Smart Contract Audit | Security Monitoring | AML/CFT (KYA/KYT) | Crypto Investigation | @Phalcon_xyz @MetaSleuth @MetaDockTeam đTG: t.me/BlockSecTeam
Joined December 2020
- Tweets 2,202
- Following 151
- Followers 27,175
- Likes 1,294
598 Photos and videos
BlockSec retweeted
Jun 10
đď¸ Weekly Web3 Security Roundup | Jun 1 - Jun 7
đ¨ This weekâs focus: @Zcash Orchard Counterfeiting Vulnerability
No confirmed exploitation, but the underlying ZK soundness bug triggered an emergency upgrade and major market impact.
Breaking down the critical ZK soundness bug behind the counterfeiting risk đ
blocksec.com/blog/web3-securâŚ
2
3
16
1,990
BlockSec retweeted
Jun 9
Note the attacker uses 662 WETH to swap the required $TOP tokens for voting power. Thus, the actual profit should be around 944 - 662 = 282 WETH.
2
8
1,776
BlockSec retweeted
Jun 9
Alert! Token $TOP was attacked, resulting in a loss of around $1.59M. The attacker acquired more than 50% of TOP voting power, due to the tokenâs low market value, and used it to pass and execute a governance proposal that minted a large amount of TOP to themselves. The newly minted TOP was then swapped for WETH via the Balancer pool, draining the existing LP liquidity.
Projects using similar Lido/Aragon governance implementations should carefully review their voting power distribution, quorum/pass thresholds, mint permissions, and related governance safeguards.
Attack Tx: app.blocksec.com/phalcon/expâŚ
6
9
51
5,955
BlockSec retweeted
Jun 9
Update: @zachxbt raised questions about the official âprivate key compromiseâ story.
x.com/zachxbt/status/2064191âŚ
Rug pull or real key compromise? Hard to tell without more transparency.
Either way, stay vigilant. Operational security, infrastructure security, key management, and disclosure practices deserve far more attention.
Jun 9
We're aware of a security incident involving the compromise of private keys belonging to a member of the Humanity Foundation. The safety of our community is our top priority, and we want to be fully transparent about what we know.
As a precaution, please do NOT interact with the bridge or any liquidity pools until we give the all clear. This is the single most important step you can take to protect your funds right now. We are actively working with leading security experts and our exchange partners to assess the scope of the incident and secure all affected systems.
We're deeply sorry that this has happened. Protecting this community is our responsibility, and we don't take that lightly. We will share verified updates as soon as we have them and we won't speculate before facts are confirmed.
Official updates will only come from this account or @terencekwok
Beware of the scammers and impersonators who exploit moments like this. We will never DM you first or ask for your seed phrase or private keys.
1
1
13
2,739
BlockSec retweeted
Jun 9
Asterix @asterixlabs was reportedly attacked a few hours ago, with a loss of ~$40K. The root cause appears similar to yesterdayâs Flooring incident, which had a total impact of $900K , with ~$500K rescued by white hats.
Asterix appears to be forked from Flooring, and DN404/BT404 appear to share essentially the same 404-style ERC20/ERC721 hybrid contract design under different names/variants.
The shared root cause appears to be a high-bit NFT ID shift/overflow issue, leading to ID reuse and broken ownership/approval/accounting breakdowns (underflow).
Specifically, full uint256 NFT IDs enter external functions, while ownership/accounting is stored in packed lower-width slots. Crafted IDs with different high bits but colliding low bits can desync ownership, approvals, balances, and NFT backing. The attacker can then abuse exchange/transfer/unwrap flows to inflate the fungible token balance, sell into liquidity pools to drain WETH, and potentially extract additional value from backed NFTs.
Jun 8
Weâre aware of an exploit affecting the $ASTX token contract that occurred around 4am GMT 8 earlier today.
Our team is currently investigating the root cause of the exploit. We will drop a full, official post-mortem statement once we have everything mapped out. Thanks for standing by us though this unfortunate incident.
