DEV Community: Cryip

How a Fake MEV Opportunity Cost JaredFromSubway.eth $7.5M

Saravana kumar — Tue, 23 Jun 2026 11:45:55 +0000

On June 20, 2026, the prominent Ethereum sandwich MEV bot JaredFromSubway.eth was drained of approximately 7.5 million dollars, with the operator claiming losses closer to 15 million in WETH, USDC, and USDT.

Unlike traditional exploits that rely on reentrancy, access control failures, or private key compromises, this attack cleverly abused the bot’s own autonomous opportunity detection and execution engine. The attacker fed the bot artificially profitable-looking trades over several weeks, tricking it into granting large token approvals to malicious contracts. This article delivers a technical deep dive for smart contract developers, MEV bot builders, and DeFi automation engineers.

Attack Architecture (Technical Breakdown)

The attacker executed a patient, multi-phase strategy. First, they deployed multiple fake ERC-20 tokens that closely mimicked WETH, USDC, and USDT, along with fake Uniswap-style liquidity pools engineered with manipulated price curves. They also deployed several helper contracts.

The core of the attack targeted the bot’s simulation engine. JaredFromSubway continuously scans for sandwich and arbitrage opportunities using eth_call or forked state simulations. The attacker crafted pools that consistently returned highly profitable simulation results tailored to the bot’s internal heuristics. This triggered the bot’s execution logic to generate approved transactions for the attacker-controlled contracts.

In the early phase, small approvals were consumed immediately to build trust. In later stages, the bot left large standing approvals, including one notable case of roughly 92 WETH to a helper contract at 0x4ee0…313ce. Once sufficient approvals accumulated, the attacker deployed a sweep contract that used transferFrom calls to drain funds from the bot’s operational wallets. The stolen assets were partially routed through Tornado Cash.

Critical Vulnerabilities Exposed

The primary weakness was overly permissive approval logic. Many MEV bots still grant unlimited approvals to untrusted or newly encountered contracts during opportunity execution. A common vulnerable pattern seen in such bots looks like this:

Another major issue was weak simulation validation. While the bot performed profitability simulations, it lacked sufficient on-chain verification layers to detect fake pools and suspicious contracts. The system did not properly differentiate between genuine opportunities and adversarial setups designed specifically to trigger approvals. The bot also lacked proper separation between scouting, validation, and execution phases.

Defensive Architecture Recommendations

Developers building similar systems should implement strict approval management. Instead of using unlimited approvals, always reset approvals first and grant only the exact amount required. Here is a recommended ApprovalManager pattern:

Add multi-stage validation before any approval is granted. Here is an improved execution flow in TypeScript:

Architect the bot with clear separation of concerns: scouting module (read-only), validator module (heuristics), executor module (minimal approvals), and monitoring module. Implement circuit breakers and use multisig wallets with timelocks for large funds. Prefer EIP-2612 permit signatures for time-bound approvals.

Monitoring & Recovery Mechanisms

Real-time monitoring is essential. Track all approval events using a custom subgraph or off-chain indexer and set up alerts for large approvals. The JaredFromSubway operator offered a 50% white hat bounty for the return of 2150 ETH within 48 hours. Building similar bounty mechanisms with timelocks is recommended.

Conclusion & Action Items

This incident represents a new class of attacks called Economic Simulation Attacks against autonomous on-chain agents.
Immediate checklist for MEV and automated trading bot developers:

Audit every approved call and remove unlimited approvals.
Introduce multi-layer validation before granting any spending permission.
Implement proper approval tracking with automatic revocation logic.
Separate simulation, validation, and execution modules clearly.
Add circuit breakers and emergency pause functionality.
Regularly test your system against adversarial pool simulations. By applying these patterns, developers can significantly reduce the risk of similar sophisticated approval exploits.

How a Single Validation Mismatch Can Drain Millions - Lessons from the Aztec Connect Exploit

Saravana kumar — Mon, 15 Jun 2026 12:41:00 +0000

On June 14 2026, an attacker successfully exploited a vulnerability in Aztec Connect's deprecated RollupProcessorV3 contract and drained approximately 2.19 million dollars worth of assets.
No reentrancy attacks were involved. No flash loans were used. No private keys were compromised. No flaws in the underlying cryptography were discovered.
The root cause was a subtle but critical mismatch between what a zero-knowledge proof mathematically verifies and what the smart contract actually executes during settlement. This incident highlights a growing risk in blockchain systems that rely on advanced proof systems for scaling and privacy.

Why This Matters

Many developers working with zero-knowledge proofs operate under a dangerous assumption. They believe that if a verifier contract confirms a proof is valid, then the associated state transition in the smart contract must automatically be safe and correct.
In reality, a zk-proof only guarantees that a specific computational statement holds true according to the rules encoded in the circuit. It does not automatically ensure that the on-chain smart contract logic correctly interprets, decodes, or applies the outputs from that proof.
This gap between verification and execution creates an attack surface that is difficult to detect through standard audits focused only on reentrancy, access control, or arithmetic overflows. The Aztec Connect incident demonstrates how such mismatches can lead to catastrophic fund drains even in mature protocols.

The Dangerous Pattern

In this setup, the proof verification step relies on verifiedTransactions while the actual processing loop uses totalTransactions. These two values are intended to stay in sync but are supplied independently by the caller. This separation creates an opportunity for manipulation.

The Exploit Scenario

An attacker can submit crafted input like this:

verifiedTransactions = 10
totalTransactions = 15

The zk-proof validates correctly because it only checks the first 10 transactions. However, the contract proceeds to execute settlement logic for all 15 transactions. The additional 5 transactions were never part of any valid proof, allowing the attacker to inject unauthorized state changes such as minting fake balances or crediting funds that were never deposited.
Once fake balances exist in the contract's internal accounting, the attacker can simply call withdrawal functions to extract real assets from the protocol.

This line, executed outside the verified portion of the rollup, turns the attack into a direct theft of protocol funds.

Creating Fake Balances and Draining Funds

The attacker does not need complex primitives. By forcing the contract to process unverified transactions, they can inflate balances, manipulate internal accounting totals, or trigger unauthorized transfers. Because the deprecated contract still held significant liquidity and lacked active monitoring or emergency controls, the drain was able to complete successfully.
This class of bug is particularly insidious because it does not rely on breaking the zero-knowledge proof itself. The proof system worked exactly as designed. The failure occurred in the bridge between the proof world and the execution world.

The Secure Pattern: Single State Commitment

The recommended approach eliminates ambiguity by using a single source of truth for the state transition:

Both the verifier circuit and the on-chain settlement logic now operate on identical inputs: the old state root and the new state root. There is no room for the caller to supply conflicting counters or transaction counts.

Never Trust User Inputs After Proof Verification

A common follow-up mistake is to verify a proof and then still rely on user-supplied values for critical operations.

Always extract necessary values directly from the decoded proof output rather than accepting them again from the transaction calldata.

Add Invariant Checks

Defensive programming is essential even when using zero-knowledge proofs. Regular invariant testing helps catch accounting inconsistencies:
solidity

These checks should run after every major state transition, especially in rollup processors or bridging contracts.

Fuzz the Boundary Conditions

Developers should actively test for mismatches using property-based testing:
solidity

Tools such as Foundry, Echidna, Medusa, and Halmos are highly effective for exploring these edge cases automatically.

The Zombie Contract Problem

One of the contributing factors in the Aztec Connect incident was the deprecated status of the RollupProcessorV3 contract.
Even after a protocol upgrades to newer versions, older contracts often continue to hold funds. Without active monitoring, pause mechanisms, or upgrade paths, these "zombie" contracts become attractive targets. Attackers systematically scan for such forgotten but solvent contracts across Ethereum and layer-2 ecosystems.
Teams should implement clear deprecation strategies, including fund migration deadlines, public notices, and where possible, emergency admin functions (protected by timelocks or multi-signature governance).

