https://andromeda.observer/ Public incidents and advisories. Read at source. Root cause as published. Losses as sourced, attributed. en Fri, 06 Nov 2026 00:00:00 GMT https://andromeda.observer/e/tendril-tax-token-burn-sync-pool-drainhttps://andromeda.observer/e/tendril-tax-token-burn-sync-pool-drainWed, 04 Nov 2026 00:00:00 GMTSmart-contract exploitAccountingTENDRIL's sell-tax hook burned the pair's balance and synced reserves mid-sell; a flash-loaned swap took near all USDT. ~$555K pool loss, per CertiK. Primary sources: https://x.com/Phalcon_xyz/status/2118307638274675165 · https://x.com/Phalcon_xyz/status/2118335898018308197 · https://x.com/CertiKAlert/status/2118242639212658985 · https://x.com/DefimonAlerts/status/2118229071972684057 · https://bscscan.com/tx/0xfdff4fba4327821c204af07944076ecaaee163a994398fdf4063d08712e40059https://andromeda.observer/e/corevault-bnix-osk-spot-price-redemptionhttps://andromeda.observer/e/corevault-bnix-osk-spot-price-redemptionTue, 03 Nov 2026 00:00:00 GMTSmart-contract exploitOraclePer Defimon and CertiK, a flash-loaned WBNB dump skewed CoreVault's spot-price oracle and inflated a principal redemption, draining its InsurancePool. Primary sources: https://x.com/DefimonAlerts/status/2117840075291513155 · https://x.com/CertiKAlert/status/2117807437357183374 · https://x.com/TenArmorAlert/status/2117794176079376390 · https://bscscan.com/tx/0x072a10a579e2a8afa26a681205a2aaaa38f74bcb9d1064b12bd9e9ebe2c598b3https://andromeda.observer/e/binance-initial-findings-fake-interview-signing-servicehttps://andromeda.observer/e/binance-initial-findings-fake-interview-signing-serviceTue, 03 Nov 2026 00:00:00 GMTExchange post-mortem (initial)Social engineeringBinance: a fake-interview repo, an internal AI tool and a deployment token reached its wallet signing service. ~$6.34B impacted, ~$2.85B frozen. Primary sources: https://x.com/binance/status/2117626126214504729 · https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · http://www.kcna.kp/en/article/detail/873496f71f6ab3e667a4271b5a4cf4c6 · http://kcna.kp/en/article/detail/547d4372853b197db4d1c73810d70768https://andromeda.observer/e/mercado-bitcoin-security-incident-platform-pausedhttps://andromeda.observer/e/mercado-bitcoin-security-incident-platform-pausedMon, 02 Nov 2026 00:00:00 GMTExchange security incident (developing)Not yet publishedMercado Bitcoin says a 2 Nov security incident affected assets worth US$36.3M; US$12.9M blocked. Platform paused; MB says it will cover balances. Primary sources: https://x.com/MercadoBitcoin/status/2117637227551273267 · https://x.com/MercadoBitcoin/status/2118096165430550882https://andromeda.observer/e/btcpay-server-2-4-1-hot-wallet-drainshttps://andromeda.observer/e/btcpay-server-2-4-1-hot-wallet-drainsSun, 01 Nov 2026 00:00:00 GMTSelf-hosted software exploitNot yet publishedBTCPay Server says attackers drained BTC and LTC hot wallets on servers running 2.4.1 or earlier, via the flaw fixed in 2.4.2. Rebuild, don't just update. Primary sources: https://blog.btcpayserver.org/btcpay-server-security-incident-2-4-1-and-earlier/ · https://x.com/BtcpayServer/status/2117106238123123008 · https://x.com/BtcpayServer/status/2117264826569211992 · https://mempool.space/address/bc1p0f7wmcnesrapznymf9ljdn04pudgmh96sqtrm9vmgqxdh666fh8qvn63r7https://andromeda.observer/e/premia-arbitrum-vaults-empty-option-poolshttps://andromeda.observer/e/premia-arbitrum-vaults-empty-option-poolsSun, 01 Nov 2026 00:00:00 GMTSmart-contract exploit (developing)ValidationPer Blockaid, an attacker created empty Premia option pools, flash-loaned and bought options to lock vault collateral, then withdrew it. ~$400K to $465K. Primary sources: https://x.com/blockaid_/status/2116745378674463229 · https://x.com/blockaid_/status/2116745382231515416 · https://x.com/PeckShieldAlert/status/2116758393067340132 · https://arbiscan.io/tx/0x64602cbbeba5d3c7a5e2cff4f98cc118886fc6051c56fa50458abec2c90441achttps://andromeda.observer/e/flap-kintsu-dns-hijack-malicious-cloneshttps://andromeda.observer/e/flap-kintsu-dns-hijack-malicious-clonesSat, 31 Oct 2026 00:00:00 GMTDNS hijack (developing)Third-party accessFlap and Kintsu say their domains were hijacked on 31 Oct. Kintsu: an unauthorized nameserver change at its registrar served a malicious clone for ~4 hours. Primary sources: https://x.com/Kintsu/status/2116570830075474018 · https://x.com/flapdotsh/status/2116352828734050339 · https://x.com/flapdotsh/status/2116400008127996252 · https://x.com/blockaid_/status/2116354922128015441https://andromeda.observer/e/troves-legacy-rebalancer-xwbtc-vaulthttps://andromeda.observer/e/troves-legacy-rebalancer-xwbtc-vaultSat, 31 Oct 2026 00:00:00 GMTSmart-contract exploit (developing)Access controlTroves says a replaced rebalancing contract still held permissions and was used to take ~8.6 BTC from its xWBTC/WBTC vault on Starknet. Three vaults paused. Primary sources: https://x.com/trovesfi/status/2116541963755475375 · https://x.com/trovesfi/status/2116579889986068900 · https://x.com/trovesfi/status/2116606204680249415https://andromeda.observer/e/b14g-core-staking-unauthorized-withdrawal-hard-forkhttps://andromeda.observer/e/b14g-core-staking-unauthorized-withdrawal-hard-forkSat, 31 Oct 2026 00:00:00 GMTStaking protocol exploit (developing)Not yet publishedb14g says ~97M CORE staked through it was withdrawn without authorization on 31 Oct. A Core hard fork on 2 Nov moved 68.15M CORE to a recovery address. Primary sources: https://x.com/b14g_network/status/2116570456245596580 · https://x.com/Coredao_Org/status/2116582149101121618 · https://x.com/b14g_network/status/2117155664980251068https://andromeda.observer/e/trezor-cryptobilis-implant-reporthttps://andromeda.observer/e/trezor-cryptobilis-implant-reportFri, 30 Oct 2026 00:00:00 GMTHardware supply chain (unverified report)Supply chainTrezor says it received a credible report of a hardware implant in a Trezor Safe 5 bought from CryptoBilis. Not yet lab-verified. No losses reported. Primary sources: https://trezor.io/blog/news/implant-reported-in-a-trezor-sold-by-cryptobilis · https://x.com/Trezor/status/2116062963752747040https://andromeda.observer/e/binance-hot-wallet-eip7702-sweephttps://andromeda.observer/e/binance-hot-wallet-eip7702-sweepThu, 29 Oct 2026 00:00:00 GMTExchange hot wallet compromise (developing)Not yet publishedBinance estimates ~$6.3B impact and ~$3B frozen. On Ethereum, ~$3.79B left Binance-labeled wallets after an EIP-7702 delegation. Per Binance, on-chain. Primary sources: https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7 · https://x.com/binance/status/2115993361517891592 · https://etherscan.io/tx/0xad99264d5532ae0dd04b2004eebda05f25657e70dacb764f7ac8d4ccd051298b · https://etherscan.io/tx/0x53bd38b816c23e74134786c29a8c18d792777998a3b9326047b583100e88e2f3 · https://etherscan.io/tx/0x7baba482077843514d9c72bac0110ba0916b0814288a72917e2c3bb27a9d8659 · https://etherscan.io/tx/0xc954c86f118e8e410e6a3eb9e3b38ff4a95fbdae9d2d58e13166afb7a1f4fc5fhttps://andromeda.observer/e/zklink-nova-arbitrator-forged-batch-roothttps://andromeda.observer/e/zklink-nova-arbitrator-forged-batch-rootWed, 28 Oct 2026 00:00:00 GMTBridge exploit (developing)Bridge & cross-chainzkLink Nova's Ethereum bridge lost ~$780K–805K after a stale Arbitrator auth hash let an attacker install a forged batch root. Per SlowMist, Phalcon. Primary sources: https://x.com/SlowMist_Team/status/2115635114638250409 · https://x.com/Phalcon_xyz/status/2115671779717083260 · https://x.com/zkLink_Official/status/2115731883313254565 · https://x.com/zkLink_Official/status/2115792847098216545 · https://etherscan.io/tx/0x4f3c23e75b9134e8cae5a462550daad42fbbc19242567fcc34c0a035e297462chttps://andromeda.observer/e/humanode-evm-precompile-delegatecallhttps://andromeda.observer/e/humanode-evm-precompile-delegatecallWed, 28 Oct 2026 00:00:00 GMTChain-level exploitAccess controlHumanode says a DELEGATECALL flaw in its EVM precompiles let an attacker spend existing approvals: 12.77M eHMND from 436 accounts. Refunds pledged. Primary sources: https://blog.humanode.io/humanode-incident-response-and-recovery-update/ · https://x.com/humanode_io/status/2115542397413408974 · https://x.com/humanode_io/status/2115542405634302118https://andromeda.observer/e/fence-tranche-pool-rollover-drawhttps://andromeda.observer/e/fence-tranche-pool-rollover-drawWed, 28 Oct 2026 00:00:00 GMTSmart-contract exploit (developing)AccountingAn Avalanche tranche pool tied to Fence lost ~1.013M USDC when a day-rollover accounting step reopened draw capacity. Per SlowMist, Defimon, Phalcon. Primary sources: https://x.com/SlowMist_Team/status/2115281126516490514 · https://x.com/DefimonAlerts/status/2115328732181242351 · https://x.com/Phalcon_xyz/status/2115371832593563761 · https://x.com/CertiKAlert/status/2115289650025923015 · https://snowtrace.io/tx/0x3f6b23292a2e9c2956c7ac56d0b1f79b0271b49edec2156d2675ddf1de058c77https://andromeda.observer/e/udesk-script-deposit-address-swaphttps://andromeda.observer/e/udesk-script-deposit-address-swapTue, 27 Oct 2026 00:00:00 GMTMalicious script injection (developing)Supply chainSlowMist: a Udesk customer-service script loaded code from udeskqlobal[.]com that steals sessions and logins and swaps crypto deposit addresses. Primary source: https://x.com/SlowMist_Team/status/2115033345675678012https://andromeda.observer/e/predict-fun-api-docs-wallet-drainshttps://andromeda.observer/e/predict-fun-api-docs-wallet-drainsTue, 27 Oct 2026 00:00:00 GMTWallet drains (developing)Third-party accesspredict.fun says ~400,000 USDT left a small number of user wallets; its third-party-hosted API docs site may have been compromised. Reimbursement pledged. Primary source: https://x.com/predictdotfun/status/2115089547528950108https://andromeda.observer/e/wiron-base-chainport-abnormal-issuancehttps://andromeda.observer/e/wiron-base-chainport-abnormal-issuanceTue, 27 Oct 2026 00:00:00 GMTAbnormal bridge issuance (developing)Not yet publishedIron Fish is investigating abnormal wIRON issuance on Base; on-chain, the ChainPort relayer minted 2.38B wIRON in one tx. 1:1 backing not assured. Primary sources: https://x.com/ironfishcrypto/status/2115282030946824307 · https://basescan.org/tx/0x8556ae35e3b99d0f9df139e4ac544b87550981c2064c1ae4b9442854accb1694 · https://basescan.org/token/0x166e70941262ae7cbf9df5c8897a6242c546457dhttps://andromeda.observer/e/glamsterdam-gloas-builder-deposit-routinghttps://andromeda.observer/e/glamsterdam-gloas-builder-deposit-routingMon, 26 Oct 2026 00:00:00 GMTProtocol spec fix (pre-mainnet)ValidationGlamsterdam fix merged 26 Oct: at the Gloas fork, validator deposits sharing a key with a builder could be credited to the builder. Pre-mainnet. Primary sources: https://github.com/ethereum/consensus-specs/pull/5736 · https://github.com/ethereum/consensus-specs/issues/5735https://andromeda.observer/e/avalanche-safe-unclaimed-approval-addresshttps://andromeda.observer/e/avalanche-safe-unclaimed-approval-addressMon, 26 Oct 2026 00:00:00 GMTApproval exploit (MEV front-run)Access controlA 2-of-7 Safe kept unlimited approvals to an address empty on Avalanche. An attacker claimed it; an MEV bot front-ran the ~$7.45M sweep. Per Defimon. Primary sources: https://x.com/DefimonAlerts/status/2115005055619260758 · https://snowtrace.io/tx/0x6952f80bbbcad4368b020bcda600965cf0a520a8694db431b6b1521842d3829e · https://snowtrace.io/tx/0xf1f87d370290afe269ae8eb30fe8e5e4694ad153914a2de6d980641f4a331289 · https://snowtrace.io/tx/0xf88a7960a07832e1bf5be64edbd12a9e615b4f63959a4b87a147f0c63c007ed5https://andromeda.observer/e/yapeswap-zero-quorum-governancehttps://andromeda.observer/e/yapeswap-zero-quorum-governanceSun, 25 Oct 2026 00:00:00 GMTGovernance exploitGovernancePer SlowMist, a zero-quorum Yapeswap proposal with ~0.000055% of voting power gave an attacker YapeFactory's fee role. Loss ~$21.9k. Primary sources: https://x.com/SlowMist_Team/status/2114290073546219799 · https://etherscan.io/tx/0x4c741568cc12b23b382db409b0a38a4cfb6c708904f0c2ce7bad2e4fa7179e1e · https://etherscan.io/tx/0x4527ca2d464aba06c96844a4842d3a79b49771c1964cd1333153a9a4c8dd8a39 · https://etherscan.io/tx/0xfe77b46a63b588748456f810129f6e89f2ab138d402ae0e2d64b29bb9880362ehttps://andromeda.observer/e/dotswap-v1-legacy-server-signing-drainhttps://andromeda.observer/e/dotswap-v1-legacy-server-signing-drainSun, 25 Oct 2026 00:00:00 GMTCustodial pool drain (developing)Not yet publishedDotSwap V1's legacy server-side signing path was used to drain ~8.5 BTC (~$685K) from custodial V1 pools over ~4 hours on 25 Oct, per On Nexus. Primary source: https://x.com/swap_on_nexus/status/2114918342863868103https://andromeda.observer/e/polkadot-asset-hub-xcm-dotusd-supplyhttps://andromeda.observer/e/polkadot-asset-hub-xcm-dotusd-supplySat, 24 Oct 2026 00:00:00 GMTChain-level bug (developing)Bridge & cross-chainAn XCM bug on Polkadot Asset Hub cut ~4.06M dotUSD from recorded supply; arbitrage cost the Treasury LP an est. $1.3M. Per Polkadot's forum notice. Primary sources: https://forum.polkadot.network/t/xcm-issue-affecting-asset-hub/19126 · https://x.com/PolkadotDevs/status/2114836882169512094https://andromeda.observer/e/electrum-malicious-server-rbf-swaphttps://andromeda.observer/e/electrum-malicious-server-rbf-swapSat, 24 Oct 2026 00:00:00 GMTWallet advisoryValidationElectrum before 4.8.3 let a malicious server replace a just-broadcast transaction and trick users into fee-bumping a payment to the attacker. Update now. Primary sources: https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v · https://x.com/ElectrumWallet/status/2113935057656369564 · https://github.com/spesmilo/electrum/commit/90fe30822561e515a9d2d6e5a352cc07780999ebhttps://andromeda.observer/e/x100-flash-loan-senate-takeoverhttps://andromeda.observer/e/x100-flash-loan-senate-takeoverSat, 24 Oct 2026 00:00:00 GMTGovernance exploit (developing)GovernancePer BlockSec Phalcon, flash-loaned X tokens took two of three X100 Senate seats on 24 Oct 2026 and forced a treasury dump. Est. loss $4.75M to $4.85M. Primary sources: https://x.com/Phalcon_xyz/status/2114020331925258732 · https://x.com/blockaid_/status/2114006384735916278 · https://x.com/blockaid_/status/2114011721300086877 · https://app.blocksec.com/phalcon/explorer/tx/eth/0x38c60844f1923d53fdce7d99e9bc2a2d8c73a08e793341dfbb479f8cc74d81d0https://andromeda.observer/e/initia-movevm-minting-halthttps://andromeda.observer/e/initia-movevm-minting-haltFri, 23 Oct 2026 00:00:00 GMTChain halt (developing)Not yet publishedInitia halted its L1 and rollups on 23 Oct 2026. A co-founder cites a MoveVM bug that allowed minting and about $2.7M bridged out. Root cause unpublished. Primary sources: https://x.com/initia/status/2113661738625155217 · https://x.com/ItsAlwaysZonny/status/2113667290059190466https://andromeda.observer/e/wax-bridge-negative-fee-withdrawalhttps://andromeda.observer/e/wax-bridge-negative-fee-withdrawalThu, 22 Oct 2026 00:00:00 GMTBridge exploitBridge & cross-chainPer Blockaid, a WAX bridge withdraw action accepted a negative max_fee, so tokens left via Solana and Ethereum without being paid for on WAX. Fixed 23 Oct. Primary sources: https://x.com/blockaid_/status/2113247490950696982 · https://x.com/blockaid_/status/2113248378582683941 · https://x.com/WAX_io/status/2113390476225397077 · https://x.com/WAX_io/status/2113733701536551382 · https://waxblock.io/transaction/406b76e85ac057ac7322d4bf7ddbea6ac4a2b23539deaa00ea635d17518fb0c9https://andromeda.observer/e/fearless-wallet-extension-key-exfiltrationhttps://andromeda.observer/e/fearless-wallet-extension-key-exfiltrationWed, 21 Oct 2026 00:00:00 GMTMalicious wallet codeSupply chainPolkadot says the third-party Fearless Wallet browser extension leaked private keys since Feb 2025. SlowMist names versions 3.0.1 and 3.0.3 to 3.0.5. Primary sources: https://x.com/Polkadot/status/2112910039207800970 · https://x.com/SlowMist_Team/status/2113187562336706815https://andromeda.observer/e/nem-token-lp-burn-price-manipulationhttps://andromeda.observer/e/nem-token-lp-burn-price-manipulationWed, 21 Oct 2026 00:00:00 GMTSmart-contract exploitAccountingPer SlowMist, NemTokenV2 on BNB Chain counted transfers into its pool as sells; repeated transfer-skim-burn cycles inflated NEM and took ~$821,920. Primary sources: https://x.com/SlowMist_Team/status/2113206749524316486 · https://x.com/Phalcon_xyz/status/2113223739978707083 · https://bscscan.com/tx/0xfb093c96c0094cbcca10801f97ed2e5ed3d96550ce64b544df5a349545723f91https://andromeda.observer/e/coindcx-deprecated-wallet-sweep-failurehttps://andromeda.observer/e/coindcx-deprecated-wallet-sweep-failureWed, 21 Oct 2026 00:00:00 GMTExchange wallet lossNot yet publishedCoinDCX lost 15.99M USDT from deprecated wallets exposed in its July 2025 incident after a failed sweep let deposits pile up, per CoinDCX. Primary sources: https://coindcx.com/blog/coindcx-news/on-chain-wallet-activity-update-21-oct-2026 · https://x.com/CoinDCX/status/2114913942904660317https://andromeda.observer/e/slice-fundsmodule-fake-slicerhttps://andromeda.observer/e/slice-fundsmodule-fake-slicerTue, 20 Oct 2026 00:00:00 GMTSmart-contract exploitValidationSlice says an exploiter took about $41k in unwithdrawn store earnings on 20 Oct 2026 via a legacy settlement function on Base. Contracts paused and fixed. Primary sources: https://x.com/slice__so/status/2112843976545796498 · https://x.com/DefimonAlerts/status/2112804669865042308 · https://basescan.org/tx/0x02b039a6345348d984e4a0b70dd233127772206e61ce82c390c4709c0b8d790ahttps://andromeda.observer/e/keystone-website-breach-shipping-datahttps://andromeda.observer/e/keystone-website-breach-shipping-dataTue, 20 Oct 2026 00:00:00 GMTData breachNot yet publishedKeystone says a third party obtained customer names, contacts, addresses and order details after unauthorized access to its website. No keys or seeds. Primary source: https://x.com/KeystoneWallet/status/2114054080754770137https://andromeda.observer/e/argent-style-wallet-recovery-wrap-replayhttps://andromeda.observer/e/argent-style-wallet-recovery-wrap-replayMon, 19 Oct 2026 00:00:00 GMTSmart-contract exploitValidationPer SlowMist, an Argent-style wallet system let a recovery finalize at once and replayed one signed call up to 19 times; ~$59.8k lost on 19 Oct 2026. Primary sources: https://x.com/SlowMist_Team/status/2112157232624476254 · https://etherscan.io/tx/0xbfed8d33561ed5f9cbd0f4e62a5bbd20187a64f3e22180148dcb58ed6ebaa795 · https://etherscan.io/tx/0xa0ee8f914205a948c79eca039b7d8265537eb220472c9be1455d3321f1bd571bhttps://andromeda.observer/e/rotki-premium-backup-weak-kdfhttps://andromeda.observer/e/rotki-premium-backup-weak-kdfMon, 19 Oct 2026 00:00:00 GMTSoftware advisoryCryptographyrotki before 1.44.2 keyed premium cloud backups with one unsalted SHA-256 of the password, exposing API keys to offline guessing if a backup leaked. Primary sources: https://nvd.nist.gov/vuln/detail/CVE-2026-116071 · https://github.com/advisories/GHSA-qgg8-6p8q-vrp7 · https://github.com/rotki/rotki/releases/tag/v1.44.2 · https://github.com/rotki/rotki/issues/13393https://andromeda.observer/e/alpscon-hardhat-default-key-whitelisthttps://andromeda.observer/e/alpscon-hardhat-default-key-whitelistSun, 18 Oct 2026 00:00:00 GMTSmart-contract exploitAccess controlPer Defimon, AlpsCon's KYC whitelist on BNB Chain included Hardhat's public test account #0; an attacker used it on 18 Oct 2026 to net about $152K. Primary sources: https://x.com/DefimonAlerts/status/2112102178026308045 · https://bscscan.com/tx/0x824b83f94bdc2e69b81f1cb2dfdf9d4aeed066114e3de29e3af59bd2d9355fc2 · https://bscscan.com/tx/0x29d790bfa04f3b989291f4e9b713cd9544735db5c6f2206166851fef5db11608 · https://bscscan.com/tx/0x6b0148ee33d63877b9c018e9f920152e1f3423539e61e7a08e45c6b4fd7e9178https://andromeda.observer/e/ngrave-liquid-push-notification-phishinghttps://andromeda.observer/e/ngrave-liquid-push-notification-phishingSat, 17 Oct 2026 00:00:00 GMTPhishing via third-party providerThird-party accessAttackers hijacked NGRAVE LIQUID's push provider on 17 Oct 2026 and sent a fake alert that phished recovery phrases. About $2.56M traced, per NGRAVE. Primary source: https://www.ngrave.io/en/blog/incident-report-fake-liquid-security-alert-17-octoberhttps://andromeda.observer/e/tipmine-tip-pool-drainhttps://andromeda.observer/e/tipmine-tip-pool-drainSat, 17 Oct 2026 00:00:00 GMTSmart-contract exploitNot yet publishedTenArmor flagged a ~$68.5K attack on TIPMine on BNB Chain. On-chain, the TIP/SOL pool lost 715 SOL on 17 Oct 2026. Root cause: Unknown. Primary sources: https://x.com/TenArmorAlert/status/2111993166752866498 · https://bscscan.com/tx/0xa7b879b5d4252fa5b518db1f81be8a5cc670c5b978c7626fa287c0a1f37895a3https://andromeda.observer/e/qubic-wallet-weak-seed-drainhttps://andromeda.observer/e/qubic-wallet-weak-seed-drainSat, 17 Oct 2026 00:00:00 GMTWallet exploit (developing)CryptographyQubic says an attacker drained 1,404 wallets, about 2.94 trillion QU, on 17-18 Oct 2026 by exploiting weakly generated seeds. Recovery open. Developing. Primary sources: https://x.com/_Qubic_/status/2111796725677715474 · https://x.com/_Qubic_/status/2111796732598403507 · https://x.com/_Qubic_/status/2112608369135804801 · https://github.com/qubic/wallet/commit/09dd288c338c7ccfade043e840c53b80e795a916 · https://x.com/Phalcon_xyz/status/2112059239829242142 · https://x.com/SlowMist_Team/status/2112471727209161180https://andromeda.observer/e/cysic-bridge-fraudulent-mint-messagehttps://andromeda.observer/e/cysic-bridge-fraudulent-mint-messageSat, 17 Oct 2026 00:00:00 GMTBridge exploitBridge & cross-chainOn 17 Oct 2026 an attacker minted 10M CYS on BNB Chain through Cysic's bridge after accessing a supporting database, per Cysic. Cysic suspended the bridge. Primary sources: https://x.com/cysic_fdn/status/2111761749116637687 · https://x.com/cysic_fdn/status/2112234119337848900https://andromeda.observer/e/kolan-hook-buyback-no-slippage-guardhttps://andromeda.observer/e/kolan-hook-buyback-no-slippage-guardThu, 15 Oct 2026 00:00:00 GMTSmart-contract exploitValidationPer Defimon, Kolan's Uniswap V4 hook bought back with no slippage limit when anyone closed a window; a flash-loan attacker netted ~1.28 ETH on 15 Oct 2026. Primary sources: https://x.com/DefimonAlerts/status/2110776621087047818 · https://etherscan.io/tx/0x7b131926e6f06491ae1aead3e419b208c8aa70ed7898e8c5a33d9f52e40915a9https://andromeda.observer/e/pirate-chain-counterfeit-arrr-rollbackhttps://andromeda.observer/e/pirate-chain-counterfeit-arrr-rollbackWed, 14 Oct 2026 00:00:00 GMTChain-level exploitValidationTwo validation flaws let an attacker mint about 39.82M counterfeit ARRR on 14 Oct 2026. Pirate Chain v6.0.14 rolled the chain back to block 4,176,944. Primary sources: https://x.com/PirateChain/status/2113071437703532640 · https://x.com/PirateChain/status/2110774266123767871 · https://github.com/PirateNetwork/pirate/releases/tag/v6.0.14-b14db80 · https://github.com/PirateNetwork/pirate/blob/master/doc/release-notes/release-notes-6.0.14.md · https://github.com/PirateNetwork/pirate/blob/master/doc/release-notes/release-notes-6.0.10.mdhttps://andromeda.observer/e/uncx-vesting-v2-share-accountinghttps://andromeda.observer/e/uncx-vesting-v2-share-accountingWed, 14 Oct 2026 00:00:00 GMTSmart-contract exploitAccountingUNCX Vesting V2 was drained on 14 Oct 2026 via stale share records reused on cancel. 11 transactions, 4 chains, about $807,609 per UNCX's report. Primary sources: https://uncx.network/vesting-incident · https://x.com/UNCX_token/status/2110506196339941423https://andromeda.observer/e/autheo-ibc-asset-validationhttps://andromeda.observer/e/autheo-ibc-asset-validationMon, 12 Oct 2026 00:00:00 GMTChain-level exploitBridge & cross-chainAutheo says an IBC asset-validation flaw let an attacker-run chain create ~219M unauthorized THEO on 12 Oct 2026. Mainnet remained halted as of 20 Oct. Primary source: https://www.autheo.com/blog/autheo-community-update-october-20-2026https://andromeda.observer/e/bitbay-vault-zero-liquidity-withdrawhttps://andromeda.observer/e/bitbay-vault-zero-liquidity-withdrawFri, 09 Oct 2026 00:00:00 GMTSmart-contract exploitAccountingPer SlowMist, a BitBay vault on Polygon paid its full balance when liquidity was zero; an attacker redeemed one share unit for ~14,838 DAI on 9 Oct 2026. Primary sources: https://x.com/SlowMist_Team/status/2108399198035202138 · https://polygonscan.com/tx/0x5b795dc5c5e1665b712c7ccf478c1d8c59a162d698f4e0bfb40bd303e04a7ff2https://andromeda.observer/e/ledger-cryptobilis-implanthttps://andromeda.observer/e/ledger-cryptobilis-implantFri, 09 Oct 2026 00:00:00 GMTHardware supply chainSupply chainLedger confirmed a hidden implant in signers resold by CryptoBilis that captured recovery phrases at setup and sent them over LTE. Losses unconfirmed. Primary sources: https://x.com/Ledger/status/2109896739985453358 · https://www.ledger.com/blog-response-hardware-implant-attack · https://x.com/Ledger/status/2112478780576952759https://andromeda.observer/e/ethervista-pair-k-invariant-overflowhttps://andromeda.observer/e/ethervista-pair-k-invariant-overflowFri, 09 Oct 2026 00:00:00 GMTSmart-contract exploitValidationPer SlowMist, EtherVistaPair.swap() multiplied uint112 reserves into an overflowing K check; two crafted swaps drained WETH and VISTA on 9 Oct 2026. Primary sources: https://x.com/SlowMist_Team/status/2108427455572918626 · https://etherscan.io/tx/0xb2c7332d9e1be6a86d9d37083aa4cc0d94b60eb95cc9b29494555a3c09764930https://andromeda.observer/e/x7-pioneer-claimrewards-double-counthttps://andromeda.observer/e/x7-pioneer-claimrewards-double-countThu, 08 Oct 2026 00:00:00 GMTSmart-contract exploitAccountingPer SlowMist, X7Pioneer's claimRewards() re-added the same unaccounted ETH on every empty call; an attacker took ~6.78 ETH on 8 Oct 2026. Primary sources: https://x.com/SlowMist_Team/status/2108142452888776907 · https://etherscan.io/tx/0xc98056d6ab55ef898189da5fa1fb08b968cb84ca99528d171f8240836b21766dhttps://andromeda.observer/e/79thvault-operator-key-pool-drainhttps://andromeda.observer/e/79thvault-operator-key-pool-drainWed, 07 Oct 2026 00:00:00 GMTKey compromiseAccess controlPer Defimon, 79thVault's operator key moved 2.01M 79AU out of its PancakeSwap pool