Security Intelligence
In-depth breakdowns of real security incidents, what happened, why it happened, and what the industry can learn.
ASI Alliance Breach: Compromised Mint Authority Drained Fetch.ai, NuNet, and SingularityNET for $2.25M Across Three Linked Projects
A linked attacker drained approximately 8.72 million FET from Fetch.ai's token-conversion contract and used compromised minting authority to create 408.5M NTX, 896M AGIX, 500.5M WMTX, and 492.4M CGV without authorization across September 19–20, 2026. Bitquery estimated approximately $2.25 million in realized proceeds — most minted tokens could not be sold at pre-incident prices. The attacker also swept 16 operational wallets and drained $289,575 USDC from a payroll contract. Bitquery traces the activity to a single actor and attributes the root cause to privileged key compromise, not a contract exploit.
Liquid Network's 4,000 BTC Exploit: How a Rangeproof Cache Key Flaw Unlocked $320 Million in Unbacked LBTC
An attacker exploited a flaw in Elements' rangeproof-verification cache — the cache key included the proof bytes but not the Pedersen commitment — allowing a proof verified for a small legitimate amount to satisfy the check for a commitment encoding 4,000 LBTC. The unbacked LBTC was redeemed through SideSwap's peg-out service for approximately $320 million in real BTC from Liquid's federation reserves. SideSwap's authorization key was not compromised. After negotiations, 3,400 BTC (~85%) was returned. Blockstream's September 23 assessment confirmed approximately 602 BTC remained outstanding and did not characterise that balance as an agreed bounty.
Cronos/Tectonic's $120M TONIC Exploit: How a Governance Token Drained Nine Lending Markets and Forced a Controversial Two-Hour Chain Rollback
An attacker manipulated the price of Tectonic's illiquid TONIC governance token and borrowed roughly $120.4 million across nine lending markets on Cronos. Validators halted the chain 36 minutes after the exploit began and coordinated a rollback of 10,961 blocks — reversing 1 hour 54 minutes of history and recovering approximately $111.2 million — while $9.19 million had already bridged to Ethereum and remained unrecovered. The rollback erased all transactions in the window, not just the exploit, reviving a contentious industry debate over finality, immutability, and the practical meaning of decentralization on validator-coordinated chains.
Rain's $1.1M Card Contract Exploit: How an Outdated Solana Program Drained 2,321 Neobank Users Through a Broken Authorization Check
An attacker exploited a broken multi-signature authorization check in an outdated version of Rain's Solana card contract, granting itself withdrawal rights over user card-collateral accounts and draining roughly $1.1 million across multiple stablecoin-card programs. Avici reported $500,859 lost from 1,685 users and Tria $431,945 from 636 users. Users' self-custodial wallets and private keys were not compromised — only balances pre-committed to card funding inside Rain's shared contract. Avici's AVICI token fell 49% and the company pledged to refund affected card balances.
Moonwell's $8.7M MAMO Exploit: How an Illiquid Governance Token Became an $11 Million Borrow Key on Base
An attacker pumped the price of Moonwell's illiquid MAMO governance token roughly eightfold — from $0.0105 to $0.088 — deposited it as overvalued collateral, and borrowed approximately $11 million in liquid assets including cbBTC, WETH, USDC, and wstETH across 18 transactions. Security firms CertiK and PeckShield estimated net losses at $8.7 million, exceeding Moonwell's entire annual fee revenue of $8.6 million. No smart contract code was broken. The attacker spent roughly $7 million on the manipulation and lost an estimated $3.8 million on that leg — a rational price for an oracle reading that unlocked far more in liquid borrows. It was Moonwell's fourth exploit in under a year.
Offside Wallet Theft Factory: 40 Malicious Firefox Extensions Stealing Wallet Seeds via Supabase, Cloudflare Workers, and Silent Update Conversion
Socket identified 77 linked Firefox extensions — 40 confirmed malicious, 37 deceptive shells — active since at least March 2026. The campaign impersonated OKX, Rabby Wallet, and TronLink using four distinct theft methods: Supabase-controlled phishing loaders, Cloudflare Worker exfiltration of recovery phrases, pre-encryption keyring interception, and clipboard/credential harvesting. Nine extensions were published as sports-score apps and later silently converted to wallet stealers via update.
