Security & Exploits

Liquid Network paused its sidechain after purported white-hat hackers withdrew roughly 4,000 BTC — about $320 million — from the federation wallet backing L-BTC.

Moonwell froze borrowing on Base after an estimated $8.7m MAMO price-manipulation exploit exposed the danger of treating thin liquidity as real collateral.

A governance exploit drained roughly $8.5 million from Term Labs vaults. The harder question is how a control layer became the attack surface.

For years, the hardware-wallet pitch has been simple: keep the keys offline and the internet cannot get them. Coldcard built

Blockaid’s H1 2026 report logs 212 verified incidents and $1.1bn in losses — a record first half. But the real story isn’t the total: it’s that privileged-key misuse, not contract bugs, now drives most of the damage.

An attacker deposited $2 in SAUCE tokens, submitted a forged oracle update with a zeroed BLS signature, and drained $9.05 million from Bonzo Lend — Hedera’s largest lending protocol — in under a minute.

Security firm Hexens disclosed a critical vulnerability in the Aptos blockchain’s Move VM that could have exposed $70 billion in crypto infrastructure. The attack cost? Just $3,000. The success rate? Nearly 90%. No funds were lost — but the details should terrify every protocol builder in the ecosystem.

Quantstamp links Humanity Protocol’s $36M exploit to North Korean hackers. A fake Bithumb email gave attackers seven private keys, draining 141M H tokens and crashing the price 90%. The BNB Chain deployment is permanently abandoned.