English
BlockSec
Report

BlockSec✓

@BlockSecTeam

Smart Contract Audit | Security Monitoring | AML/CFT (KYA/KYT) | Crypto Investigation | @Phalcon_xyz @MetaSleuth @MetaDockTeam 👉TG: https://t.co/owokTLanv5

154 Following27.3K Followers2.3K Posts
  1. BlockSec✓@BlockSecTeam
    If your crypto gets stolen today, you usually have two options: pay a professional firm thousands of dollars, assuming they'll even take a small case, or just give up. We built Trace AI to give you a third. It runs on the same tracing tech behind @MetaSleuth, which our team has used on on-chain cases worth over a billion dollars. 8 chains, 10 languages, and it starts at $5.
    221224.5K
  2. BlockSec✓@BlockSecTeam
    BlockSec
    RT @Phalcon_xyz: Our system detected a suspicious transaction targeting zkLink @zkLink_Official Nova, resulting in approximately $780K in losses. The root cause was flawed authentication-state verification in the Arbitrator, combined with a caller-controlled external call in the claim path. The protocol uses an Arbitrator to claim authenticated messages from source-chain message services and forward them through destination gateways. During a legitimate claim, an authenticated gateway callback stores finalizeMessageHash, which the Arbitrator checks against the expected source gateway, value, and message. However, the Arbitrator failed to clear finalizeMessageHash between claims. Since transient storage persists until the transaction ends, a second claim could reuse the first claim’s authentication hash without a fresh authenticated callback. The claim path also accepted a caller-supplied target and calldata, allowing the attacker to execute a privileged root update through the Arbitrator and then pass verification using the stale hash. The attacker exploited this in five steps: 1. Called the publicly accessible SyncL2TxHashRelayer to claim a valid Linea message synchronizing two transaction hashes. The authenticated callback populated finalizeMessageHash, and the Arbitrator forwarded the legitimate message to the Ethereum Gateway. 2. Called the same entry point again within the same transaction, replacing the Linea message-service target with the Ethereum Gateway and supplying sendMessage() calldata to invoke syncBatchRoot(116409, attackerChosenRoot, 0). 3. The Ethereum Gateway accepted the call from the trusted Arbitrator. The zkLink contract then accepted the attacker-chosen root because the update came from its authorized Gateway. 4. The second claim triggered no fresh authentication callback. By supplying the same expected source gateway, value, and message as the first claim, the attacker passed the Arbitrator’s hash check using the remaining finalizeMessageHash. 5. Submitted 12 withdrawal proofs matching the newly installed root, withdrawing 22.4313 ETH and 11 ERC20 assets, including approximately 245.74 pufETH, 18,113.45 USDC, and 12.57 ezETH. The funds came from the zkLink contract’s ETH holdings and the ERC20 Bridge’s token reserves. All 12 withdrawal proofs reconstructed the attacker-installed root; the failure occurred in authenticating the root update. Attack TX:
    020243
  3. BlockSec✓@BlockSecTeam
    BlockSec
    RT @Phalcon_xyz: Who can approve transactions? Who controls privileged access? How does the team respond to incidents? These are operational security questions. BlockSec’s SEAL @_SEAL_Org Certification Assessment evaluates operational controls and supporting evidence against the SEAL framework, with scope determined by the team’s systems, responsibilities, and risks. Explore the six modules and the assessment process 👇
    Security Alliance @_SEAL_Org
