Nobody breached KelpDAO's smart contracts. They breached the single piece of infrastructure KelpDAO's bridge was built to trust. On April 18, 2026, an attacker manipulated the lone…
An attacker spent roughly 42 hours preparing a swarm of 123 worthless tokens and five worker wallets before launching them within ten seconds of one another, and by the time most u…
Hyperbridge initially reported losses of $237,000 tied to an exploit that saw 1 billion DOT tokens minted out of nothing. Days later the protocol revised that number to $2.5 millio…
Sumsub has scanned the passports, faces, and government IDs of users across more than 4,000 client businesses . Each of those clients relies on Sumsub to answer a question they can…
Helius CEO Mert was the first to raise an alarm. On the morning of April 1st, he posted publicly that Drift "might be getting exploited," though he stopped short of certainty. Minu…
A $300,000 deposit was enough to trigger an $80 million overprint of Resolv's USR stablecoin, once an attacker gained control of the single off-chain key responsible for authorizin…
On March 15, 2026, an attacker who had spent roughly nine months quietly building an 84% share of Venus Protocol's supply cap for Thena's THE token triggered a Mango Markets-style …
Someone was sitting on a $50 million position in Aave — not idle, but earning, parked in yield-bearing aEthUSDT . On March 12, 2026, that holder decided to move the position into a…
Aave's own defensive infrastructure, not an attacker, wiped out $27.78 million in healthy user positions on March 10. The system responsible, the CAPO oracle, exists specifically t…
An unaudited smart contract belonging to Solv Protocol let an attacker mint the same tokens twice from a single deposit, draining roughly $2.73 million in a single, tightly looped …
For years, zero-knowledge proofs were pitched as a way to remove trust from the equation entirely: don't believe the team, verify the math. On that pitch, a decade of privacy tools…
FoomCash marketed itself as a "ZKProof-powered private lottery protocol," a system whose withdrawals were supposedly unforgeable thanks to zero-knowledge proofs. The project pitche…
Get new scam files the moment we publish them — usually 2–3 emails a week.