Cross-chain security awareness in plain English. Research snapshot only. Not financial advice. We never publish drain recipes or exploit steps. Some items are quick public-report notes; not every story is a full 369 deep-dive.
24 Oct 2026: Blockaid, Defimon, Phalcon, and Chainalysis report that attackers borrowed X tokens, won a governance vote, and withdrew the Senate pool in the same block. 85M. A third party also took about 550,000 X.
3 for a high-severity bug. A hostile server can hide a transaction you broadcast and show a fake one. A fee bump on that fake payment can pay the attacker. Electrum says two users reported it and one loss is confirmed.
25 Oct 2026: Keystone says unauthorized access to its website was detected on 20 Oct. On 23 Oct, after reviewing Shopify API activity, it confirmed that customer names, contact details, shipping addresses, and order details were taken.
Initia: MoveVM script cache let the attacker fake bridged balances. 24 Oct: Initia says a MoveVM script-caching bug let the attacker fake balances of WETH, iUSD, and USDC without changing recorded supply. No INIT was minted. 08M USDC via Noble. 52 ETH at 0x358e…cac8.
CoinDCX confirms a 15.99M USDT loss and says it absorbed it. 99 million USDT from an old wallet that was compromised in the July 2025 incident. An automatic sweep failed, so new deposits piled up there.
Railway says it is not under a new attack. 25 Oct: Railway says it is not currently under attack. On 23 Oct a revocation list sent to OpenAI and Anthropic included some newer replacement keys by mistake, so those fresh keys stopped working.
Day 12: wording corrected. Friend report, not official. 25 Oct: no official, wire, or Finnish confirmation of remand or a named prison. A friend reports he is on remand at Maltepe No. 3; that remains unconfirmed.
23 Oct 2026: SlowMist lists Kimchi Token as a rug pull of $385,000. Lookonchain describes a promoter-led dump, with the price down more than 95%. No reply from the promoters was found. Research snapshot from SlowMist and Lookonchain.
23 Oct 2026: SlowMist says a GitHub Solidity test-task repo runs hidden code when the folder is opened in VS Code, through a workspace settings file. It found eight similar repos. The pitch is a Web3 job interview. No dollar loss figure.
On-chain rate still reads about 6% high. 24 Oct: no new Swell post since the pause. 082. Market prices sit closer to the clean value. Swell has not posted a reopening time or a confirmed ETH loss.
Full amount laundered; Cysic will burn 7.2M CYS. 23 Oct: Onchain Lens says the exploiter laundered about $743K through Tornado Cash and that the full amount is now through.
Bridge processing resumed. 23 Oct 15:50 UTC: WAX says bridge processing resumed with a fix in place, and that the lost reserves will be replenished. The $90.5K figure from Blockaid and SlowMist stands.
SlowMist: 1,500+ phishing sites. 24 Oct: SlowMist says the DarkSword iOS trojan is being pushed through more than 1,500 phishing sites aimed at crypto users. No new dollar loss figure.
21-22 Oct 2026: SlowMist sizes the NEM (NemTokenV2) loss at about $821,920. CertiK and TenArmor put the same event near $820K. Defimon's lower figure is about $726K.
14-15 Oct 2026 (late catch, report 19 Oct): Zeabur says an attacker used leaked internal credentials stored in plaintext and read customer environment-variable records. It counts 3,218,965 variable records and 321,810 account records.
22 Oct 2026: Realms, the Solana DAO tool, says a scammer took an expired Discord invite link and used it to send people to a fake Discord server. No loss figure was given. Research snapshot from Realms.
Foundation: 4.12M ILY of its bridge liquidity drained. 23 Oct: ILITY says attackers targeted foundation servers, including with a server-side request forgery, and drained 4,121,791 ILY of foundation-supplied bridge liquidity. The tokens were sold.
5 sent the user's private key to an attacker server when the wallet was unlocked. The code was added on 19 Feb 2025 and could be switched on through 10 Oct 2026. Eight users have reported 17,286 DOT stolen.
Patches are out; Amazon says the flaws are broadly exploited. 35. Amazon says the flaws, now called PHP2Shell, are broadly exploited, with a first attempt seen on 17 Oct. Cloudflare reported a large wave of attempts after the release.
20-21 Oct 2026 (late catch): Cloudflare says the private keys for eight eMudhra intermediate certificates were compromised, and that the keys were weak enough that a forged certificate could impersonate a site.
0 to PyPI and Docker with malware that steals credentials from the host, including cloud keys, AI keys, and SSH keys. The bad PyPI wheels were live about 11:39 to 13:23 UTC. Docker tags were affected until about 14:20 UTC.
Second wallet sent ~18,800 ETH; two days total about $109M. 21 Oct: a wallet labeled Drift Exploiter 1 sent about 18,800 ETH (about $46M) into Tornado Cash. With the 20 Oct batch, two days total about $109M.
