블로그
리서치 보고서
Web3 보안 현황을 다루는 심층 보안 보고서, 사고 분석 및 산업 리서치.
보안 사고 분석Makina Incident AnalysisOn 20 January 2026, DeFi protocol MakinaFi suffered an exploit resulting in the theft of 1,299 ETH, valued at approximately $4.13 million. 
보안 사고 분석Truebit Incident AnalysisOn 08 January 2026 Truebit was exploited for ~$26.6M due to an overflow issue. A malicious actor minted tokens for zero ETH that they then sold for ~$26.4M in the same transaction. The exploit was followed up by a second attacker who was able to extract a further ~$224k. 
보안 사고 분석Balancer Incident AnalysisOn 3 November 2025, Balancer and its forks Beets and Bex were exploited, resulting in a combined initial loss of approximately $130M.
보안 사고 분석Numa Incident AnalysisOn 10 August 2025 Numa protocol was exploited for ~$313k. A malicious actor acquired additional Numa tokens by liquidating victim accounts after manipulating the NumaVault by minting nuBTC. Minting the nuBTC inflated the total synth value and in turn, reduced the collateral value of cNuma according to the Numa VaultManager logic.
보안 사고 분석GMX Incident AnalysisOn 9 July 2025 GMX V1 vault was exploited by a white-hat for ~$42M due to a reentrancy issue. The funds were later returned to GMX who awarded the white-hat a 10% bounty. The whitehat had minted and then staked GLP before creating a short position directly from the vault contract through reentrancy. Executing in this order bypassed the ShortsTracker, and prevented the average short position price from being updated. This occurs when the market price exceeds the tracked average price, resulting in the protocol overestimating unrealized losses. As a result, the Assets Under Management (AUM) calculation was manipulated to inflate the apparent value of GLP.
보안 사고 분석Arcadia Incident AnalysisOn 15 July 2025, a malicious actor took advantage of a lack of input validation in Arcadia Finance’s Rebalancer contract to obtain assets by paying off a portion of a user’s debt and withdrawing the underlying assets for a net gain of ~$3.6M. 
보안 사고 분석Sola Incident AnalysisOn April 12 2025, an unverified contract, 0x623c, was exploited, leading to the loss of approximately $28,000 due to a lack of access control. The exploit was the fourth incident linked to this same attacker, who had already conducted exploits on Gemcy, OPC, and AIRWA, gaining around $181,000. On April 23, the attacker conducted a fifth attack on ACB.
보안 사고 분석Mobius Token Incident AnalysisOn 11 May 2025, our system detected a suspicious attack involving Mobius Token #MBU on Binance Smart Chain #BSC, which resulted in an approximate loss of $2.16M
보안 사고 분석Magic Internet Money Incident AnalysisOn 25 March 2025, MIM Spell was exploited for 6,261.13 ETH (~$12.9M) due to a vulnerability in the integration of the RouterOrder and Cauldron contracts. The attacker was able to borrow funds, liquidate themselves then borrow funds again without repaying them. This was due to the liquidation process not overwriting records in RouterOrder that counted as collateral, allowing exploiter to falsely borrow additional funds after liquidation.
보안 사고 분석0xInfini Incident AnalysisOn 24 February 2025, 0xInfini was targeted by an attack that resulted in a loss of ~$49M. A key wallet used in the attack had previously been involved in the development of Infini contracts and had retained admin rights which were used to redeem all Vault tokens.
보안 사고 분석바이비트 사건 분석2025년 2월 21일 오후 2시 16분 11초(UTC), 악의적인 컨트랙트 업그레이드로 인해 Bybit의 이더리움 콜드월렛에서 자금이 유출되었습니다. 이번 공격으로 약 14.6억 달러의 피해가 발생한 것으로 추정되며, 이는 Web3 역사상 최대 규모의 보안 사건으로 기록되었습니다.
보안 사고 분석XPEPE Token Incident AnalysisOn 25 January 2025, an attacker exploited a vulnerability in XPEPE’s TokenStaker contract which led to a 99% drop of the token price.