BlockSec @BlockSecTeam

.@_Qubic_ was reportedly exploited due to weak wallet seed generation. The issue now appears to have been fixed: github.com/qubic/wallet/c… However, the vulnerability was reported as early as February and does not appear to have been properly addressed at the time. The current fix also appears to follow the recommendation in that report: replacing Math.random() with crypto.getRandomValues(). Reports affecting critical components such as wallet seed generation deserve timely attention and follow-up.

Qubic @_Qubic_

2 days ago

Security incident update. Between 23:42 UTC on 17 October and 01:26 UTC on 18 October, an attacker drained 1,404 Qubic wallets, totalling around 2.94 trillion QU. Here is what happened, what has been done, and what comes next.

94 135 584 179K 104

.@UNCX_token was exploited across multiple chains for ~$1.5M. The root cause was inconsistent accounting of _totalTokenShares between release() and cancel(). This variable tracks the total outstanding shares of all schedules for a token. Specifically, after release(), a schedule with _depositedShares = D and schedule.released = R has only D − R shares remaining in _totalTokenShares. However, cancel() removes D − V, where V is the recalculated vestedShare. This accounting assumption can be broken through a donation followed by a top-up, which increases schedule.totalAmount while minting very few new shares and pushes V below R. Consequently, D − V exceeds the schedule’s remaining D − R shares, causing cancel() to deduct shares already removed by release(). This reduces the shared _totalTokenShares denominator and inflates the payout from the schedule retained by the attacker. The key attack steps are illustrated using this exploit transaction: app.blocksec.com/phalcon/explor… 1. Set up three schedules: The attacker created schedules 5058, 5059, and 5060. They fully released 5059 and 5060 while retaining 5058 for the final withdrawal. 2. Donate: The attacker transferred tokens directly to the vesting contract, inflating the asset-per-share value without minting new shares. 3. Top up and cancel: The attacker topped up schedules 5059 and 5060 with future-vesting tokens. Due to the manipulated share price, the top-ups greatly increased schedule.totalAmount while minting very few new shares, pushing vestedShare below schedule.released. Cancelling the schedules then deducted previously released shares from _totalTokenShares again. 4. Extract profits: With _totalTokenShares artificially reduced, the attacker released schedule 5058 at an inflated redemption value and repaid the flash loan. The attacker repeated this process to drain assets from the vulnerable contract.

keyboard_arrow_left Previous keyboard_arrow_right Next

UNCX Lockers @UNCX_token

5 days ago

UNCX Vesting V2: Security Incident Update Following the security incident affecting our Vesting V2 contracts across several chains earlier today, we want to share an update on the measures taken, the affected tokens, and what comes next. 1. Security measures and containment We

12 5 26 17K 4

🗓 Weekly Web3 Security Roundup | Oct 05 - Oct 11 🚨 Spotlight on 1 notable incident | ~$542K lost this week Featuring a vulnerability breakdown and in-depth analysis of selected key cases👇 blocksec.com/blog/web3-secu…

About 6 hours ago, ~$3.55M in unclaimed bridge funds was claimed and transferred out. Did the owner initiate the transactions, or did an attacker obtain valid EIP-7702 authorizations? Several days earlier, stuckfunds.eth, an onchain researcher, had sent multiple messages to 0x4943, notifying the owner that the funds were still claimable. The claims were submitted by 0x24a9, an address funded via Tornado Cash, and executed through EIP-7702 delegations on the EOA. Onchain data confirms that the authorizations were valid, but not whether the owner signed them intentionally, was tricked into signing them, or had the private key compromised. TX1 ($1.33M): app.blocksec.com/phalcon/explor… TX2 ($2.22M): app.blocksec.com/phalcon/explor…

keyboard_arrow_left Previous keyboard_arrow_right Next

🗓 BiWeekly Web3 Security Roundup | Sep 21 - Oct 04 🚨 Spotlight on 8 notable incidents | ~$418M lost these two weeks Featuring a vulnerability breakdown and in-depth analysis of selected key cases👇 blocksec.com/blog/web3-secu…

NEAR Intents @near_intents suffered a ~$3.8M exploit due to a vulnerability affecting its deposit and withdrawal infrastructure. The attacker drained assets from a BNB Chain hot wallet, with the stolen funds subsequently routed through KuCoin and bridged to Bitcoin. NEAR Intents has patched the affected components and temporarily suspended deposits and withdrawals across 11 networks for security checks. The team has also announced a compensation plan to fully reimburse affected users.

