블로그
리서치 보고서
Web3 보안 현황을 다루는 심층 보안 보고서, 사고 분석 및 산업 리서치.
보안 사고 분석FinSoul: The Fintoch Fraud ContinuesOn October 10, 2023, FinSoul ($FSL) dropped approximately 99% in value. This investigative report exposes the complex web of deception that the professional scammers behind this project (and others) have spun.
보안 사고 분석HopeLend Incident AnalysisOn October 18, 2023, the lending pool of Hope.money was exploited by an attacker who leveraged a flash loan. 
보안 사고 분석Fantom Foundation & Employee Wallet DrainOn October 17, several unauthorized transfers occurred from multiple wallets Labelled ‘Fantom: Foundation Wallet’ as well as some unlabelled but connect wallets. Losses amounted to approximately \$7 million with Fantom stating \$550k was related to the Foundation with the rest relating to the personal funds of an employee.
보안 사고 분석Platypus DeFi Incident AnalysisOn 12 October 2023, DeFi project Platypus Finance was exploited across three flash loan transactions, by two externally owned addresses (EOAs), for approximately \$2.23 million. The exploit was due to price manipulation of the Platypus WAVAX and sAVAX pools. Platypus were able to recover \$575k after a mistake by an exploiter.
보안 사고 분석Stars Arena Incident AnalysisOn 7 October, 2023 SocialFi project Stars Arena was exploited via a reentrancy vulnerability for 266,103 AVAX, approximately \$2.88 million. The incident was the largest reentrancy exploit to occur on the Avalanche chain in 2023. Stars Arena was also exploited two days prior on 5 October for roughly \$2k by the same exploiter. This earlier incident likely drew increased scrutiny over the Stars Arena contract.
보안 사고 분석Lucky Star Currency Exit ScamOn 9 October, the price of LSC token dropped by 99% due to a token dump carried out by externally owned address 0x9Ef72 which withdrew LSC tokens from two contracts owned by the Lucky Star Currency project. The tokens were then swapped for approximately $1.1 million making it the largest exit scam seen in October so far. 
September Stats GraphThe September Stats Graphic shows data from hacks, scams, and incidents in September 2023
Lending Contract Exploits: A RetrospectiveIn traditional finance, lenders provide funds in return for interest on their deposits, while borrowers pay interest for immediate access to funds. DeFi lending operates on the same principle, but uses smart contracts. This approach means DeFi is accessible to everyone without the need for personal details or trusting a third party to hold funds. This report examines several past exploits analyzed by CertiK
보안 사고 분석Mark Cuban's Private Key CompromiseOn 15 September, a publicly doxed Mark Cuban wallet was drained in a private key compromise leading to the loss of multiple ERC-20 tokens and ETH. 
Shifty Negotiations: Are Projects Still Benefiting From Negotiating With Their Attackers?In April 2023, CertiK published an analysis of Web3 projects that had been hacked or exploited between October 2020 and April 2023 which saw some some or all funds returned after trying to negotiate with their attackers.
보안 사고 분석ZKasino Security Update Post MortemOn September 16, 2023, the ZKasino team released a security update. The security update claimed a potential weak point was identified by a white-hat hacker named 'bart1e' in their smart contracts. In response to questions and concerns from the community, this article will analyze this issue and identify the root cause.
The Billion Dollar BriefingThe Web3 sector reached an unfortunate milestone recently, though it's not exactly unfamiliar territory. As of September 4, 2023, the industry crossed the $1 billion mark in terms of value lost to exit scams, exploits, and hacks.