Daniel Tan retweeted
#LedgerReseller exploit. In Oct 2026, users who bought Ledger hardware from Southeast Asian reseller #CryptoBilis were hacked and lost $93M due to a hardware supply chain attack that monitored the users' hardware wallet’s screen with a malicious implant
xitter.cf/Ledger/status/21098967…
Update from Ledger Donjon on the CryptoBilis investigation 🔽
@DonjonLedger is investigating Ledger signers sold by CryptoBilis, a reseller in Southeast Asia, that contained an unauthorized hardware implant. Ledger confirmed this on October 10th for one affected user's signer. All confirmed fund losses tied to the incident disclosed on October 9th involve signers sold through CryptoBilis. We have not verified a drain linked to a signer bought elsewhere. CryptoBilis has confirmed it stopped selling Ledger signers while the investigation continues.
Based on the Donjon's analysis of the attack, the implant sits inside the enclosure and reads the data shown on the screen. During setup, the signer displays the 24-word recovery phrase. When the implant detects these screens, its microcontroller decodes the words and transmits them over LTE using a provisioned eSIM. The implant is a separate component. It does not modify the Secure Element or the Ledger operating system, and it does not alter transactions or signatures.
The Donjon will analyze the signers it receives and will share more as the investigation continues.
We have not confirmed the total number of affected users or the total value lost. Figures circulating online come from third parties and Ledger has not fully verified them. If your funds were drained and you have not contacted us, please do so through Ledger Support so we can include your case. We are also reviewing reports of implants in other signers and locations. We will continue to share information as the investigation progresses. Rest assured the Ledger team is going above and beyond to leave no stone unturned to investigate this situation to the strongest possible outcome.
If you bought a Ledger signer from CryptoBilis and have not set it up, do not set it up and contact Ledger Support. If you have set it up, transfer your assets promptly to a new signer with a new recovery phrase. Do not enter or restore any recovery phrase on a signer bought from CryptoBilis. Never enter your recovery phrase into a website, app or form.
If you lost funds or hold a tampered signer, contact Ledger Support at support.ledger.com and file a report with local law enforcement. Do not send the signer to anyone before speaking with Ledger Support or local law enforcement. If you lost funds, coordinate with law enforcement before opening the signer. Researchers and others with relevant information can write to [email protected].
If you did not buy from CryptoBilis and want to inspect the inside of your signer, the guide is at support.ledger.com/article/4…. Use caution and make sure your recovery phrase is backed up first, because opening a signer can damage it.
Ledger will never call you, message you directly, or ask for your 24-word recovery phrase. We will update this post when we verify new information.
#Bybit exploit. On February 21, 2025, a hacker compromised Bybit's Safe multi-sig wallet frontend, resulted in $1.4B asset loss
The #Sygnia report indicates its root cause was malicious code from #Safe{Wallet}'s infrastructure. No compromise was detected within Bybit's systems
Bybit Hack Forensics Report
As promised, here are the preliminary reports of the hack conducted by @sygnia_labs and @Verichains
Screenshotted the conclusion and here is the link to the full report: docsend.com/view/s/rmdi832mp…
#Bitget exploit. Bitget's $388M in assets were hacked on 11 chains on Sep 24, 2026, after the attacker gained high-level privileges by exploiting a bug in an off-chain 3rd party security product, and the private-key compromise has been ruled out.
bitget.com/academy/bitget-se…
#LedgerReseller exploit. In Oct 2026, users who bought Ledger hardware from Southeast Asian reseller #CryptoBilis were hacked and lost $93M due to a hardware supply chain attack that monitored the users' hardware wallet’s screen with a malicious implant
xitter.cf/Ledger/status/21098967…
Update from Ledger Donjon on the CryptoBilis investigation 🔽
@DonjonLedger is investigating Ledger signers sold by CryptoBilis, a reseller in Southeast Asia, that contained an unauthorized hardware implant. Ledger confirmed this on October 10th for one affected user's signer. All confirmed fund losses tied to the incident disclosed on October 9th involve signers sold through CryptoBilis. We have not verified a drain linked to a signer bought elsewhere. CryptoBilis has confirmed it stopped selling Ledger signers while the investigation continues.
