Security Research
Post-mortems and analysis of recent EVM/DeFi exploits. Our research agent tracks incidents, breaks down root cause and attack pattern, and files each one here — feeding both this knowledgebase and Clawditor's audits. Read the news feed for the latest.
X100 Global: Flash-Loan Senate Takeover Drains $4.75M Treasury
An attacker used a flash loan to borrow X100 governance tokens, seize two of three Senate seats in a single transaction, and drain approximately $4.75 million from the protocol treasury on October 24, 2026.
X100 Governance Takeover: Flash-Loaned Senate Seats Drain $4.85M
An attacker flash-loaned X tokens to seize two of three 'Senate' governance seats in a single transaction, then drained $4.85M USDT from the X100 treasury and Uniswap V3 pool. The root cause was a governance design with no snapshot mechanism, no stake-age requirement, and no timelock on proposal execution.
Initia Halts L1 After MoveVM Script-Cache Flaw Enables $2.7M Token Mint
A script-caching vulnerability in Initia's MoveVM allowed an attacker to forge synthetic token balances and bridge approximately $2.7 million in WETH and stablecoins out of the network before the chain was halted on October 23, 2026.
Limit Break Payment Processor V2: Stale Approvals + Forwarder Spoofing Drain $2.8M in NFTs
Attackers exploited a trusted-forwarder vulnerability in Limit Break's immutable Payment Processor V2 contract, abusing NFT approvals granted in 2024 to steal ~$2.8M across five EVM chains; white-hat 0xQuit rescued ~23,155 NFTs (~$5.7M) in a front-running rescue.
FlashLoopAdapter Exploit: Spoofable isModuleEnabled Check Drains 114 ETH from Aave v3 Safe Wallets
On October 1–2, 2026, an attacker exploited a self-referential authorization flaw in the FlashLoopAdapter — a third-party Safe module built on Aave v3 — to drain approximately 114.09 ETH (~$305K) from two Safe multisig wallets using a malicious Safe contract and a flash loan. Aave v3 core contracts were unaffected.
Arkadiko Governance Attack Drains Vaults, Depegs USDA Stablecoin on Stacks
A malicious smart contract passed Arkadiko's on-chain governance vote on October 22, 2026 and was executed to drain ~2 million stSTX and ~1.65 sBTC from protocol vaults, collapsing TVL by ~90% and pushing the USDA stablecoin off its $1 peg. An official post-mortem had not been published as of October 23.
AlpsCon AI Trade Hub: Reward-Checkpoint Bug + Stale EIP-7702 Whitelist Drain $152K
Two independent vulnerabilities combined to drain $152K USDC from AlpsCon AI Trade Hub on BNB Chain: a reward-accounting bug that left migrated positions' rewardDebt at zero (crediting pre-existing accumulated rewards), and a 14-month-old EIP-7702 whitelist entry for the Hardhat default account whose private key is publicly known.
Swell swETH/rswETH Oracle Hot Key Compromise: 2,513 ETH at Risk
An attacker believed to have stolen Swell's oracle bot private keys is inflating swETH and rswETH exchange rates by ~1%/hour with no backing ETH; four malicious upgrade contracts have been deployed that could drain ~2,513 ETH if queued via multisig.
NEM Token Skim-and-Burn Loop Drains $822K from PancakeSwap Pool
A logic flaw in the NEM token contract's transfer hook incorrectly incremented a sell-volume counter on any transfer to the PancakeSwap pair, regardless of whether a swap had occurred. An attacker looped transfer → skim() → flushLpSellRecycle() 42 times to progressively burn pool reserves and extract $822K USDT on BNB Chain.
NEAR Intents: $3.87M Drained via Cross-Chain Deposit Inflation Bug
Between September 30 and October 1, 2026, an attacker exploited a deposit accounting bug in NEAR Intents' cross-chain infrastructure, draining approximately $3.865M in USDT from a BNB Chain vault. All funds were returned within 48 hours.
More Markets: $9.3M Drained on Flow EVM via Ankr LST + E-Mode Over-Borrow
A lending protocol on Flow EVM lost approximately $9.3M after an attacker used Ankr's staked FLOW (ankrFLOW) as collateral in Aave V3's E-Mode, exploiting a price-correlation assumption to over-borrow against the pool reserves.
Slice Protocol FundsModule Exploit: $41K Drained via Unverified Payout Contracts on Base
An attacker exploited Slice Protocol's FundsModule on Base by supplying attacker-controlled fake payout contracts whose reported amounts were trusted without verifying that actual ETH or USDC was received. The exploit drained approximately $41,000 in pooled reserves on October 21, 2026.