    If your protocol is ready to get certified, these firms are accredited and taking clients now. Already working with one of them? Ask about SEAL Certifications starting today. @audit_wizard @BlockSecTeam @chain_security @Composable_Sec @ConsensysAudits @cyfrin @DefiSafety @hackenclub @HackenProof @SecurityOak @OpenZeppelin @opsek_io @Quantstamp @0xshield3 @sigp_io @statemindio @trailofbits @Wonderland @zellic_io @zeroshadow_io Announcement:
    040401
  4. Security Alliance✓@_SEAL_Org
    Posts @_SEAL_Org
    If your protocol is ready to get certified, these firms are accredited and taking clients now. Already working with one of them? Ask about SEAL Certifications starting today. @audit_wizard @BlockSecTeam @chain_security @Composable_Sec @ConsensysAudits @cyfrin @DefiSafety @hackenclub @HackenProof @SecurityOak @OpenZeppelin @opsek_io @Quantstamp @0xshield3 @sigp_io @statemindio @trailofbits @Wonderland @zellic_io @zeroshadow_io Announcement:
    16468.6K
  5. BlockSec✓@BlockSecTeam
    BlockSec
    RT @Phalcon_xyz: A few hours ago, a USDC tranche vault on Avalanche lost ~$1M due to inconsistent principal accounting in the fund-user claim path. The vault has two roles: the fund provider, who deposits and withdraws principal, and the fund user, who borrows funds from the tranche and is responsible for repaying them. The attacker controlled both roles within the same tranche, allowing them to deposit funds as the provider and immediately borrow them as the user. The claim function deducted borrowed but unmatured principal from total deposits, but ignored matured yet unrepaid principal. When the attacker claimed again after maturity, the function first processed maturity records using the current timestamp, moving the previously borrowed principal into the matured balance, then checked the available amount. Because the calculation omitted the matured balance, it incorrectly restored the full borrowing allowance, even though nothing had been repaid. Flawed formula: Available = Total deposited − Borrowed, not yet matured Correct formula: Available = Total deposited − Borrowed, not yet matured − Matured, not yet repaid The fund-provider withdrawal function correctly deducts both balances, while the fund-user claim function omits matured but unrepaid principal. Key attack steps: 1. The attacker created a tranche with the same address as both fund provider and fund user, setting its maturity shortly afterward. 2. Using an Aave flash loan, the attacker deposited 1,013,353.61 USDC as the fund provider, then borrowed the entire principal as the fund user in the same transaction. They used those funds to repay the flash loan, paying a 506.68 USDC fee. 3. After 163 blocks, once maturity had passed, the attacker called claim again. The incorrectly restored allowance let them borrow another 1,013,353.61 USDC without repaying the first tranche loan or making a new deposit. The second borrowing was funded by other users’ principal deposits in the vault. Attack TX:
    050421
  6. BlockSec✓@BlockSecTeam
    BlockSec
    RT @0xboo: 2/ Of course, none of this happens without our top-tier audit providers: @ABDKconsulting, @AdevarLabs, @bailsecurity, @BlockSecTeam, @Certora, @chain_security, @ConsensysAudits, @cyfrin, @dedaub, @GuardianAudits, @hackenclub, @HackenProof, @HalbornSecurity, @Hashlock_, @hexensio, @immunefi, @KannAudits, @LeastAuthority, @lethalspoons, @MixBytes, @NethermindSec, @OpenZeppelin, @Quantstamp, @QuillAudits_AI, @rv_inc, @SecurityOak, @sherlockdefi, @spearbit, @statemindio, @Veritylab, @yAuditDAO, @zellic_io, and @zokyo_io 🤝 Huge thanks for continuing to fund this support for builders!
    010598
  7. BlockSec✓@BlockSecTeam
    BlockSec
    RT @0xboo: 1/ 🔐 Extension secured! 185 applications. 60+ projects supported. $500k in subsidies allocated. We’re excited to bring 3 more months of the Ethereum Security Subsidy Program to @ethereum builders. Big thanks to @ethereumfndn and @NethermindSec for helping make the pilot program a success - let’s keep it going!
