Binance lost about $6.4B on Oct 29. Biggest crypto theft on record.
On Ethereum the attacker brought 50 presigned permissions for one hot wallet, one per possible nonce. One matched.
The wallet ran their code for 3h49m after that. Six more pulls after the first sweep.
On Ethereum the attacker brought 50 presigned permissions for one hot wallet, one per possible nonce. One matched.
The wallet ran their code for 3h49m after that. Six more pulls after the first sweep.
2
2
2
231
Wrote up the on-chain timeline, from the delegation to the revocation: sigintzero.com/blog/binance-6…
0
0
0
11
Polymarket traders lost about $2.65M Thursday to a hacked page speed script.
The vendor was DebugBear. Its script found your logged-in session, sold or moved your positions, and paid the attacker through Polymarket's own relayer.
Second vendor script hit there since June.
The vendor was DebugBear. Its script found your logged-in session, sold or moved your positions, and paid the attacker through Polymarket's own relayer.
Second vendor script hit there since June.
1
0
0
113
Aron put the on-chain timeline and the script teardown together here: sigintzero.com/blog/polymarke…
0
0
0
16
Someone found a bug in Initia's Move VM on Friday and gave themselves balances nothing ever minted.
Then they bridged them to Ethereum.
The lockboxes paid out $2.7M in real AUSD, ETH and USDC, most of it within 7 minutes.
The chain halted 42 minutes after the mint.
Then they bridged them to Ethereum.
The lockboxes paid out $2.7M in real AUSD, ETH and USDC, most of it within 7 minutes.
The chain halted 42 minutes after the mint.
1
0
1
132
I added up every Ethereum receipt and the timeline, including why the lockboxes had no way to say no: sigintzero.com/blog/initia-2-…
0
0
0
77
Someone bought a DAO majority with a flash loan Saturday and had the treasury sell 400,000 tokens for $35.
X100's Senate had three seats, ranked by what was staked right then.
The three day vote window was only a deadline. A majority could execute at once.
About $4.85M gone.
X100's Senate had three seats, ranked by what was staked right then.
The three day vote window was only a deadline. A majority could execute at once.
About $4.85M gone.
2
0
3
208
Alex went through the contract, all three attack waves, and the one limit that saved the other 12M tokens: sigintzero.com/blog/x100-4-85…
0
0
1
99
Someone printed about 39.8M ARRR on Pirate Chain last week. Supply up about 20%.
A refactor last year made blocks skip the burn proof on coin imports. Send the same tx normally and it's rejected. Put it inside a block and it mints.
Then it all went into the shielded pool.
A refactor last year made blocks skip the burn proof on coin imports. Send the same tx normally and it's rejected. Put it inside a block and it mints.
Then it all went into the shielded pool.
1
0
1
333
Alex traced it through the fix commits, including why the turnstile never fired: sigintzero.com/blog/pirate-ch…
0
0
1
212
BiFi's USDT market on Ethereum sat untouched for 36 days.
When it woke up, the code charged all 36 days of interest at whatever rate the market showed in that moment. Inside one transaction you get to set that rate yourself.
$165K out, in a single block.
When it woke up, the code charged all 36 days of interest at whatever rate the market showed in that moment. Inside one transaction you get to set that rate yourself.
$165K out, in a single block.
2
1
4
207
Whitehat bot c0ffeebabe ran the drain one block after the attacker deployed, then sent most of it back. Then address poisoners showed up 8 minutes after the refund. Full trace: sigintzero.com/blog/bifi-165k…
0
0
0
179
On Friday a rescue bot paid the Cetus hacker about $392K.
Eight Sui Bridge withdrawals from the May 2025 exploit sat signed and unclaimed for 17 months. The bot claimed them all, paid the gas, then asked the hacker for a tip.
The 109k USDT still isn't frozen.
Eight Sui Bridge withdrawals from the May 2025 exploit sat signed and unclaimed for 17 months. The bot claimed them all, paid the gas, then asked the hacker for a tip.
The 109k USDT still isn't frozen.
1
1
1
230
Aron's write-up, with the whole 17-month timeline on-chain: sigintzero.com/blog/sui-bridg…
0
0
0
222
UNCX's vesting contract lost ~$1.49M on four chains.
Claiming tokens took your shares off the pool total. Cancelling could take the same shares off again.
Get the order right and your next claim gets paid from other projects' vested tokens.
Copycats did the rest.
Claiming tokens took your shares off the pool total. Cancelling could take the same shares off again.
Get the order right and your next claim gets paid from other projects' vested tokens.
Copycats did the rest.
1
0
0
298
Alex's write-up, with the code and the on-chain timeline: sigintzero.com/blog/uncx-vest…
0
0
0
232
Someone took about $1.28M from Papertrade, a new 1000x perps venue on Hyperliquid, within eight hours of launch.
It prices every trade at Hyperliquid's live mid. So they bought ~6,000 ETH to push it $3, closed, flipped short, sold it back.
296 wins out of 305.
It prices every trade at Hyperliquid's live mid. So they bought ~6,000 ETH to push it $3, closed, flipped short, sold it back.
296 wins out of 305.
1
1
1
415
I wrote up the whole loop with the trade-by-trade numbers: sigintzero.com/blog/papertrad…
0
0
0
238
A drain tied to Ledgers sold by one reseller in Southeast Asia took about $102M on Friday.
Ledger now says a board hidden inside read the 24 words off the screen at setup and sent them out over LTE.
The genuine check still passes. It only checks the secure chip.
Ledger now says a board hidden inside read the 24 words off the screen at setup and sent them out over LTE.
The genuine check still passes. It only checks the secure chip.
1
0
0
292
Alex's write-up, with the on-chain trail and why the genuine check can't see it: sigintzero.com/blog/ledger-cr…
0
0
0
239