Building SigintZero: Smart contract audits & on chain monitoring. The post-mortem always costs more than the audit.
- Tweets 384
- Following 703
- Followers 541
- Likes 1,573
Someone launched a fake GIWA chain last weekend. GIWA is Upbit's L2 and has no mainnet yet.
Real OP Stack rollup, GIWA's reserved chain ID. A DEX listed it and 1,335 wallets bridged in.
Then the operators upgraded their bridge, took 766 ETH and put the code back.
1
28
Alex traced the upgrade tx and where the ETH went sigintzero.com/blog/giwa-imp…
5
Duelbits got drained for about $7M last week. Their second hot wallet hack since 2024.
At 08:40 UTC their Ethereum wallet was paying normal withdrawals. By 09:02 it had sent everything to a fresh address. Five transfers.
1,370 ETH has gone into Tornado Cash since.
1
106
Traced the whole thing on-chain, Tornado deposits included sigintzero.com/blog/duelbits…
1
22
Bitget lost $387.5M and nobody touched their private keys.
Someone got into a backend system and fed the signer fake withdrawal orders. It signed them.
Their alarm went off at 18:31 UTC. The signer kept going until 21:23.
About $290M left after the alarm.
1
37
Alex put the whole timeline together, gas limit tell included sigintzero.com/blog/bitget-3…
16
Someone bought $20k of NTRN and staked it 11 minutes before a Neutron vote closed. It passed.
The proposal made them admin of 10 Astroport and Drop contracts.
24 minutes later all 10 ran their code and were empty. About $9.4M.
It sat in plain view for three days.
1
1
1
44
Aron pulled the whole timeline together here sigintzero.com/blog/neutron-…
13
This bridge contract had a cap written into it. One million tokens per conversion.
It enforced that on deposits. On payouts it enforced nothing.
Someone got the signing key and asked for 8.7 million in one call. Float gone.
The older version checked both ways.
1
1
1
60
Dmitry went through the chain state on this one, it's worth a read if you ship upgradeable contracts. sigintzero.com/blog/singular…
27
Someone found a genuine bug in a Safe helper contract this week. Built the exploit. Sent it.
An MEV bot read it out of the mempool, paid ~$46k to jump the queue, and took all 2,900 rsETH. About $7.4M.
The attacker came back an hour later and got 23 ETH.
1
85
Someone made a Nomic escrow account send Bitcoin to itself. 25 times, one block.
Out came 40 BTC of nBTC with nothing behind it.
It sat inside Osmosis allBTC being counted as real collateral for 74 days.
36% of the backing was air.
1
1
53
Wrote up how the two bugs combine, and the part where the rate limit that trapped the attacker got read as demand and raised. sigintzero.com/blog/nomic-40…
19
I'm going to ETHGlobal Tokyo 2026 @ETHGlobal!
Use my referral link below to earn a discount on your stake!
Link: ethglob.al/6PDNOD9I0C
46
Notional Finance lost $1.73M on Friday, out of a 2020 contract they stopped using two versions ago.
Someone built a debt too big for the variable holding it. The contract kept the bits that fit, got zero, and read the account as debt free.
Nobody ever swept it.
1
91
Aron pulled the transactions apart, including the bit where they split the position across two maturities to dodge SafeMath. sigintzero.com/blog/notional…
1
28
Liquid lost 4,000 BTC on Sunday. About 95% of what backs L-BTC.
The coins were minted from nothing and pegged out like any order. Every key stayed put.
The hole was a cache key. Four fields hashed back to back, no length prefixes. Merged 5 days earlier. Never released.
1
1
1
83
Pulled every OP_RETURN between the attacker and Blockstream, verified the PGP signatures, read the diff. sigintzero.com/blog/liquid-n…
1
40
Two validators joined Core's block rotation twelve seconds apart. Three days later they left the same way.
In between the chain credited them the same block rewards more than once. 255M CORE, years early.
The address a block pays into had code on it. EIP-7702.
1
92
Pulled apart what the fix actually tells you about the bug. sigintzero.com/blog/core-dao…
41