Pre-Deployment Checklist

Consistency

Does the settlement process exactly what the proof verifies?
Are all counters and totals fully synchronized between proof and execution?
Is every state transition represented by a single, atomic state root?

Accounting

Can balances increase without corresponding deposits?
Can withdrawals exceed verified deposits?
Can total supply change unexpectedly?

Proof Integration

Can user inputs override or supplement proof outputs?
Do the verifier and settlement logic ever disagree on the same parameters?

Final Takeaway

The Aztec Connect exploit serves as a powerful reminder: never verify one thing and execute another. When your proof system and settlement logic stop operating on identical data, the consequences can be measured in millions of dollars.
As zero-knowledge technology becomes more widespread in blockchain scaling solutions, security teams must pay equal attention to the cryptographic circuits and the surrounding smart contract glue code. A single mismatched variable is sometimes all it takes to turn a mathematically sound proof into an expensive real-world failure.
By adopting strict single-source-of-truth designs, rigorous invariant checking, and comprehensive fuzz testing, developers can significantly reduce this category of high-impact vulnerabilities.

From Vulnerability to Rescue: Engineering a White Hat Recovery System for DeFi Exploit Mitigation

Saravana kumar — Tue, 09 Jun 2026 16:04:36 +0000

Decentralized finance systems operate in an environment where execution is deterministic, irreversible, and adversarial by default. Once a vulnerability is discovered and exploited, the system often transitions into a race condition between attackers and defenders. In most cases, attackers win simply because they act faster and operate closer to the execution layer.
A White Hat Recovery System is a production grade security architecture designed to reduce that gap. It combines real time blockchain monitoring, mempool level analysis, risk scoring engines, and smart contract level emergency controls to detect and respond to exploits within the same execution window.
This article explains how to build such a system from an engineering perspective, focusing on real components, real constraints, and deployable code structures.

System Architecture Overview

A White Hat Recovery System is not a single service. It is a distributed pipeline that spans off chain and on chain components.
In a real deployment, the architecture typically looks like this:
Blockchain Node Layer → Mempool Listener Service → Transaction Normalization Engine → Exploit Detection Engine → Risk Decision Orchestrator → White Hat Recovery Executor → Smart Contract Defense Layer → Incident Logging and Alert System
Each layer is designed to operate independently so that latency in one component does not break the entire pipeline. The most critical constraint in this system is time, because exploit transactions often complete within a single block.

Mempool Listener Service

The first engineering challenge is capturing transactions before they are mined. This requires a WebSocket based connection to an Ethereum node or a third party RPC provider.
In production systems, multiple providers are often used to reduce data loss and latency spikes.

At this stage, the system only collects raw transaction data. No heavy computation is performed here because throughput must remain high.
In large scale deployments, this service is usually backed by a queue system like Kafka or Redis streams to prevent overload.

Transaction Normalization Layer

Raw blockchain transactions are inconsistent for analysis. They must be converted into structured objects before being passed into the detection engine.
This normalization step ensures that all downstream services work with a consistent schema.

In advanced systems, this layer also performs ABI decoding and internal call simulation using trace APIs. This allows the system to understand not just what was called, but what will likely happen if the transaction is executed.

Exploit Detection Engine

The detection engine is the core intelligence layer of the White Hat Recovery System. It is responsible for identifying patterns that resemble known exploit behavior.
Most production systems use a hybrid approach combining rule based scoring with behavioral analysis.
Risk scoring model

The goal is not perfect classification. The goal is fast probabilistic detection under time constraints.
Flash loan detection logic

In production systems, this logic is often replaced with machine learning models trained on historical exploit datasets.

Risk Decision Orchestrator

Once a transaction is scored, the system must decide whether to ignore it, monitor it, or trigger an active response.

This layer is critical because false positives can be as damaging as missed exploits.

Only CRITICAL level transactions are forwarded to the recovery system.

At scale, this component often includes additional safeguards such as rate limiting, duplication checks, and cooldown windows to avoid repeated triggering on similar transactions.

White Hat Recovery Execution Layer

This is where active intervention happens. The system attempts to prevent exploit finalization using MEV aware strategies.

Since blockchain transactions cannot be reversed after confirmation, the only viable strategy is to compete for inclusion in the next block.

A practical example of white hat intervention occurred during the Flooring Protocol exploit, where Yuga Labs coordinated a recovery operation to help secure high-value NFTs before attackers could fully capitalize on the vulnerability. The incident demonstrated how rapid response and coordinated execution can significantly reduce losses during active exploitation.

A common approach is using Flashbots or similar private relay systems.

This system operates under probabilistic success conditions. Inclusion is not guaranteed, but private relays significantly improve execution reliability compared to public mempools.

Smart Contract Defense Layer

Off chain systems alone cannot guarantee recovery. Smart contracts must be designed with built in emergency controls.

A basic production pattern is the emergency pause mechanism, which allows protocol administrators or governance systems to halt operations during detected anomalies.

More advanced systems introduce recovery vaults that isolate user funds during incidents and allow controlled restoration after verification.

The importance of recovery-oriented protocol design was highlighted when white hat researcher 0xFlorent successfully recovered approximately 2 million ETH that had remained inaccessible since the 2016 HongCoin ICO. Although the incident was not a live exploit response, it demonstrated how carefully engineered recovery mechanisms and deep protocol analysis can restore otherwise lost assets.

These mechanisms are essential because without them, recovery systems are limited to observation only.

Incident Response Lifecycle

A complete exploit handling flow follows a strict time sensitive pipeline.

Transaction enters mempool
Listener captures transaction
Normalization engine processes data
Risk engine computes score
Decision engine classifies severity
If CRITICAL, recovery executor triggers response
Flashbots bundle is submitted
Smart contract emergency mode is activated if available
Incident logs are generated for audit and governance

The entire process must complete within a single block window to be effective.

Engineering Constraints and Real World Limitations

Building a White Hat Recovery System comes with strict constraints.

The first limitation is blockchain immutability. Once a transaction is confirmed, recovery is only possible if the protocol includes explicit recovery hooks. Without these hooks, no external system can reverse state changes.

The second limitation is latency. Attackers often use optimized MEV bots and private relays, meaning defensive systems must compete at the same execution layer.

A recent example of this challenge was the Foom Cash exploit response, where white hat security teams rapidly intervened to secure approximately $1.84 million in assets following a smart contract compromise. The case illustrated how execution speed and coordinated response infrastructure can determine whether funds are recovered or permanently lost.

The third limitation is false positives. Over aggressive detection can result in blocking legitimate users or triggering unnecessary emergency states, which can degrade protocol trust.

Conclusion

A White Hat Recovery System is a full stack security architecture that combines real time blockchain monitoring, exploit detection logic, MEV based execution strategies, and smart contract level emergency controls.

Its success depends not only on engineering speed but also on how well the underlying protocol is designed to support recovery operations.

In modern DeFi systems, security is no longer a post deployment feature. It is a core architectural requirement that must be embedded at every layer of the system from smart contracts to off chain infrastructure.

The Private Key Security Practices That Could Stop a Humanity Protocol-Like Attack

Saravana kumar — Tue, 09 Jun 2026 12:09:30 +0000

If you've built anything in Web3, you've probably worked with private keys. Whether you're creating a wallet application, a DeFi protocol, a trading bot, a multisig management tool, or an automated transaction signer, private keys are at the center of everything.

Yet many developers use wallet libraries every day without understanding what actually happens when a user enters a password and unlocks a wallet.

How does an encrypted private key become a usable signing key?
What cryptographic operations happen behind the scenes?
Why do so many crypto hacks originate from poor key management rather than broken cryptography?
Most importantly, how can developers avoid a catastrophic private key compromise?

Let's dive into the technical details.

