Blog
Research reports
In-depth security reports, incident analyses, and industry research covering the state of Web3 security.
Incident analysisThe IEGT Exit Scam: A Complex Web of DeceptionOn July 22, 2023, IEGT orchestrated an exit scam, resulting in a $1.14 million loss. While not the largest fraudulent act of the year, its complexity was unparalleled, especially in the clever camouflage of team wallet balances.
Incident analysisZunami Protocol Incident AnalysisOn 13 August, 2023 Zunami Protocol suffered an exploit via flash loan attack, resulting in a loss of ~$2.16 million
Incident analysisKokomo Finance On 26 March, 2023, Kokomo Finance (KOKO) on the Optimism Smart Chainconducted an exit scam and stole ~$4 million in user funds.
Incident analysisVyper Incident AnalysisOn July 30, reports surfaced of vulnerabilities in Vyper versions 0.2.15, 0.2.16 and 0.3.0 which left many Curve pools vulnerable to a reentrancy attack.
Incident analysisConic Finance Incident AnalysisOn 21 July, 2023 the Conic Finance ETH Omnipool was exploited for 1724 ETH (\$3.2 million) via a read-only reentrancy vulnerability. Despite having reentrancy guards in place, an incorrect assumption led to a reentrancy guard being bypassed. Conic paused the ETH Omnipool but a few hours later they lost a further \$300,000 to MEV arbitrage in the crvUSD Omnipool.
Incident analysisPalmswap Incident AnalysisOn 24 July, 2023 Palmswap fell victim to a flash loan exploit, resulting in the loss of 901,455 USDT. 
Incident analysisEraLend Incident AnalysisOn 25 July, 2023 EraLend was exploited in a read-only reentrancy attack, leading to a total loss of approximately $2.7 million. 
Incident analysisPoly Network Incident AnalysisOn 1 July 2023, Poly Network was exploited by an attacker that was able to issue themselves $42 billion worth of assets across multiple chains. 
Incident analysisChibi Finance Incident AnalysisOn 27 June 2023, Chibi Finance team orchestrated an exit scam that led to the loss of over $1 million of investor funds.
Incident analysisCertiK's Update on the Merlin DEX RugpullWe want to provide the community with an update regarding the Merlin DEX incident that took place on April 25th, when Merlin insiders rugpulled their users for $1.8M.
Incident analysisGDAC Incident AnalysisOn the morning of 10 April, South Korean exchange GDAC announced on their website that their exchange wallets had been compromised leading to the loss of $13 million worth of cryptocurrency. The company disclosed that this loss amounted to 23% of all of the exchange's holdings.
Incident analysisMEV Bot Incident AnalysisOn 3 April, CertiK was alerted to an incident involving a malicious validator front running multiple Miner Extractable Value (MEV) bots leading to a loss of just over $25 million.