CertiK 블로그

PaperTrade reported manipulation attempts on 10–11 October 2026 targeting the Hyperliquid best bid and ask (BBO) used to price its synthetic positions. The project acknowledged the attempts on 11 October. The account examined in this analysis withdrew 1,279,106.191184 USDC more than it deposited. PaperTrade settled positions at the instantaneous BBO midpoint, while its profit haircut used a fixed reference notional. This linked large synthetic payouts to an influenceable quote without increasing the haircut percentage as position size grew.

On 30 September 2026, HOT Omni Bridge on NEAR was exploited, resulting in five observed BSC treasury payouts totaling $3.86M USD. The attacker used a large pre-existing balance of a custom auxiliary token to request refunds far greater than the amounts in a new deposit. Recording the resulting large decimal amounts expanded the refund event beyond NEAR's 16384 bytes log limit and failed the Intents deposit resolver. HOT subsequently returned the original deposited backing, including USDT, while the Intents credit created by an earlier successful receipt survived.

On October 6, 2026, at 06:13:11 UTC, an attacker drained 200 ETH ($542,982 at the time of the exploit) of ETH-A collateral from a legacy auction-keeper contract on Ethereum mainnet. The 200 ETH came from four 50 ETH lots that the keeper won with zero bids during MakerDAO's "Black Thursday" liquidations in March 2020 and never settled. An unauthenticated function on the keeper let the attacker give a contract it controlled full delegation over the keeper's MakerDAO Vat account. In a single transaction, the attacker settled the old auctions and withdrew the collateral.

The Office of the Comptroller of the Currency (OCC) has finalized its rulebook for payment stablecoin issuers under the GENIUS Act. The rules take effect on January 18, 2027, the same day the GENIUS Act itself takes effect. Any issuer that wants to be in the U.S. market on day one has less than three months to get its house in order.

We look at United States regulatory updates in September 2026, including the results of the CLARITY Act votes, updates on tokenized stocks, market structure guidance by the CFTC, and more.

Kyrgyzstan’s central bank is developing a digital version of its national currency, the Digital Som. On 9 September 2026, it signed a Memorandum of Understanding with CertiK, the largest Web3 security services provider, on Digital Som security and broader digital asset oversight. The partnership spans security assessment, formal verification, operational resilience, and ongoing risk monitoring, connecting technical security with longer-term risk management and regulatory oversight.

What the CLARITY Act is, how it would split crypto oversight between the SEC and CFTC, where it stands in Congress, and what it means for crypto businesses.

reparing for a Web3 penetration test? Here’s what happens before, during, and after an engagement, and how to get the most value from yours.

Red team vs. pentest vs. bug bounty for Web3 projects: what each one actually tests, when to use which, and how to combine them into one program.

CertiK independently verified Sui’s Mainnet Tunnel performance campaign, which recorded more than 15.2 billion off-chain transactions across 7,680 tunnels at a peak of 40.68 million TPS.

CertiK’s formal verification of zkWasm provides mathematical proof that a leading zero-knowledge virtual machine executes programs correctly — a rigor level beyond traditional audits, now validated for ACM CCS 2026.

CertiK joins LF Decentralized Trust to bring formal verification and security expertise into the open-source infrastructure enterprises are building on amid intensifying global regulation.

As of October 2026, Monad held about USD 1 billion in TVL as its trading, lending, stablecoin, and RWA activity concentrated around emerging market leaders.

Morpho surpassed its previous TVL high while DeFi remained below its 2025 peak, supported by growth across Robinhood Chain, Arc, and real-world asset lending.

Circle’s Arc mainnet is scheduled for September 16, 2026, using USDC for gas and settlement while connecting stablecoin scale with institutional and programmable financial activity.