The Problem With Raw Private Keys
A private key is simply a 256-bit number.
Example:
0x4c0883a69102937d6231471b5dbb6204fe5129617082795b0f7e2d9b9a4f3c11

Whoever controls this value controls the wallet entirely. They can:

Sign transactions
Transfer funds
Approve smart contracts
Manage protocol-owned assets

This is why storing raw private keys is extremely dangerous.
Bad Example:

In this scenario, if a database leak occurs, the attacker instantly gains access to all the funds. Instead, modern wallets encrypt private keys before storage.

What Actually Gets Encrypted?

Many developers imagine that wallets simply encrypt the private key using a plain password. The reality is much more complex.
Typical Workflow:
Private Key → KDF + Salt → Encryption Key → AES Encryption → Keystore File
The password itself is never used directly for encryption.
Instead, a Key Derivation Function (KDF) transforms the password into a cryptographically strong key.
This makes brute-force attacks significantly more expensive.

Ethereum V3 Keystore Format

Most Ethereum wallets use a JSON keystore format.

Notice something important: the private key itself is not stored directly anywhere in this file. Instead, it contains:

Encrypted ciphertext
KDF settings
Verification hash (MAC)
Encryption metadata

Without the password, recovering the private key from this file becomes computationally expensive.

Creating An Encrypted Wallet Using Ethers.js

Let's first generate a random wallet:

Output:

Now let's encrypt it:

Output:

At this point, the raw private key is protected by encryption. This JSON file can be safely stored in a database, file system, or cloud storage service.

Understanding Scrypt

One reason Ethereum wallets use Scrypt is to make password cracking expensive.
Without a KDF:
AES(
password,
privateKey
);

An attacker could test millions of passwords per second.
With Scrypt:
scrypt(
password,
salt,
N,
r,
p
);
The algorithm intentionally consumes memory and CPU resources.
Example:

Increasing these values multiplies the computational cost for an attacker attempting a brute-force crack. This is why strong wallet passwords remain effective even after database leaks.

Decrypting The Wallet

Eventually, a transaction must be signed. The wallet therefore needs temporary access to the private key.

Behind the Scenes:
Encrypted JSON → Parse Parameters → Scrypt KDF → AES Key Creation → AES Decryption → Private Key

This is one of the most sensitive moments in the wallet lifecycle.
A successful malware infection at this stage could result in a private key compromise.

What Happens During Transaction Signing?

Once decrypted, the private key signs transactions.
Example:

Internally:

Transaction → Serialize → Hash → ECDSA Sign → Signature

The private key never leaves the application.
Only the signature is broadcast to the network.

Signing Messages

Wallets can also sign arbitrary messages to authenticate users:

Verification:

This mechanism powers wallet login systems and off-chain approvals.

This mechanism powers:
Wallet login systems
Web3 authentication
Ownership verification
Off-chain approvals

Building A Secure Wallet Service

Imagine you're building a backend signer.
A simple architecture might look like this.
User → API Gateway → Encrypted Wallet Storage → Password Validation → Temporary Decryption → Signing Service → Blockchain

Basic Implementation:

The service only decrypts the wallet when strictly required. This minimizes the private key's exposure time.

The Memory Security Problem

Many developers focus entirely on storage encryption at rest. However, attackers frequently target the system's RAM memory.
When this code runs:

The private key exists in its raw form inside the RAM. Potential attack vectors include:

Memory dumping
Compromised containers
Privileged insider attacks

Many massive crypto thefts begin with memory extraction rather than breaking the underlying cryptography.

A Common Private Key Compromise Scenario

Consider this code:

Developers often add general object logging during debugging. Unfortunately, these logs can be automatically shipped to third-party monitoring systems like Datadog, CloudWatch, or Elasticsearch.

As a result, sensitive wallet data accidentally becomes accessible to anyone with log access inside the organization. This simple mistake has contributed to multiple high-profile security incidents across the crypto industry.

Environment Variables Are Not Always Safe

Many teams store secrets here:
PRIVATE_KEY=0x4c0883...

While convenient, environment variables may appear in:

Crash reports
CI/CD pipelines
Deployment logs
Debug outputs A better approach is encrypted key storage combined with runtime decryption.

Hardware Wallet Architecture

A stronger design avoids exposing keys entirely.
Architecture:
Application → Signing Request → Hardware Wallet → Signature

The private key never enters application memory.
Only the signature is returned.
This dramatically reduces attack surface.

HSM-Based Enterprise Signing

Large exchanges rarely store hot wallet keys directly on servers.
Instead they use Hardware Security Modules.
Architecture:
Application → HSM → Secure Signing → Signature

Benefits:
Tamper resistance
Audit logs
Role-based access
Secure key storage
Controlled signing operations
This is one reason major custodians can secure billions of dollars in assets.

Multi-Signature Protection

Even strong encryption cannot eliminate every risk.
For treasury management, multisig wallets provide an additional layer.
Example:
Signer A / Signer B / Signer C → 2/3 Approval → Execute Transaction

If a single signer experiences a private key compromise, attackers still cannot immediately access the funds.
This dramatically improves operational security.
Security Checklist For Developers
Before deploying any wallet infrastructure, verify the following:

Private keys are encrypted at rest.
Strong KDF settings are used.
Secrets never appear in logs.
Runtime decryption is minimized.
Hardware wallets are used when possible.
Critical assets use multisig protection.
Secret scanning tools are enabled.
Backup systems are encrypted.
Signing activity is monitored.
Incident response procedures exist.

Final Thoughts

Most blockchain developers spend countless hours securing smart contracts while paying far less attention to wallet security.
Yet many real-world breaches originate from exposed credentials, leaked environment files, insecure backups, or a simple private key compromise rather than flaws in blockchain protocols themselves.
Understanding how encrypted private keys are stored, decrypted, and used during transaction signing helps developers design safer systems. Whether you're building a wallet, exchange, DeFi protocol, trading infrastructure, or treasury management platform, secure key handling is one of the most important security responsibilities you will ever have.
The strongest smart contract in the world cannot protect assets if the private key protecting them is exposed.

Why Security Researchers Stop Reporting Bugs: Lessons from THORChain's Vulnerability and Exploit Incidents

Saravana kumar — Tue, 02 Jun 2026 12:43:53 +0000

Every engineering team says they value security researchers.
But many researchers would argue that actions matter more than words.
Recently, discussions around THORChain raised questions about vulnerability disclosure, bug bounty expectations, and how protocol teams communicate with researchers. Around the same period, the protocol also faced a multi-chain exploit that resulted in losses exceeding $10 million and forced emergency network actions.
For developers, these events highlight an important reality:
Security isn't just about finding vulnerabilities. It's about creating an ecosystem where researchers want to report them.

The Hidden Risk Most Teams Ignore

Most security discussions focus on attackers.
Far fewer focus on the people trying to help.
A typical vulnerability lifecycle looks like this:
Researcher finds bug
↓
Reports vulnerability
↓
Team validates issue
↓
Fix is deployed
↓
Researcher receives recognition
↓
Public disclosure

Looks simple.
In reality, many breakdowns happen between the report and the recognition stage.
When researchers feel ignored, under-rewarded, or excluded from the process, future vulnerabilities may never be reported responsibly.

The Economics of Responsible Disclosure

Imagine you're a security researcher.
You spend:
20+ hours auditing code
Building proof-of-concepts
Writing reports
Communicating with maintainers
Now compare the outcomes:
const researcherChoices = {
responsibleDisclosure: {
reward: "$5,000",
effort: "high"
},

sellToBroker: {
reward: "$50,000+",
effort: "medium"
}
};

The numbers vary, but the incentive problem is real.
If organizations want researchers to choose responsible disclosure, the reporting experience must be worth it.

