31 articles tagged with #smart-contract-security. AI-curated summaries with sentiment analysis and key takeaways from 50+ sources.
The MEV bot JaredFromSubway lost $7.5 million after attackers exploited malicious token approvals to drain assets from its smart contract. This incident highlights persistent security vulnerabilities in automated trading bots and the risks of unlimited token permissions on blockchain protocols.
The Ethereum Foundation has proposed new standards for clear signing in Web3 wallets to replace blind signing, making transactions human-readable and reducing phishing vulnerabilities. This initiative addresses a critical security gap where users cannot verify transaction details before approval, protecting them from malicious contract interactions.
A sophisticated attacker exploited Jaredfromsubway.eth, a prominent Ethereum MEV bot operator, by tricking them into approving fraudulent trading routes and subsequently draining $7.5 million in WETH, USDC, and USDT. The exploit highlights vulnerabilities in smart contract approval mechanisms and demonstrates that even experienced DeFi participants remain susceptible to social engineering and signature manipulation attacks.
A MEV bot named JaredFromSubway lost $7.5 million in WETH, USDC, and USDT after an attacker exploited token approval vulnerabilities to drain its Ethereum contract. The incident highlights critical smart contract security risks in the MEV bot ecosystem where token approvals can be weaponized to siphon assets.
The Aztec Connect protocol experienced a significant security exploit, with SlowMist's analysis revealing critical vulnerabilities in deprecated smart contracts. The incident underscores systemic risks when blockchain protocols remain immutable and unpatched after being sunset, creating long-tail security exposure for users and the ecosystem.
Hackers exploited unverified smart contracts to steal over $36 million across four DeFi protocols in six months, with a single Truebit attack netting $26 million. The attacks highlight a critical security gap: contracts without public source code verification bypass standard review processes, allowing attackers to decompile bytecode and use AI tools to identify exploitable vulnerabilities at scale.
Raydium, a major Solana-based decentralized exchange, experienced a $1.3 million exploit targeting its legacy liquidity pools, with attackers successfully draining SOL, USDC, and RAY tokens. The incident highlights ongoing security vulnerabilities in DeFi protocols, even among established platforms, and raises concerns about the safety of older pool infrastructure.
Token of Power (TOP) experienced a significant exploit on Tuesday that resulted in $1.58 million being drained from its Balancer V1 liquidity pool. Multiple on-chain security firms including Blockaid, PeckShield, and Cyvers identified and reported the attack, highlighting ongoing vulnerabilities in decentralized finance protocols.
Zcash's ZEC token crashed over 50% to $310 following disclosure of a critical bug in its Orchard privacy upgrade, triggering more than $116 million in liquidations within 24 hours. The sharp decline reflects severe loss of confidence in the protocol's security and development practices.
Researchers introduce AttackPathGNN, a graph neural network that detects smart contract vulnerabilities by analyzing relationships between functions rather than isolated code patterns. The method achieves 92.3% F1 score on test datasets and identifies exploits like reentrancy that existing detectors miss, addressing security gaps exposed by historical attacks like The DAO.
Gnosis Pay experienced a module-based security attack that compromised user funds, though the platform has committed to reimbursing affected victims. The incident raises significant questions about the robustness of the underlying smart contract architecture and module validation mechanisms.
DeFi experienced a tumultuous weekend marked by four separate hacks, multiple Sui network outages, and a crypto card-related warning that extended market anxiety into the week. These incidents collectively highlight persistent security vulnerabilities and infrastructure fragility across decentralized finance protocols.
The article examines how blockchain and AI technologies present dual-edged implications for the U.S. financial system, offering transformative opportunities while simultaneously creating new fraud risks and systemic vulnerabilities that regulators and institutions must address.
DxSale, a liquidity locker platform on BNB Chain, lost $7.3 million in BNB after attackers exploited a hidden backdoor in its smart contract to drain funds from over 1,400 liquidity providers. The incident highlights critical security vulnerabilities in DeFi infrastructure and raises concerns about contract auditing practices.
A16z's research demonstrates that AI agents can successfully identify vulnerabilities in DeFi protocols, but face significant practical and technical barriers when attempting to exploit them. The findings underscore the dual-edged nature of AI in blockchain security and highlight the critical importance of developing containment measures to mitigate potential misuse by malicious actors.
Researchers introduce Chaintrix, an LLM-augmented smart-contract auditing framework that combines AI analysis with deterministic structural verification to reduce false positives. The system achieves 71.7% recall on high-severity vulnerabilities, outperforming existing AI and static analysis tools by 26 percentage points on OpenAI's EVMbench benchmark.
A liquidity provider on 1inch called TrustedVolumes suffered an ongoing exploit draining nearly $6 million, perpetrated by the same attacker who exploited 1inch Fusion V1 in March 2025 for approximately $5 million. The recurring attacks highlight persistent vulnerabilities in 1inch's infrastructure.
Aave is fighting in federal court to unfreeze $71 million in recovery funds stemming from the Kelp DAO hack, raising a critical legal question about whether seized crypto assets can be used to satisfy unrelated judgments. The case will set precedent for how DeFi protocols and recovery mechanisms interact with the traditional legal system.
Sui blockchain introduces a parallel transaction model using an object-based architecture that eliminates sequential processing bottlenecks, while its Move programming language enhances smart contract security. The platform's quantum-safe cryptography positions it as a more secure alternative to older blockchains like Ethereum and Solana for institutional DeFi applications.
Rhea Finance suffered a $7.6 million exploit through a sophisticated attack involving fake token contracts and manipulated liquidity pools that deceived the protocol's Oracle mechanisms. The attackers extracted funds by creating artificial liquidity traps, prompting Rhea Finance to pause all contracts while investigating the incident with security partners.
The Ethereum Foundation has launched a $1 million security subsidy program in partnership with Areta's audit marketplace, granting developers access to over 20 vetted security firms including Blocksec, Certora, Hacken, Immunefi, and Quantstamp. This initiative aims to reduce barriers to smart contract auditing and strengthen the overall security posture of the Ethereum ecosystem.
International authorities from the US, UK, and Canada have dismantled a major crypto phishing operation affecting over 20,000 victims, freezing $12 million in suspected criminal proceeds and identifying $45 million in total cryptocurrency fraud. The coordinated crackdown targets approval phishing scams, a prevalent vector for stealing digital assets from unsuspecting users.
The article examines critical vulnerabilities threatening DeFi's sustainability, exploring the existential risks users face in decentralized finance and evaluating emerging mitigation strategies. The piece highlights systemic challenges that could determine whether DeFi survives as a viable ecosystem or collapses under its own complexities.
Anthropic has publicly released Claude Fable 5, an AI software that has generated concern within the cryptocurrency community about potential negative consequences for internet infrastructure and security. The release has sparked discussions about the implications of advanced AI capabilities intersecting with crypto ecosystems.
Cryptocurrency exploit losses declined significantly to $68 million in May, down from $650 million in the prior month, with code vulnerabilities accounting for approximately 66% of losses. The sharp drop suggests improved security measures and reduced attack surface, though developers remain vulnerable to smart contract flaws.