to an attacker on 7 Oct 2026, who sold it for ~$12.5M in BNB. Primary sources: https://x.com/DefimonAlerts/status/2108100434942431441 · https://x.com/PeckShieldAlert/status/2108133701448327326 · https://bscscan.com/tx/0x18bc04788b034a1d8a09620770340977099cb4db7628e8931a5c4e625d37d0cchttps://andromeda.observer/e/malicious-hardhat-npm-packageshttps://andromeda.observer/e/malicious-hardhat-npm-packagesTue, 06 Oct 2026 00:00:00 GMTMalicious packagesSupply chainTwo npm packages aimed at Hardhat users, published 6-7 Oct 2026, run an obfuscated loader on import that targets browser-wallet storage. Remove them. Primary sources: https://osv.dev/vulnerability/MAL-2026-17660 · https://osv.dev/vulnerability/MAL-2026-17662https://andromeda.observer/e/makerdao-legacy-auction-keeper-drainhttps://andromeda.observer/e/makerdao-legacy-auction-keeper-drainTue, 06 Oct 2026 00:00:00 GMTSmart-contract exploitAccess controlPer CertiK, an unauthenticated function on a 2020-era MakerDAO auction-keeper contract let an attacker take 200 ETH of unsettled collateral on 6 Oct 2026. Primary sources: https://www.certik.com/blog/makerdao-legacy-auction-keeper-incident-analysis · https://x.com/DefimonAlerts/status/2107391959853600812 · https://etherscan.io/tx/0xbb6940f7c2a1e68cafbae7bb9b94d09af9af06ec3a114f6996f2cab993f3a88chttps://andromeda.observer/e/vyper-unicode-literal-shiftinghttps://andromeda.observer/e/vyper-unicode-literal-shiftingTue, 06 Oct 2026 00:00:00 GMTCompiler advisoryCompilerTwo Vyper advisories (6 Oct 2026) show hidden or look-alike characters can make literals compile to different values in Vyper 0.4.1 through 0.5.0b1. Primary sources: https://github.com/vyperlang/vyper/security/advisories/GHSA-wvx7-39qj-2g9v · https://github.com/vyperlang/vyper/security/advisories/GHSA-r3c7-7xwm-6vfwhttps://andromeda.observer/e/hai-malicious-governance-proposalhttps://andromeda.observer/e/hai-malicious-governance-proposalTue, 06 Oct 2026 00:00:00 GMTGovernance attack (attempt)GovernancePer Defimon, a 6 Oct 2026 HAI proposal labeled treasury maintenance would have delegated the treasury's KITE votes to its proposer. HAI says it failed. Primary sources: https://x.com/DefimonAlerts/status/2107601752048435215 · https://x.com/letsgethai/status/2110446688045519086 · https://www.tally.xyz/gov/hai/proposal/945307170338596554802456536891275189748084619609113760500856562733210244266 · https://optimistic.etherscan.io/tx/0x48f51df912052658ea256a3c2ea893a66dee79a79b82b24383fc4f23da706aebhttps://andromeda.observer/e/subql-common-ci-artifact-swaphttps://andromeda.observer/e/subql-common-ci-artifact-swapMon, 05 Oct 2026 00:00:00 GMTPackage compromiseSupply chainMalicious @subql/common 5.8.3 hit npm on 5 Oct 2026. A release step swapped the built package for an external tarball. Runs on install and import. Primary sources: https://www.stepsecurity.io/blog/subql-ecosystem-compromised · https://github.com/advisories/GHSA-9333-3c4x-x3h5https://andromeda.observer/e/vyper-optimizer-msg-value-or-khttps://andromeda.observer/e/vyper-optimizer-msg-value-or-kFri, 02 Oct 2026 00:00:00 GMTCompiler advisoryCompilerVyper advisory GHSA-6j9c-gvcw-74fj: with default optimization, (msg.value | K) in a ternary branch compiles to 1. Affects 0.3.8 and later; no patch listed. Primary source: https://github.com/vyperlang/vyper/security/advisories/GHSA-6j9c-gvcw-74fjhttps://andromeda.observer/e/flashloopadapter-self-vouching-safe-modulehttps://andromeda.observer/e/flashloopadapter-self-vouching-safe-moduleThu, 01 Oct 2026 00:00:00 GMTSmart-contract exploitAccess controlOn 1 Oct 2026 a fake Safe passed FlashLoopAdapter's isModuleEnabled check and drained two real Safes via a raw call. About $305K lost, per Defimon. Primary sources: https://x.com/DefimonAlerts/status/2105695635647144370 · https://olympix.security/blog/flashloopadapters-305k-loss-and-how-olympix-would-have-prevented-ithttps://andromeda.observer/e/near-intents-deposit-notification-ghost-balancehttps://andromeda.observer/e/near-intents-deposit-notification-ghost-balanceTue, 29 Sep 2026 00:00:00 GMTSmart-contract exploitBridge & cross-chainNEAR Intents says failed deposit notifications credited an attacker with $3.8M, withdrawn via BNB Chain from 29 Sep 2026. Funds returned in full 2 Oct. Primary sources: https://x.com/AlexAuroraDev/status/2111124226962870770 · https://x.com/near_intents/status/2105642219357241796 · https://x.com/ilblackdragon/status/2106072953570181155 · https://www.certik.com/blog/hot-bridge-near-intents · https://bscscan.com/tx/0x9fe58e031f73bbd880c782bc9e7446bcda32cadb304a729209871a4a81856c4c · https://bscscan.com/tx/0x16ddfa695b9525662b8e57c35723f44af89b4e7fc2dedc3634f730caf8b90c02https://andromeda.observer/e/kelpdao-rseth-bridge-dvn-2026https://andromeda.observer/e/kelpdao-rseth-bridge-dvn-2026Sat, 18 Apr 2026 00:00:00 GMTBridge verification compromiseThird-party accessKelpDAO: on 18 Apr 2026 a forged cross-chain packet accepted by third-party bridge verification released 116,500 rsETH from the Ethereum lockbox. Kelp says mainnet backing and the rsETH contract remain intact. Primary sources: https://blogs.kerneldao.com/blog/kelp-dao-%C2%B7-incident-response-%C2%B7-april-19-2026 · https://layerzero.network/blog/kelpdao-incident-statementhttps://andromeda.observer/e/drift-durable-nonce-admin-takeover-2026https://andromeda.observer/e/drift-durable-nonce-admin-takeover-2026Wed, 01 Apr 2026 00:00:00 GMTGovernance / admin compromiseAccess controlOn 1 Apr 2026 Drift on Solana lost ~$285.3M after pre-signed durable-nonce approvals transferred Security Council admin control. Attacker then inflated fake collateral and withdrew real assets. Primary sources: https://x.com/DriftProtocol/status/2039564437795836039 · https://blocksec.com/blog/drift-protocol-incident-multisig-governance-compromise-via-durable-nonce-exploitationhttps://andromeda.observer/e/balancer-csp-rounding-2025https://andromeda.observer/e/balancer-csp-rounding-2025Mon, 03 Nov 2025 00:00:00 GMTSmart-contract exploitAccountingBalancer: on 3 Nov 2025 incorrect rounding in the exact-out swap path of V2 Composable Stable Pools enabled a multi-chain drain. Balancer puts theft at $121.1M before recoveries; V3 unaffected. Primary source: https://medium.com/balancer-protocol/nov-3-exploit-post-mortem-51dcbeb6b020https://andromeda.observer/e/swissborg-kiln-sol-unstake-2025https://andromeda.observer/e/swissborg-kiln-sol-unstake-2025Mon, 08 Sep 2025 00:00:00 GMTThird-party staking API compromiseSupply chainSwissBorg: on 8 Sep 2025 a Kiln Connect API compromise during an unstake