블로그
리서치 보고서
Web3 보안 현황을 다루는 심층 보안 보고서, 사고 분석 및 산업 리서치.
보안 사고 분석Magic Internet Money Incident AnalysisOn 25 March 2025, MIM Spell was exploited for 6,261.13 ETH (~$12.9M) due to a vulnerability in the integration of the RouterOrder and Cauldron contracts. The attacker was able to borrow funds, liquidate themselves then borrow funds again without repaying them. This was due to the liquidation process not overwriting records in RouterOrder that counted as collateral, allowing exploiter to falsely borrow additional funds after liquidation.
보안 사고 분석0xInfini Incident AnalysisOn 24 February 2025, 0xInfini was targeted by an attack that resulted in a loss of ~$49M. A key wallet used in the attack had previously been involved in the development of Infini contracts and had retained admin rights which were used to redeem all Vault tokens.
보안 사고 분석바이비트 사건 분석2025년 2월 21일 오후 2시 16분 11초(UTC), 악의적인 컨트랙트 업그레이드로 인해 Bybit의 이더리움 콜드월렛에서 자금이 유출되었습니다. 이번 공격으로 약 14.6억 달러의 피해가 발생한 것으로 추정되며, 이는 Web3 역사상 최대 규모의 보안 사건으로 기록되었습니다.
보안 사고 분석XPEPE Token Incident AnalysisOn 25 January 2025, an attacker exploited a vulnerability in XPEPE’s TokenStaker contract which led to a 99% drop of the token price.
산업 리서치INOs: A New Era in Web3 Fundraising — Opportunities and ChallengesWhat is driving the rise of INOs, and how might they shape the future of decentralized networks and project funding? Let’s dive into the potential benefits and challenges of this emerging model.
산업 리서치Evil in the Shadows: Unveiling the Chaos in Ethereum’s Token EcosystemIn the Web3 space, new tokens are constantly emerging. Have you ever wondered how many new tokens are issued each day? And more importantly, are these new tokens safe? Over the past few months, CertiK's security team has identified numerous cases of rug pull transactions. Notably, all of the tokens involved in these cases were newly listed on the blockchain.
보안 사고 분석FEG Bridge Exploit Technical AnalysisOn December 29, 2024 at 5:00 AM UTC, the FEG token bridge system was exploited, which permitted the attacker to withdraw FEG tokens from the bridge contract without depositing them in the source chain. The total profit for the attacker across three blockchains (Ethereum, Base, and BSC) is approximately $1 million USD.
보안 사고 분석Clober Dex Incident AnalysisOn 10 December 2024, Clober DEX liquidity vault on Base Network was exploited resulting in a loss of 133.7 ETH (~$501k). The root cause of the attack was a reentrancy vulnerability in the _burn() function of the Rebalancer contract. Clober made an announcement via their X account, offering a 20% bounty to the attacker.
보안 사고 분석Polter Finance Incident AnalysisOn 16 November 2024, Polter Finance was exploited for ~$8.7 million, due to a price manipulation exploit. Polter Finance paused their platform shortly after to investigate. 
보안 사고 분석DeltaPrime Incident AnalysisOn 11 November 2024, DeltaPrime was exploited for ~$4.8M across Arbitrum and Avalanche network. The attack combined two vulnerabilities. The first one is an unchecked input allowing the attacker to move borrowed token to another arbitrary address.
The second one also involves arbitrary address input that can be exploited by leveraging the claim mechanism to withdraw the collateral.
보안 사고 분석CryptoBottle Incident AnalysisIn October 2024, CryptoBottle on Polygon was exploited on three separate occasions with combined losses totalling ~$527k. In the latest incident on 24 October, the largest of the three, an attacker exploited a critical vulnerability to disable a balance check in the swap() method after callback, and made arbitrary swaps to acquire a large amount of NAS tokens which they then sold to drain the project of ~$490k USDT.
보안 사고 분석Omnipus Incident AnalysisOn 11 September 2024, Omnipus contracts were drained of ~$30k received during the presale of the OPUS token.