Web3 is Going Just Great

July 10, 2025

Kinto token crashes; community claims rug pull, Kinto claims hack

The price of Kinto's $K token suddenly crashed 90%, sparking accusations of a rug pull. A tranche of investor tokens had just been unlocked recently, leading some to speculate that investors dumped their tokens on retail buyers.

However, Kinto blamed the token crash on the exploit that was recently disclosed by VennBuild, claiming on Twitter that "we got hacked by a state actor". Venn seemed to corroborate Kinto's explanation that the crash was related to the exploit, tweeting that although they had tried to warn all vulnerable projects before publicly disclosing the bug, "Sadly the Kinto token was not found despite being vulnerable, and exploited without time to mitigate."

Kinto has announced a plan to try to fundraise to cover a $1.4 million loss in liquidity, then create a new $K token based on a snapshot of previous token holdings.

July 9, 2025

$2.2 million in user funds stolen from Texture; hacker returns 90%

(attribution)

An attacker exploited the Solana-based lending protocol Texture, stealing $2.2 million in user funds from one of the project's vaults.

Shortly after the attack, Texture sent a message to the thief: "We are offering a 10% bounty of any funds stolen, which are yours to keep if you return the remaining 90%. You made an opsec mistake, but it’s not too late to avoid escalating the situation."

The threat and "bounty" offer apparently worked, and the hacker returned $1.98 million, keeping $220,000 as a so-called "greyhat bounty". "As the hacker has fulfilled their side of the agreement, we will not pursue the matter further," wrote Texture.

July 9, 2025

Security researchers disclose exploit that put over $10 million across multiple protocols at risk

On July 9, security researchers at VennBuild and other firms disclosed a "critical backdoor" affecting thousands of smart contracts, which one of the researchers said left "over $10,000,000 at risk for months". The researchers suggested that the backdoor was likely created by Lazarus, a North Korean state-sponsored hacking group.

According to the researchers, they found thousands of contracts affected by the exploit, and worked with multiple protocols to upgrade contracts or withdraw vulnerable funds. The researchers theorized that the attackers were "likely a sophisticated group waiting for a bigger target, not small wins."

Tweet thread by deeberiroz [archive]

July 9, 2025

GMX exchange hacked for $42 million

(attribution)

The decentralized perpetual exchange GMX has been exploited for $42 million. The exploit involved a vulnerability in one version of the exchange's price calculation smart contract. GMX paused some trading while they investigated the hack, and placed other temporary restrictions on the platform.

GMX offered a 10% "bug bounty" to the hacker if they returned the funds. As of 24 hours after the theft, the hacker had not acknowledged the offer, and had begun swapping the stolen tokens.

June 26, 2025

Resupply stablecoin lender exploited for $9.3 million

(attribution)

An attacker was able to exploit a vulnerability in a smart contract used by the Resupply stablecoin lender to extract about $9.3 million from the project. After depositing around $200,000, they were able to inflate the price of another token and borrow almost $10 million.

Resupply announced the theft shortly afterwards, and stated that they had paused the vulnerable contract.

Resupply is a fairly new project, having officially launched on March 20 — about three months before the exploit.

June 23, 2025

Self Chain fires founder after $50 million scam allegations

(attribution)

On June 19, a company called Aza Ventures published allegations on Telegram that they had been scammed by someone promising to facilitate OTC sales of steeply discounted tokens for projects like SUI and NEAR. They claimed they had discovered the whole scheme was a Ponzi.

Aza Ventures was initially hesitant to name the scammer, hoping they could pressure the scammer to return the stolen funds, but later reports quickly named Self Chain founder Ravindra Kumar as the alleged culprit. Kumar posted on June 19, "I've been accused of serious wrongdoing, which is completely false."

On June 23, Self Chain announced that they had terminated Kumar as CEO "due to recent developments that diverge from the founding vision".

June 23, 2025

New York scammer "daytwo" steals $4 million from Coinbase users, blows most of it gambling

Christian Nieves, a New York man who goes by the handles "daytwo" and "PawsOnHips", has reportedly stolen more than $4 million through a theft ring where he impersonates Coinbase customer support. An investigation by crypto sleuth zachxbt outlined thefts from multiple Coinbase users, including one elderly victim who lost $240,000.

zachxbt noted that Nieves seems to have a gambling problem, depositing much of the stolen funds into crypto gambling websites. "You’ll see onchain how casino deposits get smaller as he loses funds," wrote zachxbt. "Recently this escalated to the point where he started stealing cuts from accomplices." He also appears to have used some of the stolen funds on luxury goods, including a Corvette and expensive watches.

Tweet thread by zachxbt [archive]

June 21, 2025

Hacken token crashes after private key leak

(attribution)

Web3 cybersecurity firm Hacken had a cybersecurity incident of their own when the private key belonging to a wallet with mint access for the project's $HAI token was leaked. According to Hacken, the leak was attributable to "human error during architectural changes". After a malicious party gained access to the key, they minted around 900 million $HAI on the Ethereum and BNB chains, almost doubling the total supply. The attacker only profited around $250,000, but they crashed the token price by around 97% in the process.

Tweet thread by Hacken [archive]
"Hacken cites 'human error' after private key leak triggers $5 million crash in $HAI value", The Block

June 18, 2025

Israeli-linked hackers steal and destroy $90 million from Iranian Nobitex exchange

(attribution)

The Iran-based Nobitex cryptocurrency exchange suffered a $90 million hack, and the attacker has also promised to imminently release data and source code from the platform. The hacking group appears to have burned the crypto assets, effectively destroying them rather than taking them for their own profits.

Gonjeshke Darande (also "Predatory Sparrow"), a hacking group with links to Israel, claimed responsibility for the theft, accusing the platform of serving as a "key regime tool" to finance terror and violate sanctions. The cyberattack comes shortly after Israel launched air strikes on Iran.

"Iranian crypto exchange Nobitex hacked for over $90 million by pro-Israel group", Elliptic [archive]

June 17, 2025

Meta Pool exploited

(attribution)

An attacker exploited a vulnerability in the staking contract for Meta Pool, which is a liquid staking project. This allowed them to mint 9,700 mpETH, the project's liquid staking token, which is notionally worth $27 million. However, very low liquidity for the token meant that the attacker was only able to swap 10 ETH (~$25,000) of tokens.

Meta Pool acknowledged the theft in a post shortly after the exploit was noticed by a blockchain security firm, and announced that the team had paused the project's smart contract.

"Meta Pool, a Liquid Staking Protocol, Suffers $27M Exploit", CoinDesk [archive]