博客
研究报告
深入的安全报告、事件分析和行业研究，涵盖 Web3 安全现状。
安全事件分析Post Mortem: DefiLabsOn July 27th, 2023, DefiLabs was rug-pulled by a privileged function in the `vPoolv6` contract, which is not audited by Certik.
Dirty Laundry: The Bitcoin Network's Growing Role in the Laundering of Stolen CryptoIn 2023, a discernible shift in crypto laundering methods has emerged. Our analysis reveals a marked increase in the bridging of stolen funds to the Bitcoin blockchain.
安全事件分析Time Token ExploitOn 7 December TIME token was exploited leading to a loss of 89.5 ETH. The exploiter was able to burn a majority of TIME tokens via the vulnerable Forwarder contract entrusted to execute a transaction from an arbitrary sender address.
行业研究How AI is Transforming KYC for Crypto Project TeamsIn the often-anonymous world of crypto, effective Know Your Customer (KYC) tools are essential to validate the integrity and legitimacy of crypto project teams. Artificial Intelligence (AI) has become a crucial part of this process. It's used by KYC investigators to confirm identities and by teams to understand and manage their own risks.
行业研究The Rise of Stablecoins in Unstable TimesIn addition to mitigating the price volatility inherent in the cryptocurrency market, stablecoins serve what is to millions of people an even more important purpose: acting as a financial refuge during periods of economic and political instability.
安全事件分析KyberSwap Elastic On Nov 22nd (+UTC) 2023, KyberNetwork suffered multiple flashloan exploits across several chains resulting in a loss of ~$47M worth of assets.
安全事件分析Heco Bridge ExploitOn 22 November, another major private key compromise affected the Heco Bridge and HTX hot wallets amounting to \$116 million in losses. A malicious actor compromised several wallets belonging to HTX as well as the Heco bridge operator wallet, allowing them to withdraw withdraw assets on Ethereum and TRON. We have also identified a suspicious movement of Bitcoin. This brings the total lost to private key compromises this year to over \$800 million, representing 56% of all funds lost in 2023. This incident is also the fifth largest incident in 2023 and is the largest bridge attack this year.
安全事件分析Kronos Research Incident AnalysisOn 18 November 2023, Kronos Research announced, via social media platform X, that unauthorized access to their API resulted in a loss of approximately \$26 million. The incident isn’t a typical private key compromise which often refers to the private key of a victims wallet, but instead was due to a API private key compromise. Whilst there are differences between the two, this incident resulted in the victim losing control of their funds. Since the API keys belonging to Kronos Research were compromised, we are classifying this incident as a private key compromise, which have seen \$134 million lost in November alone.
安全事件分析Poloniex Incident AnalysisOn 10th November, Poloniex wallets on Ethereum, Tron and BTC were compromised leading to an overall loss of approximately $132 million. In total, the stolen funds have passed through at least 681 wallets as assets are being laundered. This is the second largest private key compromise that CertiK has detected in 2023. Just 40 incidents involving private key compromises have accounted for 57% of the overall losses in 2023, demonstrating how devastating private key compromises can be. 
October Stats GraphThe October Stats Graphic shows data from hacks, scams, and incidents in October 2023
安全事件分析Maestro & UnibotIn late October two of the most popular Telegram trading bots were exploited, leading to a total loss of $1.1 million. The two exploits happened within a week of each other starting with the Maestro incident on 24 October, followed by the Unibot incident on 31 October. 
安全事件分析Safereum Exit ScamOn 23 October 2023, the price of Safereum dropped approximately 92% due to an externally owned address (EOA) holding the ENS safereum.eth unlocking Safereum tokens held in a PinkLock contract which they then sold. Additionally, funds raised in the project’s SAFEPAD fairnlaunch were also transferred to safereum.eth after its conclusion resulting in approximately $1.3 million in ETH lost.