Security News
Recent exploits and disclosures across EVM/DeFi. For deep breakdowns, see Security Research.
Initia L1 Halted After MoveVM Script-Cache Bug Enables $2.7M Bridge-Out
On October 23, 2026, a script-caching vulnerability in Initia's MoveVM allowed an attacker to forge bridged-asset balances (WETH, iUSD, USDC) and bridge out approximately $2.7M before Initia paused both its L1 and all rollups. The attacker moved 1,135.5 ETH just five seconds after the halt; no native INIT tokens were minted. A full post-mortem is pending.
X100 Global Loses $4.75M as Flash-Loan Attack Seizes Governance Senate
On October 24, 2026, an attacker flash-borrowed X100 governance tokens, atomically seized two of three Senate seats, and executed a malicious treasury proposal that drained approximately $4.75M in USDT. The X100 token price collapsed over 96%. BlockSec and Blockaid confirmed the incident; root cause is the absence of snapshot voting and a timelock.
NEAR Intents $3.8M Cross-Chain Exploit Recovered After 48-Hour Deadline
On October 1, 2026, an attacker drained ~$3.87M USDT from a BNB Chain vault serving NEAR Intents by exploiting a flaw at the handover between Omni's deposit/withdrawal infrastructure and the BNB Chain smart contract — accepted withdrawal messages matched the legitimate format but the authorization logic was bypassable. The team issued a 48-hour return deadline; funds were returned and the contract patched. Full root-cause post-mortem has not yet been published.
AlpsCon AI Trade Hub Loses $152K to Reward Checkpoint Bug and Stale EIP-7702 Whitelist
AlpsCon's BNB Chain reward hub was drained of ~$152K USDC on October 18, 2026 after an attacker combined a publicly known Hardhat private key (still whitelisted for 14 months) with a MasterChef-style rewardDebt initialization bug that credited migrated positions with all historical rewards. Verichains and DeFiHackLabs documented the proof-of-concept.
X100 Governance Exploit: Flash-Loaned Senate Seats Drain $4.85M USDT on Ethereum
On October 24, 2026, an attacker flash-loaned X tokens to seize two of three 'Senate' governance seats on X100 (Ethereum), then executed a treasury-drain proposal in a single atomic transaction for ~$4.75M USDT. Two follow-on attackers exploited the same path, pushing total losses to ~$4.85M. Root cause: no balance snapshot, no stake-age requirement, and no timelock on governance execution.
NEAR Intents $3.8M Exploit Resolved: Funds Returned, $300K Bug Bounty Paid
A smart contract flaw in NEAR Intents allowed an attacker to accumulate false credits via failed external calls (September 30–October 1, 2026), draining $3.8M. The suspected exploiter returned all funds within 36 hours; NEAR Intents closed its investigation October 4 and later paid a $300K bounty for a second related vulnerability discovered October 7.
SlowMist Warns of Malicious 'sol-live' GitHub Repo Targeting Solidity Developers' Wallets
SlowMist issued an alert about a GitHub repository posing as a Solidity interview project ('sol-live') that harvests browser login databases, wallet extension storage, and macOS Keychain files on execution. SlowMist identified eight similar projects using the same technique. While not a smart contract exploit, this supply-chain threat directly targets smart contract developers and auditors.
Initia Halts Network After ~$2.6M Exploit via Move Function Token Minting Bug
Initia suspended its network following a reported ~$2.6 million exploit in which a vulnerability in a Move function allowed unauthorized creation of unbacked tokens, which were subsequently swapped for ETH and USDC on Ethereum. The exact date and full technical details are unconfirmed; this is based on a single source and should be treated as preliminary.
Limit Break Payment Processor V2 Exploited for $2.8M via Stale NFT Approvals Across Five EVM Chains
An ERC-2771 trusted-forwarder flaw in Limit Break's immutable Payment Processor V2 allowed attackers to abuse stale NFT approvals granted in 2024, stealing ~$2.8M across Ethereum, Polygon, Base, Arbitrum, and ApeChain starting ~September 24. White-hat 0xQuit rescued ~23,155 NFTs (~$5.7M); Limit Break found the same forwarder bug in PP V3 and paused it.