1
7
21
4,233
BlockSec retweeted
Jun 3
đ Weekly Web3 Security Roundup | May 25 - May 31
đ¨ Spotlight on 5 notable incidents | ~$16M lost this week
Featuring a vulnerability breakdown and in-depth analysis of selected key casesđ
blocksec.com/blog/web3-securâŚ
1
2
9
1,934
Jun 3
Proud to be part of the SEAL Certifications initiative @_SEAL_Org
At BlockSec, we see this as an important step toward more standardized, credible, and transparent security auditing across Web3, helping build a more mature security assurance framework for the ecosystem.
Jun 2
If your protocol is ready to get certified, these firms are accredited and taking clients now.
Already working with one of them? Ask about SEAL Certifications starting today.
@audit_wizard @BlockSecTeam @chain_security @Composable_Sec @ConsensysAudits @cyfrin @DefiSafety @hackenclub @HackenProof @SecurityOak @OpenZeppelin @opsek_io @Quantstamp @0xshield3 @sigp_io @statemindio @trailofbits @Wonderland @zellic_io @zeroshadow_io
Announcement: radar.securityalliance.org/sâŚ
1
1
6
2,568
BlockSec retweeted
May 27
.@StakeDAOHQ was reportedly exploited via a deployer key compromise, resulting in ~5.44T $vsdCRV minted to the attacker. The attacker appears to have obtained the deployerâs private key and set an arbitrary peer for $vsdCRV. Using that peer, they forged a malicious message that triggered unconditional minting of ~5.44T $vsdCRV to their address.
2
2
14
3,132
BlockSec retweeted
May 27
đ Weekly Web3 Security Roundup | May 18 - May 24
đ¨ Spotlight on 5 notable incidents | ~$104.6M lost this week
Featuring a vulnerability breakdown and in-depth analysis of selected key casesđ
blocksec.com/blog/web3-securâŚ
2
5
7
2,039
BlockSec retweeted
May 25
An unknown contract named 'SquidRouterModule' was reportedly exploited on #Ethereum due to improper input validation, resulting in ~$3M in losses. @squidrouter has clarified that this incident is unrelated to Squidâs core protocol/contracts.
The root cause appears to be misuse of the Axelar Bridge, similar to the previous @crosscurvefi attack pattern (x.com/Phalcon_xyz/status/201âŚ). The attacker (0xe1d5...3265) forged malicious calldata and abused approval permissions granted via PermissionManager (0x03B8...4cB7) to force token approvals from victims to Uniswap.
Using these malicious approvals, the attacker swapped victimsâ assets for fake tokens (0xe6Ff...3512) through Uniswap pools and profited.
May 25
This incident is unrelated to Squidâs core protocol and contracts. All Squid users and integrators are unaffected and no action is needed.
A third-party Gnosis Safe module was exploited today across Base and Ethereum, resulting in approximately $3.2M in losses. The vulnerable contract is verified on Basescan under the name âSquidRouterModuleâ but this contract was not built, deployed, or operated by Squid. It is a third-party smart-wallet product that chose to integrate with Squid, among other protocols, but has not been in contact with us.
The exploit worked because the third-party module accepted a caller-supplied constant string as proof that a message was secure. If you pass in this string (which is publicly available in the verified contractâs code), then you can execute an array of arbitrary calldata, stealing funds at will. The victimsâ Safes had added this faulty contract as a trusted Safe Module, which gives the contract the ability to spend any tokens in the Safe without signatures. Squidâs own router (0xce16F69375520ab01377ce7B88f5BA8C48F8D666) is architecturally different and was not touched. Squid user funds, approvals, and integrations are fully secure.
Early public reporting may reference âSquidRouterâ due to the contractâs verified name on Basescan. The accurate framing is: a third-party SquidRouterModule was exploited, not Squidâs Router contract. The contract shares our name but is not our code. We are monitoring the situation and will share updates if anything changes materially.
1
8
22
5,467
BlockSec retweeted
May 19
đ Weekly Web3 Security Roundup | May 11 - May 17
đ¨ Spotlight on 3 notable incidents | ~$4.72M lost this week
Full analysis with vulnerability breakdown đ
blocksec.com/blog/weekly-webâŚ
#Web3Security
3
14
2,582
BlockSec retweeted
May 18
The root cause of the @VerusCoin incident appears to be improper validation of economic backing in the import submission flow [1].
