Index
Search
Search the public record. Drafts and scheduled notes are not included.
defi
UNCX Vesting V2 was drained on four chains. The headline said $1.49M, UNCX's own count says about $808K
On 14 October 2026 attackers abused a share-accounting flaw in UNCX Network's Smart Token Vesting V2 and took tokens belonging to ten projects on Ethereum, BNB Chain, Base and Robinhood Chain. Early tallies said about $1.49M. UNCX's report puts realised value near $808K and lists returns by whitehats.
Published 2h ago
defi
FlashLoopAdapter: how a spoofable caller check cost two Safe wallets 114 ETH
On 1 October 2026 an attacker used a flash loan and a fake Safe to make a third-party Aave adapter run their instructions inside two real Safe wallets, taking about 114 ETH (around $305,000). Aave v3 and Safe's own contracts were not at fault, according to analysts and Aave's founder.
Published 2h ago
defi
Payy's bridge paid out $1.9M after its verifier accepted a forged proof
On 24 September 2026 Payy's Ethereum bridge released about 1.92M USDC against a burn that never happened. Payy's post-mortem says an invalid proof got through its Noir and Barretenberg verifier. The network was paused, and a user claims process has been promised but not yet published.
Published 2h ago
defi
Limit Break Payment Processor V2 was abused through a forged sender, taking about $2.8M
An attacker used a flaw in Limit Break's old Payment Processor V2 contract to act as wallets that had left approvals in place. Credora counts about $2.8M in confirmed losses. Whitehats rescued about 23,000 NFTs. V2 cannot be paused, and Limit Break tells users to revoke approvals.
Published 3h ago
defi
Notional V1 lost about $1.7M from a deprecated escrow contract, says its post-mortem
Notional says an attacker caused an integer overflow in its deprecated V1 contract on 3 September 2026 and drained about 1.65M USDC and 69K DAI of leftover funds. The contract was paused and nothing has been recovered. The team says no other product is at risk.
Published 3h ago