Truebit - Rekt
First major hack of 2026, as TrueBit was drained for $26.2 million through an overflow in unverified bytecode. The same attacker hit Sparkle weeks prior. Old code keeps bleeding - the archives have clearly become a shopping list.
TMXTribe - Rekt
$1.4 million lost on TMXTribe due to a logic bug. The team wallets deployed contracts during the exploit, never paused, and continue deploying days later. Meanwhile, complete radio silence from the team. Logic bug or choreographed exit?
Aave's Winter of Discontent
Fresh off its SEC victory, Aave turned on itself. A rushed, Christmas-week vote over brand control and swap fees exposed deep fractures - so severe the proposal’s own author disavowed it. Phase 1 collapsed. Phase 2 puts ownership and alignment back on the line.
Yearn - Rekt IV
Deja vu, as Yearn suffers its 2nd hack in 6 weeks and its 4th exploit overall. A recycled 2023 error drained $293k. The archives are fast becoming a shopping list - Yearn x2, Balancer, Abracadabra. Could we have DeFi relic hunters aiming for old code?
Aevo - Rekt
Dead code still bleeds. Aevo, formerly known as Ribbon Finance, took a $2.7 million hit on old vaults. A proxy admin vulnerability enabled a full oracle hijack, allowing the attacker to rig prices to infinity and drain the old contract in one atomic loop.
The Big Blind
After VC bets $1 billion on Kalshi. Paradigm drops research 6 days later, halving Polymarket's volume. Both platforms hire desks to trade against users. Wall Street backs both. The tech changed. Maybe the skim just learned to code. Welcome to the new Vegas.
USPD - Rekt
An attacker front-ran USPD's proxy deployment in September using a CPIMP attack, installed a hidden middleman, waited 78 days, then minted 98 million unbacked tokens for $1 million. Security researchers had documented and patched this exact attack vector months earlier.
The Economy of Access
Imagine a world with smart locks on property, biometric gates on money, algorithms that execute without appeal. Early experiments already left people locked out, stranded and starving. Now it could be tokenized at scale. Forster, Orwell, Dick, Postman were they writing fiction or prophecy?
Yearn - Rekt III
A forgotten yETH pool led to Yearn’s 3rd exploit since 2021. Attacker minted to infinity and drained $9 million in one transaction. Legacy code nobody maintained became a legacy problem somebody else took advantage of.
Megaoops
A $250 million pre-deposit imploded into 156 seconds of chaos after infra failed, parameters broke, and MegaETH’s team collected all required multisig signatures too early. A random user executed it, pushing deposits to $500 million. No hack - just human error at scale.
GANA Payment - Rekt
Speed-to-market killed another protocol. Nine days from launch to liquidation. $3.1 million drained from GANA Payment via leaked owner keys and EIP-7702 delegation exploit. BSC's 41% audit rate vs Ethereum's 74% keeps paying dividends - to attackers.
Libra II - Electric Boogaloo
Libra - the rug that won’t die - flipped $61.5 million USDC to SOL after judge unfreezes funds. Two countries, zero arrests, millions extracted across four crypto scams. Legal speed vs. blockchain speed - enforcement loses, criminals win.