Blog
Research reports
In-depth security reports, incident analyses, and industry research covering the state of Web3 security.
Incident analysisThe Anatomy Of A PhishWith a significant rise in the prominence of phishing scams, we have seen some fraudsters mimicking CertiK. As a leading security organization we would be remiss if we didn’t take the time to warn you about these targeted campaigns so please take a minute while we show you how to detect and protect against these emails.
Incident analysisWeb3 Celebrity Endorsements AnalysisLast year’s market peak may feel like a long time ago for those who have since watched prices slide and the euphoria die down, but the actions of a number of celebrities who promoted Web3 projects at the top are now coming back to bite them.
Incident analysisTransit Swap Incident ReportTransit Swap – a cross-chain aggregator – has suffered a breach of its smart contracts. $20 million has been stolen from addresses which had previously interacted with the protocol.
Incident analysisMEV Bot OxBAD... Incident AnalysisMEV bot 0xBAD... was exploited for $1,463,112.71 by 0xB9F78... after earlier taking advantage of a user who mistakenly executed a transaction. Whether the two incidents are related is unclear, but the MEV bot is getting no sympathy from the crypto community.
Incident analysisBoy X Highspeed Incident AnalysisBoy X Highspeed (BXH) – a financial services platform for Web3 and metaverse related assets – has suffered a loss of at least $2.4 million across its operations on BSC, Avalanche, and HECO Chain.
Incident analysisWintermute HackWintermute has been hacked for ~$162.5m which appears to be due to a leaked (or brute forced) private key and not a smart contract vulnerability. At least ~$273,949,000 has been lost to private key compromises this year, making this one of the largest attack vectors this year. The exploiter used a privileged function with the private key leak to specify that the swap contract was the attacker controlled contract. However, Wintermute have announced that that over the counter trading and centralized exchange funds have not been affected.
Incident analysisNew Free Dao Incident AnalysisOn Sep-08-2022 02:09:25 AM +UTC, CertiK’s Skynet detected a flashloan attack in progress on the BSC blockchain. New Free Dao ($NFD) experienced a flashloan exploit for a potential profit of ~$1.25M USD (4,481 BNB). 2,481 remains as BNB in the attacker’s wallet after they converted 2,000 BNB to 556,556 USDT. The token’s price has plummeted over 99% as a result of the attacker dumping a total of 6,838,792 NFD tokens.
New Free Dao has no apparent presence on social media and is not listed on CoinMarketCap.
Incident analysisCauldron Flashloan Attack On Sep-06-2022 07:26:41 PM +UTC, a contract named CauldronV2 (address: 0xe767c...) suffered a loss of about ~$370K due to a vulnerability in the contract. 
Incident analysisBill Murray Hacked WalletYesterday we heard news that Bill Murray’s personal wallet had been compromised leading to the loss of funds raised in the actor's charity NFT collection. Looking onchain, we can see that the exploiter wallet stole 112.05 wETH which was then swapped for ETH.
Incident analysisSudoRare Incident AnalysisSudoRare, a self proclaimed NFT AMM, committed an exit scam within 24 hours of deploying their smart contract that resulted in the loss of $852k. 
Incident analysisCurve Finance Hack Incident AnalysisCurve Finance was compromised on August 9, 2022 for approximately ~$612K in total loss due to a cloned malicious site
Incident analysisWormhole Bridge Exploit Incident Analysis TL;DR
On February 02, 2022 at 5:58 PM +UTC, a malicious actor launched multiple attacks aiming to bypass the verification process of the Wormhole bridge on Solana. The attacker carried out the second-largest crypto theft from a DeFi protocol ever, which resulted in the loss of roughly 120,000 Wormhole Ethereum (WeETH) worth over $320M.