Slice says most of the $41K was its own; under 10 stores hit. 21 Oct: Slice says a legacy function in its settlement contract took about $41K of store earnings that had not been withdrawn. Most of that was Slice's or tied to past partner work.
05M lost, classed as an unbacked mint. 44M on 20 Oct. No project statement or root cause has been published. Tracker posts appeared 20-21 Oct. Research snapshot from DefiLlama and SlowMist Hacked.
20 Oct 2026: Tyler Hobbs Studio warned that fake accounts tag people to claim a QQL mint pass. Art Blocks echoed the warning. They say there is no open mint. Do not click, connect a wallet, or answer those DMs.
Network is live; claims open until 1 May 2027. 21 Oct: Qubic says validators approved the recovery, the network is running, and the reclaim platform is open. First funds have gone back to verified owners. org. The claim window runs to 1 May 2027.
8K on Ethereum through flaws in recovery and execution modules. The attacker could change ownership and replay signed actions into a thin pool. This is the design pattern, not a report about Argent the company.
18 Oct 2026: Defimon and ExVul report about $152K USDC drained from AlpsCon’s reward pool on BNB Smart Chain.
5K lost in a flash-loan-assisted attack involving TIP / TIPMine on BNB Smart Chain. Root cause not stated. No project statement found in this pass.
17 Oct 2026: XPR block producer MadBlocks describes two incidents. A bug in the WebAuth signing contract put debt on 67 LOAN accounts and caused 35 liquidations before a patch; bridged USDC returned to LOAN. 9M XPR (~$169K) sent to KuCoin.
18 Oct 2026: Defimon reports about $165K taken from BiFi's Ethereum USDT lending market after interest accounting mishandled a long idle gap (~36 days).
Ledger reviewing reports outside Southeast Asia; no drain verified there yet. 18 Oct: Ledger Support repeats that confirmed fund losses involve devices sold through a limited number of resellers, and adds that it has not verified a drain linked to a device bought outside Southeast Asia while investigations continue and other reports are under review.
Official report: ≈$807K realised; more white-hat returns; LE complaint. 0) putting realised attacker proceeds at about $807,609 across BNB Chain, Robinhood Chain, Ethereum, and Base. That figure supersedes speculative token valuations for UNCX's own accounting.
Post-mortem: deposit-refund ghost balances; auto-pause added. 17 Oct coverage of the 16 Oct post-mortem from GM Alex Shevchenko: the fault was in the Intents contract, not Omni bridge infrastructure.
8 million ARRR without authorization, roughly a 20% supply increase. The coins went into the shielded Sapling pool. 75M as the nominal value of those unbacked coins, not a confirmed realized loss.
PublicAML: 119M minted, ~$730K sold; Autheo has not confirmed. 7 ETH (~$730K). 76M) figure. 5M unsold THEO sit in a separate Base wallet. Autheo has not confirmed these revised totals, published a post-mortem, or announced recovery. Mainnet remains halted.
13–14 Oct 2026 (late catch for our board): crypto casino Gamdom says an unauthorized connection on an automation server led to a hot-wallet drain. Founder Felix Römer confirmed just over $3M lost; SlowMist catalogues $4,208,000.
12 Oct 2026: privacy-token project ZeroTrace says its vault paid out its full backing after accepting a forged zero-knowledge proof. 67 ETH (~$12K).
11–12 Oct 2026 (late catch for our board): digital-collectibles platform Candy Digital locked its site after unauthorized SOL withdrawals from wallets it had generated for users.
55M of long-unclaimed balances from NEAR Rainbow Bridge and Polygon Agglayer withdrawals being claimed and moved out through valid EIP-7702 delegations. eth had messaged the owner of EOA 0x4943…c9f4 that the funds were still claimable.
09 Oct 2026 disclosure (fix shipped 25 Sep): researcher Cayden Liao and Veria Labs reported through XRPL's bug bounty a counting flaw from about 2015 in how the ledger's built-in exchange sums trades.
05 Oct 2026 (wider coverage 08–09 Oct): Based said an outsider reached an internal dashboard for its Visa card program.
07 Oct 2026: The 79AU token's operator role can move tokens out of its PancakeSwap pool. 5M) left.
21 Sep 2026 (Defimon public write-up 07 Oct): Defimon says a public routing function on The Red Village NFT game could upgrade one of its contracts to attacker code. FI. An on-chain bounty message appeared about two weeks later.
SlowMist: bookmark took Privy tokens; funds through Privacy Cash. 09 Oct Grok window: SlowMist's fuller write-up says the malicious bookmark collected Privy login tokens, browser storage, and wallet data, with MFA-related logic in the payload.
On-chain message: Duelbits says it traced funds and offers a bounty deal. 09 Oct Grok window: Defimon relayed an on-chain message (08 Oct) stating Duelbits has traced the funds and identified the person it believes is responsible, and offers a bounty deal for return of the rest.