NEAR Intents @near_intents

3 weeks ago

Earlier today NEAR Intents services were stopped after a security incident was detected. The incident was caused by a bug in the Omni deposit and withdrawal infrastructure interaction with NEAR Intents smart contract. The preliminary report indicates the total loss of

208 234 2K 780K 195

Bitget: $387.5M stolen. Less than $1M frozen. Full fund flow analysis: blocksec.com/blog/bitget-ha… $183M swapped into ETH within hours. Issuers froze $339K. NEAR Intents blocked $50M in attempts but caught $503K. THORChain let it all through. Tracing worked. Freezing did not, because the window was hours and most of it closed before the first request landed.

Bitget: $387.5M gone. No private key stolen, no contract exploited. The attacker compromised internal credentials and told the wallet system to send the money. It did. Bybit, now Bitget. The attack surface has moved off-chain. Our breakdown, with a complete security review framework for exchanges and custodians: blocksec.com/blog/bitget-38…

.@payy_link was reportedly exploited, with estimated losses of $1.93M. Interestingly, the verifyRollup traces show several burn operations executed successfully with all-zero burn_hash values. How these zero hashes passed verification remains unclear; possible causes include a circuit flaw or a compromise of privileged infrastructure. The team has not yet responded publicly. Attack TX1: app.blocksec.com/phalcon/explor… Attack TX2: app.blocksec.com/phalcon/explor…

🗓 Weekly Web3 Security Roundup | Sep 14 - Sep 20 🚨 Spotlight on 2 notable incidents | ~$11.3M lost this week Featuring a vulnerability breakdown and in-depth analysis of selected key cases👇 blocksec.com/blog/web3-secu…

🚨 ALERT! We have observed a series of attack transactions targeting contracts on #Ethereum, including those associated with @Fetch_ai, @nunet_global, and @SingularityNET. Total losses exceed $2.1 million. The incidents appear to stem from leaked private keys belonging to two privileged accounts (e.g., the deployer account). By controlling these accounts, the attacker was able to execute authorized privileged operations and drain valuable assets through direct transfers or token minting. The attacker appears to be actively probing potential victims, with @SingularityNET’s AGIX token being the latest target. Stay vigilant！ Compromised accounts: etherscan.io/address/0x1572… etherscan.io/address/0x863F…

Attackers rarely break the chain. They take over a channel you already trust — a real account, a real conversation, a real history. BlockSec co-founder @yajinzhou and the Gate security team on how account takeovers, phishing and impersonation actually work, and what separation of identity, devices and permissions buys you.

Gate 华语 @Gate_zh

a month ago

🚨 安全小测试：合作伙伴突然发来新收款地址，还附上盖章确认函——你转不转？ ⚠️ 先别急，听听专家怎么说！？ 首期 #大门安全课，Gate 安全团队携手 @BlockSecTeam，带你拆穿那些“专攻人性、不攻代码”的套路 👇

36 0 1 9K 0

.@nostrafinance was reportedly hit by a price-manipulation attack: approximately $3.5M was borrowed against NSTR collateral, though the final loss is not yet confirmed. 1. The attacker first created an NSTR/SolvBTC pool and added 1.5 SolvBTC as one-sided liquidity away from the active price: voyager.online/tx/0x741af6efc…. This increased the pool liquidity reported by GeckoTerminal, apparently influencing which pool supplied its Pragma NSTR price. 2. The attacker then added very little liquidity between the normal price and a much higher price; a small buy pushed the quote sharply upward: starkscan.co/tx/0x772e73613…. At that point, Pragma had two contributing NSTR/USD prices: a normal AVNU quote of ~$0.00596118 (starkscan.co/tx/0x1d33ab3d3…) and a manipulated GeckoTerminal quote of ~$99.02439975 (starkscan.co/tx/0x6bc9b41bc…). Although the documentation describes a median of three sources, the second listed source did not provide a price in this instance. With only two available values, the median was their arithmetic average, approximately $49.51518, consistent with the borrow trace. 3. The attacker used another account holding NSTR collateral to borrow ETH, STRK, USDC, USDT, WBTC and DAIv1 at the inflated valuation: starkscan.co/v1/SN_MAIN/tx/…

