Company
Blockchain security firm that audits smart contracts and publishes post-incident analyses of DeFi exploits, wallet drains and protocol vulnerabilities.
UNCX's Vesting V2 contracts lost about $1.49 million across four chains, Blockaid said, after a release function left a stale share counter. Immunefi's head of security says the contract never enforced a rule keeping the global share total consistent across functions.
Reality
An attacker took about $86,000 from UNCX's shared Ethereum vesting pool on Oct. 14, according to security firm Blockaid. About $3.25 million was still in the contract when Blockaid flagged the attack as ongoing.
Reality
ExVul reports an attacker drained 9.1231 ETH, about $22,770, from the sven.eth wallet using an EIP-7702 authorization its owner had signed. ExVul says neither PodMining nor TAPEETH had a flaw; cryptotimes notes the account is not yet independently confirmed.
Reality
Security firms traced about 1,783 wstETH, worth more than $6 million, out of a Base vault on Oct. 4 whose owner is an anonymous 3-of-7 Safe. With Base and Aave's core contracts not blamed, the loss lands on a custody setup whose seven signers no one has publicly identified.
Reality
Two Safe multisigs lost up to $310K after an attacker impersonated a Safe to get past FlashLoopAdapter, an Aave leverage add-on the owners had enabled. Aave and Safe's core code held, so the loss fell on owners who let a module move funds without signatures.
Perspective Coverage
3 publishersReality
Estimates of the loss run from $4M to $9M against the $72.77M locked in Moonwell, and the remedy was a borrow cap set to 1 wei, which is the tell that this was an underwriting choice rather than a bug.
Reality