博客
研究报告
深入的安全报告、事件分析和行业研究，涵盖 Web3 安全现状。
安全事件分析Kronos Research Incident AnalysisOn 18 November 2023, Kronos Research announced, via social media platform X, that unauthorized access to their API resulted in a loss of approximately \$26 million. The incident isn’t a typical private key compromise which often refers to the private key of a victims wallet, but instead was due to a API private key compromise. Whilst there are differences between the two, this incident resulted in the victim losing control of their funds. Since the API keys belonging to Kronos Research were compromised, we are classifying this incident as a private key compromise, which have seen \$134 million lost in November alone.
安全事件分析Poloniex Incident AnalysisOn 10th November, Poloniex wallets on Ethereum, Tron and BTC were compromised leading to an overall loss of approximately $132 million. In total, the stolen funds have passed through at least 681 wallets as assets are being laundered. This is the second largest private key compromise that CertiK has detected in 2023. Just 40 incidents involving private key compromises have accounted for 57% of the overall losses in 2023, demonstrating how devastating private key compromises can be. 
安全事件分析Maestro & UnibotIn late October two of the most popular Telegram trading bots were exploited, leading to a total loss of $1.1 million. The two exploits happened within a week of each other starting with the Maestro incident on 24 October, followed by the Unibot incident on 31 October. 
安全事件分析Safereum Exit ScamOn 23 October 2023, the price of Safereum dropped approximately 92% due to an externally owned address (EOA) holding the ENS safereum.eth unlocking Safereum tokens held in a PinkLock contract which they then sold. Additionally, funds raised in the project’s SAFEPAD fairnlaunch were also transferred to safereum.eth after its conclusion resulting in approximately $1.3 million in ETH lost.
安全事件分析FinSoul: The Fintoch Fraud ContinuesOn October 10, 2023, FinSoul ($FSL) dropped approximately 99% in value. This investigative report exposes the complex web of deception that the professional scammers behind this project (and others) have spun.
安全事件分析HopeLend Incident AnalysisOn October 18, 2023, the lending pool of Hope.money was exploited by an attacker who leveraged a flash loan. 
安全事件分析Fantom Foundation & Employee Wallet DrainOn October 17, several unauthorized transfers occurred from multiple wallets Labelled ‘Fantom: Foundation Wallet’ as well as some unlabelled but connect wallets. Losses amounted to approximately \$7 million with Fantom stating \$550k was related to the Foundation with the rest relating to the personal funds of an employee.
安全事件分析Platypus DeFi Incident AnalysisOn 12 October 2023, DeFi project Platypus Finance was exploited across three flash loan transactions, by two externally owned addresses (EOAs), for approximately \$2.23 million. The exploit was due to price manipulation of the Platypus WAVAX and sAVAX pools. Platypus were able to recover \$575k after a mistake by an exploiter.
安全事件分析Stars Arena Incident AnalysisOn 7 October, 2023 SocialFi project Stars Arena was exploited via a reentrancy vulnerability for 266,103 AVAX, approximately \$2.88 million. The incident was the largest reentrancy exploit to occur on the Avalanche chain in 2023. Stars Arena was also exploited two days prior on 5 October for roughly \$2k by the same exploiter. This earlier incident likely drew increased scrutiny over the Stars Arena contract.
安全事件分析Lucky Star Currency Exit ScamOn 9 October, the price of LSC token dropped by 99% due to a token dump carried out by externally owned address 0x9Ef72 which withdrew LSC tokens from two contracts owned by the Lucky Star Currency project. The tokens were then swapped for approximately $1.1 million making it the largest exit scam seen in October so far. 
安全事件分析Mark Cuban's Private Key CompromiseOn 15 September, a publicly doxed Mark Cuban wallet was drained in a private key compromise leading to the loss of multiple ERC-20 tokens and ETH. 
安全事件分析ZKasino Security Update Post MortemOn September 16, 2023, the ZKasino team released a security update. The security update claimed a potential weak point was identified by a white-hat hacker named 'bart1e' in their smart contracts. In response to questions and concerns from the community, this article will analyze this issue and identify the root cause.