Drift Protocol $285M DPRK Multisig Exploit — Attacker Now Laundering $61.5M via Tornado Cash
North Korean threat actors drained $285M from the Drift Protocol on April 1, 2026, by compromising multisig signers through social engineering and fake collateral. On October 20–21, 2026, the attacker funneled $61.5M (25,700 ETH) through Tornado Cash, with ~$194M still under attacker control.
Symbiosis Bitcoin Bridge: 46 Billion syBTC Minted via Fee-Verification Bypass in BridgeV2
A fee-verification flaw in Symbiosis's BridgeV2 contract on BNB Chain allowed an attacker to mint 46.1 billion unbacked syBTC from a 330-satoshi ($0.25) deposit, liquidating an estimated $770K across BNB Chain, Ethereum, and Rootstock in four minutes. The Bitcoin bridge was taken offline and 15 BTC recovered.
MakerDAO Legacy Keeper Proxy Drained of 200 ETH via Missing ds-auth on Exit Function
A six-year-old MakerDAO ETH-A auction keeper proxy that never called deal() was exploited via a permissionless withdrawal function missing its ds-auth guard, losing 200 ETH (~$543K).
Cysic Bridge Exploit: Database Breach Enables Unauthorized Mint of 10M CYS, $727K Drained
An attacker breached Cysic's bridge backend database on October 17, 2026, then exploited a message-processing flaw to mint 10 million unauthorized CYS tokens on BNB Chain, ultimately bridging roughly $727,000 worth of ETH to Ethereum. The bridge remains offline with no reopening timeline.
Notional Finance V1 $1.73M Integer Overflow: uint128 Truncation Erases Debt in Solidity 0.6.x
An attacker exploited an unchecked uint128 narrowing cast in Notional Finance's legacy V1 escrow to craft two fCash positions whose combined debt equalled exactly 2¹²⁸ — silently truncating to zero and bypassing the free-collateral check, draining $1.73M in USDC and DAI.
MakerDAO ETH-A Keeper: Six-Year-Old Dormant Proxy Drained of 200 WETH ($538K)
A dormant MakerDAO liquidation keeper proxy that had won four collateral auctions in 2020 but never executed deal() was drained of 200 WETH via an unguarded drain function, illustrating how legacy access-control omissions can survive for years before being exploited.
Autheo THEO: Unbacked Cross-Chain Mint via Compromised Hyperlane Relayer Key
An attacker used a trusted relayer key to forge a Hyperlane cross-chain message that triggered unbacked minting of 19M THEO tokens on Base, which were swapped for 700 ETH (~$1.76M). The root cause remains the relayer key compromise; it is unconfirmed whether the flaw is in Autheo's deployment or the shared Hyperlane stack.
NEAR Intents: Credit-on-Attempt Deposit Bug Enables $3.87M Phantom Balance Drain
A BNB Chain vault contract in the NEAR Intents bridge incremented user balances on deposit attempt but never decremented them on revert, letting an attacker accumulate $3.87M in phantom USDT balances via 23 failed transactions before draining the vault; all funds were subsequently returned.
Base Vault Loses $6M After Whitelist Change Without Timelock
An anonymous 3-of-7 Safe multisig controlling an unidentified DeFi vault on Base added a malicious contract to its lending whitelist on October 4, 2026, draining approximately 1,783 wstETH (~$6M). No timelock separated the whitelist approval from its effect, and the vault required no collateral from whitelisted borrowers.
UNCX Vesting V2: Share-Accounting Bug Drains $1.49M Across Four Chains
Attackers exploited a missing share-counter decrement in UNCX's Smart Token Vesting V2 contracts to drain ~$1.49M from 10 tokens across Ethereum, BNB Chain, Base, and Robinhood Chain. Copycat wallets and MEV bots joined the original attacker in 11 total drain transactions.
EIP-7702 Delegation Exploit Drains sven.eth Wallet of $22.7K
On October 14, 2026, an attacker used a pre-signed EIP-7702 authorization to delegate execution of the victim's Ethereum EOA to a malicious contract and sweep 9.1231 ETH plus TAPEETH tokens. The attack exploits EIP-7702's sponsored-transaction model, which lets any relayer include a pre-signed delegation and act in the context of the victim's address.
Dormant MakerDAO Keeper Drained: 200 WETH Lost to Missing ds-auth on exit()
A third-party MakerDAO ETH-A liquidation keeper proxy deployed in 2020 was drained of approximately 200 WETH (~$538K) on October 6, 2026, after an attacker funded via Tornado Cash called its unprotected exit() function — a straightforward access-control omission on a contract sitting dormant for six years.
Papertrade: Unguarded BBO Midpoint Oracle Yields $1.28M Manipulation Attack on Launch Day
A Hyperliquid veteran exploited Papertrade's use of Hyperliquid's live best-bid-offer midpoint as its sole, unprotected price oracle on the protocol's first day, simultaneously moving the underlying spot price to profit on Papertrade positions across 296 of 305 trades for $1.28M.
