Blog
Research reports
In-depth security reports, incident analyses, and industry research covering the state of Web3 security.
Incident analysisMagic Internet Money Incident AnalysisOn 25 March 2025, MIM Spell was exploited for 6,261.13 ETH (~$12.9M) due to a vulnerability in the integration of the RouterOrder and Cauldron contracts. The attacker was able to borrow funds, liquidate themselves then borrow funds again without repaying them. This was due to the liquidation process not overwriting records in RouterOrder that counted as collateral, allowing exploiter to falsely borrow additional funds after liquidation.
Incident analysis0xInfini Incident AnalysisOn 24 February 2025, 0xInfini was targeted by an attack that resulted in a loss of ~$49M. A key wallet used in the attack had previously been involved in the development of Infini contracts and had retained admin rights which were used to redeem all Vault tokens.
Incident analysisBybit Incident Technical AnalysisOn Feb-21-2025 at 02:16:11 PM UTC, the Bybit’s cold ethereum wallet was drained due to a malicious contract upgrade. This exploit resulted in an estimated loss of approximately $1.46 billion, marking the largest breach in Web3 history.
Incident analysisXPEPE Token Incident AnalysisOn 25 January 2025, an attacker exploited a vulnerability in XPEPE’s TokenStaker contract which led to a 99% drop of the token price.
Industry researchINOs: A New Era in Web3 Fundraising — Opportunities and ChallengesWhat is driving the rise of INOs, and how might they shape the future of decentralized networks and project funding? Let’s dive into the potential benefits and challenges of this emerging model.
Industry researchEvil in the Shadows: Unveiling the Chaos in Ethereum’s Token EcosystemIn the Web3 space, new tokens are constantly emerging. Have you ever wondered how many new tokens are issued each day? And more importantly, are these new tokens safe? Over the past few months, CertiK's security team has identified numerous cases of rug pull transactions. Notably, all of the tokens involved in these cases were newly listed on the blockchain.
Incident analysisFEG Bridge Exploit Technical AnalysisOn December 29, 2024 at 5:00 AM UTC, the FEG token bridge system was exploited, which permitted the attacker to withdraw FEG tokens from the bridge contract without depositing them in the source chain. The total profit for the attacker across three blockchains (Ethereum, Base, and BSC) is approximately $1 million USD.
Incident analysisClober Dex Incident AnalysisOn 10 December 2024, Clober DEX liquidity vault on Base Network was exploited resulting in a loss of 133.7 ETH (~$501k). The root cause of the attack was a reentrancy vulnerability in the _burn() function of the Rebalancer contract. Clober made an announcement via their X account, offering a 20% bounty to the attacker.
Incident analysisPolter Finance Incident AnalysisOn 16 November 2024, Polter Finance was exploited for ~$8.7 million, due to a price manipulation exploit. Polter Finance paused their platform shortly after to investigate. 
Incident analysisDeltaPrime Incident AnalysisOn 11 November 2024, DeltaPrime was exploited for ~$4.8M across Arbitrum and Avalanche network. The attack combined two vulnerabilities. The first one is an unchecked input allowing the attacker to move borrowed token to another arbitrary address.
The second one also involves arbitrary address input that can be exploited by leveraging the claim mechanism to withdraw the collateral.
Incident analysisCryptoBottle Incident AnalysisIn October 2024, CryptoBottle on Polygon was exploited on three separate occasions with combined losses totalling ~$527k. In the latest incident on 24 October, the largest of the three, an attacker exploited a critical vulnerability to disable a balance check in the swap() method after callback, and made arbitrary swaps to acquire a large amount of NAS tokens which they then sold to drain the project of ~$490k USDT.
Incident analysisOmnipus Incident AnalysisOn 11 September 2024, Omnipus contracts were drained of ~$30k received during the presale of the OPUS token.