Nostra @nostrafinance

a month ago

On September 17, a manipulated NSTR oracle price enabled one account to borrow approximately $3.5 million worth of ETH, STRK, USDC, USDT, WBTC and DAIv1 against NSTR collateral in the Nostra money market on Starknet. The Nostra money market is paused: lending, borrowing,

60 8 22 79K 13

🗓 Weekly Web3 Security Roundup | Sep 07 - Sep 13 🚨 Spotlight on 2 notable incidents | ~$320M lost this week Featuring a vulnerability breakdown and in-depth analysis of selected key cases👇 blocksec.com/blog/web3-secu…

ALERT! Our system detected an attack that drained ~$7.8M from a Gnosis Safe wallet on Ethereum (0x40E93a52F6Af9fCD3b476aeDADD7FeABD9f7AbA8). The root cause was a flawed authorization check in the executor contract (0x4f0055926c839D1d960a82CBF84E2eE933958ebC). Setting the supplied contract parameter to address(this) passed validation, allowing attacker-controlled calls to execute from the trusted executor through an enabled Safe module. The exploit moved ~2,900 aEthrsETH into a Uniswap V4 pool paired with the worthless “Permissionless Attacker Token” (PAT), leaving the Safe with a worthless LP NFT. The original attack transaction was front-run by the MEV bot yoink, which captured ~2,882 rsETH (~$7.8M) and routed it to 0xC70f00CD7E461686b04B0E912E309becA8b80ea0. Original attack TX: app.blocksec.com/phalcon/explor… Front-run TX: app.blocksec.com/phalcon/explor…

🗓 Weekly Web3 Security Roundup | Aug 31 - Sep 06 🚨 Spotlight on 4 notable incidents | ~$9.4M lost this week Featuring a vulnerability breakdown and in-depth analysis of selected key cases👇 blocksec.com/blog/web3-secu…

BlockSec's blockchain penetration testing is now live, written up as a series: What it covers, where its boundaries sit, how it is authorized, and which attack surfaces it has to reach. First four parts are live, more to come 🔜 Part 1: Why institutions need it: blocksec.com/blog/why-crypt… Part 2: What it is, and its boundaries: blocksec.com/blog/what-is-b… Part 3: Authorization and production safety: blocksec.com/blog/blockchai… Part 4: The attack surfaces it covers: blocksec.com/blog/web3-atta…

BlockSec Phalcon @Phalcon_xyz

a month ago

A cloud and web pentest stops where the money starts moving. Signing → approval → fund logic → on-chain transactions — we test that chain adversarially, in an agreed scope, with evidence for every confirmed path. Blockchain Penetration Testing, now live at BlockSec! Start

0 1 8 40K 3

A cloud and web pentest stops where the money starts moving. Signing → approval → fund logic → on-chain transactions — we test that chain adversarially, in an agreed scope, with evidence for every confirmed path. Blockchain Penetration Testing, now live at BlockSec! Start here👇 blocksec.com/blockchain-pen…

Eleven security teams, one place for BNB Chain builders to find the support they need. From contract audits to real-time monitoring and incident response, here’s what each team on the AvengerDAO marketplace brings to the table 🧵👇

Builders on @BNBCHAIN can now book BlockSec's security services through the AvengerDAO marketplace. 🔍 Audits — coverage spans the full stack: smart contracts, DeFi protocols, L1s, L2s and rollups, wallets, bridges, nodes and RPC infrastructure. Every audit evaluates implementation security, business logic and, where applicable, economic design, backed by our own static analyzer and LLM-assisted detection system. Alongside audits, we run dedicated blockchain penetration testing and security testing. 📡 Real-time monitoring — Phalcon keeps watching your protocol once it's live, so risk doesn't sit unnoticed between audits. Our findings go beyond severity ratings. Each issue comes with clear, actionable remediation, and every report is built for real-world use: mainnet launches, public disclosures, exchange listing reviews and compliance processes. Find us on the AvengerDAO marketplace 👇 avengerdao.org/marketplace