Certora: most of the loss left after Bitget's own alarm. 07 Oct Grok window: Certora says reconciliation flagged the gap at 19:05 UTC and Bitget blocked withdrawals, but forged requests were not user withdrawals, so the signer kept signing.
Immunefi: whitelist design + no disclosure channel. 07 Oct Grok window: Immunefi's Gonçalo Magalhães says once an address was on the whitelist, the vault let it pull assets without posting collateral.
06 Oct 2026: CERT-UA (via SOC Prime) described UAC-0277 campaigns where compromised websites show a fake Cloudflare check that talks users into running a command.
CertiK: unprotected function took over the keeper Maker account. 08 Oct Grok window: CertiK says one function on the third-party keeper had no access check, so an outside contract could be granted full control of the keeper's MakerDAO account.
Three wallets emptied in about 69 seconds; SOL into Privacy Cash. 08 Oct Grok window: Trenchbook tracing puts Solana, Base, and BNB Chain wallets emptied between 4:14:54 and 4:16:03 PM ET on 06 Oct, funded by one gas wallet on the EVM side.
news 05 Oct): Salus flagged users of Revenue, a no-KYC bridge from X Money balances to crypto, signing USDG permit messages that attackers submitted as unlimited spend rights, then transferFrom in the same transaction.
04 Oct 2026: GoPlus reported a user lost about $305k DAI after copying a lookalike address from transaction history. Attackers had dusted the victim from an address matching the real recipient's prefix and suffix.
03 Oct 2026: SlowMist TI flagged MALT on Polygon for about $72k lost when swap recorded caller input and pre-swap reserves, then an external rebalanceHook pulled DAI from the protocol Capital Source into the pool before output transfer.
02 Oct 2026 on-chain (Defimon alert 03 Oct; SlowMist-monitored English flashes 04 Oct): GoldPesa's GPXHooks Uniswap v4 hook on Base was drained for about $114k to $115k.
Researcher scale on exits; MetaMask still unconfirmed. 36 ETH in diverted proposal fees on a sample of MetaMask-operated proposers. MetaMask has not confirmed validator count or ETH amount.
13M ONE (~$340k) leaving the account after an earlier takeover. Support had frozen the account and helped restore email and authenticator, but an API key the attacker created stayed live.
12–26 Sep 2026 (heavier late window): Relay, a cross-chain routing protocol, said an API exposed pending route and status details before execution. MEV searchers used that foresight to sandwich about 5,600 users. 88.
Post-mortem: ~36.9M unauthorized ZANO before rewind. 4M ZANO twice (29 Aug and 25 Sep) plus a huge fUSD mint of the same class. Indistinguishable supply is why recovery chose a month-scale restart over selective burn.
Late Sep 2026: attackers stood up a fake GIWA mainnet (OP Stack-style, reserved chain ID 9134) while the real Dunamu/Upbit-backed L2 was still unlaunched.
24–25 Sep 2026: A flaw in Limit Break Payment Processor V2 let attackers abuse leftover NFT and token approvals from Magic Eden’s closed EVM marketplace (listings roughly Feb–Oct 2024). Malicious zero-price takes hit collections first.
23 Sep 2026 ~21:14 UTC (team): Meter reported a block-validation flaw used to mint unbacked MTR and MTRG, dump on DEXs, and bridge funds out. 3M of unbacked wrapped MTRG via Passport on BNB, partly sold on PancakeSwap.
83M then ~$90k), nearly emptying the bridge. Funds from the first batch were largely swapped to ETH. Payy paused deposits, withdrawals, transfers, and cards.
55M) from the Ethereum TokenConversionManagerV3 path and mint large amounts of AGIX, NTX, WMTx, and CGV. 8M before thin-book prices collapsed.
SlowMist (with OKX security) tied malicious FomoPeek iOS builds from Apple’s App Store to roughly 580k USDT consolidated at an attacker address.
22 Sep 2026: An expedited Neutron proposal (framed as an AI governance experiment) passed and reassigned admin on Astroport and Drop contracts. 96M already moved off-chain paths at early reporting.
23 Sep 2026: Crypto Solv (Pulse-side chain forensics) mapped bridged-out pDAI inside Ethereum Railgun. The Omni token is Dai Stablecoin from PulseChain at 0x12D9…5C13, not Maker DAI. Total supply on ETH is about 226M.
16 Aug 2026: SafePal disclosed an authorization flaw in an order-tracking plugin. Under some conditions another customer’s order could be read.
87M CACAO and swap out. 34M class) still sitting in a PeckShield-cited Bitcoin address, plus other assets / on-chain CACAO. Team (Aaluxx) paused global ops.
