A vault operator on YO Protocol fat-fingered a $3.84 million swap with broken slippage params. $112K came out the other side - a $3.71 million loss. The team quietly backstopped it. But so far, there is no public acknowledgment.
First major hack of 2026, as TrueBit was drained for $26.2 million through an overflow in unverified bytecode. The same attacker hit Sparkle weeks prior. Old code keeps bleeding - the archives have clearly become a shopping list.
$1.4 million lost on TMXTribe due to a logic bug. The team wallets deployed contracts during the exploit, never paused, and continue deploying days later. Meanwhile, complete radio silence from the team. Logic bug or choreographed exit?
Fresh off its SEC victory, Aave turned on itself. A rushed, Christmas-week vote over brand control and swap fees exposed deep fractures - so severe the proposal’s own author disavowed it. Phase 1 collapsed. Phase 2 puts ownership and alignment back on the line.
Deja vu, as Yearn suffers its 2nd hack in 6 weeks and its 4th exploit overall. A recycled 2023 error drained $293k. The archives are fast becoming a shopping list - Yearn x2, Balancer, Abracadabra. Could we have DeFi relic hunters aiming for old code?
Dead code still bleeds. Aevo, formerly known as Ribbon Finance, took a $2.7 million hit on old vaults. A proxy admin vulnerability enabled a full oracle hijack, allowing the attacker to rig prices to infinity and drain the old contract in one atomic loop.
After VC bets $1 billion on Kalshi. Paradigm drops research 6 days later, halving Polymarket's volume. Both platforms hire desks to trade against users. Wall Street backs both. The tech changed. Maybe the skim just learned to code. Welcome to the new Vegas.
An attacker front-ran USPD's proxy deployment in September using a CPIMP attack, installed a hidden middleman, waited 78 days, then minted 98 million unbacked tokens for $1 million. Security researchers had documented and patched this exact attack vector months earlier.
Imagine a world with smart locks on property, biometric gates on money, algorithms that execute without appeal. Early experiments already left people locked out, stranded and starving. Now it could be tokenized at scale. Forster, Orwell, Dick, Postman were they writing fiction or prophecy?
A forgotten yETH pool led to Yearn’s 3rd exploit since 2021. Attacker minted to infinity and drained $9 million in one transaction. Legacy code nobody maintained became a legacy problem somebody else took advantage of.
A $250 million pre-deposit imploded into 156 seconds of chaos after infra failed, parameters broke, and MegaETH’s team collected all required multisig signatures too early. A random user executed it, pushing deposits to $500 million. No hack - just human error at scale.
Speed-to-market killed another protocol. Nine days from launch to liquidation. $3.1 million drained from GANA Payment via leaked owner keys and EIP-7702 delegation exploit. BSC's 41% audit rate vs Ethereum's 74% keeps paying dividends - to attackers.