Web3 Security Weekly News Review — September 28–October 4, 2026
A vault with no named owner lost $6M to a whitelist entry, a swap protocol got its $3.8M back in 36 hours with a public ultimatum, and the exchange breached for $387.5M finished…
#Smart Contracts
Articles tagged Smart Contracts
Web3 Security Weekly Data Report — September 28–October 4, 2026
The series snapped back 40x after the Bitget week — and every dollar of it sat in the glue: an allowlist, a Safe module, a hook's shared unlock, a deposit rail. Not one core…
Web3 Security Weekly Intelligence — September 28–October 4, 2026
Every dollar lost this week sat in the glue — an allowlist, a Safe module, a hook, a deposit rail — and for the first time in this column's coverage, a public ultimatum brought…
Deep Analysis: The $6M Vault Nobody Owns — the Base wstETH Whitelist Takeover, a Full-Chain Review
Nothing was hacked — a permission list was edited, correctly, by whoever holds the keys. The vault's math was fine; the answer to 'who can change who can borrow' was 'seven people…
Web3 Security Weekly News Review — September 21–27, 2026
A $20K governance vote took over a chain's applications, an exchange lost $387.5M without a single private key being stolen, and the costliest month of 2026 got that way in seven…
Web3 Security Weekly Intelligence — September 21–27, 2026
The week's losses came from the layer above the keys: an exchange backend that could forge transactions, a governance process that could reassign contract admins, and a rollup…
Deep Analysis: The Neutron Governance Takeover and the $9.3M Vote — A Full-Chain Review
Nothing was hacked. A governance proposal did exactly what governance proposals can do — and that was the vulnerability. The contracts worked as written; the vote was the attack.
Web3 Security Weekly Intelligence — September 14–20, 2026
The week's largest loss needed no exploit at all: a list of keys, an app that kept signing with them, and six days in which nobody stopped it. The rest of the damage came from an…
Deep Analysis: The Safe Module Authorization Exploit and the MEV Race — A Full-Chain Review
The wallet's cryptography was never broken. A module the owner had already whitelisted accepted instructions from anyone, moved a $7.7M position, and then lost the proceeds to a…
Web3 Security Weekly News Review — September 7–13, 2026
A quiet dollar week with a loud pattern: three unbacked-mint failures on Bitcoin wrappers in six days, two settlement-layer checks that were never made, plus Tether's $39.27M…
Web3 Security Weekly Data Report — September 7–13, 2026
The smallest dollar week this site has recorded, on a net basis down 91% — but three unbacked-mint failures in six days, and two settlement-layer checks that were never made, make…
Web3 Security Weekly Intelligence — September 7–13, 2026
A quiet dollar week with a structural alarm: three wrapper backing failures in six days, and a freeze pipeline operating at nearly eight times the week's crime total.
Deep Analysis: The Symbiosis BridgeV2 Unbacked Mint — A Full-Chain Review
The third unbacked-mint failure in six days — and the clearest demonstration that a wrapper's true loss ceiling is its exit liquidity, not its mint logic.
Web3 Security Weekly News Review — August 31–September 6, 2026
The largest Bitcoin-sidechain incident of the year defines the week: 3,998.5 unbacked L-BTC minted via a cache-key collision, pegged out within minutes, mostly returned on-chain…
Web3 Security Weekly Data Report — August 31–September 6, 2026
A dual-basis report: the largest single event of the year ($320M gross, ~$272M returned) sits on top of a busy protocol tail (~$11.6M).
Web3 Security Weekly Intelligence — August 31–September 6, 2026
The week's theme is trust in computed verdicts: cached proofs, collided identifiers and forged claims all let a protocol accept something it should have checked.
Web3 Security Weekly News Review — August 24–30, 2026
10 events; ~$33.8M realized; two price-manipulation lending attacks define the week and the month — plus a chain rollback that reversed $111.2M.
Web3 Security Weekly Data Report — August 24–30, 2026
~$33.8M realized losses across 9 loss events (plus one data breach tracked separately), up 52% week-over-week; price manipulation dominates and a rollback changed what the…
Web3 Security Weekly Intelligence — August 24–30, 2026
Price manipulation is August's method, consensus-level rollback is the new containment tool, and the ecosystem's response to thin-collateral lending has not caught up.
Deep Analysis: The Tectonic TONIC Pump-and-Borrow — A Full-Chain Review
The month's largest event is a liquidity story dressed as a price story: a thin token, an unadjusted collateral factor, and a chain willing to roll back.
Web3 Security Weekly News Review — August 17–23, 2026
9 whitelist-sourced events; ~$22.2M realized losses; a $8.5M governance takeover takes the headline while a shared-infrastructure bug spreads across six Cosmos EVM chains.
Web3 Security Weekly Data Report — August 17–23, 2026
~$22.2M realized losses across 9 events; top-3 concentration 77%; the week's shape is governance and shared infrastructure, not classic key theft.
Web3 Security Weekly Intelligence — August 17–23, 2026
Governance becomes an attack surface, a shared-infrastructure bug spreads across six chains, and a silent patch process turns a known bug into a countdown timer.
Deep Analysis: The Term Finance Governance Takeover — A Full-Chain Review
No code bug, no oracle game, no key leak: six Term Finance vaults were drained through their own governance after an attacker bought a near-empty electorate for roughly 0.5 ETH.
Latest across columns
- Web3 Security Weekly News Review — October 5–11, 2026 · Weekly News Review · 2026-10-12
- Web3 Security Weekly Data Report — October 5–11, 2026 · Weekly Data Report · 2026-10-12
- Web3 Security Weekly Intelligence — October 5–11, 2026 · Weekly Intelligence · 2026-10-12
- Web3 Security Weekly Recovery & Enforcement Update — October 5–11, 2026 · Security Market Intelligence · 2026-10-12