Security Is Also a Product Experience

Developers often think security is purely technical.
It's not.
The vulnerability reporting process is a user experience.
Bad UX examples:
const badProcess = {
responseTime: "14 days",
acknowledgement: false,
communication: "minimal",
rewardCriteria: "unclear"
};

Better approach:
const goodProcess = {
acknowledgement: "<24 hours",
communication: "regular updates",
rewardCriteria: "publicly documented",
disclosurePolicy: "clear"
};

Researchers remember how they were treated.
And communities remember how teams responded.

Why Cross-Chain Protocols Are Hard to Secure

One reason THORChain attracted attention is because cross-chain infrastructure is among the most complex systems in crypto.
A simple application protects:
Application
↓
One blockchain
↓
One execution environment

Cross-chain protocols must protect:
Protocol
↓
Bitcoin
Ethereum
BNB Chain
Base
Other chains
↓
Shared security assumptions

Every additional chain increases complexity.
Security researchers have repeatedly pointed out that cross-chain systems create larger attack surfaces than single-chain applications. Community discussions following the exploit highlighted this challenge.

Build a Bug Bounty Program Developers Actually Trust

Many bug bounty programs fail because they are designed from the organization's perspective.
Instead, design from the researcher's perspective.
Checklist:
const bountyProgram = {
responseSLA: "24 hours",
severityMatrix: true,
publicRules: true,
appealProcess: true,
payoutTimeline: true
};

Questions every program should answer:
How is severity calculated?
Who decides the reward?
How quickly are reports reviewed?
What happens if the researcher disagrees?
When can the issue be disclosed publicly?
If these answers aren't documented, controversy becomes inevitable.

Security Culture Matters More Than Security Tools

You can buy scanners.
You can buy audits.
You can buy monitoring platforms.
You cannot buy trust.
Teams that consistently attract high-quality vulnerability reports usually share three traits:
const securityCulture = [
"Fast responses",
"Transparent communication",
"Fair researcher treatment"
];

Researchers talk to each other.
A protocol's reputation often determines whether the next critical vulnerability is privately reported or publicly exposed.

What Developers Should Take Away

The biggest lesson isn't about THORChain.
It's about engineering culture.
A vulnerability can be patched.
A smart contract can be upgraded.
Infrastructure can be rebuilt.
But once researchers lose confidence in a project's disclosure process, rebuilding trust becomes much harder.
The strongest security teams don't just fix bugs.
They create an environment where researchers want to help them find the next one.

How to Secure Your Multisig Wallet: Complete Hack Prevention Guide with Technical Analysis

Saravana kumar — Mon, 25 May 2026 13:00:55 +0000

Multisig wallets are widely considered one of the most secure methods for managing cryptocurrency assets, especially for teams, DAOs, organizations, and high-net-worth individuals. Unlike traditional single-signature wallets, multisig requires multiple private keys to approve a transaction, significantly reducing the risk of a single point of failure.
However, despite their strong theoretical design, multisig wallet hacks continue to happen frequently. Most of these incidents occur not because of bugs in the multisig smart contract itself, but due to weak threshold configurations, poor key management, improper owner controls, and human mistakes. Attackers often exploit low-threshold multisigs (especially 1-of-N setups) to gain full control and drain funds or mint unauthorized tokens.
In one recent incident, attackers compromised a single signer in a low-threshold multisig, took over ownership, and minted millions of dollars worth of unbacked stablecoins, leading to heavy depegging.
In 2025–2026, multiple high-profile incidents have shown that even projects using multisig lost millions because they did not follow strict security practices.
This comprehensive guide provides practical, actionable steps combined with technical analysis to help you build a robust, hack-resistant multisig wallet.

1. Popular Multisig Wallet Tools & Platforms

Here are the most widely used and trusted multisig solutions with their key features:

Safe (formerly Gnosis Safe) Most popular multisig for Ethereum and EVM-compatible chains. Uses a smart contract-based proxy architecture. Supports modules, guards, spending limits, and timelocks. Highly customizable and audited. Best for DAOs and DeFi projects.
Squads Leading multisig solution on Solana. Very user-friendly interface with strong security features. Supports SquadsX for advanced governance. Ideal for Solana-based teams and projects.
Fireblocks Institutional-grade MPC (Multi-Party Computation) wallet. Not a traditional multisig but offers similar or better security. Used by exchanges, funds, and large organizations. Provides strong compliance and insurance options.
BitGo Enterprise-level custody and multisig solution. Supports both multisig and MPC. Offers advanced policy controls, cold storage, and insurance up to $250M+. Best for institutions and large funds. Recommendation: For most users and small-medium projects : Safe (EVM) or Squads (Solana). For large institutions : Fireblocks or BitGo.

2. Multisig Fundamentals & Technical Architecture

How Multisig Works Technically:

Uses threshold cryptography : requires m out of n signatures to execute a transaction.
On Ethereum/EVM: Safe uses proxy pattern + Safe.sol smart contract with functions like addOwner(), removeOwner(), and execTransaction().
Signature validation follows EIP-1271.
Recommended Technical Setup:
Threshold: 2-of-3 for small teams, 3-of-5 or 4-of-7 for high-value projects.
Use deterministic deployment (CREATE2) for verifiable addresses.
Enable Guard modules and fallback handlers.

3. Multisig Setup Best Practices

Always use hardware wallets (Ledger, Trezor, Coldcard) as signers.
Separate multisigs for different roles (daily operations vs critical actions).
Deploy only on the audited platforms mentioned above.

4. Advanced Key Management (Technical)

Use BIP-39 + BIP-44/49/84 standards for seed phrases.
Store seeds offline only using metal backups (Cryptosteel).
Each signer must use separate seeds and different derivation paths.
Enable YubiKey / FIDO2 hardware authentication.
Avoid key reuse between personal and multisig wallets.

5. Safe Transaction Signing – Technical Rules

Never allow blind signing (eth_sign). Always use eth_signTypedData_v4 (EIP-712).
Before signing, verify recipient address, calldata, value, and nonce.
Implement timelock (24–48 hours) for large or critical transactions.
Use Transaction Guard modules to restrict dangerous operations.

6. Major Technical Attack Vectors & Mitigations

Single Key Compromise Root Cause: Low threshold (1-of-N) Prevention: Use minimum 3-of-5 threshold.
Owner Takeover Root Cause: Easy owner addition/removal Prevention: High threshold + timelock on owner changes.
Unauthorized Minting/Upgrades Root Cause: Weak access control Prevention: Role separation + spending limits.
Phishing & Malware Root Cause: Compromised signer device Prevention: Dedicated clean hardware devices.
Malicious Approvals Root Cause: Unlimited approve() Prevention: Regular revocation via Revoke.cash.
DelegateCall Exploitation Root Cause: Unsafe modules/guards Prevention: Whitelist trusted modules only. Key EIPs to Follow: EIP-712, EIP-1271, EIP-4337.

7. Ongoing Technical Maintenance

Monthly audit of owners and threshold.
Quarterly recovery testing.
Simulate transactions on Tenderly.
Monitor using Etherscan, DeBank, and platform dashboard.
Consider MPC wallets for very high-value projects.

Pro Tips for Maximum Security

Ideal setup: 3-of-5 Safe with Guard + Timelock module.
Critical actions should need a higher threshold.
Always do video call confirmation for sensitive transactions.
Test on testnet first.
Get insurance for large holdings.

AI + Formal Verification: The Final Form of Secure Software Development – Lessons from Vitalik Buterin

Saravana kumar — Tue, 19 May 2026 13:00:39 +0000

On May 18, 2026, Ethereum co-founder Vitalik Buterin published an important article titled "A shallow dive into formal verification".
In this post, Vitalik explores how AI-assisted formal verification is becoming one of the most powerful tools for building highly secure and optimized software, especially in blockchain, cryptography, and other high-stakes systems.
He argues that we are moving toward what Yoichi Hirai calls the "final form of software development", where we can write highly optimized low-level code while mathematically proving its correctness against a high-level specification.

