The Ten-Month Cover-Up Behind ZeroLend's Quiet Base Exploit
For nearly a year, ZeroLend let its LBTC market on Base sit empty while depositors were told nothing. The market was actually drained on February 23, 2025 , only eighteen days afte…
Latest
Fresh from the desk
A Routine Rebalance Cost YO Protocol $3.6 Million — No Hacker Involved
YO Protocol's own automated vault system, not an outside attacker, is responsible for one of DeFi's stranger losses this year: a single rebalancing trade that sent $3.71 million in…
Dormant Truebit Contract Drained of $26.2 Million Via Five-Year-Old Overflow Bug
On January 8, 2026, an attacker emptied Truebit's aging purchase contract of 8,535 ETH (roughly $26.2 million) in a single transaction, capping off nearly five years of dormancy fo…
A 36-Hour Drain: How TMXTribe Lost $1.4 Million to an Unaudited Contract Loop
TMXTribe, an Arbitrum-based perpetuals platform built as a fork of GMX, lost roughly $1.4 million to an exploit that ran for about 36 hours before the funds were bridged out and la…
Freed From the SEC, Aave Turns Its Fire Inward Over Who Owns the Brand
A four-year regulatory overhang lifted for Aave in mid-December 2025, only for the protocol to spend the following weeks consumed by an internal dispute over ownership, revenue, an…
Five-Year-Old iEarn Contract Bled for $293k in Yearn's Fourth Exploit
DeFi's habit of repeating itself isn't limited to patterns of behavior — sometimes it's the exact same bug, replayed against a different balance sheet. Yearn Finance has now been h…
A Six-Day-Old Oracle Patch Let an Attacker Drain Aevo's Legacy Ribbon Vaults for $2.7M
On December 12, Aevo's dormant Ribbon Finance vaults lost $2.7 million — not to some novel cryptographic break, but to a routine oracle configuration change that had quietly stripp…
Six Days Between a Billion-Dollar Bet and a Volume Bombshell
Paradigm led a $1 billion investment into Kalshi on December 2, 2025 , with participation from Sequoia, Andreessen Horowitz, Meritech Capital, IVP, ARK Invest, Anthos Capital, Capi…
Hidden Proxy Sat Undetected for 78 Days Before Draining $1M From USPD
USPD's smart contracts passed audit review and its unit tests held up fine. What the protocol failed to notice was that an outside party had been sitting in its admin role for near…
Kill Switches, Biometric Gates and Tokenized Assets: How Access Became Conditional
In 1969, Philip K. Dick imagined a door that would not open until its occupant paid it five cents — a scene from his novel Ubik that read, at the time, as satire aimed at a hyper-c…
How a Forgotten yETH Pool Let an Attacker Mint Infinite Tokens and Walk Away With $9 Million
An old, largely overlooked corner of the Yearn ecosystem became the site of a nine-figure — in token count, not dollars — minting event on November 30. A custom stableswap pool for…
Four Signatures, Zero Oversight: MegaETH's Pre-Deposit Unravels Into a $500M Scramble
On November 25, 2025, MegaETH — a Layer 2 network backed by Ethereum co-founders Vitalik Buterin and Joe Lubin's MegaLabs, which had just closed a $450 million token sale and carri…
Investigation alerts
Get new scam files the moment we publish them — usually 2–3 emails a week.