Specifically, the Verus-Ethereum Bridge contract verifies that:
1) the export/notarization proof is valid, and;
2) keccak256(serializedTransfers) matches the export's hashtransfers commitment (i.e., hashReserveTransfers[1][2]).
However, it does NOT sufficiently validate that the source-chain export actually carries enough locked/burned value to support the corresponding payouts on Ethereum.
As a result, the attacker was able to submit a Verus export [3] with essentially no meaningful economic backing, but with a matching serializedTransfers hash, and the bridge still released ~$11.7M in ETH / tBTC / USDC [4].
At a high level, the vulnerable flow is:
1) proveImports(...)
-> validates the proof and checks that hash(serializedTransfers) matches the committed transfer hash;
2) processTransactions(...)
-> proceeds to execute the payouts on Ethereum
What is missing is a robust check that the source-chain export's actual economic backing is sufficient to support the imported transfers before assets are released.
Please note: the deployed code is not open-sourced. Our investigation is based on the attack transactions and code currently available in the official repository, which may not reflect the full deployed implementation or the complete attack surface.
References:
[1] github.com/monkins1010/VerusâŚ
[2] github.com/monkins1010/VerusâŚ
[3] explorer.verus.io/tx/f899e69âŚ
[4] app.blocksec.com/phalcon/expâŚ
May 18
.@VerusCoin's Verus-Ethereum Bridge smart contract (0x715185) was reportedly attacked hours ago on #Ethereum, with estimated losses of about $11.7M, including ~1,625.4 ETH, ~103.6 tBTC, and ~148K USDC. The stolen assets were transferred to 0x65cb8b and swapped into roughly 5,402.4 ETH (valued at ~$11.4M).
On-chain records show that the attacker address, 0x5abb91, was funded via Tornado Cash. The root cause remains under investigation.
Attack TX: app.blocksec.com/phalcon/expâŚ
5
14
63
22,123
BlockSec retweeted
May 18
.@VerusCoin's Verus-Ethereum Bridge smart contract (0x715185) was reportedly attacked hours ago on #Ethereum, with estimated losses of about $11.7M, including ~1,625.4 ETH, ~103.6 tBTC, and ~148K USDC. The stolen assets were transferred to 0x65cb8b and swapped into roughly 5,402.4 ETH (valued at ~$11.4M).
On-chain records show that the attacker address, 0x5abb91, was funded via Tornado Cash. The root cause remains under investigation.
Attack TX: app.blocksec.com/phalcon/expâŚ
1
1
7
13,195
BlockSec retweeted
May 14
đ Bi-Weekly Web3 Security Roundup | Apr 27 - May 10
đ¨ Spotlight on 11 notable incidents | ~$15.9M lost over the past two weeks
Featuring a vulnerability breakdown and in-depth analysis of selected key cases đ
blocksec.com/blog/weekly-webâŚ
#Web3Security
3
8
2,561
BlockSec retweeted
May 14
.@TransitFinance was reportedly attacked on #TRON, with estimated losses of about $1.88M. Since the affected contracts are not open-sourced and TRON lacks strong public analysis tooling, our investigation suggests the incident involved abuse of standing unlimited approvals.
Specifically, users had previously granted unlimited USDT allowance to its official approval contract:
TTLaNDdcL5rMfxMS2VL1UCa44ebRCNbqew (TransitApproveGovernanceTron)
The attacker then abused Transitâs own execution chain:
TUfPjKD6PbaWC4gDcA9u1WsJHv6vyUkbc4 (attack executor)
-> TFHc9qsQCiepyyUQynnVVrQwMxZ37Fi15N (TransitProxyV3Tron)
-> TUY2wroSG3hAyjQeWTuaJ8Gn5HJVsb7NPz (TransitMixSwapBridge)
-> TTLaNDdcL5rMfxMS2VL1UCa44ebRCNbqew (TransitApproveGovernanceTron)
-> TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t.transferFrom(...) (USDT)
This turned old standing approvals into direct victim-to-attacker USDT transfers. The figure shows one concrete example.
