EthSecurity

- How to Manage Crypto Keys Without Losing Sleep - link - Building Our Own Post-Quantum FIDO Token - Use mutation testing to find the bugs your tests don't catch  @EthSecurity1

Seems ledger wallet suffers supply chain attack @EthSecurity1

- Vulnerabilities in Liquity forks Part 1 and Part 2 by VulSight. - Yo Protocol's Unseen Dangers: Why Code Audits Aren't Enough - link @EthSecurity1

Papertrade hacked for $ 1.28M - A quant trader with $13M+ all-time PnL manipulated Papertrade’s oracle by executing massive ETH buys/sells on Hyperliquid to briefly move its price, profiting $1.73M gross on timed long/short flips before a final $450k liquidation left $1.28M net. - The attack involved 305 trades (296 wins) over 8 hours, with average 98-second holds: open $200M+ Papertrade positions, manipulate Hyperliquid price within seconds, close for profit, and reverse direction repeatedly. - Papertrade prices directly off Hyperliquid’s ETH spot at the exact second, making it vulnerable to short-term manipulation; the post suggests the team blocked some closes and recommends upgrading to Hyperliquid’s less manipulable official multi-feed oracle. @EthSecurity1

Papertrade hacked for $ 1.28M A quant trader with $13M+ all-time PnL manipulated Papertrade’s oracle by executing massive ETH buys/sells on Hyperliquid to briefly move its price, profiting $1.73M gross on timed long/short flips before a final $450k liquidation left $1.28M net. The attack involved 305 trades (296 wins) over 8 hours, with average 98-second holds: open $200M+ Papertrade positions, manipulate Hyperliquid price within seconds, close for profit, and reverse direction repeatedly. Papertrade prices directly off Hyperliquid’s ETH spot at the exact second, making it vulnerable to short-term manipulation; the post suggests the team blocked some closes and recommends upgrading to Hyperliquid’s less manipulable official multi-feed oracle. @EthSecurity1

https://x.com/cayden_liao/status/2109074675695579399 @EthSecurity1

- Threat Contained: marginfi Flash Loan Vulnerability - link - How a Single Logic Slip in a Perp DEX Earned us a $50,000 Bounty - link @EthSecurity1

- Lazarus Group project by the Security Alliance offers a massive collection of DPRK IT worker personas and a fun presentation. - 48% of Ethereum EIP-7702 uses linked to crime, says Wintermute - The Vulnerability Exposing Tangem Cards to Brute-Force Attacks - link @EthSecurity1

TheRedVillage.com hacked for $80.7K RootCuase: forwardRequest() is public and makes the router call any registered service with any calldata the caller passes. The router holds the "_authorizeUpgrade" role, so the attacker used it to call upgradeTo on the SeasonService UUPS proxy and point it at their own unverified implementation. That implementation contains a delegatecall backdoor gated to the attacker's tx.origin. SeasonService holds the transferERC20In/Out roles on TRVZooKeeper, the contract players approve WETH to for tournaments. About 13 minutes later, the backdoor used transferERC20In to pull WETH from ~299 player wallets that had approved ZooKeeper, then used transferERC20Out to send ZooKeeper's whole balance, 31.43 WETH, Victim: https://polygonscan.com/address/0xc97dcb0492412bfbbf47332f1b1b49e177e8f15c (TRV Router) @EthSecurity1

First Atomic L1-to-L2 Mainnet Transaction Executed @EthSecurity1

Malicious EOA submitted governance takeover transaction in letsgetheai.com @EthSecurity1

seems mantle L2 got drained for $500M @EthSecurity1

MakerDAO ETH-A Liquidation Keeper Bot hacked for ~$538K RootCause: Access Control vulnerability - Flipper.deal() on the keeper's old auctions → Vat.flux the collateral to the keeper → GemJoin.exit() 200 WETH to an attacker-supplied recipient → unwrap to 200 ETH TX: https://etherscan.io/tx/0xbb6940f7c2a1e68cafbae7bb9b94d09af9af06ec3a114f6996f2cab993f3a88c Attacker: https://etherscan.io/address/0x01eb957e5c7dcddd60f3c875956ccc6fb9bda5fa Victim: https://etherscan.io/address/0x9c05a05893ada984fc20d0da0c046de5cc0e8273 (unverified impl) @EthSecurity1

On October 2, 2026, an attacker stole ~$115K from GoldPesa's GPXHooks RootCause: The reBalance function's "USDC Donation Check" only verified excess USDC in the hook vs. Uniswap (if usdcInsideHook > usdcInsideUniswap) but ignored shortfalls; TAKE_PAIR action during modifyLiquiditiesWithoutUnlock shared deltas across callers, allowing the hook to receive far less (~$34K instead of ~$149K). TX: https://basescan.org/tx/0x5c1febd5047c2a15c37988b6abd5c8b984236dddf6fd24eed96b0f43951ad2c9… Vulnerable hook (GPXHooks): https://basescan.org/address/0x4519e2b040ff1b64fa03abe2aef0bc99d7cceaa8#code… @EthSecurity1

Set Protoco hacked for ~5.08 ETH RootCause: A rounding vulnerability in the actualizeFee function that inflated unitShares from 4,927 to 4,928 without any fee being minted. The attacker exploited the issue by issuing shares before the recalculation and redeeming afterward to extract excess collateral, using Uniswap v4 flash accounting for temporary liquidity to amplify the attack. @EthSecurity1

-  A Trust-Aligned Guide to ABCI, Determinism, and IBC Integrity - Incident Post-Mortem: Reth Mainnet State Root Mismatch - Auditing Step By Step: Part 1 - link   @EthSecurity1

Goldpesa hacked for $114 K Rootcause: Attacker borrowed 175K USDC from Morpho, created an unpaid position in PositionManager inside their unlock, then swapped on GPX pool to force rebalance—hook’s BURN_POSITION + TAKE_PAIR netted against attacker’s debt, effectively paying for it. @EthSecurity1

- How to Survive Supply-Chain Attacks - link - How Sui Move rethinks flash loan security - link - Safe StableSwap-NG Deployment, How to Avoid Risks from Volatile Oracles - link @EthSecurity1

NEAR rejected 50 MIL inflow from NK and froze 500K So NK hacked them LMAOOOOO

#PeckShieldAlert #ZachXBT has reported that Near Intents was exploited for $3.865M after its BSC hot wallet saw multiple irregular outflows. The exploiter has transferred the stolen funds to #Kucoin and bridged them to BTC. The exploiter address has interacted with an address labeled #NorthKorea

@EthSecurity1

- Token Risk Scanning for Traders: Glider Flags 20+ on-chain risks others miss -link - Crypto bridges monitoring - link - Fileless Malware Techniques and Analysis of a Remote Access Trojan @EthSecurity1