changed withdrawal authority on >150,000 SOL stakes. ~192,000 SOL affected. SwissBorg says its own custody was not breached. Primary sources: https://swissborg.com/blog/swissborg-security-update-kiln-breach · https://www.kiln.fi/post/re-enablement-of-kiln-services-and-security-incident-informationhttps://andromeda.observer/e/bunni-idle-balance-rounding-2025https://andromeda.observer/e/bunni-idle-balance-rounding-2025Tue, 02 Sep 2025 00:00:00 GMTSmart-contract exploitAccountingBunni: on 2 Sep 2025 ~$8.4M was taken from weETH/ETH (Unichain) and USDC/USDT (Ethereum) via flash-loan swaps plus tiny withdrawals that skewed liquidity estimates. Primary source: http://blog.bunni.xyz/posts/exploit-post-mortem/https://andromeda.observer/e/odinfun-liquidity-amm-2025https://andromeda.observer/e/odinfun-liquidity-amm-2025Tue, 12 Aug 2025 00:00:00 GMTSmart-contract exploitNot yet publishedOdin.fun: mid-Aug 2025 a vulnerability in its latest liquidity AMM update was exploited. Cofounder said 58.2 BTC lost; remaining platform funds safe; operations paused. Primary source: https://x.com/odin_funhttps://andromeda.observer/e/credix-admin-sonic-2025https://andromeda.observer/e/credix-admin-sonic-2025Mon, 04 Aug 2025 00:00:00 GMTProtocol admin compromiseAccess controlCrediX: on 4 Aug 2025 acknowledged a security breach, disabled the website to stop new deposits, and pledged full recovery of user funds within 24–48 hours. Reports put the drain near $4.5M. Primary source: https://x.com/Credix_financehttps://andromeda.observer/e/woo-x-dev-backdoor-withdrawals-2025https://andromeda.observer/e/woo-x-dev-backdoor-withdrawals-2025Thu, 24 Jul 2025 00:00:00 GMTExchange account compromiseSocial engineeringWOO X: on 24 Jul 2025 a socially engineered backdoor on a developer MacBook let an attacker replace credentials for nine accounts and withdraw $14M. Users compensated from treasury; WOO attributes UNC4899/Lazarus. Primary source: https://woox.io/blog/july-24th-security-incident-post-mortemhttps://andromeda.observer/e/bigone-hot-wallet-2025https://andromeda.observer/e/bigone-hot-wallet-2025Wed, 16 Jul 2025 00:00:00 GMTExchange hot-wallet incidentNot yet publishedBigONE: on 16 Jul 2025 it detected abnormal asset transfers, suspended deposits/withdrawals/trading, and said a third-party attack hit certain hot-wallet tokens. Private keys said secure; BigONE says it will fully cover losses. Primary sources: https://bigone.zendesk.com/hc/en-us/articles/48906456010393-Announcement-Regarding-BigONE-Security-Incident-on-16-July-2025 · https://bigone.zendesk.com/hc/en-us/articles/48916067512345-BigONE-Security-Incident-Disclosure-and-Progress-Update-July-16https://andromeda.observer/e/arcadia-rebalancer-calldata-2025https://andromeda.observer/e/arcadia-rebalancer-calldata-2025Tue, 15 Jul 2025 00:00:00 GMTSmart-contract exploitValidationArcadia on Base: on 15 Jul 2025 unvalidated swap/calldata in the Rebalancer path let an attacker abuse trusted rebalancer permissions. ~$3.5–3.6M per security firms. Primary sources: https://www.certik.com/blog/arcadia-incident-analysis-arbitrary-swapdata · https://veridise.com/blog/audit-insights/low_level_call_hijacking_arcadia_exploit/https://andromeda.observer/e/gmx-v1-orderbook-reentrancy-2025https://andromeda.observer/e/gmx-v1-orderbook-reentrancy-2025Wed, 09 Jul 2025 00:00:00 GMTSmart-contract exploitReentrancyGMX: on 9 Jul 2025 a live V1 vulnerability on Arbitrum let ~$40M of GLP liquidity be withdrawn. Funds returned after outreach; $5M bounty paid. V2 unaffected. Primary source: https://gmxio.substack.com/p/glp-funds-on-arbitrum-fully-recoveredhttps://andromeda.observer/e/nobitex-hot-wallet-2025https://andromeda.observer/e/nobitex-hot-wallet-2025Wed, 18 Jun 2025 00:00:00 GMTExchange hot-wallet incidentNot yet publishedNobitex: in Jun 2025 it reported unauthorized access to part of its infrastructure and hot wallets, suspended access, and said most user assets were in cold storage. Gonjeshke Darande claimed responsibility. Primary source: https://nobitex.ir/mag/incident-statement-4/https://andromeda.observer/e/alexlab-self-listing-2025https://andromeda.observer/e/alexlab-self-listing-2025Fri, 06 Jun 2025 00:00:00 GMTSmart-contract exploitValidationALEX: on 6 Jun 2025 a security incident hit its Stacks DEX pools (STX, sBTC, USDC, USDT and others). Stacks Foundation says the root cause was ALEX's application-level verification, not a Stacks protocol flaw. Primary source: https://stacks.foundation/june-6-alex-incidenthttps://andromeda.observer/e/cork-wsteth-weeth-vault-2025https://andromeda.observer/e/cork-wsteth-weeth-vault-2025Wed, 28 May 2025 00:00:00 GMTSmart-contract exploitAccess controlCork: on 28 May 2025 an attacker extracted 3,761 wstETH from the wstETH:weETH Liquidity Vault by combining rollover-price skew with a Cork Hook authorization bypass. All markets paused. Primary source: https://www.cork.tech/blog/post-mortemhttps://andromeda.observer/e/cetus-clmm-overflow-check-2025https://andromeda.observer/e/cetus-clmm-overflow-check-2025Thu, 22 May 2025 00:00:00 GMTSmart-contract exploitValidationCetus: on 22 May 2025 a flawed overflow check in an open-source library used by its CLMM let an attacker flash-swap, inject artificial liquidity, and drain pool reserves. Core pools disabled within minutes. Primary sources: https://cetusprotocol.notion.site/Cetus-Incident-Report-May-22-2025-Attack-Disclosure-1ff1dbf3ac8680d7a98de6158597d416 · https://www.sui.io/blog/cetus-incident-response-onchain-community-votehttps://andromeda.observer/e/abracadabra-gm-cauldrons-2025https://andromeda.observer/e/abracadabra-gm-cauldrons-2025Tue, 25 Mar 2025 00:00:00 GMTSmart-contract exploitAccountingAbracadabra: on 25 Mar 2025 a GmxV2CauldronV4 liquidation path left orderValueInCollateral intact after collateral was pulled, letting an attacker mint ~13.4M undercollateralized MIM. User collateral unaffected. Primary source: https://paragraph.com/@abracadabra-money/post-mortem-attack-on-gm-cauldrons-25-03-25https://andromeda.observer/e/zoth-admin-proxy-2025https://andromeda.observer/e/zoth-admin-proxy-2025Fri, 21 Mar 2025 00:00:00 GMTProtocol admin compromiseAccess controlZoth: Mar–Apr 2025 security incidents included an admin-privilege path enabling unauthorized proxy upgrade and USD0++ drainage. Zoth published a 10 Apr security incident report. Primary source: https://medium.com/@zoth.io/security-incident-report-10th-april-2025-4dd9ed72e869https://andromeda.observer/e/infini-admin-usdc-2025https://andromeda.observer/e/infini-admin-usdc-2025Mon, 24 Feb 2025 