Hacks
Hacks
V12 Says THORChain Silently Patched Its Critical Bug, Then Told Researchers the Bounty Is 'Permanently Retired'
A security startup says it disclosed a fund-draining vulnerability to the cross-chain protocol weeks before a $10.7M exploit hit a near-identical flaw. Now it plans to publish exploit code for more.
Hacks
Gnosis Pay Hit by 'Delay Module' Exploit as Gnosis Pledges to Cover User Losses
Co-founder Martin Köppelmann said the company will make all users whole after attackers exploited the smart-contract module that governs Gnosis Pay card accounts. No loss figure has been disclosed.
Hacks
Alephium Bridge Loses $815K to Forged Guardian Messages, Not Stolen Keys
Alephium's Wormhole-fork TokenBridge was drained on Ethereum and BNB Chain in roughly seven minutes after an off-chain backend flaw let fraudulent messages slip past its four-guardian network, the team said in a public correction.
Hacks
OpenZeppelin Pushes Back After Ex-CTO Declares All of DeFi Unsafe
The smart contract security firm distanced itself from Manuel Aráoz's warning that AI coding agents have made DeFi impossible to defend, calling the threat real but manageable.
Hacks
Hacker Mints 5.4 Trillion Tokens in StakeDAO Exploit, Nets $91K
A compromised private key let an attacker forge a cross-chain message on Arbitrum, triggering cascading warnings across Curve Finance and Beefy Finance.
Hacks
StablR Stablecoins Exploited, EURR and USDR Depeg After Minting Key Compromise
Estimates of losses range from $2.8 million to $10 million.
Hacks
LayerZero's Incident Report Says Kelp Downgraded From 2-of-2 to 1-of-1 DVN Before $292M Exploit
Detailed May 18 post-mortem traces a six-week breach to DPRK group TraderTraitor and locks in a new 3-of-3 DVN protocol default. Kelp says LayerZero approved the configuration and has migrated rsETH bridging to Chainlink.
Hacks
$11.58M Drained in Ongoing Exploit on Verus-Ethereum Bridge
An active exploit on the Verus-Ethereum Bridge has resulted in $11.58 million in losses, according to security firm Blockaid.
Hacks
Kelp DAO Burns Exploiter's rsETH on Arbitrum, Plans Two-Week Withdrawal Reopening: Kelp DAO
Kelp DAO has burned the attacker's rsETH tokens and outlined a recovery plan to refill liquidity through Aave's Recovery Guardian multisig before resuming withdrawals.
Hacks
Wasabi Loses $5M+ in Latest DeFi Exploit
Wasabi Protocol is the latest victim in what appears to be a record bad month for DeFi hacks.
