Index
Search
Search the public record. Drafts and scheduled notes are not included.
defi
Symbiosis's Bitcoin Bridge minted 46 billion syBTC from a 25-cent deposit. Real losses were about 9.97 BTC
On 11 September 2026 an attacker used two flaws in Symbiosis's native Bitcoin Bridge to mint about 46.1 billion unbacked syBTC from a 330-satoshi deposit. Symbiosis's post-mortem puts losses to liquidity providers and users at 9.97 BTC, about $770,000. The bridge is offline for a rewrite and audit.
Published 2h ago
defi
Pragma's 4 September oracle error halved major prices on Starknet and set off 47 liquidations
A faulty USDT conversion in Pragma's publishing software made BTC, ETH and other prices look about half their real value for a few minutes on 4 September 2026. Vesu liquidated 47 positions. Vesu reports 95% of assets recovered at 11 September prices; curator refunds are still in progress.
Published 2h ago
defi
Hemi lost 124.5M unclaimed HEMI to a claim contract bug, says its post-mortem
Hemi says an attacker drained about 124.5 million unclaimed HEMI from its legacy Genesis Drop claim contract on 7 September 2026 by calling back into the contract before it updated its balances. The tokens sold for about $255,000. HEMI, veHEMI and bridges were not affected.
Published 3h ago
defi
Liquid Network lost about 4,000 BTC to a proof cache bug, says Blockstream
Blockstream's assessment says a flaw in how Elements cached proof checks let about 4,000 unbacked L-BTC pass validation on 6 September 2026. The fake L-BTC was redeemed for real BTC through a federation member's peg-out. 3,400 BTC was returned, and about 602 BTC remains outstanding.
Published 3h ago
defi
NEAR Intents lost about $3.8M to a deposit notification bug, says its postmortem
NEAR Intents says an attacker used 23 failed deposits to create about $3.8M in unbacked "ghost funds" in its intents.near contract, then withdrew real tokens between 29 September and 1 October 2026. The postmortem of 16 October says the bug was in the contract, not Omni, and that all funds were returned.
Published 3h ago
defi
Nostra Finance lost about $3.5M after a thin pool price fooled its oracle
On 17 September 2026 an attacker pushed the price of Nostra's own NSTR token through a thin pool and borrowed about $3.5M against it. Pragma says the price response had two sources and that a three-source minimum would have rejected it. Nostra's final loss and any recovery are not known.
Published 3h ago
defi
Notional V1 lost about $1.7M from a deprecated escrow contract, says its post-mortem
Notional says an attacker caused an integer overflow in its deprecated V1 contract on 3 September 2026 and drained about 1.65M USDC and 69K DAI of leftover funds. The contract was paused and nothing has been recovered. The team says no other product is at risk.
Published 3h ago