00:00:00 GMTNeobank / admin compromiseAccess controlInfini: on 24 Feb 2025 acknowledged reports of a security compromise while saying transfers and payments remained operational. Analysts put USDC drained near $49–50M. Primary source: https://x.com/infini_sohttps://andromeda.observer/e/bybit-eth-cold-wallet-safe-ui-2025https://andromeda.observer/e/bybit-eth-cold-wallet-safe-ui-2025Fri, 21 Feb 2025 00:00:00 GMTExchange cold-wallet compromiseSocial engineeringBybit: on 21 Feb 2025 a spoofed Safe{Wallet} UI let attackers change its ETH cold-wallet logic and move ~$1.46B. Other cold wallets unaffected; Bybit says client assets remain 1:1 backed. Primary source: https://www.bybit.com/en/learn/this-week-in-bybit/bybit-security-incident-timelinehttps://andromeda.observer/e/zklend-empty-market-accumulator-2025https://andromeda.observer/e/zklend-empty-market-accumulator-2025Tue, 11 Feb 2025 00:00:00 GMTSmart-contract exploitAccountingzkLend: on 11 Feb 2025 an empty wstETH market was inflated via flash-loan donations, then floor-division withdrawals created excess collateral. ~$9.57M drained; markets suspended. Primary source: https://medium.com/zklend/zklend-security-incident-post-mortem-27d9abaf66f6https://andromeda.observer/e/phemex-hot-wallet-2025https://andromeda.observer/e/phemex-hot-wallet-2025Thu, 23 Jan 2025 00:00:00 GMTExchange hot-wallet incidentNot yet publishedPhemex: on 23 Jan 2025 at 11:30 UTC it detected unusual hot-wallet activity, suspended deposits and withdrawals, isolated devices, and reported to security firms and law enforcement. Withdrawals later restored by 26 Jan. Primary source: https://phemex.com/announcements/phemex-hot-wallet-security-incident-update-and-timelinehttps://andromeda.observer/e/radiant-safe-malware-ownership-2024https://andromeda.observer/e/radiant-safe-malware-ownership-2024Wed, 16 Oct 2024 00:00:00 GMTProtocol admin compromiseSocial engineeringRadiant: on 16 Oct 2024 malware on at least three developers' devices collected Safe{Wallet} signatures that transferred LendingPool ownership. ~$50M drained from Arbitrum and BSC. Primary source: https://medium.com/@RadiantCapital/radiant-post-mortem-fecd6cd38081https://andromeda.observer/e/bingx-hot-wallet-2024https://andromeda.observer/e/bingx-hot-wallet-2024Fri, 20 Sep 2024 00:00:00 GMTExchange hot-wallet incidentNot yet publishedBingX: at ~4:00 UTC+8 on 20 Sep 2024 it confirmed an incident affecting one hot wallet. System isolated; most funds said to be in unaffected cold wallets; $10M frozen in recovery efforts. Primary source: https://bingx.com/en/blog/article/ama-recap-with-bingx-cpo-vivien-lin-addressing-the-recent-hot-wallet-incidenthttps://andromeda.observer/e/penpie-batch-harvest-reentrancy-2024https://andromeda.observer/e/penpie-batch-harvest-reentrancy-2024Tue, 03 Sep 2024 00:00:00 GMTSmart-contract exploitReentrancyPenpie: on 3 Sep 2024 missing reentrancy protection in PendleStakingBaseUpg.batchHarvestMarketRewards let a malicious SY inflate rewards via flash-loaned assets during harvest. ~11,113.6 ETH (~$27.35M) reported lost. Primary sources: https://gov.magpiexyz.io/t/penpie-incident-overview-and-request-for-compensation-suggestions/297 · https://blog.penpiexyz.io/penpie-post-mortem-report-1ac9863b663ahttps://andromeda.observer/e/ronin-bridge-threshold-2024https://andromeda.observer/e/ronin-bridge-threshold-2024Tue, 06 Aug 2024 00:00:00 GMTBridge configuration faultValidationRonin: on 6 Aug 2024 a bridge upgrade misinterpreted the required operator vote threshold, allowing ~4,000 ETH plus ~$2M USDC outflows. Treated as whitehat; funds returned; $500k bounty offered. Primary source: https://x.com/Ronin_Networkhttps://andromeda.observer/e/wazirx-liminal-multisig-payload-2024https://andromeda.observer/e/wazirx-liminal-multisig-payload-2024Thu, 18 Jul 2024 00:00:00 GMTExchange custody compromiseSocial engineeringWazirX: on 18 Jul 2024 a cyber attack on one Liminal-operated multisig wallet lost funds exceeding $230M. WazirX says the UI showed one transaction while a different payload was signed. Primary source: https://wazirx.com/blog/preliminary-report-cyber-attack-on-wazirx-multisig-wallet/https://andromeda.observer/e/lifi-facet-arbitrary-call-2024https://andromeda.observer/e/lifi-facet-arbitrary-call-2024Tue, 16 Jul 2024 00:00:00 GMTSmart-contract exploitValidationLI.FI: on 16 Jul 2024 a newly deployed facet lacked LibSwap call validation. Attackers drained ~$11.6M in USDC/USDT/DAI from 153 wallets with infinite approvals on Ethereum and Arbitrum. Primary source: https://li.fi/knowledge-hub/incident-report-16th-julyhttps://andromeda.observer/e/dmm-bitcoin-4502-btc-2024https://andromeda.observer/e/dmm-bitcoin-4502-btc-2024Fri, 31 May 2024 00:00:00 GMTExchange wallet compromiseNot yet publishedDMM Bitcoin: on 31 May 2024 it announced an unauthorized outflow of 4,502.9 BTC. FBI, DC3 and Japan's NPA later attributed the theft (~$308M) to DPRK actors tracked as TraderTraitor. Primary sources: https://bitcoin.dmm.com/news/20240531_01 · https://www.fbi.gov/news/press-releases/fbi-dc3-and-npa-identification-of-north-korean-cyber-actors-tracked-as-tradertraitor-responsible-for-theft-of-308-million-from-bitcoindmmcomhttps://andromeda.observer/e/sonne-velo-donation-attack-2024https://andromeda.observer/e/sonne-velo-donation-attack-2024Tue, 14 May 2024 00:00:00 GMTSmart-contract exploitAccountingSonne: on Optimism an attacker executed timelocked VELO market-creation and collateral-factor txs, then used a known Compound v2 donation/precision attack for ~$20M. ~$6.5M saved by seeding VELO. Primary source: https://medium.com/@SonneFinance/post-mortem-sonne-finance-exploit-12f3daa82b06https://andromeda.observer/e/hedgey-claimcampaigns-allowance-2024https://andromeda.observer/e/hedgey-claimcampaigns-allowance-2024Fri, 19 Apr 2024 00:00:00 GMTSmart-contract exploitAccess controlHedgey: on 19 Apr 2024 ClaimCampaigns.sol let an attacker create a locked campaign approving a malicious locker, cancel without revoking allowance, then drain. ~$45M notional across chains. Primary source: https://medium.com/hedgey/hedgey-exploit-post-mortem-784e9860fd8dhttps://andromeda.observer/e/prisma-migrate-trove-zap-2024https://andromeda.observer/e/prisma-migrate-trove-zap-2024Thu, 28 Mar 2024 00:00:00 GMTSmart-contract exploitValidationPrisma: on 28 Mar 2024 insufficient validation in MigrateTroveZap.onFlashloan let attackers close and reopen Troves with less collateral. ~3,479 ETH (~$12M) taken; protocol paused. Primary source: https://hackmd.io/@PrismaRisk/PostMortem0328https://andromeda.observer/e/seneca-chamber-performoperations-2024https://andromeda.observer/e/seneca-chamber-performoperations-2024Wed, 28 Feb 2024 00:00:00 GMTSmart-contract exploitAccess controlSeneca: on 28 Feb 2024 Chamber.performOperations let an attacker call transferFrom using users' excessive approvals. $6.4M stolen; ~$5.3M recovered via whitehat, ~$1.04M kept as bounty. Primary source: https://paragraph.com/@seneca-protocol/seneca-exploit-post-mortemhttps://andromeda.observer/e/fixedfloat-hosting-compromise-2024https://andromeda.observer/e/fixedfloat-hosting-compromise-2024Fri, 16 Feb 2024 00:00:00 GMTExchange infrastructure compromiseThird-party accessFixedFloat: in February 2024 an attacker exploited its security structure and stole $26.1M. FixedFloat later says the same actor returned via Time4VPS hosting on 31 Mar. Service later resumed. Primary source: https://ff.io/blog/news/reasons-for-hackinghttps://andromeda.observer/e/orbit-bridge-ethereum-vault-2024https://andromeda.observer/e/orbit-bridge-ethereum-vault-2024Mon, 01 Jan 2024 00:00:00 GMTBridge exploitNot yet publishedOzys (Orbit Bridge): between 5:52 and 6:25 a.m. KST on 1 Jan 2024 an attacker took ~$81.5M in ETH, WBTC, USDT, USDC and DAI from the Ethereum vault. Ozys says not a contract bug or stolen validator key. Primary source: https://medium.com/orbit-chain/official-statement-regarding-orbit-bridge-exploit-551928f3dc52https://andromeda.observer/e/ledger-connect-kit-npm-2023https://andromeda.observer/e/ledger-connect-kit-npm-2023Thu, 14 Dec 2023 00:00:00 GMTSupply-chain compromiseSupply chainLedger: on 14 Dec 2023 a phished former employee NPM account published malicious Connect Kit versions 1.1.5–1.1.7 that could reroute dApp transactions. Fix within ~40 minutes; hardware and Ledger Live unaffected. Primary sources: https://www.ledger.com/blog/security-incident-report · https://www.ledger.com/blog/a-letter-from-ledger-chairman-ceo-pascal-gauthier-regarding-ledger-connect-kit-exploithttps://andromeda.observer/e/htx-hot-wallet-2023https://andromeda.observer/e/htx-hot-wallet-2023Wed, 22 Nov 2023 00:00:00 GMTExchange hot-wallet incidentNot yet publishedHTX: on 22 Nov 2023 it confirmed a hot-wallet attack on HTX and the Heco bridge path. Justin Sun said HTX would fully compensate; deposits and withdrawals temporarily suspended. Primary sources: https://www.htx.com/zh-cn/support/104954980569005/ · https://www.htx.com/zh-cn/support/24955033595175/https://andromeda.observer/e/poloniex-hot-wallet-2023https://andromeda.observer/e/poloniex-hot-wallet-2023Fri, 10 Nov 2023 00:00:00 GMTExchange hot-wallet incidentNot yet publishedPoloniex: around 10 Nov 2023 a hot-wallet incident drained exchange wallets. Justin Sun said Poloniex was financially healthy and would fully reimburse; some stolen assets were reported frozen. Primary source: https://www.poloniex.com/announcement/18976674677911https://andromeda.observer/e/mixin-cloud-database-2023https://andromeda.observer/e/mixin-cloud-database-2023Sat, 23 Sep 2023 00:00:00 GMTCustodial infrastructure compromiseThird-party accessMixin Kernel: early 23 Sep 2023 HKT, its cloud service provider's database was attacked, with loss of some mainnet assets (~US$200M). Deposits and withdrawals suspended. Primary source: https://x.com/MixinKernel/status/1706139175018529139https://andromeda.observer/e/coinex-hot-wallet-key-leak-2023https://andromeda.observer/e/coinex-hot-wallet-key-leak-2023Tue, 12 Sep 2023 00:00:00 GMTExchange hot-wallet compromiseKey compromiseCoinEx: on 12 Sep 2023 anomalous hot-wallet withdrawals were detected. Cause preliminarily determined as hot-wallet private key leakage. Cold wallets unaffected; foundation bears losses. Primary source: https://www.coinex.com/en/announcements/detail/19187420867348https://andromeda.observer/e/stake-com-lazarus-2023https://andromeda.observer/e/stake-com-lazarus-2023Mon, 04 Sep 2023 00:00:00 GMTExchange hot-wallet compromiseSocial engineeringFBI: Lazarus Group stole $41 million from Stake.com. Stake said unauthorized ETH/BSC hot-wallet transactions were contained and operations resumed; user funds said safe. Primary sources: https://www.fbi.gov/news/press-releases/fbi-identifies-lazarus-group-cyber-actors-as-responsible-for-theft-of-41-million-from-stakecom · https://medium.com/@edcraven22/always-moving-forward-reflections-on-the-recent-stake-com-exploit-431105710a2ehttps://andromeda.observer/e/curve-vyper-reentrancy-2023https://andromeda.observer/e/curve-vyper-reentrancy-2023Sun, 30 Jul 2023 00:00:00 GMTCompiler / smart-contract exploitReentrancyCurve: on 30 Jul 2023 several pools compiled with Vyper 0.2.15 were exploited after a malfunctioning reentrancy lock. Curve said other pools were safe. Primary source: https://x.com/CurveFinancehttps://andromeda.observer/e/multichain-mpc-abnormal-move-2023https://andromeda.observer/e/multichain-mpc-abnormal-move-2023Thu, 06 Jul 2023 00:00:00 GMTBridge / MPC compromiseKey compromiseMultichain: early Jul 2023 assets locked in its MPC address were moved to an unknown address abnormally. Users told to stop using services and revoke approvals. PeckShield ~$126M. Primary source: https://x.com/MultichainOrghttps://andromeda.observer/e/atomic-wallet-june-2023https://andromeda.observer/e/atomic-wallet-june-2023Sat, 03 Jun 2023 00:00:00 GMTWallet client compromiseNot yet publishedAtomic Wallet: early Jun 2023 a subset of users lost funds. Atomic said less than 0.1% of users were affected and listed possible causes without confirming a single root cause. Primary source: https://atomicwallet.io/bloghttps://andromeda.observer/e/euler-donate-to-reserves-2023https://andromeda.observer/e/euler-donate-to-reserves-2023Mon, 13 Mar 2023 00:00:00 GMTSmart-contract exploitValidationEuler: on 13 Mar 2023 ~$197M was taken via a missing health check on donateToReserves. After weeks of negotiation, ~$240M was returned. Primary source: https://www.euler.finance/blog/war-peace-behind-the-scenes-of-eulers-240m-exploit-recoveryhttps://andromeda.observer/e/ftx-alameda-collapse-2022https://andromeda.observer/e/ftx-alameda-collapse-2022Fri, 11 Nov 2022 00:00:00 GMTExchange insolvencyCustody failureFTX: on 11 Nov 2022 FTX Trading Ltd. and affiliates filed for Chapter 11. Customer withdrawals had halted days earlier amid Alameda solvency revelations. Not a smart-contract exploit; custodial failure. Primary sources: https://www.sec.gov/newsroom/press-releases/2022-219 · https://www.justice.gov/usao-sdny/pr/united-states-attorney-announces-charges-against-ftx-founder-samuel-bankman-fried