Initia Network Halted After MoveVM Bug Enables $2.6M Unbacked Minting and Bridge Drain
On October 23, 2026, Initia suspended its L1 blockchain and all rollups after a Day 0 MoveVM bug allowed an attacker to mint ~2M unbacked AUSD tokens and bridge ~$2.6M to Ethereum via LayerZero. The network halt at 15:41 UTC, ~42 minutes after the initial exploit tx, limited further losses; investigation and recovery timeline are pending.
WAX Multi-Chain Bridge Exploited for ~$75K–$90.5K via Input Validation Bug in Withdraw Function
On October 22, 2026, an attacker exploited a missing input validation flaw in the WAX Multi-Chain Bridge's eth.token::withdraw function. The WAX side incorrectly validated fee parameters and reported false withdrawal data to the Solana and Ethereum bridge components, resulting in payouts of ~52,986.50 USDC via Solana and a corresponding ETH release. DefiLlama classifies the loss at $90,500.
Arkadiko Governance Attack Drains ~2M stSTX + 1.65 sBTC, Depegs USDA on Stacks
On October 22, 2026, a malicious governance proposal was passed and executed on Arkadiko, a CDP protocol on the Stacks Bitcoin L2, draining ~2 million stSTX and ~1.65 sBTC from vaults. The USDA stablecoin lost its dollar peg and TVL fell approximately 90%. The specific governance bypass mechanism is unconfirmed; the team disclosed the attack on X at ~20:29 UTC.
Balancer V1 joinswapPoolAmountOut Rounding Bug Drains $234K; Immutable Forks Still Exposed
On August 31, 2026, an attacker exploited a down-rounding flaw in Balancer V1's joinswapPoolAmountOut to mint 4,408.8 BPT for a single satoshi of WBTC, draining ~$234,000. The attack was financed by $1B+ in flash loans from Aave, Spark, Morpho, and Uniswap V3. Because V1 is immutable, any AMM fork that copied the join math remains unpatched.
Drift Protocol Exploiter Moves $122.3M into Tornado Cash in 520 Transfers
The wallet linked to the April 2026 Drift Protocol hack ($285M, attributed to Lazarus Group) deposited $122.3M in ETH into Tornado Cash on Oct 20–21 across 520 transactions — reportedly the largest Tornado Cash deposit by any single exploiter in two years. The laundering of the remaining ~$163M is ongoing.
Blockaid Analysis: $1B Flash Loan in September Balancer V1 Exploit Exposed DeFi Compliance Blind Spots
A Blockaid report published Oct 22 detailed how a Sept 6 attacker borrowed over $1 billion via Aave V3 flash loans, used the capital to manipulate Balancer V1 pools, and extracted ~$250K — all while compliance tools monitoring static account balances missed the attack. Blockaid flagged the attacker address hours before execution via Tornado Cash funding traces.
AlpsCon AI Trade Hub Drained $152K on BNB Chain via EIP-7702 Whitelist Abuse
An attacker used EIP-7702 account delegation to co-opt a publicly-known Hardhat test key left on AlpsCon's KYC whitelist, then over-claimed historical rewards via a zero-initialised share accounting bug. Total loss ~$152,809 USDC. DeFiHackLabs published a Foundry PoC (PR #1306).
Swell swETH/rswETH Oracle Keys Compromised — 2,513 ETH at Risk, Four Malicious Upgrade Contracts Deployed
Swell's oracle bot private keys appear compromised as of Oct 21; exchange rates are being inflated at the protocol's maximum cap (~1%/hr) with no backing ETH. Four upgrade contracts capable of draining ~2,513 ETH have been deployed but not yet queued. Swell confirms no ETH has been moved and the protocol is operational.
