블로그
리서치 보고서
Web3 보안 현황을 다루는 심층 보안 보고서, 사고 분석 및 산업 리서치.
보안 사고 분석MangoFarmSOL Exit ScamOn 6th January 2024, the MangoFarmSOL project conducted an exit scam leading to losses estimated around ~$1.32 million which is the largest exit scam that we have investigated in 2024 so far.
산업 리서치MiCA’s Benefits and Limitations: An Auditing Perspective on EU Stablecoin RegulationThe global regulatory landscape for cryptocurrencies varies widely, from countries fully embracing the financial technology for its innovation and economic potential to those completely banning its use. This article examines the EU's approach to regulating stablecoins, emphasizing the role of auditors in security and risk assessments under these regulations.
보안 사고 분석Bot-Driven Wash Trading in Exit ScamsCertiK has detected multiple exit scams employing bots for wash trading, a deceptive practice designed to attract unsuspecting investors. These scammers employ a subtle yet effective technique, transferring funds across various tokens—a strategy that sometimes slips under the radar of security assessments and exit scam post-mortems.
보안 사고 분석XKingdom Incident AnalysisOn 6th January 2024, the XKingdom_Tech project stole community funds and deleted their website and all social media presence. In total, the XKingdom_Tech exit scam led to $1.2 million in losses making it one of the largest exit scams we have seen over the past few months. The stolen funds were bridged to Ethereum and deposited into Tornado Cash. 
산업 리서치Beware the Honeypot: How Telegram Channels Used Actors to Promote ScamsCertiK has been closely monitoring a serial scammer who is orchestrating honeypot schemes across at least five Telegram channels. In these channels, actors are used to post trading videos, before viewers are gradually steered towards investing in honeypot scams.
산업 리서치Navigating the European Banking Authority’s Compliance Guidelines with SkyInsightsThe European Banking Authority (EBA) has updated its guidelines on money laundering and counter-terrorist financing, extending these to include crypto-asset service providers (CASPs). Compliance and risk management tools like SkyInsights aid CASPs in adapting to these new guidelines through enhanced transaction monitoring and risk identification capabilities.
보안 사고 분석Concentric.Fi Incident AnalysisOn 22nd January, Concentric.fi was exploited leading to losses of over $1.85 million. The wallets that conducted the attack have been doxxed as the OKX exploiter. Concentric announced on X that their protocol was attacked due to a targeted social engineering attack leading to the compromise of one of their teams admin wallets. From there the attackers were able to upgrade Concentric vault contracts with a malicious implementation leading to losses in liquidity pools as well as users who had approved Concentric contracts.
보안 사고 분석Socket Tech Incident AnalysisOn 16 January 2024, Socket Tech was exploited by EOA 0x50df for approximately $3.3 million. The attacker took advantage of a vulnerability within the performAction function of a newly deployed contract which has an incomplete user input validation. Users who had approved the vulnerable SocketGateway contract had their funds stolen stolen. From this attack there were 230 wallets that lost funds with the biggest victim losing $656k USDC.
보안 사고 분석Post Mortem: Hector NetworkIn light of the $2.7 million withdrawal incident from Hector Network's contract, we have gathered all the relevant information and are committed to maintaining transparency with the public.
보안 사고 분석Honeypot ScamsFollowing on from our blog on The Proliferation of Honeypot Contracts in Web3 where we took a detailed look at a prolific honeypot creator, we take a look at the some common honeypot mechanisms and how they trap users funds.
보안 사고 분석Narwhal IncidentNarwhal’s token experienced two considerable drops within a two day period leading to an overall slippage of approximately 99%. The project’s official X account @Narwhal_fyi, announced that they had experienced an exploit, but did not give any specific details. Initial indications pointed to a private key compromise, however on-chain links suggest this incident was an exit scam. Approximately $1 million worth of funds were deposited into Tornado Cash with a further $410,000 sitting in two wallets. In this blog, we will outline the suspicious links that indicate that this incident is an exit scam. 
산업 리서치Trap Phishing on Trusted Platforms: A New Phishing Trend in The Web3 WorldWe have identified a new active form of phishing in the Web3 ecosystem. It involves putting phishing traps in influential platforms like exchanges and marketplaces to broaden the reach and credibility of phishing sites. The phishing traps can be in the form of web3 project job advertisements, airdrops, and NFT sales from faked project sites.