What is Formal Verification?

Formal verification is the process of mathematically proving that your code behaves exactly as specified, using tools like Lean 4, Coq, or Isabelle.
Instead of relying only on tests, you create machine-checkable proofs that your implementation satisfies certain properties such as no overflow, no reentrancy, correct state transitions, and more.
Simple Example in Lean 4:
def fib : Nat → Nat
| 0 => 0
| 1 => 1
| n + 2 => fib (n + 1) + fib n

theorem fib_mod3 (k : Nat) :
fib (3 * k + 1) % 2 = 1 ∧
fib (3 * k + 2) % 2 = 1 ∧
fib (3 * k + 3) % 2 = 0 := by
induction k with
| zero => decide
| succ k ih =>
simp [fib]; omega
This is not just documentation. It is a proof that the computer can verify automatically.

Why This Matters for Developers

Unprecedented Security for Smart Contracts and Crypto
One bug in a smart contract can lead to millions in losses. Formal verification allows us to prove critical properties like safety, liveness, and correctness at the bytecode or assembly level.
Efficiency and Correctness Together (The Game Changer)
Let AI generate highly optimized low-level code (EVM bytecode, RISC-V assembly, etc.).
Write a clean, readable high-level specification or implementation.
Use Lean to prove that both versions are mathematically equivalent.This combination gives you the best of both worlds: performance and trustworthiness.
End-to-End Verification
Modern projects are moving beyond verifying just the specification. They are now verifying the actual implementation that runs on the blockchain (for example, evm-asm and Verified zkEVM projects).

Practical Advice for Developers (Actionable Steps)

Start experimenting now:

Explore the evm-asm project (EVM implementation in assembly with Lean proofs).
Check ongoing Verified zkEVM and formal consensus protocol efforts.
Try Vyper with its growing formal verification features.
Leverage AI Effectively:
Use models like Leanstral, Claude, or Deepseek to generate both code and proof drafts.
You don’t need to write full proofs manually. AI can produce a strong starting point for you to refine.
Best Practices for Security-Critical Code:
Define formal specifications for invariants (access control, arithmetic safety, state transitions).
Maintain redundant layers: code + types + tests + formal proofs.
Focus first on your most critical modules (crypto primitives, parsers, virtual machines).

Important Limitations

Vitalik is clear that formal verification is not a silver bullet:

Partial verification leaves non-verified parts vulnerable.
A wrong specification makes the proof useless.
Hardware-level attacks (side-channels, timing) are outside most formal models.
The proof assistant itself (for example, Lean) could theoretically have bugs.

The real power comes from defense in depth by combining formal proofs with testing, audits, and good engineering practices.

The Road Ahead

AI is making bug discovery easier than ever. Instead of fearing it, developers can use the same AI to create mathematically proven correct systems.
As Vitalik and others suggest, “The defects are finite, and we are entering a world where we can finally find them all.”
Developers who adopt formal verification and AI workflows today will lead the next generation of secure blockchain infrastructure, cryptographic libraries, and high-assurance systems.

Top 10 Crypto News Websites Every Developer Should Track for Security Intelligence and Hack Reports

Saravana kumar — Thu, 14 May 2026 11:48:10 +0000

Blockchain and cryptocurrency move at breakneck speed. For developers building dApps, smart contracts, bridges, or wallets, writing secure code is just the starting point. You need continuous access to real-time intelligence on emerging vulnerabilities, detailed post-mortem analyses of hacks, on-chain forensics, audit insights, and latest threat trends. The crypto space has already lost tens of billions of dollars due to exploits like smart contract bugs, private key compromises, bridge attacks, and social engineering.
Following the right sources regularly helps you move from reactive fixes to building truly proactive and resilient systems. Here is a detailed breakdown of the top crypto news websites every developer should bookmark and check often.

1. CoinDesk (coindesk.com)

CoinDesk is one of the most authoritative and trusted general crypto news platforms. It delivers timely and high-quality coverage of major hacks, exchange breaches, protocol-level security incidents, regulatory developments affecting security, and broader industry risks.
Developers benefit from its in-depth reporting on Layer 2 solutions, protocol upgrades, institutional adoption risks, and breaking security events. The platform also provides price data, research, indices, and analysis that give important context on how market movements or regulations can affect project security. Its "Latest Crypto News" section and exploit coverage make it a solid daily starting point.

Core Expertise:

Breaking news on major security incidents and hacks
Regulatory and policy updates impacting security
Market context and broader industry risk analysis
Credible, high-standard journalism

2. De.Fi REKT Database (de.fi/rekt-database)

The De.Fi REKT Database is a manually curated and comprehensive repository of thousands of documented scams, DeFi exploits, exit scams, phishing attacks, and other Web3 incidents. It includes total funds lost calculations, categorizations by attack type and chain, detailed vulnerability breakdowns, and useful analytical insights.
Created by the De.Fi security team, it serves as a powerful reference for threat modeling. Developers can search specific projects, study recurring problems such as access control flaws or admin key compromises, and learn preventive patterns. This database helps avoid repeating past mistakes and supports smarter architecture decisions.

Core Expertise:

Historical database of Web3 exploits and scams
Attack categorization and loss tracking
Threat modeling from real past incidents
Identifying recurring vulnerability patterns

3. SlowMist Hacked (hacked.slowmist.io)

SlowMist maintains one of the largest independent blockchain security incident databases. It tracks thousands of hack events with cumulative losses exceeding tens of billions of dollars. The site categorizes incidents by type and ecosystem, providing clear descriptions, timelines, loss amounts, and attack methods.
It features real-time updates on latest exploits and releases monthly security reports that analyze trends like supply chain attacks, phishing, and private key leaks. For developers, this is an invaluable raw data source for research, pattern recognition, and strengthening code security.

Core Expertise:

Large independent hack database management
Monthly security trend analysis
Real-time exploit tracking
Detailed attack vector documentation

4. QuillAudits (quillaudits.com)

QuillAudits is a leading blockchain security auditing firm that has completed over 1,500 audits and secured protocols with significant total value locked. Their platform offers audit reports, vulnerability leaderboards, blog resources, and tools focused on smart contract security, OPSEC, multisig reviews, and infrastructure protection.
They cover the full protocol lifecycle from design and threat modeling to adversarial audits, operational security, and post-launch monitoring. Developers gain practical insights into both common and emerging vulnerabilities, economic attack vectors, and best practices for building secure systems across DeFi, RWA, and infrastructure projects.

Core Expertise:

Smart contract auditing and code security
Vulnerability identification and classification
Security best practices and OPSEC
Full lifecycle protocol security

5. Rekt.news (rekt.news)

Rekt.news delivers sharp, investigative, and narrative-driven journalism on major DeFi exploits. Their detailed "Rekt" reports break down incidents with timelines, root cause analysis (such as admin key compromises, missing timelocks, upgrade flaws, or oracle issues), and discussions on systemic risks.
The platform's in-depth style helps developers understand not just what happened but why it happened and what broader lessons should be applied. It covers sophisticated attacks across different chains and frequently highlights governance, operational, and architectural failures.

Core Expertise:

Investigative reporting on big DeFi hacks
Deep root cause analysis
Governance and architectural failure breakdowns
Narrative-style post-mortems

6. Cryip (cryip.co)

Cryip is a research-driven platform that delivers crypto and Web3 news, on-chain data analysis, tokenomics research, and strong security intelligence. Its dedicated Security & Hacks section stands out for timely and detailed reporting on real-world exploits and security incidents.
Beyond hacks, Cryip offers weekly on-chain metrics reports across major chains like Ethereum, Solana, and Bitcoin, token unlock schedules with supply impact analysis, fundraising news, and compliance updates that often relate to security and risk management. Its technical yet accessible writing style helps developers connect market context, on-chain data, and practical security implications when designing protocols or building user protection features.

