Dead code still bleeds. Aevo, formerly known as Ribbon Finance, took a $2.7 million hit on old vaults. A proxy admin vulnerability enabled a full oracle hijack, allowing the attacker to rig prices to infinity and drain the old contract in one atomic loop.
After VC bets $1 billion on Kalshi. Paradigm drops research 6 days later, halving Polymarket's volume. Both platforms hire desks to trade against users. Wall Street backs both. The tech changed. Maybe the skim just learned to code. Welcome to the new Vegas.
An attacker front-ran USPD's proxy deployment in September using a CPIMP attack, installed a hidden middleman, waited 78 days, then minted 98 million unbacked tokens for $1 million. Security researchers had documented and patched this exact attack vector months earlier.
Imagine a world with smart locks on property, biometric gates on money, algorithms that execute without appeal. Early experiments already left people locked out, stranded and starving. Now it could be tokenized at scale. Forster, Orwell, Dick, Postman were they writing fiction or prophecy?
A forgotten yETH pool led to Yearn’s 3rd exploit since 2021. Attacker minted to infinity and drained $9 million in one transaction. Legacy code nobody maintained became a legacy problem somebody else took advantage of.
A $250 million pre-deposit imploded into 156 seconds of chaos after infra failed, parameters broke, and MegaETH’s team collected all required multisig signatures too early. A random user executed it, pushing deposits to $500 million. No hack - just human error at scale.
Speed-to-market killed another protocol. Nine days from launch to liquidation. $3.1 million drained from GANA Payment via leaked owner keys and EIP-7702 delegation exploit. BSC's 41% audit rate vs Ethereum's 74% keeps paying dividends - to attackers.
Libra - the rug that won’t die - flipped $61.5 million USDC to SOL after judge unfreezes funds. Two countries, zero arrests, millions extracted across four crypto scams. Legal speed vs. blockchain speed - enforcement loses, criminals win.
Routine database change at Cloudflare killed 20% of the web for 3 hours. Crypto exchanges froze. Twitter died. No blockchain failures reported, but some front-ends went dark. Decentralized protocols, centralized pipes. The irony wasn't subtle.
October brought warnings about Stream's 4x leverage and recursive loops. November brought consequences - $93 million vanished, xUSD crashed 77%, $285 million exposure unwound. Trevee recovered fully through aggressive action. Most depositors face near-total losses competing for scraps.
A rounding function with one direction – down - became a $128 million exploit across several chains. Attackers manipulated rates in Balancer's pools, then some forks of Balancer realized they'd copy-pasted the same bug. Open source means everyone copies the code - including the bugs.
Backing a stablecoin with another stablecoin backed by the first isn't finance - it's expensive performance art. Stream and Elixir got caught playing stablecoin hot potato. In one instance, Stream turned $1.9 million into $14.5 million xUSD through recursive minting.