博客
研究报告
深入的安全报告、事件分析和行业研究，涵盖 Web3 安全现状。
安全事件分析Magic Internet Money Incident AnalysisOn 25 March 2025, MIM Spell was exploited for 6,261.13 ETH (~$12.9M) due to a vulnerability in the integration of the RouterOrder and Cauldron contracts. The attacker was able to borrow funds, liquidate themselves then borrow funds again without repaying them. This was due to the liquidation process not overwriting records in RouterOrder that counted as collateral, allowing exploiter to falsely borrow additional funds after liquidation.
安全事件分析0xInfini Incident AnalysisOn 24 February 2025, 0xInfini was targeted by an attack that resulted in a loss of ~$49M. A key wallet used in the attack had previously been involved in the development of Infini contracts and had retained admin rights which were used to redeem all Vault tokens.
安全事件分析Bybit Incident Technical AnalysisOn Feb-21-2025 at 02:16:11 PM UTC, the Bybit’s cold ethereum wallet was drained due to a malicious contract upgrade. This exploit resulted in an estimated loss of approximately $1.46 billion, marking the largest breach in Web3 history.
安全事件分析XPEPE Token Incident AnalysisOn 25 January 2025, an attacker exploited a vulnerability in XPEPE’s TokenStaker contract which led to a 99% drop of the token price.
行业研究INOs: A New Era in Web3 Fundraising — Opportunities and ChallengesWhat is driving the rise of INOs, and how might they shape the future of decentralized networks and project funding? Let’s dive into the potential benefits and challenges of this emerging model.
行业研究Evil in the Shadows: Unveiling the Chaos in Ethereum’s Token EcosystemIn the Web3 space, new tokens are constantly emerging. Have you ever wondered how many new tokens are issued each day? And more importantly, are these new tokens safe? Over the past few months, CertiK's security team has identified numerous cases of rug pull transactions. Notably, all of the tokens involved in these cases were newly listed on the blockchain.
安全事件分析FEG Bridge Exploit Technical AnalysisOn December 29, 2024 at 5:00 AM UTC, the FEG token bridge system was exploited, which permitted the attacker to withdraw FEG tokens from the bridge contract without depositing them in the source chain. The total profit for the attacker across three blockchains (Ethereum, Base, and BSC) is approximately $1 million USD.
安全事件分析Clober Dex Incident AnalysisOn 10 December 2024, Clober DEX liquidity vault on Base Network was exploited resulting in a loss of 133.7 ETH (~$501k). The root cause of the attack was a reentrancy vulnerability in the _burn() function of the Rebalancer contract. Clober made an announcement via their X account, offering a 20% bounty to the attacker.
安全事件分析Polter Finance Incident AnalysisOn 16 November 2024, Polter Finance was exploited for ~$8.7 million, due to a price manipulation exploit. Polter Finance paused their platform shortly after to investigate. 
安全事件分析DeltaPrime Incident AnalysisOn 11 November 2024, DeltaPrime was exploited for ~$4.8M across Arbitrum and Avalanche network. The attack combined two vulnerabilities. The first one is an unchecked input allowing the attacker to move borrowed token to another arbitrary address.
The second one also involves arbitrary address input that can be exploited by leveraging the claim mechanism to withdraw the collateral.
安全事件分析CryptoBottle Incident AnalysisIn October 2024, CryptoBottle on Polygon was exploited on three separate occasions with combined losses totalling ~$527k. In the latest incident on 24 October, the largest of the three, an attacker exploited a critical vulnerability to disable a balance check in the swap() method after callback, and made arbitrary swaps to acquire a large amount of NAS tokens which they then sold to drain the project of ~$490k USDT.
安全事件分析Omnipus Incident AnalysisOn 11 September 2024, Omnipus contracts were drained of ~$30k received during the presale of the OPUS token.