Core Expertise:

Security news combined with on-chain analysis
Weekly on-chain metrics and token unlock reports
Market context for security events
Practical technical intelligence for developers

7. CertiK (certik.com)

CertiK is one of the largest Web3 security platforms. It combines formal verification, smart contract audits, AI-powered tools, and real-time monitoring through Skynet. They have assessed hundreds of billions in market cap, identified tens of thousands of vulnerabilities, and secured thousands of projects.
Developers should follow their research reports, security scores, vulnerability disclosures, and insights on emerging threats. Skynet provides ongoing project monitoring, while their audit methodology and educational content help raise smart contract security standards.

Core Expertise:

Smart contract audits and formal verification
Real-time security monitoring
Security scoring and risk assessment
Enterprise-level vulnerability research

8. Chainalysis (chainalysis.com)

Chainalysis is the leading blockchain analytics and intelligence platform, trusted by law enforcement, regulators, and enterprises. It excels at tracing illicit funds, visualizing transaction flows across chains (including bridges and mixers), and providing deep reports on crypto crime trends, money laundering, sanctions evasion, and post-hack fund movements.
Although enterprise-focused, developers gain critical understanding of how exploits unfold on-chain, how attribution works, and how stolen funds are laundered. This knowledge helps make better decisions on privacy versus compliance, risk modeling, and user safety features.

Core Expertise:

On-chain fund tracing and attribution
Crypto crime and money laundering analysis
Post-hack fund flow tracking
Blockchain forensics

9. TRM Labs (trmlabs.com)

TRM Labs delivers advanced blockchain intelligence, AI agents, and threat graphs across more than 180 chains. Used by governments and financial institutions, it effectively maps illicit activity categories and supports real-time detection and disruption.
Their reports provide macro insights into trends in crypto-related crime. For developers, TRM Labs data helps build more resilient applications, improve fraud prevention, and incorporate risk signals into smart contracts or frontends.

Core Expertise:

Advanced threat intelligence and AI risk detection
Illicit activity tracking and categorization
Fraud prevention and compliance tools
Macro crypto crime trend reports

10. DeFiLlama Hacks (defillama.com/hacks)

DeFiLlama’s Hacks database offers a clean and data-rich view of exploits with total value lost statistics, breakdowns by DeFi versus bridges, chain rankings, attack vectors, techniques, and languages used. It includes searchable tables, visualizations, and export options.
This quantitative resource is excellent for analyzing trends and benchmarking your project’s risk profile against historical data.

Core Expertise:

Quantitative hack data and loss statistics
Attack vector and chain-wise trend analysis
Data visualization of security incidents
Historical risk benchmarking Why Developers Must Track These Sources Regularly Monitoring these platforms helps you learn from past incidents, implement stronger architecture and OPSEC, conduct better audits, and build safer features for users. Security intelligence should become part of your regular workflow.

Pro Tips:

Prioritize Security & Hacks sections on Cryip, SlowMist, Rekt.news, and DeFiLlama.
Set up Google Alerts, RSS feeds, or newsletter subscriptions.
Cross-reference incidents across multiple sources for complete understanding.
Apply learnings immediately: code reviews, multisig and timelock usage, regular audits, and monitoring setup. By actively following these 10 resources, developers can gain a real edge in building secure and resilient blockchain systems in a high-risk environment.

Mistral AI PyPI Supply Chain Attack (mistralai 2.4.6): What Python & AI Developers Must Do Right Now

Saravana kumar — Wed, 13 May 2026 12:06:54 +0000

On May 12, 2026, Microsoft Threat Intelligence along with security firms (Aikido, Wiz, Socket, and others) disclosed that mistralai==2.4.6 on PyPI contained malicious code. This was the official Python client library for Mistral AI's large language models.
The malicious version remained live for only a few hours but may have been downloaded by thousands of developers working on AI agents, trading bots, smart contract tools, RAG pipelines, and internal applications.
Key facts:

Only version 2.4.6 was affected. All other versions are clean.
The package has been removed from PyPI.
This attack is part of the ongoing "Mini Shai-Hulud" campaign that has already compromised many popular packages across PyPI and npm.

How the Malware Worked (Technical Breakdown)

The attack was stealthy and effective:
Execution on Import Malicious code was injected into src/mistralai/client/init.py. Simply running import mistralai on Linux systems triggered the payload.
Payload Delivery It silently downloaded https://83.142.209.194/transformers.pyz to /tmp/transformers.pyz and executed it in the background. The filename was chosen to mimic the legitimate Hugging Face transformers library.
Credential Harvesting The malware searched the system for:

GitHub tokens
Cloud credentials (AWS, GCP, Azure)
API keys
Passwords stored in common locations
Potentially crypto wallet related files
Evasion Techniques
Skipped systems set to Russian language.
On systems appearing to be in Israel or Iran, it had a random chance to run destructive commands that could wipe files.

Immediate Actions for Developers (Do This Today)

1. Check if you installed the malicious version
Check installed version
pip list | grep mistralai

Search in dependency files
grep -E "mistralai==2.4.6" \
requirements*.txt pyproject.toml uv.lock poetry.lock Pipfile Pipfile.lock 2>/dev/null

2. Revert to Safe Version
Downgrade to clean version
pip install mistralai==2.4.5 --force-reinstall

Or install the latest clean version
pip install mistralai --upgrade
3. Scan for Indicators of Compromise
Check for dropped payload
ls /tmp/transformers.pyz

Look for suspicious files
find /tmp -name "transformer" -type f 2>/dev/null
4. Rotate All Secrets

Rotate GitHub Personal Access Tokens (especially those with broad scopes)
Rotate cloud access keys
Change API keys used with Mistral services
Update secrets in CI/CD pipelines

Long-Term Defenses Every AI/Python Developer Should Adopt

Dependency Security Checklist:

Always pin exact versions in production (never use loose versions like mistralai).
Use lock files (poetry.lock, uv.lock, etc.) and regularly audit them.
Add dependency scanning in CI/CD (pip-audit, safety, osv-scanner, Dependabot).
Generate SBOMs for critical projects.
Use virtual environments or containers for all experiments.
Wait 24-48 hours before adopting newly released versions of popular packages.
Consider internal package mirrors (Artifactory, Nexus, or simple PyPI cache) for team projects.
For teams heavily using Mistral AI:
Audit all code using from mistralai import Mistral
Review automated dependency update tools and add allow-lists for critical AI packages.
Why This Keeps Happening
Supply chain attacks are increasing because developers often install packages with a single command without verification. Attackers now target widely used tools, especially in the fast-moving AI and crypto development space. The "Mini Shai-Hulud" campaign proves that even official packages from reputable companies can be compromised.

Conclusion

No package is completely safe, even from well-known AI companies like Mistral AI. Security must be part of every developer's daily workflow.
Verify. Pin versions. Scan regularly. Rotate secrets.

Polkadot Bridge Hack: MMR Proof Bug Leads to 1B DOT Mint

Saravana kumar — Mon, 13 Apr 2026 12:10:43 +0000

On April 13, 2026, the Hyperbridge ISMP (Interoperability State Machine Protocol) gateway on Ethereum was exploited. An attacker forged an ISMP PostRequest by exploiting a critical edge-case bug in the Merkle Mountain Range (MMR) proof verification logic combined with missing proof-to-request binding and weak authorization checks in the TokenGateway contract.
The result: 1,000,000,000 bridged DOT tokens were minted in a single atomic transaction, which were immediately swapped for approximately 108.2 ETH ($237,000 – $242,000). Native Polkadot remained completely unaffected. The EthereumHost contract has since been frozen.

