Topic
Exploits, oracle design failures and post-incident remediation in decentralised finance protocols.
KolanHook lost about 2.31 ETH on 15 October 2026 to a flash-loan price push, according to a DEV Community post-mortem. Its buyback swap had no effective price limit, and any caller could trigger it.
Reality
MCN Labs lost about $92.6K because LPBonus used two different MSN reserve values in one reward calculation, a DEV Community analysis says. One LP holder claimed about 1.44M FIST from a reward increment funded with about 940K.
Reality
An attacker took about $86,000 from UNCX's shared Ethereum vesting pool on Oct. 14, according to security firm Blockaid. About $3.25 million was still in the contract when Blockaid flagged the attack as ongoing.
Reality
Scanning 146 Morpho vaults on-chain, a dev.to author found timelocks on all 122 listed ones and none on 5 unlisted vaults holding about $305M. The method is five RPC calls on any proxy, and in the Morpho data the timelock decides whether depositors get a warning window.
Reality
Security firms traced about 1,783 wstETH, worth more than $6 million, out of a Base vault on Oct. 4 whose owner is an anonymous 3-of-7 Safe. With Base and Aave's core contracts not blamed, the loss lands on a custody setup whose seven signers no one has publicly identified.
Reality
Researchers Tim Hall and Remo Stieger found protocol logic exploits caused 55% of DeFi flash loan losses from 2022 to mid-2024, up from 28% before. For an investor, diligence on a DeFi position moves from price feeds to the design of the contracts themselves.
Perspective Coverage
3 publishersReality
About $6 million in wstETH left an unidentified Base vault via a whitelist flaw a researcher had found the week before, Immunefi says. Roughly $31.7 million remains under seven unnamed Safe signers who, more than a day later, had not claimed the vault or announced a fix.
Reality
CertiK argues AI agents that can suspend accounts on their own should be managed like staff, with set permissions, human checkpoints and someone accountable. For the team rolling one out, every action the agent may take needs an owner and a review rule before it goes live.
Reality
Two Safe multisigs lost up to $310K after an attacker impersonated a Safe to get past FlashLoopAdapter, an Aave leverage add-on the owners had enabled. Aave and Safe's core code held, so the loss fell on owners who let a module move funds without signatures.
Perspective Coverage
3 publishersReality
Crypto hacks drained $766.49 million in September, a 2026 monthly record, and $387.5 million came from one breach of Bitget's hot wallets. After the money returned from the Liquid Network exploit, that one exchange accounts for about 80% of what stayed stolen.
Reality
Kelp DAO has sued LayerZero Labs and co-founder Bryan Pellegrino for negligence and misrepresentation over April's $292 million rsETH bridge exploit. The forged message cleared a bridge that trusted one LayerZero-run verifier, so the case tests who answers for that setup.
Reality
A Gnosis Safe lost $7.73M in rsETH on September 15 through an automation module its own owner had whitelisted, an MEV bot took the proceeds in the same block, and Kelp DAO froze the destination address for 24 hours.
Reality
The Pando Rings exploiter swapped 3 million DAI for about 1,570 ETH on CoW Protocol, then pushed 800 ETH into Tornado Cash as the protocol entered maintenance mode.
Reality