Fresh incidents, analyzed daily.
AI-assisted first pass, reviewed by us before it's published here.
AFX Trade Arbitrum Bridge Drained for $24.15M Following Multi-Sig Validator Key Compromise
Attackers compromised 5 out of 9 validator keys on AFX Trade's third-party Arbitrum bridge, reaching quorum to execute a fraudulent $24.15 million USDC withdrawal into Ethereum.
Undocumented Tenda Router Backdoor Exposed: Hardware Risks to Node Operators and RPC Endpoints
Security researchers uncovered an undocumented administrative backdoor (CVE-2026-11405) across multiple Tenda router models, allowing attackers to hijack network traffic and modify DNS settings.
Phishing signature drains $999,999 in USDT from Ethereum wallet
An Ethereum user reportedly lost $999,999 in USDT after signing a fraudulent approval. Attackers then used Multicall to move and split the funds quickly across a few transactions. The incident is another example of token-approval phishing at high value.
Aurum / NEYRO report alleges custodial drain hidden as “AI trading”
A forensic report alleges that Aurum’s NEYRO product did not perform real trading and instead routed deposits into a pool controlled by the operator. The report says user funds were then swept out and spread across many wallets. The claimed losses are in the tens of millions.
Gravity Bridge reportedly drained in suspected signing-key compromise
Gravity Bridge was reported to have lost about $5.4 million in what investigators suspect was a signing key compromise. Validators reportedly halted the bridge while the incident was investigated. The case highlights the danger of privileged key theft in cross-chain systems.
LayerZero-based cross-chain trick leads to Kelp DAO theft and Aave spillover
A cross-chain attack on Kelp DAO was reported to have released 116,500 rsETH to an attacker after a message was accepted as legitimate. The stolen assets were then used to borrow heavily across DeFi platforms, including Aave, contributing to a broader market panic and large withdrawals.
JFrog Artifactory Zero-Days Uncovered: How Package Registry Flaws Expose Web3 Build Pipelines
Critical privilege escalation zero-days in JFrog Artifactory allow unauthenticated attackers to breach package repositories, posing a severe threat of malicious dependency injection in Web3 CI/CD pipelines.
Garden Finance Exploit: Supply Chain Compromise Drains $450K USDT Across Multiple Chains
An off-chain solver database breach allowed hackers to inject fake transaction records into Garden Finance’s HTLC bridge, mistakenly releasing $450K USDT across Ethereum, Arbitrum, Base, and BNB Chain.
WEMIX Smart Contract Hacked: $6.25M in Stablecoins Illegally Minted After Owner Key Compromise
Attackers compromised the owner/admin credentials for WEMIX$ stablecoin smart contracts, fraudulently minting 5.22M unbacked tokens before swapping and bridging out $6.25 million.
Russian APT Campaign Targeting Zimbra Mail Servers: A Blueprint for Targeted Web3 Phishing
International intelligence confirms an APT campaign targeting Zimbra webmail servers. Compromised internal communications directly enable high-precision social engineering against protocol admins and multisig keyholders.
Critical Check Point Firewall Zero-Day Hit by Active Exploitation: A Direct Threat to Validator Integrity
A CVSS 9.1 authentication bypass in Check Point SmartConsole allows attackers to modify firewall policies, potentially exposing isolated crypto bridge validators to direct intrusion.
Active $9.7M Exploit Hits Crypto Payment Processor Triple-A
Crypto payment processor Triple-A is facing an ongoing hot wallet breach, with over $9.7M routed to a single attacker address—and deposits are still live. Read our breakdown of the attack and crucial security hardening practices every crypto business must implement to prevent key compromises.
Ostium drained of $23.75M in oracle signer key compromise
Ostium confirmed a loss of 23,752,746 USDC from its OLP vault after an attacker obtained an oracle signer private key. The protocol paused trading and later reopened after hardening measures. The funds were converted into ETH and routed through Tornado Cash.
Verus Ethereum Bridge hit again in $7.54M exploit
The Verus Ethereum Bridge suffered another exploit, this time draining about $7.54 million from the same bridge contract hit earlier in the year. Security researchers said the attack used the bridge’s import path to trigger payouts that were not properly backed on the source side. The incident added to a series of bridge losses this month.
AFX Trade loses $24.15M after bridge validator keys are compromised
AFX Trade was drained of about $24.15 million in USDC after an attacker compromised the signing keys used by its bridge validators. The withdrawal was accepted by the protocol because enough validator signatures were present. The stolen funds were then moved to Ethereum and swapped for ETH.