FundsModule Contract Loses ~$41K Due to Missing Asset Verification
A smart contract flaw in FundsModule allowed an attacker to withdraw funds without proper asset verification, resulting in an approximately $41,000 loss reported around October 22, 2026. Details remain sparse; no chain or protocol attribution has been confirmed.
Blockaid: $1B Flash Loan in Balancer V1 Attack Exposes DeFi Compliance Monitoring Gaps
Blockaid published analysis on October 22–23, 2026 of a September 6 Balancer V1 exploit in which an attacker moved over $1 billion in flash-loan capital to drain ~$250K from legacy V1 pools — a pattern invisible to compliance tools that only snapshot balances at block close. The underlying precision flaw in `joinswapPoolAmountOut` / `calcSingleInGivenPoolOut` also produced a separate $234K drain on August 31 via nested flash loans that drove WBTC reserves to dust, minting 4,408.8 BPT for a single satoshi.
NemTokenV2 Skim-and-Burn Loop Drains $822K from PancakeSwap BNB Pool
An attacker exploited a sell-tracking flaw in the NemTokenV2 contract on BNB Chain, executing a 42-iteration deposit-skim cycle that drained approximately $821,920 from a PancakeSwap USDT/NEM pool. The contract mistakenly treated direct token transfers to the pair address as sales, triggering skim logic without an actual swap. Funds were subsequently bridged to Ethereum.
Railway Hosting Breach Linked to $371K in Crypto Wallet Drains
On October 21, 2026, Railway.app reported a potential breach of customer environment variables. Security researcher Taylor Monahan linked ~$371K in crypto wallet drains to API keys and private keys stored as Railway env vars, across 500+ transactions from 200+ addresses on 19 blockchains. Railway has not officially confirmed the link to the crypto losses.
UNCX Vesting V2 Exploited for $807K–$1.49M Across Four EVM Chains
On October 14, 2026, a stale share-counter accounting flaw in UNCX Network's Smart Token Vesting V2 contracts allowed an attacker to manipulate pool share prices and drain approximately $807K–$1.49M across BNB Chain and three other EVM networks. No admin privileges were required; copycat wallets and MEV bots amplified the initial drain.
SlowMist Warns Crypto Platforms: Critical PHP2Shell Flaws (CVSS 9.2) Actively Exploited
SlowMist issued an October 21 advisory urging DeFi protocols and crypto exchanges to patch two PHP vulnerabilities rated 9.2 CVSS. PHP released fixes in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35; Cloudflare confirmed millions of exploit attempts already in the wild. No confirmed DeFi smart-contract losses attributable to these CVEs were reported at time of writing.
More Markets on Flow EVM Loses $9.3M via Ankr LST + E-Mode Overborrow
More Markets, an Aave V3 fork on Flow EVM, was drained of 15.5M WFLOW (~$9.3M) after an attacker used ankrFLOW as overvalued collateral in an E-Mode category that assumed price correlation with WFLOW. Neither the Flow blockchain nor Ankr's core protocol was compromised.
UNCX Vesting V2: $1.49M Drained via Stale Share Counter on Four EVM Chains
A share-accounting inconsistency in UNCX Network's Vesting V2 contracts — where release() reduced the global share counter without zeroing the position's deposit record — let attackers, copycats, and MEV bots drain roughly $1.49M. BNB Smart Chain bore the largest share (~$969K). UNCX confirmed LP-locking and legacy V1 vesting remain unaffected.
Drift Protocol Hacker Moves $109M ETH to Tornado Cash Over Two Days
Wallets linked to the April 2026 Drift Protocol exploit — attributed to North Korean threat group UNC6862 (Lazarus-linked) by Mandiant — deposited roughly 44,510 ETH (~$109M) into Tornado Cash on October 20–21, 2026. An estimated $138–195M of the original ~$295M haul remains unrecovered; law enforcement has frozen only ~$9.2M to date.
