Independent crypto security desk covering exploits, wallet threats, phishing and post-mortems. Incident mechanisms and impact.
- Tweets 486
- Following 1,430
- Followers 485
- Likes 9
Would you take 4 extra risks for roughly 0% extra yield?
$10.02B in restaked assets generated just $100K in weekly fees, while native ETH staking yields ~2.3%. Excluding points, what premium fairly prices operator, contract, wrapper and slashing risk?
1
4
31
What could freeze BNB Chain's $1B tokenized-asset market?
95.4% of BNB Chain DEX market is on PancakeSwap. An outage/exploit could spark a systemic liquidity shock: thin stock-token books face steep slippage or NAV depegs. That’s chain-wide protocol risk.
2
4
29
What if your wallet's shortened addresses help scammers?
Address poisoning fools anyone checking only first/last characters. Tera shows lookalikes side by side, flags the changed middle, and suggests the prior recipient. All wallets need it. Would yours?
3
18
How can you lose crypto without your private key being stolen?
$1 buys a test transfer before moving size. Address poisoning plants lookalikes in your history, betting you copy one. The chain executes what you sign. Confirm receipt. Worth the friction?
2
16
What did Crypto Twitter miss in the $3M NEAR bridge exploit?
$3M was hit by a bug in a bridge to NEAR—not NEAR itself. Funds were made whole, and the flaw was patched within 1 hour. Before selling the base asset, verify the real blast radius. Sell first?
1
12
What does successful AI security look like after a $3.8M breach?
7 USDT withdrawals cleared in a 4+ hour NEAR Intents exploit. SHIELD blocked the 8th; Intents paused, fixing the contract within an hour. AI limited further losses—but was containment a win?
10
Is NEAR taking the blame for the wrong layer?
$3.8M was lost through NEAR Intents on BNB Chain—not NEAR’s base chain. Repayment may make users whole, but traders must distinguish application risk from chain risk. Will they?
9
Why did a $3.8M bridge exploit freeze an unaffected protocol?
0 BSC-bridged assets were held by Templar when NEAR Intents’ BSC USDT bridge was hit—yet it paused deposits/withdrawals. Cross-chain risk may need containment before funds are hit. Right call?
8
How did $3.87M vanish while core NEAR stayed untouched?
BSC USDT deposits/withdrawals were hit by a handoff bug between Omni and NEAR Intents. Contract reviews can miss accounting failures across system boundaries. In bridge security, who owns that boundary?
1
13
Why did NEAR drop nearly 10% if its core chain wasn't hacked?
$3.8M lost in an exploit of Omni–NEAR Intents’ USDT-on-BSC flow. SHIELD paused services, fixed the flaw within an hour, and pledged full repayment. Does the market price loss or containment?
1
10
Can a $3.8M exploit show a security system worked?
$3.8M was lost after a USDT/BSC contract bug hit NEAR Intents. SHIELD flagged an anomaly, services paused, and a fix deployed within an hour. Users will be repaid. Key metric: blast radius. Trust restored?
7
Why couldn't The DAO attacker move 3.6M ETH right away?
27-day timelock: Ethereum hard-forked at block 1,920,000, creating Ethereum and Ethereum Classic. Timelocks can turn a completed exploit into a governance decision. Would you take that escape hatch?
5
5
45
How did an invalid proof drain $1.92M from Payy's bridge?
1,918,792 USDC released after Payy’s Noir/Barretenberg verifier accepted an invalid burn proof. Bridge treated false verification as authorization—making proof verification custody-critical.
26
25
140
How did $387.5M vanish without a leaked private key?
Bitget confirms stolen credentials were used to submit fraudulent withdrawals its system executed. The failure was transaction authorization, not key storage. What systems can reach the signer?
8
1
13
60
What happens when $387.5M in stolen crypto meets permissionless money?
THORChain rejected Bitget’s block request: halts protect network integrity, not censor swaps. Permissionless settlement can process disputed funds. Is neutrality worth the cost?
1
5
28
How do scammers drain 224 wallets without a phishing link?
274.6 ETH (~$517K) was stolen from 224 users via YouTube “AI trading bot” tutorials hiding wallet-drainer code. They deployed, funded & approved it—no seed theft. Median loss: 1 ETH. Audit first.
1
2
24
Can a YouTube tutorial make you drain your own wallet?
274.6 ETH (~$517K) was drained from 224 victims—no phishing link involved. Victims built, funded, and approved an “AI trading bot”; the deployment was the trap. Median loss: 1 ETH.
2
2
20
Can the right Chain ID still point to a fake network?
766.25 ETH ($2.08M) was drained from 1,335+ addresses through a fake GIWA bridge before launch. The bridge copied GIWA’s Chain ID 9134; chain IDs identify networks but do not authenticate them.
11
Why were 60% of exploited crypto projects already audited?
CoinGecko recorded 245 exploits from Jan 2025–Jul 2026. Audits don’t prevent key theft, phishing, frontend compromise, or unsafe admin access. What controls do you verify beyond the audit badge?
11