    080482
  8. BlockSec✓@BlockSecTeam
    BlockSec
    RT @Phalcon_xyz: ALERT! Our system detected a suspicious transaction targeting @x100global on Ethereum, resulting in an estimated loss of $4.75M. The root cause stems from a governance design flaw that allowed the attacker to acquire two of three Senate seats using flash-loan-funded X tokens and immediately approve and execute a malicious treasury proposal within the same transaction. The attacker purchased X tokens using flash-loaned funds, distributed them to two controlled contracts, and froze them in the Freezer to obtain Senate seats. The attacker then created and supplied liquidity to a PancakeSwap V3 X-USDT pool. Using the captured majority, the attacker executed a proposal directing the Freezer to swap 400,000 X tokens into that pool with the minimum output set to zero, receiving only about 35.68 USDT. Finally, the attacker withdrew the liquidity, sold part of the recovered X tokens through the existing Uniswap V3 X-USDT pool, and repaid the flash loan. Attack TX:
    090444
  9. BlockSec✓@BlockSecTeam
    BlockSec
    RT @Phalcon_xyz: A few hours ago, a NEM liquidity pool on #BSC lost ~$820K in a price manipulation attack that exploited a flaw in the NEM token’s tax-settlement mechanism. The vulnerability lay in _flushLpSellRecycle(), which calculated the burn amount using pendingLpSellRecycle and burned NEM directly from the liquidity pool’s balance. It then called sync() to update the reserves, allowing the pool’s NEM price to be manipulated. The attack proceeded as follows: 1. Transferred NEM directly to the pool to simulate sells and increase pendingLpSellRecycle. 2. Invoked skim() to recover most of the transferred tokens, reducing the attack cost without reducing pendingLpSellRecycle. 3. Invoked flushLpSellRecycle() to burn NEM from the pool. The burn amount was calculated as 70% of the pending amount, subject to pool-balance caps. The subsequent sync() call reduced the recorded NEM reserve, increasing NEM’s price relative to USDT. 4. Repeated steps 1–3 to raise the price further, then swapped NEM for USDT to realize a profit. Attack TX:
    080418
  10. BlockSec✓@BlockSecTeam
    BlockSec
    RT @Phalcon_xyz: 🗓 Weekly Web3 Security Roundup | Oct 12 - Oct 18 🚨 Spotlight on 3 notable incidents | ~$3.87M lost this week Featuring a vulnerability breakdown and in-depth analysis of selected key cases👇
    020435
  11. BlockSec✓@BlockSecTeam
    Give @MetaSleuth a try, a much more cost-effective option for on-chain analysis and fund tracing.
    BlockSec MetaSleuth @MetaSleuth
    . @arkham now limits free users to the latest 100 transactions, with 1500 USD per month for the subscription. Looking for an alternative? Try MetaSleuthh for address intelligence, fund flow analysis, risk screening and monitoring.
    1173K
  12. BlockSec✓@BlockSecTeam
    BlockSec
    RT @MetaSleuth: . @arkham now limits free users to the latest 100 transactions, with 1500 USD per month for the subscription. Looking for an alternative? Try MetaSleuthh for address intelligence, fund flow analysis, risk screening and monitoring.
    010487
  13. BlockSec✓@BlockSecTeam
    BlockSec
    RT @Phalcon_xyz: .@_Qubic_ was reportedly exploited due to weak wallet seed generation. The issue now appears to have been fixed: However, the vulnerability was reported as early as February and does not appear to have been properly addressed at the time. The current fix also appears to follow the recommendation in that report: replacing Math.random() with crypto.getRandomValues(). Reports affecting critical components such as wallet seed generation deserve timely attention and follow-up.
    Qubic @_Qubic_
    Security incident update. Between 23:42 UTC on 17 October and 01:26 UTC on 18 October, an attacker drained 1,404 Qubic wallets, totalling around 2.94 trillion QU. Here is what happened, what has been done, and what comes next.
    0100454
  14. Qubic✓@_Qubic_
    Security incident update. Between 23:42 UTC on 17 October and 01:26 UTC on 18 October, an attacker drained 1,404 Qubic wallets, totalling around 2.94 trillion QU. Here is what happened, what has been done, and what comes next.