Term Finance's $8.5M Governance Exploit: How a Vault Authority Attack Forced a Permanent Protocol Shutdown
An attacker exploited the governance mechanism controlling Term Finance's Meta Vaults, draining approximately $8.5 million in assets. Term Finance permanently shut down all vaults and revoked DAO governance authority in response. The core lending protocol was not compromised. Withdrawals remain open while external security firms work to trace and recover the stolen funds.
The Sandbox's 329-Trillion SAND Mint: How an approveAndCall Exploit Hijacked LayerZero Delegate Permissions and Drained the Bridge Reserve
An attacker exploited The Sandbox's approveAndCall function to hijack LayerZero delegate permissions on Base, then manufactured 329.24 trillion unbacked SAND tokens across 703 minting events. The face-value headline of $49 billion was misleading — real losses were bounded by the Ethereum OFT Adapter's reserve of ~14.75 million SAND, putting the actual drain at approximately $675,000. The Sandbox's multisig severed the bridge by zeroing LayerZero trusted peers for Base and BNB Chain. Ethereum and Polygon were unaffected.
Keeta Network's $3.64M Bridge Exploit: How a Single Component Vulnerability Put a Payment Mainnet into Read-Only Mode
An attacker exploited an isolated vulnerability in a single Keeta Network component to bridge 9.3 million KTA and 2 billion GALA tokens to a fresh wallet, then liquidated both positions for approximately 1,902 ETH (~$3.64 million). Keeta placed its payment public mainnet in read-only mode, confirmed anchoring systems were unaffected, and issued a 72-hour deadline for the attacker to return the funds.
BounceBit Chain's $3.1M Exploit: How a Wrong-Principal Authorization Check in the Evmos Vesting Module Forced a Permanent Chain Shutdown
An attacker exploited a two-part authorization failure in the Evmos vesting module inherited by BounceBit Chain, draining 286,543,148 BB tokens (~$3.1 million) from nine accounts across 14 transactions in roughly five hours. BounceBit halted block production and permanently sunset its Layer 1 chain. BB tokens are being reissued as BEP-20 on BNB Chain with pre-attack balances restored from a snapshot.
Allbridge's $191K CCTP Exploit: How a 24-Day-Old Forged Circle Message and a Flash Loan Drained a Base Router
An attacker constructed a forged Circle CCTP-style message on Polygon on July 25–26, waited 24 days for Allbridge's Base router to accumulate funds, then executed the exploit six seconds after 191,156 USDC arrived. Allbridge's receiveCctpMessage function treated Circle's message attestation as settlement proof — crediting a fictitious 999,000 USDC deposit — while a flash loan from Aave filled the gap to make the payout possible. Net loss: approximately 191,156 USDC.
Maya Protocol's $11M Exploit: How Six Chained Bugs Turned a Ghost Transaction Into a $CACAO Money Printer
Maya Protocol halted MAYAChain on August 19, 2026 after an attacker exploited a chain of six discrete software vulnerabilities to manufacture 49 million $CACAO tokens from thin air, drain pools of Bitcoin and other assets, and trigger an 89% collapse in the token's price — causing $10.9M in total losses across liquidity providers, arbitrageurs, and token holders.
550,000 USDC Lost to a Fake Google Ad: Inside the Inferno Drainer Phishing Campaign Targeting Hyperliquid Users
A Hyperliquid user lost 550,019 USDC after clicking a paid Google advertisement that led to a counterfeit Hyperliquid interface. After connecting their wallet and signing a malicious approval, the Inferno Drainer backend automatically transferred funds across three transactions and split proceeds 80/15/5 among operation addresses. Hyperliquid's protocol was not compromised. Security firm Salus linked the infrastructure to $52.74 million in aggregate losses across multiple campaigns.
Harmony's $ONE Plunges 40% After Attacker Mints Four Billion Tokens Equal to a Quarter of Supply
An attacker exploited the Harmony blockchain to mint four billion $ONE tokens without authorisation — roughly 25% of the circulating supply — causing the token price to fall 40%. Harmony paused its token bridge, requested exchange freezes on four attacker addresses, and raised the possibility of a full blockchain rollback, reviving an ongoing debate about immutability versus incident recovery in public blockchains.
Ravencoin's KAWPOW Consensus Flaw: How a Single Unchecked Header Field Put Four Days of Transactions at Risk
A critical gap in Ravencoin's KAWPOW proof-of-work validation allowed an attacker to insert invalid blocks from height 4,487,776, splitting the network and threatening to reverse nearly four days of transactions. Major mining pools deployed an emergency patch and began rebuilding a clean chain from the last known-good block while exchanges suspended RVN flows to limit double-spend exposure.