Based on the Donjon's analysis of the attack, the implant sits inside the enclosure and reads the data shown on the screen. During setup, the signer displays the 24-word recovery phrase. When the implant detects these screens, its microcontroller decodes the words and transmits them over LTE using a provisioned eSIM. The implant is a separate component. It does not modify the Secure Element or the Ledger operating system, and it does not alter transactions or signatures.
The Donjon will analyze the signers it receives and will share more as the investigation continues.
We have not confirmed the total number of affected users or the total value lost. Figures circulating online come from third parties and Ledger has not fully verified them. If your funds were drained and you have not contacted us, please do so through Ledger Support so we can include your case. We are also reviewing reports of implants in other signers and locations. We will continue to share information as the investigation progresses. Rest assured the Ledger team is going above and beyond to leave no stone unturned to investigate this situation to the strongest possible outcome.
If you bought a Ledger signer from CryptoBilis and have not set it up, do not set it up and contact Ledger Support. If you have set it up, transfer your assets promptly to a new signer with a new recovery phrase. Do not enter or restore any recovery phrase on a signer bought from CryptoBilis. Never enter your recovery phrase into a website, app or form.
If you lost funds or hold a tampered signer, contact Ledger Support at support.ledger.com and file a report with local law enforcement. Do not send the signer to anyone before speaking with Ledger Support or local law enforcement. If you lost funds, coordinate with law enforcement before opening the signer. Researchers and others with relevant information can write to [email protected].
If you did not buy from CryptoBilis and want to inspect the inside of your signer, the guide is at support.ledger.com/article/4…. Use caution and make sure your recovery phrase is backed up first, because opening a signer can damage it.
Ledger will never call you, message you directly, or ask for your 24-word recovery phrase. We will update this post when we verify new information.
Registration is now open for #CertiK #AIAuditor that not limited to scan critical vulnerabilities in #Solidity but also #Go, #Java, #Python, #TypeScript, C/#C++.
#EVMCortex An ethereum protocol engineering squad for AI coding assistants.
50 #agents, 94 #skills, 19 hooks, and 15 rules covering #Solidity development, #security auditing, DeFi integration, testing, and deployment from #Chris, a full-stack dev @Uniswap
github.com/ccashwell/evm-cor…
🚨Solidity Devs - this awesome repository has 50 agents, 91 skills and 19 hooks for Solidity development, deployment, testing and security
Built & compiled by a Uniswap Senior Engineer. Use this for higher quality development, MIT license🫡
github.com/ccashwell/evm-cor…
#AIMath What if Math is resolved?
An 87-year-old core #mathematics problem, the #jacobian conjecture, was casually solved by #Fable 5 on a Sunday evening.
crypto.training/ A wonderful site for crypto Training for web3 security engineering, Solidity, and EVM internals. #Web3Security #SmartContract #Audit #Vulnerability
1,100+ runnable EVM exploits — live on crypto.training
We’ve crossed 1,100 fully runnable exploit PoCs on crypto.training/hacks.
That’s not a list of write-ups or a folder of Solidity files that might compile. Each one is a self-contained, offline-reproducible Foundry PoC you can open in the browser and actually execute — historical DeFi hacks and high-severity audit findings reduced to faithful synthetics.
I believe this is the largest public collection of runnable EVM exploits in the world.
If you learn security by reading blogs, you get the story.
If you step the bytecode, you get the mechanism.
What makes the playground different
Every hack page can load an in-browser EVM (no backend, no fork server required for the interactive path). The killer features:
✅ Opcode-by-opcode debugging — step, reverse-step, and jump through the real execution trace of the exploit, not a simplified animation
✅ Full EVM state at every step — stack, memory, storage, call depth, and program counter, in sync with the opcode you’re on
✅ Balances panel — watch native currency, ERC-20, ERC-721, and ERC-1155 update as money moves: who was paid, who was drained, at which step
✅ “Go to vulnerability” — jump straight to the blamed source line in the vulnerable contract (real @> lines preserved for audit findings)
✅ “Watch exploit live” — story beats that walk setup → trigger → harm, each tied to executed lines in the trace
✅ Labeled call tree — see contracts by name, not only bare addresses
✅ Same PoC offline — download the analyzer ZIP / registry package and run forge test with no network when you want the Foundry path
What’s in the corpus
➡ Hundreds of historical DeFi incidents (the classic SunSec / DeFiHackLabs lineage and beyond)
➡ Hundreds of audit findings from AuditVault / contest reports — reduced to local-deploy synthetics that still demonstrate real harm
➡ One pipeline end-to-end: registry PoC → playground config → verified recording → page → analyzer ZIP
Why this matters for auditors and builders
✅ Train on mechanisms, not just CVE titles
✅ Compare how the same bug class shows up across protocols
✅ Teach juniors with a debugger instead of a wall of prose
✅ Re-run and modify PoCs locally when you want to go deeper
Open any page on crypto.training/hacks, hit the playground, and step the exploit yourself.
