博客
研究报告
深入的安全报告、事件分析和行业研究，涵盖 Web3 安全现状。
安全事件分析Normie Incident AnalysisOn 26 May 2024, an attacker exploited a vulnerability in the NORMIE contract on Base blockchain, executing a flash loan attack that significantly increased the meme coin’s token supply. This exploit resulted in a 99% drop in the token’s value, causing the market cap to crash from approximately $41 million to around $35k. The attacker gained 224 WETH (~$881,686) of which they offered to return 90%, provided certain stipulations were met. 
安全事件分析Pike Finance Incident AnalysisOn 26 April Pike Finance was exploited for $299k. As a result of the exploit they paused their contract which required it to be upgraded first. The upgrade caused a knock on effect and on 30 April 2024 Pike Finance was exploited for a second time with approximate losses of $1.68m.
安全事件分析Alex Bridge Incident AnlaysisOn 14th May, CertiK’s internal alerting system detected a suspicious transfer of $4.3 million worth of assets to a wallet on the Binance Smart Chain, with an additional 13.7 million STX worth $2 million that was transferred to a malicious address. The incident was due to a private key compromise of the project’s deployer which has been confirmed by the project since the attack. The funds that were affected on BSC were front run by a wallet who has begun negotiations to return the assets to the project. At the time of writing, the funds affected total $6.3 million.
安全事件分析Sonne Finance Incident AnalysisOn 14 May 2024, Sonne Finance was exploited for approximately $20M with a known precision loss vulnerability that was first seen in the Hundred Finance exploit in April 2023. The Sonne Finance exploit is the largest exploit to occur on the Optimism chain and is overall the 6th largest incident in 2024. The attacker took advantage of the known vulnerability when an empty pool had been newly created, after users voted to add Velo token to Sonne on the Optimism chain. 
安全事件分析Tax-Free Fraud: Exposing the ZhongHua ScamThe ZongHua exit scam resulted from the team's deliberate exemption of privileged addresses from balance checks, allowing them to mint huge amounts of tokens and dump them. We investigate how this happened.
安全事件分析Hedgey Finance Incident AnalysisOn 19 April 2024, Hedgey Finance was exploited for approximately $2 million on Ethereum in addition to a number of BONUS tokens on Arbitrum. The attacker took advantage of an oversight in the project’s ClaimCampaigns contract in which token approvals were not revoked, meaning anyone who used the createLockedCampaign() function could transfer tokens from the contract to themselves.
安全事件分析Prisma Finance Incident AnalysisOn 28 March, Prisma Finance was exploited by multiple addresses leading to a loss of approximately $12.3 million. Three attackers took advantage of a vulnerability in the Prisma Finance MigrateTroveZap contract which allowed them to manipulate a migration process. Since the exploit occurred, a wallet that received funds from the main exploiter has reached out to the Prisma Finance deployer declaring that their actions were a white hat rescue. 
安全事件分析Risk On Blast Incident AnalysisOn 24 February, GambleFi project RiskOnBlast is thought to have become the first confirmed exit scam to occur on the Blast ecosystem, a layer-2 project on Ethereum.
安全事件分析Blast Chain's $97 Million Battle: Are North Korean Hackers Rusty?A detailed post-mortem analysis of the Munchables incident on the Blast mainnet, focusing on the methods used by attackers, the vulnerabilities exploited, and the subsequent community and project response to recover lost assets and enhance security measures.
安全事件分析The Vanishing Act: How Exit Scammers Mint New Tokens UndetectedIn this post, we detail a certain type of rug pull wherein scammers apparently create tokens out of thin air before dumping them on unsuspecting investors.
安全事件分析OrdiZK Incident AnalysisOn the 5th March, CertiK confirmed OrdiZK orchestrated an exit scam that over a period of time stole approximately $1.4 million. In this incident the scammers used a verity of tactics to steal from investors including hoarding taxes from sales, dumping a large amount of tokens and abusing privileged roles to empty project contracts. This incident is the 6th exit scam of 2024 where losses have exceeded $1 million, contributing to the over $64 million lost to exit scams in 2024 so far. 
安全事件分析Crime Incorporated: CryptoGrab's UK Business RegistrationA cryptocurrency scamming group, CryptoGrab, has taken the bold step of registering as a private company in the UK. CryptoGrab offers various phishing services targeting cryptocurrency users, including the Nova Drainer and more traditional seed phrase phishing techniques. It is not uncommon for malicious actors to register fraudulent entities in the UK due to the relative ease in which companies can be registered. The group has stated in Telegram that this gives them access to platforms such as Binance and eToro. We have reported this organization to Action Fraud and Companies House in the UK. This blog aims to highlight the activities of this threat group and suggest ways to protect your assets.