Qubic Wallet Theft: ~$1.3M Drained via Math.random() Seed Weakness, SlowMist Analysis Finds
SlowMist published an analysis on October 20, 2026, confirming that roughly $1.3 million was drained from 1,404 Qubic wallets due to weak entropy — the web wallet used Math.random() for private-key seed generation, which is predictable and not cryptographically secure. Affected environments include Safari on Mac (before Oct 18, 2026) and the Qubic iOS app (before July 2025). SlowMist demonstrated private-key recovery from just six consecutive network header values.
SlowMist Flags Critical PHP Vulnerabilities (CVSS 9.2) Affecting Crypto Infrastructure
On October 21, 2026, SlowMist issued an advisory urging DeFi services and wallet providers using PHP-based systems to prepare for two critical remote-code-execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) ahead of the PHP security team's scheduled patch release at 14:00 UTC. Active exploitation has not been confirmed, but SlowMist warns that PHP-based crypto systems (APIs, admin panels, backend services) could be at risk if patches are not applied promptly.
Slice Protocol FundsModule Drained for $41K on Base via Fake Payout Contracts
An attacker exploited Slice Protocol's FundsModule contract on Base on October 21, 2026, by supplying attacker-controlled contracts whose reported payout amounts were trusted without verifying receipt of funds, draining approximately $41,000 in ETH and USDC. The exploit was flagged by TenArmor and confirmed by SlowMist. The vulnerable function (selector 0x9d2edfac) performed no authentication or balance-delta check before releasing pooled reserves.
Qubic $1.3M–$1.4M Weak Randomness: 1,404 Wallets Drained via Predictable Seed Generation (Oct 17)
On October 17, 2026, attackers exploited weak randomness in Qubic wallet seed generation to drain approximately $1.3M–$1.4M from 1,404 wallets. The Qubic network was halted, most funds frozen, and seed generation fixed in version 4.26.4. Note: Qubic is not EVM-based; the pattern (CSPRNG failure in wallet software) is relevant for EVM wallet developers.
Drift Protocol Exploiter Launders $61.5M in ETH via Tornado Cash, $194M Still Held
On October 20–21, 2026, wallets attributed to the April 2026 Drift Protocol exploiter deposited 25,700 ETH (~$61.5M) into Tornado Cash in fixed 100-ETH chunks over approximately two hours, the first major movement in two months. The attacker still controls approximately 81,454 ETH (~$194M) from the original $285M DPRK-linked heist. Recovery prospects are diminishing as laundering accelerates.
Term Labs Suffers ~$8.5M Governance Exploit on Fixed-Rate Lending Vaults
Term Labs, a fixed-rate DeFi lending protocol, lost approximately $8.5M in a governance exploit targeting its Term vaults, per PeckShield. The incident highlights risks inherent in under-timelocked or insufficiently guarded governance mechanisms in lending protocols.
Drift Protocol Exploiter Begins Moving $61M ETH Through Tornado Cash
The attacker behind the April 2026 Drift Protocol hack has started laundering approximately $61M worth of Ethereum through Tornado Cash, raising concerns about recovery prospects. The original Drift incident was attributed to targeted social engineering rather than a smart contract vulnerability.
Symbiosis Bitcoin Bridge: 46B Fake syBTC Minted from $0.25 Deposit, ~$770K Drained
On September 11, 2026, a fee-verification flaw in Symbiosis's BridgeV2 contract on BNB Chain enabled minting of 46.1 billion unbacked syBTC from a 330-satoshi deposit. The attacker liquidated ~$770K across BNB Chain, Ethereum, and Rootstock in under four minutes; Symbiosis took the bridge offline and recovered 15 BTC.
Balancer Governance Votes 99.2% to Shut Down Protocol Pools October 30 Following $128M Exploit
Balancer token holders voted 99.2% in favour of moving all pools to withdrawals-only mode starting October 30, 2026, roughly eleven months after a $128M precision-rounding exploit drained funds across six networks. BAL redemptions will open in May 2027 at an estimated $0.158 per token. The vote closes the book on an extended wind-down of Balancer Labs that began in March 2026 after the corporate entity closed citing legal exposure and revenue loss.