    Download
    107145624227K
  15. BlockSec✓@BlockSecTeam
    BlockSec
    RT @Phalcon_xyz: .@UNCX_token was exploited across multiple chains for ~$1.5M. The root cause was inconsistent accounting of _totalTokenShares between release() and cancel(). This variable tracks the total outstanding shares of all schedules for a token. Specifically, after release(), a schedule with _depositedShares = D and schedule.released = R has only D − R shares remaining in _totalTokenShares. However, cancel() removes D − V, where V is the recalculated vestedShare. This accounting assumption can be broken through a donation followed by a top-up, which increases schedule.totalAmount while minting very few new shares and pushes V below R. Consequently, D − V exceeds the schedule’s remaining D − R shares, causing cancel() to deduct shares already removed by release(). This reduces the shared _totalTokenShares denominator and inflates the payout from the schedule retained by the attacker. The key attack steps are illustrated using this exploit transaction: 1. Set up three schedules: The attacker created schedules 5058, 5059, and 5060. They fully released 5059 and 5060 while retaining 5058 for the final withdrawal. 2. Donate: The attacker transferred tokens directly to the vesting contract, inflating the asset-per-share value without minting new shares. 3. Top up and cancel: The attacker topped up schedules 5059 and 5060 with future-vesting tokens. Due to the manipulated share price, the top-ups greatly increased schedule.totalAmount while minting very few new shares, pushing vestedShare below schedule.released. Cancelling the schedules then deducted previously released shares from _totalTokenShares again. 4. Extract profits: With _totalTokenShares artificially reduced, the attacker released schedule 5058 at an inflated redemption value and repaid the flash loan. The attacker repeated this process to drain assets from the vulnerable contract.
    UNCX Lockers @UNCX_token
    UNCX Vesting V2: Security Incident Update Following the security incident affecting our Vesting V2 contracts across several chains earlier today, we want to share an update on the measures taken, the affected tokens, and what comes next. 1. Security measures and containment We have implemented several measures to prevent further exploitation of the affected contracts: > Introduced substantial flat fees exceeding 1,000 ETH per lock. > Removed all clients and contract interactions that previously allowed these fees to be bypassed. > Increased token fees to the maximum permitted by the Vesting V2 contracts (5%), making repeated vesting top-ups economically unviable. These measures are designed to prevent further exploitation through the identified methods. While our investigation and monitoring remain ongoing, we firmly believe we have taken the necessary steps available to us to contain the incident. 2. Scope of the incident As previously communicated, all LP lockers remain unaffected, across every protocol and chain supported by UNCX. The incident is isolated to UNCX Vesting V2. Our legacy vesting contracts are also unaffected and have undergone additional checks and review. The incident currently involves 10 tokens across 4 chains: Ethereum (6): $pepecoin, $EDGEN, $ZC, $X, $LO0P, $PAAL Base (1): $IMO BNB Chain (1): $BTCLE Robinhood Chain (2): $CASHCAT, $RKST 3. Next steps for affected projects and communities We are already in contact with most of the affected teams, communities or individuals impacted. We expect to share further guidance and next steps with affected teams this week. We will also publish a comprehensive incident report covering the technical findings, financials, and the details of our proposed recovery plan. Important: For all impacted tokens, we strongly advise against trading in the affected pools until further guidance is provided by the respective token teams. We will be coordinating directly with those teams over the coming days. 4. Investigation and recovery efforts Our investigation remains active, and we are coordinating with law enforcement and @seal911. To date, no funds have been returned by the attackers (primary and copycats) on any affected chain. We strongly encourage the responsible party to contact us directly to discuss a resolution. We understand the seriousness of this incident for affected projects, holders, and communities. Our immediate priorities remain preventing further exploitation, establishing the full extent of the impact, and working closely with affected teams toward a recovery plan. We will continue to communicate when any meaningful updates become available. Thank you for your patience. The UNCX Team