Base Vault $6M Drain: Whitelist Manipulation via Compromised Safe Signers
An unattributed vault on Base lost ~1,783 wstETH (~$6M) after an attacker inserted a malicious contract into the vault's Safe-multisig whitelist, then used Aave V3's aToken redemption path to withdraw collateral without providing any.
Unnamed Base Lending Vault Loses $6M via Safe Multisig Whitelist Access-Control Failure
An anonymous wstETH lending vault on Base was drained of ~1,783 wstETH (~$6M) in 19 minutes after a Safe multisig whitelisted a malicious contract that could withdraw vault shares without providing any collateral.
FlashLoopAdapter: Fake Safe Contract Bypasses Caller Authentication to Drain 114 ETH from Aave-Linked Wallets
A third-party Aave v3 Safe-module adapter authenticated the calling contract by asking the caller itself whether the module was enabled — an easy-to-spoof check. On October 1, 2026, an attacker deployed a malicious Safe that always returned `true`, then used a Morpho flash loan to repay Aave debt and withdraw collateral from two victim wallets for a net profit of ~114 ETH (~$305K).
Black Thursday's Ghost: MakerDAO Legacy Auction Keeper Drained of 200 ETH Sitting Unsettled Since 2020
A legacy MakerDAO ETH-A liquidation keeper contract deployed during the March 2020 'Black Thursday' crisis was exploited on October 6–7, 2026, when an attacker discovered a function with no access control and withdrew 200 ETH (~$542K) that had been won in zero-bid auctions and never claimed. The attacker laundered the proceeds through Tornado Cash in 10 ETH batches.
Twin October 9 Exploits: BitBay Zero-Liquidity Share Drain and EtherVista Swap K-Invariant Overflow
SlowMist flagged two unrelated EVM smart-contract exploits on October 9: a zero-liquidity edge-case drained 14,838 DAI from BitBay's Polygon vault, while a uint112 K-value overflow in EtherVista's AMM swap function yielded $18,600 to an attacker.
Two DeFi Contracts Lose $32K on the Same Day: EtherVista K-Invariant Overflow and BitBay Zero-Liquidity Drain
On October 9, 2026, SlowMist flagged two unrelated but mechanistically instructive exploits: EtherVista lost ~$18.6K when an integer overflow bypassed its AMM K-invariant swap check, and BitBay lost ~$14K when its vault paid out its entire DAI balance to a caller redeeming a minimum share at zero liquidity. Together they illustrate two recurrent classes of precision-math and boundary-condition bugs.
Set Protocol actualizeFee() Rounding Exploit: Flash Loan Amplifies 1-Wei Unit Shift to 5 ETH
On October 6, 2026, an attacker exploited a rounding error in Set Protocol's public `actualizeFee()` function, using a Uniswap v4 flash loan to amplify a one-unit share count discrepancy into a 5.08 ETH (~$21K) profit. The function lacked any access control and could be called by anyone.
MakerDAO Legacy Auction Keeper: 6-Year-Old Unguarded Exit Function Drained for 200 ETH ($538K)
A legacy third-party MakerDAO auction keeper deployed around 2020 held 200 ETH from unsettled Black Thursday zero-bid lots. On October 6, 2026, an attacker called the keeper's unprotected withdrawal function — selector `0x8804d1de` — which lacked any ds-auth or access control, and immediately laundered the proceeds through Tornado Cash.
79thVault: $12.5M Drained via Admin Role Abuse on BNB Chain, 92% Returned
A privileged admin function on 79thVault's BNB Chain contract enabled removal of 2.01M 79AU tokens from its PancakeSwap pool; 15,000 BNB (~92%) was returned after negotiations.
Term Labs DAO Drained $8.5M for $951: Low-Quorum Governance Takeover
An attacker spent approximately $951 (funded via Tornado Cash) to acquire a controlling stake in Term Labs' governance token, passed malicious proposals to transfer vault funds, and extracted roughly $8.5M in ETH and USDC on August 23, 2026. The attack highlights the systemic risk of low-liquidity governance tokens with no time-lock or quorum guard.
Abracadabra Money III: $1.8M Solvency Bypass via cook() Flag Reset
Deprecated Ethereum Cauldron contracts were drained of ~1.7M MIM when an uninitialized else-branch in the multi-action cook() function unintentionally reset the solvency-check flag after every borrow, allowing collateral-free borrowing across six instances.
Anonymous Base Vault Loses $6M After Multisig Re-Whitelists Attacker Contract
An unidentified lending vault on Base lost approximately $6 million in wstETH on October 4, 2026, after an attacker exploited a Safe multisig-controlled whitelist to gain borrowing privileges. The root cause appears to be insufficient controls over who can be added to the vault's lending whitelist.