On-Chain Summary

Exploit Transaction: 0x240aeb9a8b2aabf64ed8e1e480d3e7be140cf530dc1e5606cb16671029401109
Attacker EOA: 0xC513E4f5D7a93A1Dd5B7C4D9f6cC2F52d2F1F8E7
Master Contract: 0x518AB393c3F42613D010b54A9dcBe211E3d48f26
Helper Contract: 0x31a165a956842aB783098641dB25C7a9067ca9AB
Target Token: 0x8d010bf9C26881788b4e6bf5Fd1bdC358c8F90b8 (Bridged DOT – ERC-6160)
Profit: ~108.2 ETH
Gas Used: ~0.000339 ETH

Root Cause Analysis

The exploit was made possible by a dangerous combination of three vulnerabilities:
1. MMR Library Edge-Case Bug
The Merkle Mountain Range library contained a boundary-condition flaw in leavesForSubtree() and CalculateRoot(). When leafCount == 1, supplying an out-of-range leaf_index (e.g., 1) caused the function to silently drop the forged leaf. The verifier then promoted the next element in the proof array , a stale but legitimate historical root, directly to the computed root position.
This allowed the system to accept a completely forged payload while still passing proof verification.
Fix:
solidity
function leavesForSubtree(uint256 leafCount, uint256 leafIndex) internal pure returns (uint256) {
if (leafIndex >= leafCount) {
revert InvalidLeafIndex(leafIndex, leafCount);
}
// existing logic
}

function CalculateRoot(...) public pure returns (bytes32) {
require(leafIndex < leafCount, "MMR: leaf index out of bounds");
// ...
}
Recommendation: Always add strict bounds checking and unit tests for edge cases where leafCount == 0 or leafCount == 1.

2. Missing Cryptographic Binding Between Proof and Request

HandlerV1 only checked that the request commitment hash (request.hash()) had not been consumed before. However, the proof verification did not cryptographically bind the submitted request payload to the validated MMR proof.
As a result, an attacker could pair any valid historical proof with a completely different malicious request body.
Fix:
solidity
function handlePostRequests(PostRequest calldata request, bytes[] calldata proof) external {
// Bind proof to the exact request
bytes32 commitment = keccak256(abi.encode(request, proof));
require(!consumed[commitment], "ISMP: already consumed");

require(verifyProof(request, proof), "ISMP: invalid proof");
// ...

}
3. Weak Authorization in TokenGateway
Governance actions in TokenGateway used only a shallow source field check instead of the full authenticate(request) modifier:
solidity
function handleChangeAssetAdmin(PostRequest calldata request) internal {
if (!request.source.equals(IIsmpHost(_params.host).hyperbridge()))
revert UnauthorizedAction();

// CRITICAL: authenticate(request) was missing
IERC6160Ext20(erc6160Address).changeAdmin(newAdmin);

}
Additionally, the challengePeriod was set to 0, removing any delay-based safety window.
Fix:
solidity
function handleChangeAssetAdmin(PostRequest calldata request) internal {
authenticate(request); // Full authentication
require(challengePeriod > 0, "Challenge period must be enabled");

IERC6160Ext20(erc6160Address).changeAdmin(newAdmin);

}
4. Dangerous ERC-6160 Privilege Model
The ERC-6160 token standard granted the new admin immediate and unrestricted MINTER_ROLE and BURNER_ROLE upon calling changeAdmin(). There was no time-lock, multi-signature requirement, or secondary confirmation.
Once the attacker’s helper contract became the admin, it could mint 1 billion DOT tokens in a single call.
Fix Recommendations:

Step-by-Step Attack Flow

The attacker funded the EOA through Railgun shielded pools and Synapse Bridge for obfuscation.
Deployed a master orchestration contract and a helper contract (which would become the new token admin).
Called HandlerV1.handlePostRequests() with a carefully crafted PostRequest and MMR proof that triggered the leafCount == 1 edge case.
The forged request (action 0x04 – ChangeAssetAdmin) was dispatched to TokenGateway.onAccept().
The helper contract was set as the new admin of the bridged DOT token.
1 billion DOT tokens were minted, approved to OdosRouterV3, and swapped via Uniswap V4 PoolManager for 108.2 ETH in one transaction.

Key Lessons & Developer Checklist

1. Risk: MMR Proof
Vulnerability: Edge case when leafCount == 1
Recommended Fix: Enforce strict validation (leafIndex < leafCount) and add thorough tests
Priority: Critical
2. Risk: Proof Handling
Vulnerability: No binding between proof and request
Recommended Fix: Use a cryptographic commitment over (request + proof)
Priority: Critical
3. Risk: Authorization
Vulnerability: Only a shallow source check is performed
Recommended Fix: Implement full authenticate(request) modifier
Priority: Critical
4. Risk: Governance
Vulnerability: challengePeriod = 0
Recommended Fix: Enforce a minimum delay of 1 hour
Priority: High
5. Risk: Token Admin
Vulnerability: Instant minting rights
Recommended Fix: Add time-lock and separate role management
Priority: High
6. Risk: Architecture
Vulnerability: Single gateway handling all assets
Recommended Fix: Split into separate TokenGateway per asset
Priority: Medium

Additional Best Practices:

Implement real-time monitoring for large mints from the zero address.
Conduct thorough audits of light clients and consensus integrations.
Run a generous bug bounty program focused on proof verification paths.
Always test boundary conditions in Merkle-based verification logic.

Final Thoughts

This exploit highlights a critical truth in cross-chain bridge security: proof verification and authorization must both be bulletproof. A single weakness in either layer can lead to catastrophic consequences.
For developers building bridges, light clients, or token gateways:
Never skip strict bounds checking.
Always cryptographically bind proofs to their payloads.
Treat governance actions with the same (or higher) security standards as asset transfers.

Aethir Adapter Exploit : Complete Technical Postmortem Report

Saravana kumar — Fri, 10 Apr 2026 09:30:53 +0000

Aethir, a decentralized GPU cloud computing platform focused on providing affordable AI and gaming compute resources, faced a security incident on April 9, 2026. The attack targeted the AethirOFTAdapter contract on BNB Chain.

Initially, around 423,000 ATH (~$400K+) was drained during the exploit. However, the latest update confirms that actual user losses are limited to less than $90,000 USD, and Aethir has announced that a full compensation plan will be provided for affected users.

The attacker initially appeared to drain a substantial amount of ATH tokens. However, the Aethir team responded quickly and contained the exploit. The main token supply on Ethereum remained completely safe.

Technical Details:

Exploit Method: transferOwnership(address newOwner)
New Owner Address: 0xd5fa8ac45d6a0984d14f3b301b18910948deb11a
Total Drained: Approximately 423,000 ATH (PeckShield estimate ~$400K+)
Victim Contract: AethirOFTAdapter (Omnichain Fungible Token Adapter on BNB Chain)
Vulnerability Type: Access Control Failure (missing or bypassed onlyOwner modifier and weak ownership validation)
Bridge Used: Symbiosis Finance (cross-chain bridge)
Chains Involved: BNB Chain (exploit origin) to TRON (final destination)
Attack Complexity: Low – no flash loan, no price oracle manipulation, pure ownership takeover
The attack was simple yet effective. The attacker directly called the transferOwnership function on the AethirOFTAdapter smart contract. This function allowed them to become the new owner without proper authorization checks. Once they gained ownership, they could freely call sensitive functions like token transfers. They drained the available ATH tokens held in or controlled by the adapter contract. This highlights a common risk in bridge and adapter contracts that rely on ownership patterns for admin control, especially in omnichain setups using standards similar to LayerZero OFT.
After draining the tokens, the attacker did not hold them long on BNB Chain. They quickly routed the funds through multiple intermediate wallets to obscure the trail. Finally, they used the Symbiosis Finance bridge to move everything to the TRON network. This cross-chain move makes tracking and freezing harder across different blockchains.