    0130438
  16. UNCX Lockers@UNCX_token
    UNCX Vesting V2: Security Incident Update Following the security incident affecting our Vesting V2 contracts across several chains earlier today, we want to share an update on the measures taken, the affected tokens, and what comes next. 1. Security measures and containment We have implemented several measures to prevent further exploitation of the affected contracts: > Introduced substantial flat fees exceeding 1,000 ETH per lock. > Removed all clients and contract interactions that previously allowed these fees to be bypassed. > Increased token fees to the maximum permitted by the Vesting V2 contracts (5%), making repeated vesting top-ups economically unviable. These measures are designed to prevent further exploitation through the identified methods. While our investigation and monitoring remain ongoing, we firmly believe we have taken the necessary steps available to us to contain the incident. 2. Scope of the incident As previously communicated, all LP lockers remain unaffected, across every protocol and chain supported by UNCX. The incident is isolated to UNCX Vesting V2. Our legacy vesting contracts are also unaffected and have undergone additional checks and review. The incident currently involves 10 tokens across 4 chains: Ethereum (6): $pepecoin, $EDGEN, $ZC, $X, $LO0P, $PAAL Base (1): $IMO BNB Chain (1): $BTCLE Robinhood Chain (2): $CASHCAT, $RKST 3. Next steps for affected projects and communities We are already in contact with most of the affected teams, communities or individuals impacted. We expect to share further guidance and next steps with affected teams this week. We will also publish a comprehensive incident report covering the technical findings, financials, and the details of our proposed recovery plan. Important: For all impacted tokens, we strongly advise against trading in the affected pools until further guidance is provided by the respective token teams. We will be coordinating directly with those teams over the coming days. 4. Investigation and recovery efforts Our investigation remains active, and we are coordinating with law enforcement and @seal911. To date, no funds have been returned by the attackers (primary and copycats) on any affected chain. We strongly encourage the responsible party to contact us directly to discuss a resolution. We understand the seriousness of this incident for affected projects, holders, and communities. Our immediate priorities remain preventing further exploitation, establishing the full extent of the impact, and working closely with affected teams toward a recovery plan. We will continue to communicate when any meaningful updates become available. Thank you for your patience. The UNCX Team
    1252619K
  17. BlockSec✓@BlockSecTeam
    BlockSec
    RT @Phalcon_xyz: 🗓 Weekly Web3 Security Roundup | Oct 05 - Oct 11 🚨 Spotlight on 1 notable incident | ~$542K lost this week Featuring a vulnerability breakdown and in-depth analysis of selected key cases👇
    010419
  18. BlockSec✓@BlockSecTeam
    BlockSec
    RT @Phalcon_xyz: About 6 hours ago, ~$3.55M in unclaimed bridge funds was claimed and transferred out. Did the owner initiate the transactions, or did an attacker obtain valid EIP-7702 authorizations? Several days earlier, stuckfunds.eth, an onchain researcher, had sent multiple messages to 0x4943, notifying the owner that the funds were still claimable. The claims were submitted by 0x24a9, an address funded via Tornado Cash, and executed through EIP-7702 delegations on the EOA. Onchain data confirms that the authorizations were valid, but not whether the owner signed them intentionally, was tricked into signing them, or had the private key compromised. TX1 ($1.33M): TX2 ($2.22M):
    0100416
  19. BlockSec✓@BlockSecTeam
    BlockSec
    RT @Phalcon_xyz: 🗓 BiWeekly Web3 Security Roundup | Sep 21 - Oct 04 🚨 Spotlight on 8 notable incidents | ~$418M lost these two weeks Featuring a vulnerability breakdown and in-depth analysis of selected key cases👇
    010442
  20. BlockSec✓@BlockSecTeam
    BlockSec
    RT @Phalcon_xyz: NEAR Intents @near_intents suffered a ~$3.8M exploit due to a vulnerability affecting its deposit and withdrawal infrastructure. The attacker drained assets from a BNB Chain hot wallet, with the stolen funds subsequently routed through KuCoin and bridged to Bitcoin. NEAR Intents has patched the affected components and temporarily suspended deposits and withdrawals across 11 networks for security checks. The team has also announced a compensation plan to fully reimburse affected users.
