博客
研究报告
深入的安全报告、事件分析和行业研究，涵盖 Web3 安全现状。
安全事件分析Hedgey Finance Incident AnalysisOn 19 April 2024, Hedgey Finance was exploited for approximately $2 million on Ethereum in addition to a number of BONUS tokens on Arbitrum. The attacker took advantage of an oversight in the project’s ClaimCampaigns contract in which token approvals were not revoked, meaning anyone who used the createLockedCampaign() function could transfer tokens from the contract to themselves.
BNB Chain Q1 2024 Security ReportIn Q1 2024, BNB Chain witnessed a loss of $14,446,914 across 43 incidents, leading to an average loss of $335,974 per incident and a median loss of $151,476.
行业研究What is FinCEN and Why Does It Matter?The Financial Crimes Enforcement Network (FinCEN) is a bureau of the United States Department of the Treasury, established to guard against and investigate money laundering, terrorism financing, and other financial crimes. 
行业研究Crypto’s Top Three Compliance Risks and How To Mitigate ThemSkyInsights is the most streamlined, resource-efficient platform for maintaining crypto compliance. By addressing the critical pain points of illicit on-chain activities, sanctions exposure, and the maze of global crypto regulations, SkyInsights gives builders the tools they need to stay firmly on the right side of the law.
安全事件分析Prisma Finance Incident AnalysisOn 28 March, Prisma Finance was exploited by multiple addresses leading to a loss of approximately $12.3 million. Three attackers took advantage of a vulnerability in the Prisma Finance MigrateTroveZap contract which allowed them to manipulate a migration process. Since the exploit occurred, a wallet that received funds from the main exploiter has reached out to the Prisma Finance deployer declaring that their actions were a white hat rescue. 
安全事件分析Risk On Blast Incident AnalysisOn 24 February, GambleFi project RiskOnBlast is thought to have become the first confirmed exit scam to occur on the Blast ecosystem, a layer-2 project on Ethereum.
安全事件分析Blast Chain's $97 Million Battle: Are North Korean Hackers Rusty?A detailed post-mortem analysis of the Munchables incident on the Blast mainnet, focusing on the methods used by attackers, the vulnerabilities exploited, and the subsequent community and project response to recover lost assets and enhance security measures.
行业研究March's Major Private Key Compromises
From 12 March to 16 March we have seen nine private key compromises (PKC) that have led to a combined loss of at least $22.96 million in March, with five of those incidents incurring losses over $1 million. These incidents showcase the continued devastation that private key leakages can have on the Web3 ecosystem which has already seen approximately $239 million lost to this type of attack in 2024.
安全事件分析The Vanishing Act: How Exit Scammers Mint New Tokens UndetectedIn this post, we detail a certain type of rug pull wherein scammers apparently create tokens out of thin air before dumping them on unsuspecting investors.
行业研究Stablecoin Regulations in Europe and Singapore: Single Fiat Currency Pegged StablecoinsThe last year has seen an unprecedented number of institutions turning their attention to onchain opportunities, and there are many financial organizations eager to offer a variety of Web3 products and services to these investors. However, an omnipresent hurdle is the lack of unified global regulation of crypto-assets.
安全事件分析OrdiZK Incident AnalysisOn the 5th March, CertiK confirmed OrdiZK orchestrated an exit scam that over a period of time stole approximately $1.4 million. In this incident the scammers used a verity of tactics to steal from investors including hoarding taxes from sales, dumping a large amount of tokens and abusing privileged roles to empty project contracts. This incident is the 6th exit scam of 2024 where losses have exceeded $1 million, contributing to the over $64 million lost to exit scams in 2024 so far. 
安全事件分析Crime Incorporated: CryptoGrab's UK Business RegistrationA cryptocurrency scamming group, CryptoGrab, has taken the bold step of registering as a private company in the UK. CryptoGrab offers various phishing services targeting cryptocurrency users, including the Nova Drainer and more traditional seed phrase phishing techniques. It is not uncommon for malicious actors to register fraudulent entities in the UK due to the relative ease in which companies can be registered. The group has stated in Telegram that this gives them access to platforms such as Binance and eToro. We have reported this organization to Action Fraud and Companies House in the UK. This blog aims to highlight the activities of this threat group and suggest ways to protect your assets.