SlowMist TI matches the 17 Aug card. 7–120k Fox Market BSC stale-spot stake/mint class) landed in the 72h Grok window.
15 Aug 2026: A close friend of the victim reported that a Coldcard Mk4 holder moved an entire ~$750k Bitcoin stack onto a well-known Australian exchange and that it was withdrawn in under 12 hours. m.
Galaxy: ~1,779 BTC confirmed; sweeps look quiet after 6 Aug. 7 M) after speaking with 190+ victims, across more than 8,600 addresses. Confirmed attacker waves and footprints show no activity after 6 Aug.
Volunteer Bitcoin Red Team (post–Coldcard) reports scanning ~501 open-source Bitcoin projects and filing ~7,958 security findings, with ~1,280 rated high or critical: numbers from team lead Calle’s campaign update (≈108 hours in), with earlier Bitcoin Magazine coverage of the first sprint (~390 repos / ~4,962 findings / 85 critical).
6–26M emptied from a related multi-wallet cluster in about 15 minutes (aWBTC, WBTC, DAI, ETH, aUSDC, LDO, sUSDe and more), then largely swapped into DAI and ETH.
13 Aug 2026: Trezor disclosed that ShipMonk, a fulfillment partner, had unauthorized access to customer order data.
83 ETH (~$136k class) lost from the USM protocol after a pricing flaw in redemption (`defund` / eth-from-defund style logic).
7k USDC plus smaller WETH and cbBTC across several pools. Reporting describes unprivileged use of public pair / settlement-style functions to pull LP value.
12 Aug 2026: Harmony said it is working with exchanges to stop and freeze funds after a suspected Layer-1 security incident, while preparing a patch and evaluating rollback options.
89M USDT + 77 ETH on Ethereum: linked into one operation via Bridgers. Most proceeds moved through FixedFloat; ChangeNOW froze a six-figure slice after investigators contacted them.
7–8 Aug 2026: SlowMist and Defimon/Clara flagged ~29,984 USDC drained from Atomic / AtomicLending on Arbitrum (Uniswap V3 LP + leveraged trading).
5k USDC) drained from LpdFi / LOOPSDAO on BNB Chain in one transaction. The protocol priced LPD from live PancakeSwap LPD/USDC reserves with no time-weighted or manipulation guard.
Goodwill / recovery plan window (Aug 3). 15M custody-bridge drain would be unveiled around 3 Aug 2026.
623 WETH (~$31k) drained on Base after an unverified helper spent a victim’s existing WETH allowance. Flow: victim → unverified spender → fresh helper → attacker wallet; funds still sitting with the attacker at report time.
6k drain on Index Coop / Set Protocol’s public ExchangeIssuance helper. An attacker used a malicious Set and manager hook so component amounts changed between quote and pull, then emptied residual inventory that had sat on the helper.
07062, submitted 8 Jul) shows a network-layer attack on Monero nodes that use Tor hidden-service peers.
2M USDT sat with the exploiter plus three “winning” wallets at alert time. Token 0x8d657445…df0e2 (Pro Token); exploiter 0x427671b2…F45D; example tx hits Pancake Pro/USDT and Pro/CDAO pools. 2M as the alert-time headline, not a final loss.
23 Jul 2026 (verified chase 28 Jul): Solido Cash on Supra (Move) was hit via an oracle misassignment that valued collateral near ~$1 while market was a fraction of that. Attacker minted CASH against the bad price, sold for SUPRA.
Developing (26–27 Jul 2026): Blockaid flagged an exploit on @gardenfi HTLC rails: ~$450k USDT across Ethereum, Base, Arbitrum, and BSC. Exploiter EOA 0x25b224c05f6cc5e132165c1621de1a4c3b316999 (~$425k / ~20 txs at alert).
26 Jul 2026: WEMIX said ownership of a contract linked to its WEMIX$ stablecoin path was compromised. e, then bridged proceeds toward Ethereum and BNB. 0 bridges (incl. CCIP / PLAY), affected LPs, and related modules.
We reviewed a 24 Jul X amplification (@CryptocapoOO) claiming Hyperliquid was being “hacked” via Google: search the brand → top Sponsored result → clone site → connect wallet → funds gone, “hundreds” emptied.
Specter flagged multi-chain hot-wallet drains linked to @TripleH / @TripleAHQ (Triple-A payment rails). 3M drained/swapped/bridged to Ethereum. 72M) with no outbound sends: matching the ~5,227 ETH headline.
Kraken Security Labs flagged a new underground offer: WARDEN (actor WardenStealer): a Windows x64 stealer, clipper, and loader sold with a control panel (~$349/mo).
SlowMist reported ~542k USDC lost after attackers abused Lien’s bond exchange path.
Kaspersky researchers detailed OkoBot, a modular malware platform. Its SeedHunter module detects popular hardware-wallet software and shows fake recovery screens to harvest seed phrases.