Blog
Research reports
In-depth security reports, incident analyses, and industry research covering the state of Web3 security.
Incident analysisMu Coin Incident AnalysisOn 10 December, 2022 at 1:21:34 AM UTC, Mu Coin was flash loan attacked for approximately 45 ETH ($57K) on AVAX. The attack took advantage of differences in price between the token in the LP pools and the token price obtained by buying bonds, resulting in a smart contract that is vulnerable to economic arbitrage. Mu coin founder Jon Vaughn acknowledged the attack and is attempting to raise the price back to levels similar before the incident. 
Incident analysisLodestar Finance Incident Analysis On 10 December , 2022 Lodestar Finance’s protocol was exploited with deposits drained due to a vulnerability in the GLPOracle calculation. The exploiter profited approximately $6.5m
Incident analysisOpenSea Phishing Incident AnalysisBack in February 2022, OpenSea users were targeted by an elaborate phishing attack through emails that tricked users into signing permissions with a malicious contract. In total, 28 wallets had NFTs stolen that were worth $2 million making it the second most profitable NFT phishing attack in 2022, just behind the Bored Ape Yacht Club (BAYC) Instagram compromise in April 2022.
Incident analysisRedruby DAO Exploit Incident AnalysisOn October 4th, 2022 Redruby DAO was exploited by an unknown actor and lost approximately $91,020. At time of writing, Redruby DAO is still active. 
Incident analysisBacon Protocol Incident AnaylsisOn March 5, 2022, Bacon Protocol experienced an exploit via a flash loan attack for loss of nearly $1 million to the protocol. The exploit appears to result from the attacker taking advantage of a reentrancy issue within the lend() function of Bacon Protocol. Since the incident the project recognized the attack and reaudited contracts completely. Soon after they would rebrand as HOME Coin and recapture momentum.
Incident analysisCashio App Incident AnalysisOn March 23, 2022, at 8:23:26 AM UTC, an unknown actor exploited Cashio App leading to approximately $52 million worth of lost assets. The root cause of the attack stems from missing code in the collateral verification design. The verification design lacked necessary validation for the input “collateral”, enabling the attacker to use fake accounts to bypass the verifications and mint Cash tokens.
Incident analysisJourney of Awakening Incident AnalysisOn 12 October 2022, Journey of Awakening’s ATK token was exploited with the attacker gaining $127,805. The attacker was able to take advantage of a rewards system in the ATK contract. This vulnerability meant the attacker was able to gain rewards based on a manipulated token price.
Incident analysisPoly Network ExploitOn August 10, 2021 the cross-chain interoperability protocol Poly Network was attacked by hackers resulting in ~$610 million loss worth of digital tokens. Nearly all of the money was returned by the hacker the next day. 
Incident analysisFlare Incident AnalysisOn 13 November, 2022, the Flare team conducted an exit scam on Flare Token. The exploiter stole approximately $18.5 million. 
Incident analysisBitmart Hot Wallet CompromiseJust over a year ago, Bitmart’s hot wallets on Ethereum and BNB Smart Chain (BSC) were compromised leading to $195 million in assets.
Incident analysisLegend Coin Incident AnalysisOn 23 May, 2022, Legend Coin (LDC) was exploited via a flash loan.
Incident analysisSanta Coin Incident AnalysisOn October 24, 2022, the Santa Coin team conducted an exit scam on \$SANTA token and stole 765 BNB (~\$209K) from \$SANTA holders.