Open source tooling: github.com/sanbir/evm-hack-a…
Feedback, corrections, and new PoCs welcome.
#Web3Security #SmartContractAudit #DeFi #Ethereum #EVM #SecurityResearch #OpenSource #Solidity #BugBounty
#PostQuantumSignatures #OTS
One-Time Signatures represent the theoretical bedrock of hash-based cryptography. They provide a provably secure signature mechanism with post-quantum resilience.
TL;DR
certik.com/blog/post-quantum…
#KelpDAO has paused rsETH contracts across mainnet and several L2s.
xitter.cf/KelpDAO/status/2045595…
Earlier today we identified suspicious cross-chain activity involving rsETH. We have paused rsETH contracts across mainnet and several L2s while we investigate.
We are working with @LayerZero_Core, @unichain, our auditors and top security experts on RCA.
We will keep you posted as we learn more about this situation. Please follow only the official @KelpDAO handle for the updates.
#RheaFiance $7.6M hack. A hacker added liquidity in fresh pools with fake tokens to mislead the oracle and validation layer.
#CertiKInsight 🚨
We have seen an incident affecting @rhea_finance
The attacker created fake token contracts and added liquidity in fresh pools, likely misleading the oracle and validation layer.
In total, at least ~$7.6M was extracted
nearblocks.io/address/31ac7a…
#Tether has froze 3.29M USDT to the hackers.
xitter.cf/paoloardoino/status/20…
Rhea Fiance has temporarily paused the contracts and are conducting a thorough investigation.
xitter.cf/rhea_finance/status/20…
The RHEA team is aware of an incident affecting the protocol. As a precautionary measure, we have temporarily paused the contracts while we conduct a thorough investigation.
We are working closely with key partners, stakeholders, and security experts. Protecting user positions is our immediate priority, and our team is focused on minimizing any potential impact.
RHEA team has reached out to the responsible party through on chain transaction.
nearblocks.io/txns/6r5c2iZig…
#AIAuditor 28 out 35 real security incidents in 2026 are hit by #CertiK AI Auditor on the first run.
Daniel Tan retweeted
#CertiKStatsAlert 🚨
@DriftProtocol seems to be a victim of an exploit for ~$136M losses.
Funds are currently being laundered or moved.
~$109M in wallet 7RoMqGAcU7S6ESAhPDvB9iSXvASUhuoE8u7dYRxGBew9
solscan.io/account/7RoMqGAcU…
Stay vigilant!
#AAVEMisconfig A misconfiguration on Aave's CAPO oracle caused wstETH E-Mode liquidations, resulting in a loss of 345 $ETH.
#ZKVerifierBug on March 10th, the @CertiK Sr. Staff Security Engineer, #XifengJin, will dive into the ZK verifier attack patterns targeting DSL circuits, zkVMs, and proving systems with practical mitigation insights, in the X Space.
#CertiK #ZKVM #DSLCircuit #Audit
A high-level perspective to look at the security in #zkcircuits that abstracts away from specific languages and proving system
docs.google.com/presentation…
#Makina $4M #PriceManipulation hack. The MIM-3CRV pool was manipulated by inflating the MIM price through a flashloan, which affects DUSD Caliber to reflect an inflated value, then propagated to the Machine AUM, the DUSD exchange rate, and ultimately to the DUSD/USDC Curve pool.
#TruebitProtocol exploit. The root cause of this $26M hack was that the price calculation #overflow and was manipulated.
In the vulnerable smart contract, the SafeMath library is not used, and the Solidity version 0.8.0 or higher is also not used.
#CertiKInsight 🚨
On 8 January 2026, @Truebitprotocol
was exploited due to an overflow issue, resulting in a loss of ~$26.6M.
To learn more about what happened, read our full analysis here 👇
certik.com/resources/blog/tr…
