Blog
Research reports
In-depth security reports, incident analyses, and industry research covering the state of Web3 security.
Incident analysisX 100 Incident AnalysisIn the first operation, the initiating wallet received about 4.75 million USDT after the flash loan was repaid, while the voting deposits remained locked. On 24 October 2026, borrowed USDT bought enough X to capture two of X100's three Senate seats. That majority immediately authorized treasury trades through liquidity controlled by the executing contract. Selling the resulting X supplied the loan repayment and payout.
PaperTrade BBO Pricing IncidentPaperTrade reported manipulation attempts on 10–11 October 2026 targeting the Hyperliquid best bid and ask (BBO) used to price its synthetic positions. The project acknowledged the attempts on 11 October. The account examined in this analysis withdrew 1,279,106.191184 USDC more than it deposited. PaperTrade settled positions at the instantaneous BBO midpoint, while its profit haircut used a fixed reference notional. This linked large synthetic payouts to an influenceable quote without increasing the haircut percentage as position size grew.
Incident analysisHOT Bridge / NEAR IntentsOn 30 September 2026, HOT Omni Bridge on NEAR was exploited, resulting in five observed BSC treasury payouts totaling $3.86M USD.
The attacker used a large pre-existing balance of a custom auxiliary token to request refunds far greater than the amounts in a new deposit. Recording the resulting large decimal amounts expanded the refund event beyond NEAR's 16384 bytes log limit and failed the Intents deposit resolver. HOT subsequently returned the original deposited backing, including USDT, while the Intents credit created by an earlier successful receipt survived.
Incident analysisMakerDAO Legacy Auction Keeper Incident AnalysisOn October 6, 2026, at 06:13:11 UTC, an attacker drained 200 ETH ($542,982 at the time of the exploit) of ETH-A collateral from a legacy auction-keeper contract on Ethereum mainnet.
The 200 ETH came from four 50 ETH lots that the keeper won with zero bids during MakerDAO's "Black Thursday" liquidations in March 2020 and never settled. An unauthenticated function on the keeper let the attacker give a contract it controlled full delegation over the keeper's MakerDAO Vat account. In a single transaction, the attacker settled the old auctions and withdrew the collateral.
Incident analysisLiquid Network Incident AnalysisOn 6 September 2026, the Liquid Network was exploited through a vulnerability in the Elements codebase used to validate Confidential Transactions. The issue stemmed from an ambiguous cache-key encoding in the rangeproof verification cache, allowing two different validation inputs to produce the same cached entry. 
Incident analysisVerus Incident AnalysisOn July 23, 2026, an attacker exploited the Verus Protocol’s Ethereum cross-chain bridge, draining approximately $7.44 million in ETH, tBTC, stablecoins, and MKR. The attack relied on a discrepancy in how Verus and Ethereum interpreted notarization data: malicious duplicate state-root entries were included in otherwise legitimate notarizations, signed by Verus notaries, and then relayed to Ethereum, where they overwrote the genuine trusted state root.
Incident analysisDefiTuna Incident AnalysisOn 16 July 2026, DeFiTuna was exploited for approximately $569,601 USDC on Solana. The attackers created a highly illiquid TUNA/USDC pool and used it as the destination for borrowed USDC routed through Jupiter. Because the swap returned only a negligible amount of TUNA, DeFiTuna’s value calculation rounded the position’s total assets down to zero. The protocol then incorrectly treated the position as healthy, allowing the attackers to bypass the solvency check and withdraw the USDC through attacker-controlled liquidity positions.
Incident analysisJaredFromSubway MEV bot Incident AnalysisOn 20 June 2026, the JaredFromSubway MEV bot lost 4,424 ETH (~$7.5M) due to an approval hijacking flaw. The attacker deployed fake arbitrage pools and bait tokens that appeared to offer profitable trading opportunities, causing the bot’s automated strategy to interact with malicious contracts and grant token approvals.
Incident analysisGnosisPay Incident AnalysisOn 01 June 2026 an attacker drained dozens of GnosisPay Safes on Gnosis Chain. The attack vector was a signature-verification flaw in the GnosisPay Delay module.
Industry researchQuantum Computing Threats to the Blockchain IndustryThis report examines how future fault-tolerant quantum computers may compromise blockchain cryptography, and what protocols, validators, custodians, and ecosystem participants must do to migrate before the window closes.
Industry researchIn-Depth Research on the Telegram Escrow Market: Platform Evolution, Ecosystem Structure, and Regulatory ChallengesThe Telegram escrow market has gradually evolved into an underground service ecosystem that integrates escrow matching, fund settlement, merchant management, and traffic distribution, showing clear signs of “platformization” and network-based development.
Incident analysisResolv Protocol Incident AnalysisOn 22 March 2026, the Revolv protocol was exploited, resulting in a loss of ~$26.8M due to a compromise of the project's cloud infrastructure which gave access to Resolv’s AWS Key Management Service (KMS).