Drift Protocol Exploiter Moves $61.56M ETH to Tornado Cash After Two Months Dormant
On October 20, 2026, a wallet cluster linked to the April 1 Drift Protocol hack ($285M, attributed to a North Korean threat group via Mandiant) deposited 25,700 ETH (~$61.56M) into Tornado Cash after roughly two months of inactivity. The linked addresses still hold approximately $194M in stolen assets. The original attack was a social-engineering campaign, not a smart-contract exploit, but the laundering event is a live on-chain indicator for threat-intelligence monitoring.
Cysic Bridge Unauthorized Mint: 10M CYS Tokens Created on BSC Without Backing
On October 17, 2026, an attacker exploited the Cysic cross-chain bridge to mint 10 million CYS tokens on BNB Smart Chain with no corresponding collateral. The Cysic Foundation blacklisted the recipient address approximately 76 minutes later, but by then roughly 7.2 million tokens had already been moved. The bridge remains paused pending investigation.
79thVault's BNB Chain Pool Drained of $12.5M via Admin Privilege Abuse; 92% Returned
An admin-privileged function on 79thVault's BNB Chain contract was used on October 7 to remove 2.01M 79AU tokens from its PancakeSwap V2 pool, generating 16,249 BNB (~$12.5M). GoPlus Security investigated whether the event was a private-key compromise or insider action. After the project offered a 10% bounty and the attacker countered demanding 25%, 15,000 BNB was returned on October 9.
EIP-7702 Delegation Drainers Accumulate $1.54M in October as EOA Code-Injection Pattern Spreads
Security researchers documented multiple EIP-7702 delegation phishing incidents in October 2026, including a $22.7K individual loss (sven.eth, October 14) and an estimated $1.54M cumulative loss across the month attributed to a single sweeper contract pattern. Attackers trick users into signing EIP-7702 authorization messages that set malicious delegation code on their EOAs, enabling a single follow-up transaction to drain all assets. Wintermute noted over 80% of EIP-7702 delegations in the wild are sweeper contracts.
Pirate Chain ARRR Supply Inflated 20% via Ironwood Upgrade Transaction Validation Flaw
On October 14, 2026, an attacker exploited a transaction validation vulnerability introduced by the Ironwood upgrade (activated October 3) to mint approximately 39.8 million ARRR, inflating supply by roughly 20%. The minted coins were immediately transferred to Pirate Chain's Sapling shielded pool, making tracing difficult. A proposed rollback was dropped; a hard fork is under discussion. This is a UTXO/Zcash-based chain, not an EVM exploit, but its unbacked-mint mechanism is relevant to cross-chain auditors.
Cysic Bridge Suspended After Attacker Mints 10M CYS, Moves $727K to Ethereum
On October 17, 2026, an attacker gained unauthorized access to Cysic's bridge backend database and exploited a message-processing flaw to mint 10 million CYS on BNB Chain. The attacker sold 7.2M tokens before a blacklist froze the remainder 76 minutes later; approximately $727,000 in ETH was bridged to Ethereum. Cysic stated existing user assets were not stolen and the mainnet was unaffected.
Summer.fi Lazy Summer Vaults Exploited for $6M via Flash-Loan Share-Price Manipulation
On July 6 an attacker used a $65.4M flash loan to manipulate the totalAssets() accounting of Summer.fi's FleetCommander vaults, exploiting paused-but-not-removed Silo Varlamore strategy adapters that still contributed to share-price calculations. The attacker redeemed $70.9M after depositing $64.8M, netting ~$6.04M; funds were laundered through Tornado Cash. Summer.fi subsequently paused all Lazy Summer vaults and announced a protocol wind-down.