On-Chain Funds Flow (Exact Verified Addresses):

Initial Receiver (Exploiter): 0xd5fa8ac45d6a0984d14f3b301b18910948deb11a received 423K ATH
Intermediate Wallet 1: 0x0BB5EC0B8931F3Ae1587F2b4c4f1885343B0BDC7 received 324K ATH
Intermediate Wallet 2: 0x3A94447A7a5e5a28326ebc6730C48b0c7092F963 received 324K ATH plus additional 202K movement
Bridge Step: Symbiosis Finance (green bridge in PeckShield diagram)
Final TRON Wallets:
TL38ssgWktRRfhdjGEyfVkPD8CdP2UPq18
TNC4wgK518RZdZVa6NPZLnqy6FEswA4G15 The funds are currently split and sitting dormant on these two TRON addresses. No further transfers, mixing services, or cash-out attempts have been observed as of April 10, 2026. This gives the Aethir team and supporting exchanges a window to coordinate freezes if possible.

Timeline of Events:

April 9, 2026 : Exploit executed and funds drained on BNB Chain.
April 9 evening : PeckShieldAlert publicly flagged the incident with flow diagram.
April 10 early morning : Full amount bridged to TRON.
April 10 : Aethir official statement released.

Aethir Official Response:

Aethir team confirmed the incident and stated that all compromised bridge contracts have been disconnected immediately. The main ATH token supply on Ethereum remains 100% intact and unaffected. The ETH-ARB bridge using Squid is also safe. They estimated user impact below $90,000 USD and announced that a detailed full compensation plan will be released next week. The team is also working with exchanges to help monitor and potentially freeze the attacker wallets.

Impact Assessment:

This exploit affected only the specific bridge adapter on BNB Chain. Core protocol operations, decentralized GPU network, and primary token reserves were not impacted. The quick response from both PeckShield and Aethir prevented wider damage. Compared to other recent bridge hacks, this one was contained relatively well with lower user loss. However, it still shows the persistent risks in cross-chain infrastructure.

Why This Vulnerability Matters:

Omnichain adapters like OFT are designed to make tokens move seamlessly across chains. But they often inherit ownership control patterns from standard ERC-20 or LayerZero implementations. If access control is not hardened with multi-sig, timelock, or renounceOwnership, a single function call can lead to total compromise. This case serves as a reminder for all DeFi projects using bridges.

Recommendations for Projects:

Implement multi-signature wallets with timelock delays for all admin functions including transferOwnership.
Consider full ownership renouncement after initial setup where possible.
Add 2-step verification or DAO governance for sensitive operations.
Integrate real-time monitoring tools like PeckShield, CertiK, or Forta.
Conduct regular third-party audits specifically focused on bridge and adapter contracts.
Test ownership-related functions thoroughly in staging environments.

Recommendations for Users:

Keep large holdings on the main Ethereum chain rather than bridged versions when not needed.
Be cautious with new or less-audited bridge integrations.
Monitor official project channels for security updates.

The Evolution of Token Hijacking: AI-Powered OAuth Device Code Phishing

Saravana kumar — Wed, 08 Apr 2026 10:34:32 +0000

A new generation of cyberattacks is moving beyond simple credential theft toward Session and Token Hijacking. By abusing the OAuth 2.0 Device Authorization Grant (RFC 8628), threat actors are bypassing traditional MFA and Phishing protections. This attack doesn't steal your password; it steals your identity's "keys" while you perform a legitimate login on a trusted Microsoft domain.

The Core Vulnerability: Device Code Flow Misuse

The Device Code Flow was designed for input-constrained devices (like Smart TVs or CLI tools) that cannot easily render a browser.
The Protocol Logic
The standard flow follows this path:$$Client \rightarrow Device\ Authorization\ Endpoint \rightarrow User\ Code \rightarrow User\ Auth \rightarrow Access\ Token$$
The Security Gap
The critical flaw lies in the decoupling of the authentication session. The user authenticates independently of the client requesting the token. Because there is no browser session binding the victim to the attacker’s machine, the attacker can initiate the flow and simply wait for the victim to "authorize" it.

Technical Attack Chain: Step-by-Step

AI-Enhanced Reconnaissance
Attackers use LLMs to automate reconnaissance. By hitting the GetCredentialType endpoint, they validate targets before ever sending an email.

Endpoint: https://login.microsoftonline.com/common/GetCredentialType
Goal: Confirm account existence and identify federated tenants to ensure a high Return on Investment (ROI).
Social Engineering & Evasion
Using AI, attackers generate hyper-personalized, role-based phishing content (e.g., HR onboarding docs for new hires). To bypass URL filters, they host their redirectors on legitimate serverless infrastructure:
Platforms: Vercel, Cloudflare Pages, AWS Lambda.
Tactic: Multi-hop redirects and domain cloaking to hide the malicious backend.
The "Just-in-Time" Device Code Injection
Unlike older attacks that used static codes, modern "Phishing-as-a-Service" (PhaaS) like EvilTokens generates codes dynamically.
Trigger: The moment a victim clicks the phishing link, the attacker's backend sends a POST request to /devicecode.
Payload:
JSON
{
"client_id": "ATTACKER_APP_ID",
"scope": "openid profile offline_access",
"verification_uri": "https://microsoft.com/devicelogin"
}

Delivery: The victim is shown a legitimate Microsoft login page. Since the domain is microsoft.com, traditional "look-alike domain" detectors fail.
The Polling Loop (Token Harvesting)
While the victim logs in, the attacker’s script runs a polling loop to catch the token the moment authentication is complete:
Python
while True:
response = requests.post(token_endpoint, data=polling_payload)
if "access_token" in response:
store_tokens(response.json())
break
time.sleep(3) # Rapid polling for near-instant hijacking

Post-Exploitation: Living off the Graph

Once the access_token and refresh_token are secured, the attacker has full API access via Microsoft Graph.
Persistence: Registering a new managed device to generate a Primary Refresh Token (PRT), allowing long-term access even if the user changes their password.
Exfiltration: Silently creating inbox rules to forward emails containing keywords like "Invoice" or "Payment" to an external attacker-controlled address.

Why Traditional Defenses Fail

The effectiveness of this attack lies in its ability to operate within the boundaries of legitimate authentication traffic. Rather than trying to steal a secret, the attacker tricks the user into performing a valid action on the attacker's behalf.

Multi-Factor Authentication (MFA)
The user completes the MFA challenge themselves on the official Microsoft portal. Because the authentication happens on a real, trusted session, the attacker receives a fully validated token without ever needing to see or bypass the MFA prompt.

Password Monitoring
This method does not actually steal credentials. Since the user enters their password directly into the genuine Microsoft site, "leaked password" databases and local password-sharing protections are never triggered. There is no "stolen password" to detect.

URL Filtering
Most web filters and email gateways are configured to trust microsoft.com implicitly. Because the final destination of the phishing link is a legitimate, high-reputation domain, the attack often bypasses automated security scanners that look for "look-alike" or malicious domains.

Engineering-Level Mitigations

Detection Engineering (KQL)
Security teams should monitor Azure AD Sign-in logs for anomalies in the deviceCode protocol.
Code snippet
SigninLogs
| where AuthenticationProtocol == "deviceCode"
| where AppId !in (Your_Trusted_App_IDs)
| summarize count() by UserPrincipalName, AppId, IPAddress

Strategic Hardening
Conditional Access (CA): Restrict Device Code Flow to specific, trusted IP ranges or compliant devices.
Continuous Access Evaluation (CAE): Enable CAE to revoke tokens in real-time if a risk is detected.
Disable the Flow: If your organization does not use CLI tools or smart devices that require this flow, disable it entirely via the Authentication Methods policy in Entra ID.

Conclusion

The shift from Credential Theft to Token Hijacking represents a significant leap in attacker maturity. As AI continues to automate the "human" element of phishing, developers must move toward a Zero Trust architecture where no OAuth flow is considered safe by default. Trust the protocol, but verify the context.