Long-form research reports on a single notable attack, vulnerability or incident.
The wallets were never hacked — they were shipped compromised. A chip behind the screen read the words as they appeared, and the one precaution that matters in self-custody…
Nothing was hacked — a permission list was edited, correctly, by whoever holds the keys. The vault's math was fine; the answer to 'who can change who can borrow' was 'seven people…
Nothing was hacked. A governance proposal did exactly what governance proposals can do — and that was the vulnerability. The contracts worked as written; the vote was the attack.
The wallet's cryptography was never broken. A module the owner had already whitelisted accepted instructions from anyone, moved a $7.7M position, and then lost the proceeds to a…
The third unbacked-mint failure in six days — and the clearest demonstration that a wrapper's true loss ceiling is its exit liquidity, not its mint logic.
The largest Bitcoin-sidechain incident of the year traces to a performance optimization from 2016 — cache keys built without length prefixes turned a speedup into a minting press.
The month's largest event is a liquidity story dressed as a price story: a thin token, an unadjusted collateral factor, and a chain willing to roll back.
No code bug, no oracle game, no key leak: six Term Finance vaults were drained through their own governance after an attacker bought a near-empty electorate for roughly 0.5 ETH.