Blog
Research reports
In-depth security reports, incident analyses, and industry research covering the state of Web3 security.
March 2023 Monthly ReportSo far in 2023, $~315M has been lost to various scams and exploits in the Web3 world and a total of 205 attacks attacks recorded this year so far.
March Stats GraphThe March Stats Graphic shows data from hacks, scams, and incidents in March 2023
Industry researchKYC Actors are Ramping Up Their GameCertiK intelligence analysts have noticed an evolution in the use of KYC actors by malicious operators.
Industry researchThe Rug Pull ReportExit scams, popularly referred to as rug pulls, are an ongoing criminal scheme in Web3. A rug pull involves fraudsters robbing a crypto project by liquidating their holdings without warning and leaving investors holding worthless tokens.
Incident analysisEuler Finance Incident AnalysisOn 13 March 2023, Euler Finance was exploited leading to a loss of approximately $197 million
February 2023 Monthly ReportSo far in 2023, $~79.5M has been lost to various scams and exploits in the Web3 world and a total of 125 attacks attacks recorded this year so far.
Incident analysisPlatypus Finance Incident AnalysisOn 16 February, 2023, at 07:16:54 PM UTC, Platypus Finance, the project behind the USP stablecoin, was attacked for approximately $8.5 million. The attack caused a large decline in the price of \$USP of \$0.33, (or down more than 66% compared to its intended \$1 peg. The project’s native PTP token also lost a quarter of its value in a day. The attacker minted 40 million USP tokens from the MasterPlatypusV4 contract using 44 million Platypus LP-USDC tokens as collateral. So far, the team has been able to recover approximately \$2.4 million USDC from the attack contract.
Industry researchHow Pro-Russian Groups Are Fundraising on Telegram to Evade SanctionsPro-Russian groups are helping each other crowdfund weapons, supplies, and materiel by promoting each others wallets across a large network of Telegram channels. In this analysis, we use on-chain evidence to examine the flow of funds.
Incident analysisElasticSwap Incident AnalysisOn 13 December, 2022, at 02:23:05 AM +UTC, an unknown attacker utilized flash loans to drain approximately $850,000 from ElasticSwap. 
Incident analysisHope FinanceOn 20 February, 2023, Hope Finance had users funds drained from their Genesis Rewards Pool. Overall $1.86 million was stolen. This incident is the largest exit scam that occurred on Arbitrum this year. 
February Stats GraphThe February Stats Graphic shows data from hacks, scams, and incidents in February 2023
Incident analysisLianGo Protocol Incident AnalysisOn 7 February, 2023 CertiK detected a slippage on the LianGo Protocol’s token (LGT) which dropped 97%. Upon investigation it was discovered that the incident was made possible due to the owner of the LGT Pool contract setting a malicious contract as the LP token. However, it is likely that the wallet owning the LGT Pool contract was compromised. The stolen LGT tokens were then swapped for Tether (USDT), causing the 97% slippage. Approximately $1.6 million was taken.