May 13
đŁ Transit Announcement
Regarding a recent incident related to historical legacy risks, we would like to share the following update:
1ď¸âŁ Cause of the Incident
The issue was related to an early-version smart contract previously deployed on TRON. Although this legacy contract had been deprecated since 2022, historical vulnerabilities within it were recently exploited, affecting a limited number of users.
2ď¸âŁ Actions Taken
Upon discovery, our team immediately carried out investigation, isolation, and mitigation measures, followed by additional review and remediation on May 12, 2026. Users do not need to take any action.
The current smart contract version remains unaffected and has been operating securely for over four years, with ongoing security audits, testing, and monitoring in place. We will continue strengthening the management of legacy contracts and potential on-chain risks to further improve overall security.
3ď¸âŁ Compensation
Affected users will receive full compensation, with further details to be announced through our official channels.
4ď¸âŁ Security Reminder
⢠Please remain cautious of unsolicited messages or accounts claiming to represent Transit Finance.
⢠Never share your private key or seed phrase with anyone.
Transit Team
2
3
21
4,881
BlockSec retweeted
May 7
Alert! The contract 0xeEeEEe53033F7227d488ae83a27Bc9A9D5051756 was exploited resulting in total losses of $5.87M. An attacker-controlled contract (0xD4D5DB5EC65272B26F756712247281515F211E95) was able to invoke the function 0x4112e1c2() to transfer the @trustedvolumes Market Maker's approved assets after registering as the allowed signer.
Attack TX: app.blocksec.com/phalcon/expâŚ
1
7
35
5,923
BlockSec retweeted
May 6
.@EkuboProtocol was reportedly exploited on Ethereum hours ago, resulting in a loss of about $1.38 million (17 WBTC). The Ekubo team has urged users to revoke approvals to potentially affected router contracts.
The root cause was insufficient access control in a publicly accessible, closed-source router/wrapper contract (0x8ccb1f), which allowed an attacker to enter the Core lock flow, borrow WBTC via withdraw, and repay the debt using a victim's pre-existing token approval through payCallback -> transferFrom(victim, Core, amount).
Attack TX: app.blocksec.com/phalcon/expâŚ
May 5
There is an active security incident on Ekubo swap router contract on EVM chains only. Liquidity providers are not affected. Starknet is not affected.
We are investigating the scope of the issue, but to be safe revoke all outstanding approvals: revoke.cash
1
10
51
21,041
May 5
Add multiple language and better mobile support to our USDT freeze monitor. Have fun!
blocksec.ai/en/usdt-freeze
1
4
3,433
BlockSec retweeted
Apr 30
Pulled the full event history behind last week's observation.
USDC froze 549 TRON wallets in 10h on Mar 24. USDT froze 521 of them in 9 days (plus 14 it froze earlier).
USDT has unfrozen 90. USDC, 4.
87 sit USDT-unfrozen but USDC-frozen. One just moved ~201K USDT to @binance.
Apr 23
1/3 USDT has been quietly unfreezing addresses that @circle's USDC still has frozen. In multiple cases, funds moved directly to @Binance within hours of removal.
3
4
4,254
BlockSec retweeted
Apr 30
ALERT! Our system detected a series of unusual transactions involving @wasabi_protocol on #Ethereum and #Base, with total abnormal fund movements of roughly $5.15M.
Preliminary traces suggest that Tornado Cash-funded accounts were later granted ADMIN_ROLE-related privileges and were involved in the relevant WasabiLongPool, WasabiShortPool and WasabiVault flows.
We are sharing the related transactions for visibility and encourage the team to review and clarify the associated fund movements and role changes.
WasabiLongPool & WasabiShortPool:
1) app.blocksec.com/phalcon/expâŚ
2) app.blocksec.com/phalcon/expâŚ
WasabiVault:
1) app.blocksec.com/phalcon/expâŚ
2) app.blocksec.com/phalcon/expâŚ
1
3
21
6,042