Notional Finance V1 Drained for $1.73M via uint128 Integer Overflow Bypassing Collateral Check
A dormant Notional Finance V1 escrow on Ethereum lost $1.73M after an attacker exploited a silent uint128 cast overflow in Solidity 0.6.x to make massive debt appear as zero. SlowMist and CoinMonks published detailed technical analyses; the team paused V1 and V2 was unaffected.
NEAR Intents Post-Mortem Published: $3.8M Deposit-Notification Bug Blamed for Oct 1 Cross-Chain Drain
NEAR Intents released its official post-mortem on Oct 16-17, tracing a $3.8M exploit to a check-effects-interactions violation in its deposit handler. The attacker used a contract that caused deposit notifications to fail, triggering token refunds while ledger credits remained — repeating the pattern 23 times. All funds were recovered; a second related bug found Oct 7 earned a $300K bounty.
Tether Temporarily Freezes $1.45M in THORChain USDT Vaults on October 17
Tether blacklisted four THORChain vault addresses on October 17, 2026, freezing approximately $1.45M in USDT, then lifted the freeze roughly three hours later without providing an explanation to the protocol. No exploit has been confirmed; the action may reflect compliance enforcement against laundering of funds from prior exploits routed through THORChain.
Pirate Chain ARRR: Transaction Validation Flaw Inflates Supply by 20%, Rollback Plan Dropped
A transaction validation vulnerability in Pirate Chain's source code (discovered October 14) allowed the unauthorized creation of ~39.8M ARRR tokens, increasing supply by ~20%. The minted tokens were transferred to shielded Sapling pools, making tracing impossible. A rollback was initially proposed but later abandoned given the chain's decentralized structure; dPoW notarizations have been suspended pending a recovery plan.
Autheo THEO Token Loses 92% After $1.76M Hyperlane Bridge Exploit on Base
An attacker minted approximately 19M unbacked THEO tokens on Base by forging a Hyperlane cross-chain message using a compromised trusted relayer key, then swapped them for ~700 ETH. Autheo acknowledged the incident on October 12 but has not confirmed the root cause; whether the flaw is in Autheo's own deployment or the shared Hyperlane stack (also used by Robinhood Chain) remains unresolved.
NEAR Intents Postmortem: Deposit Notification Bug Created $3.87M in Ghost Funds; All Recovered
NEAR Intents published its October 16 postmortem attributing a $3.87M exploit to a smart contract deposit notification bug that allowed an attacker to accumulate unbacked ledger credits while receiving refunds on BNB Chain. The attacker returned all funds within 36 hours of a public ultimatum. A second critical vulnerability in the same function was separately patched on October 7.
Papertrade Faces Oracle Manipulation Allegations After $1.28M BBO-Gaming Incident on HyperEVM
A trader reportedly netted ~$1.28M on Papertrade, a 1000x synthetic-perps venue on HyperEVM, by making large ETH trades on Hyperliquid to shift its best-bid-offer (BBO) midpoint — which Papertrade uses as its settlement oracle. The incident highlights risks of using a live orderbook's BBO as an on-chain price feed for a leveraged derivatives protocol. Papertrade has since tightened open-interest caps.
MakerDAO ETH-A Keeper Proxy Drained of 200 WETH via Unguarded Function — 6-Year Dormant Bug
A keeper proxy contract that won MakerDAO collateral auctions in March 2020 but never settled them had a drain() function with no ds-auth protection. An attacker called it directly, extracting 200 WETH (~$538K) and laundering proceeds via Tornado Cash.
Pirate Chain Rolls Back Blockchain After Ironwood Turnstile Exploit; No USD Loss Confirmed
Pirate Chain (ARRR) rolled back its blockchain to the October 14, 2026 state after developers identified an exploit in the Ironwood upgrade's transparent accounting layer (turnstile). The flaw may have enabled unbacked minting or corrupted supply records. Exchanges suspended ARRR deposits and withdrawals; loss amount has not been confirmed. This is a Zcash-derived chain, not EVM.