GoldPesa GPXHooks: $114K via Uniswap v4 Shared-Unlock Delta Leak on Base
On October 2, 2026, an attacker used a 175,000 USDC Morpho flash loan to exploit GoldPesa's Uniswap v4 hook on Base: the hook's hourly rebalance called PositionManager.TAKE_PAIR without isolating its own currency deltas, allowing the attacker to net a phantom WETH/USDC debt against the hook's USDC release and extract ~$114,428.
Base Vault Drained of $6M via Multisig Whitelist Manipulation
An attacker gained whitelist access to an anonymous Base chain DeFi vault's Safe multisig in under one minute, then withdrew 1,783 wstETH (~$6M) through Aave V3 in a 19-minute window.
SKYDAO: Burn-from-Pair + Premature sync() Enables $183K Flash-Drain on BSC
SKYDAO's deflationary token controller called sync() on the PancakeSwap V2 pair mid-transfer while the pair's SKY balance was near-zero, creating a stale-reserve window that an attacker exploited with a direct pair.swap() to drain $183K of USDT on September 30, 2026.
FlashLoopAdapter Exploit: Forged Safe Authentication Drains 114 ETH via Aave V3
An access-control flaw in an Aave V3-linked Safe module (FlashLoopAdapter) let an attacker pass a forged ISafe check, hijack two victim Safe multisigs via a Morpho flash loan, and exit with ~114 ETH ($305K) from their collateral.
NEAR Intents: $3.87M Drained via Cross-Chain Vault Authorization Flaw on BNB Chain
An attacker leveraged 23 failed deposit calls to manufacture uncollateralized balances in NEAR Intents' BNB Chain HOT Bridge vault, draining $3.87M in USDT. Funds were fully recovered after a 48-hour ultimatum; a post-mortem was published October 17, 2026.
Fake GIWA L2 Drains 766 ETH via OP Stack Chain ID Squatting
Scammers deployed a counterfeit OP Stack Layer 2 using GIWA's pre-announced Chain ID 9134 before the legitimate project launched, tricking 1,335 users into bridging ~$2.08M in ETH that was immediately drained.
Internet Token (INT): Fake Uniswap V3 Pool Callback Mints 925 Million Tokens with Zero Capital on Base
An attacker on Base exploited an unvalidated caller-supplied pool address in LiquidityUnifier's swapV3() to trigger an arbitrary 925M INT mint. A two-step Convertor bypass defeated the supply guard, yielding 5.85 WETH immediately and 764M INT retained; copycat attacks later inflated total supply to ~156 billion.
PrimeFinance: Stale Signed Oracle Report Drains Hyperliquid EVM Lending Pool
A missing timestamp check in PrimeFinance's DataStreamConsumer allowed an attacker to replay a legitimately signed but 11-month-expired Chainlink DON report, repricing PRFI 52× and draining ~425 WHYPE from the lending reserve.
Limit Break Payment Processor V2: 23,000 NFTs Exposed via Legacy Approval Exploit
Stale ERC-721 approval grants to a deprecated Limit Break contract allowed an attacker to execute zero-price NFT transfers on September 25, 2026, putting $5.7M in NFTs at risk before whitehats rescued all 23,155 tokens.
DAOstack Governance Hijacked via Permissionless newOrganization: 4 ETH Treasury Drain
An attacker exploited DAOstack's permissionless `UController.newOrganization` to mint majority REP governance tokens for an existing DAO, then passed a proposal to drain the Genesis Alpha treasury of 4.025 ETH on September 26, 2026.
DAOstack Genesis Alpha: Permissionless newOrganization() Hijacks REP Minting, Drains 4 ETH Treasury
An attacker exploited DAOstack UController's permissionless `newOrganization()` function — which trusts caller-supplied Avatar getters with no governance-binding check — to gain mintReputation privileges over Genesis Alpha DAO, inflate REP supply 205%, and drain the full 4.025 ETH treasury via a malicious governance proposal. Confirmed on Ethereum mainnet block 26,059,089.
Limit Break Payment Processor V2: Forged-Sender Attack Steals $2.8M in NFTs, Whitehats Rescue $5.7M
On September 24–25, 2026, a trusted-forwarder design flaw in Limit Break's Payment Processor V2 allowed attackers to impersonate any wallet with a standing approval and drain NFTs at zero cost. Whitehats used the same vulnerability to rescue 23,155 NFTs worth $5.7M.
Payy Network: Ethereum Bridge Contract Drained of Entire Balance (~$1.83M USDC)
Payy Network's Ethereum bridge contract was exploited on September 24, 2026, with its entire balance (~$1.83M USDC) drained in a single transaction. The official root cause remains undisclosed — the team denies a key compromise but conflicting evidence implicates Payy's own prover/validator keys. Stolen funds were routed through Railgun; all network operations remain suspended.