–3 emails a week.