    NEAR Intents @near_intents
    Earlier today NEAR Intents services were stopped after a security incident was detected. The incident was caused by a bug in the Omni deposit and withdrawal infrastructure interaction with NEAR Intents smart contract. The preliminary report indicates the total loss of approximately $3.8M. These funds will be compensated in full. The contract-side vulnerability has been patched. The operations of the NEAR Intents and near(.)com are expected to resume within 1h. Deposits and withdrawals on the following networks will remain unavailable for an additional ~12 hours while fixes to the Omni infrastructure are completed: BSC, Polygon, TON, Optimism, Avalanche, Stellar, Monad, LayerX, Adi, Scroll and Plasma. In case users hold any assets from these chains inside NEAR Intents (for example, in HOT wallet or on near(.)com), they will be able to swap them into other assets once NEAR Intents is back up (in ~1h). The incident has been reported to law enforcement, and we are working with security and blockchain analytics partners to trace the funds and pursue recovery. A detailed report will be shared publicly in the following days.
    040427
  21. NEAR Intents✓@near_intents
    Earlier today NEAR Intents services were stopped after a security incident was detected. The incident was caused by a bug in the Omni deposit and withdrawal infrastructure interaction with NEAR Intents smart contract. The preliminary report indicates the total loss of approximately $3.8M. These funds will be compensated in full. The contract-side vulnerability has been patched. The operations of the NEAR Intents and near(.)com are expected to resume within 1h. Deposits and withdrawals on the following networks will remain unavailable for an additional ~12 hours while fixes to the Omni infrastructure are completed: BSC, Polygon, TON, Optimism, Avalanche, Stellar, Monad, LayerX, Adi, Scroll and Plasma. In case users hold any assets from these chains inside NEAR Intents (for example, in HOT wallet or on near(.)com), they will be able to swap them into other assets once NEAR Intents is back up (in ~1h). The incident has been reported to law enforcement, and we are working with security and blockchain analytics partners to trace the funds and pursue recovery. A detailed report will be shared publicly in the following days.
    2082331.6K784K
  22. BlockSec✓@BlockSecTeam
    Bitget: $387.5M stolen. Less than $1M frozen. Full fund flow analysis: $183M swapped into ETH within hours. Issuers froze $339K. NEAR Intents blocked $50M in attempts but caught $503K. THORChain let it all through. Tracing worked. Freezing did not, because the window was hours and most of it closed before the first request landed.
    2486.1K
  23. BlockSec✓@BlockSecTeam
    Bitget: $387.5M gone. No private key stolen, no contract exploited. The attacker compromised internal credentials and told the wallet system to send the money. It did. Bybit, now Bitget. The attack surface has moved off-chain. Our breakdown, with a complete security review framework for exchanges and custodians:
    24107.4K
  24. BlockSec✓@BlockSecTeam
    BlockSec
    RT @Phalcon_xyz: .@payy_link was reportedly exploited, with estimated losses of $1.93M. Interestingly, the verifyRollup traces show several burn operations executed successfully with all-zero burn_hash values. How these zero hashes passed verification remains unclear; possible causes include a circuit flaw or a compromise of privileged infrastructure. The team has not yet responded publicly. Attack TX1: Attack TX2:
    020425
  25. BlockSec✓@BlockSecTeam
    BlockSec
    RT @Phalcon_xyz: 🗓 Weekly Web3 Security Roundup | Sep 14 - Sep 20 🚨 Spotlight on 2 notable incidents | ~$11.3M lost this week Featuring a vulnerability breakdown and in-depth analysis of selected key cases👇
    030416
  26. Show more posts