NEAR Intents Postmortem Published: Failed-Deposit Ledger Bug Behind $3.87M Drain
NEAR Intents published a full postmortem on October 17 tracing the $3.87M September 29–October 1 exploit to a smart-contract deposit-tracking bug where failed cross-chain deposits generated phantom ledger credits. All funds were recovered after a 48-hour public ultimatum. The protocol has since added automatic pausing for any custody/ledger imbalance.
Base DeFi Vault Loses ~$6M in Whitelist Access Control Failure
An attacker exploited an access-control flaw in a Base-chain DeFi vault on October 4, getting added to the contract's lending whitelist — and then removed and re-added within one minute — before draining approximately $6M in wrapped staked ETH within 19 minutes. The exploit was flagged by Blockaid at 09:21 UTC when $2.02M had already been taken; roughly $31.7M remained in the vault.
Autheo THEO Token Loses 92% After Hyperlane Trusted Relayer Key Compromise Enables Unauthorized Minting
On October 13, 2026, an attacker exploited Autheo's Hyperlane bridge deployment on Base by compromising a trusted relayer key, minting approximately 19 million unbacked THEO tokens and swapping them for ~700.8 ETH ($1.76M). The token crashed 92% and MEXC halted transfers as Autheo launched an investigation with no official root cause disclosed.
Gamdom Crypto Casino Loses $4.2M Across Multiple Chains in Hot Wallet Breach
On October 13, 2026, Gamdom's hot wallets were breached via unauthorized access to an automation server, resulting in ~$4.2M stolen across Ethereum, BSC, Polygon, Arbitrum, Optimism, Solana, TRON, and Bitcoin. Approximately $2.2M was taken from EVM chains; stolen funds were converted to DAI and bridged across networks. The platform moved remaining funds to cold storage.
Demex Announces Permanent Shutdown Following September 2026 Bridge Exploit
Decentralized derivatives exchange Demex announced its permanent shutdown approximately one day ago, following a September 25, 2026 bridge exploit that drained ~$191,929 via registry manipulation (chain halted 52 minutes later, protecting ~$976K). Demex plans to launch a withdrawal page by end of October for users to review final balances.
FlashLoopAdapter Access Control Flaw Drains 114 ETH (~$305K) from Two Safe Multisigs
A third-party Aave V3 loop module (FlashLoopAdapter) was exploited on October 1–2 via a missing caller validation in its `open()` and `close()` functions. The attacker used a fake Safe that returned `true` for module-enabled checks, bypassed Safe authorization, and used a Morpho WETH flash loan to drain collateral from two victim Safe wallets. Aave V3 core was unaffected.
NEAR Intents Postmortem (Oct 16): Deposit Callback Bug Confirmed as Root Cause of $3.8M Exploit
NEAR Intents published its postmortem on October 16, confirming the September 29–October 1 exploit stemmed from an asymmetric refund-vs-credit bug in its settlement contract — not the Omni bridge as initially reported. The attacker returned all funds within 36 hours; a second bug in the same function was independently reported and patched on October 7 with a $300K bounty.
MakerDAO Legacy 2020 Auction Keeper Exploited for 200 ETH (~$543K)
On October 6, an attacker exploited a missing access-control function (0x8804d1de) in a MakerDAO liquidation keeper contract left over from the March 2020 Black Thursday crash. The attacker claimed four unsettled 50-ETH auction lots and laundered proceeds through Tornado Cash in 10-ETH batches within six minutes. CertiK noted other outdated contracts may still hold unclaimed funds.
FlashLoopAdapter Safe Module Drained 114 ETH via Spoofed isModuleEnabled Access Check
A third-party Aave v3 loop strategy Safe module (FlashLoopAdapter) was exploited on October 1, 2026 when its access-control guard could be passed by a fake Safe contract always returning true for isModuleEnabled. 114.09 ETH (~$305K) was taken from two leveraged-loop positions; Aave v3 core was unaffected.