Much of the initial coverage described this as a Squid hack . That framing was wrong from the start. In under two hours, 88 Gnosis Safes spread across Ethereum, Base, and Arbitrum …
Background THORChain's relationship with North Korean threat actors has been unusually direct for a protocol its size. Chainalysis data cited by CoinDesk put roughly $1.2 billion i…
"The survival of cuckoo chicks depends on the ignorance of other species." — Clifford Stoll, The Cuckoo's Egg Security researchers had already flagged the exposure. Instead of a fi…
TrustedVolumes, a liquidity provider and resolver working inside 1inch's Fusion ecosystem, lost roughly $5.87 million across four assets in a single Ethereum transaction on May 7, …
In the early hours of April 30, 2026, an attacker who already held the private key to Wasabi Protocol's sole administrative wallet put that key to use. Within roughly three minutes…
There was no announcement, no white-hat disclosure, no price crash to serve as a warning sign. The exposure sat quietly for months inside infrastructure that had already been folde…
On April 21, 2026, roughly $3.5 million left Volo, a liquid-staking protocol on Sui, drained from three isolated vaults holding WBTC, XAUm (tokenized gold), and USDC. Volo's own st…
Nobody breached KelpDAO's smart contracts. They breached the single piece of infrastructure KelpDAO's bridge was built to trust. On April 18, 2026, an attacker manipulated the lone…
An attacker spent roughly 42 hours preparing a swarm of 123 worthless tokens and five worker wallets before launching them within ten seconds of one another, and by the time most u…
Hyperbridge initially reported losses of $237,000 tied to an exploit that saw 1 billion DOT tokens minted out of nothing. Days later the protocol revised that number to $2.5 millio…
Sumsub has scanned the passports, faces, and government IDs of users across more than 4,000 client businesses . Each of those clients relies on Sumsub to answer a question they can…
Helius CEO Mert was the first to raise an alarm. On the morning of April 1st, he posted publicly that Drift "might be getting exploited," though he stopped short of certainty. Minu…
Get new scam files the moment we publish them — usually 2–3 emails a week.