Oracle Upgrade Leaves Compound's ETH Market Frozen for a Week
Compound's governance model produced another self-inflicted setback this week, echoing a prior episode in which the protocol's own processes had already caused financial damage. On…
Latest
Fresh from the desk
Tornado Cash Sanctions Put Ethereum's Neutrality to the Test
DeFi has just come through a rough summer. Two brutal market crashes and a grim macro backdrop have left much of the industry's optimism riding on the success of Ethereum's newly-c…
Misconfigured Liquidity Pool Lets Acala Users Mint $1.3 Billion in Excess aUSD
A configuration error in a newly launched liquidity pool on Acala Network, the Polkadot-based project describing itself as the "DeFi Hub of Polkadot," allowed users to mint roughly…
DNS Hijack on Curve Finance's Front End Leads to $575K in Losses
On August 9, 2022, Curve Finance's main interface, curve.fi , was compromised through a DNS hijack, first flagged publicly by a security researcher. Visitors were served a prompt t…
When Code Gets Blacklisted: The Tornado Cash Sanctions Fallout
Tornado Cash, long the most contested application built on Ethereum, has finally run out of runway. Earlier efforts to appease regulators evidently weren't enough to hold off enfor…
The Phantom-Slope Wallet Drain - Tracing Solana's $5.3M Mass Key Compromise
A sudden, indiscriminate attack tends to produce the same reaction every time: panic first, then suspicion, as nobody can be sure who's already been hit and who's next. Roughly 8,0…
The Free-For-All Drain: How a Trusted-Root Bug Let Anyone Empty Nomad Bridge of $190M
Nomad Bridge lost $190 million in liquidity over roughly two and a half hours in an exploit that, unlike most hacks, required no special access or sophistication — once the flaw wa…
A Flash Loan, an Inflated Token, and $3.5M Gone From Nirvana Finance
Nirvana Finance, a newly launched protocol on Solana, lost $3.5 million to a flash loan exploit. The project markets itself as a form of "DeFi 3.0," promising to "transform risk in…
How a Storage Slot Collision Let an Attacker Seize Audius Governance
On Monday, July 25, 2022, Audius — a web3 music-streaming platform often compared to Spotify — suffered a governance exploit that saw roughly $6 million worth of its AUDIO token di…
Fake Tick Account Lets Attacker Siphon $8.8M From Crema Finance on Solana
Crema Finance , a concentrated-liquidity automated market maker built on Solana, was manipulated into generating and paying out millions of dollars in fabricated liquidity-provider…
Three Arrows Capital's Collapse Drags Voyager and BlockFi Into a Liquidity Crisis
Three Arrows Capital's implosion continues to spread through the industry. Bad positions in LUNA, staked ETH, and Grayscale's GBTC trust triggered hundreds of millions of dollars i…
Two Compromised Keys, One $100 Million Bridge: Inside the Harmony Horizon Hack
Harmony's cross-chain bridge lost $100 million in an exploit that ranks among the largest bridge hacks on record, making it the third bridge to enter the top-ten leaderboard and th…
Investigation alerts
Get new scam files the moment we publish them — usually 2–3 emails a week.