Hacked Event Broadcast

Polkadot issued a security alert stating that the Fearless Wallet browser extension (a third-party wallet) had been compromised since February 2025. Malicious code sent users’ private keys to an attacker-controlled server when the wallet was unlocked. Eight users have reported unauthorized transactions totaling 17,286 DOT. Affected users are urged to create new keypairs in a different wallet and move funds immediately.

Slice (onchain commerce protocol) suffered an exploit in its FundsModule where the 0x9d2edfac function trusted release amounts returned by caller-selected source contracts without verifying that corresponding ETH or USDC was actually received. The attacker used two contracts that returned nonzero amounts while transferring no assets, enabling immediate withdrawals of ~$41k from pooled reserves to the attacker.

An attacker exploited two flaws in an Argent-style smart wallet system. The recovery module’s unrestricted setter allowed a crafted recovery period to wrap the deadline timestamp into the past, enabling same-transaction recovery and ownership change with a valid guardian signature. The execution module also failed to reject reuse of identical signed payloads (executed 19 times in one tx and 9 times in another). The attacker used the repeated executions to trade against a low-liquidity MARK/WETH pool, resulting in a loss of approximately $59,800.

AlpsCon AI Trade Hub on BNB Chain was exploited. An attacker used the publicly known private key of a Hardhat default test account that had remained on the KYC whitelist for ~14 months, executed code via EIP-7702, flash-loaned USDC to buy and stake ALPS, and exploited a reward accounting bug (fresh stake treated as historical to claim accumulated rewards), netting ~$152K USDC after repaying the loan.

An attacker exploited insufficient randomness in some Qubic wallet seed generation (affecting seeds created in any browser on iPhone/iPad, Safari on Mac before Oct 18, 2026, or the Qubic iOS app before July 2025), draining approximately 2.94 trillion QU (~$1.3 million) from 1,404 wallets. The issue was in seed generation, not the Qubic protocol. The network was halted, most funds frozen, and seed generation fixed in version 4.26.4.

The Affluent DeFi protocol on the TON chain experienced an unbacked minting incident classified under token and share accounting, resulting in a loss of approximately $1,053,000 due to a smart contract vulnerability.

A transaction validation vulnerability in Pirate Chain source code allowed the unauthorized creation of approximately 39.8 million ARRR, increasing the total supply by about 20%. The newly minted funds were transferred into the Sapling shielded pool. NonKYC identified suspicious deposits, restricted the associated accounts, and blocked withdrawals. The exploit combined two validation failures: bypassing the issuance check and incorrect interpretation of the output scripts. dPoW operators suspended notarizations as a precaution, and exchanges/pools were asked to pause operations while a recovery plan is developed.

UNCX Network’s Vesting V2 contracts had a share-accounting logic vulnerability (VestingManager.cancel failed to ensure retained shares covered already-released amounts). The attacker transferred tokens directly to lower the shares-per-token rate, released and canceled schedules, and drained excess tokens from the shared vesting pool. Initial loss on Ethereum was ~$86k, later escalating to ~$1.49M across multiple chains.

Crypto gambling platform Gamdom was attacked on October 13, 2026, due to an unauthorized server connection, resulting in approximately $4.2 million stolen from hot wallets. The incident affected multiple blockchains; the platform went offline for investigation and moved remaining hot wallet funds to cold storage.

Papertrade, a synthetic perpetuals platform with up to 1000x leverage built on Hyperliquid’s HyperEVM, suffered a ~$1.28 million loss about 8 hours after its Oct. 10, 2026 launch. A wallet moved ETH prices on Hyperliquid (via large buys/sells) while holding highly leveraged positions on Papertrade that settled against the manipulated BBO midpoint, extracting profits from the platform’s shared USDC liquidity pool. Papertrade attributed it to overly permissive open-interest limits at launch and tightened them.

BitBay’s Polygon DAI/USDC vault, UsdcDaiV4Vault, was exploited. The attacker first called reposition() to force the vault’s liquidity to zero, then redeemed only one minimal share. Because _withdraw() sends the contract’s entire token balance when liquidity == 0 instead of the user’s proportional share, about 14,838.47 DAI (roughly $14,000) was drained.

EtherVista’s liquidity pool was exploited due to an integer overflow in the K-invariant check inside EtherVistaPair.swap(). Both reserves are uint112, so their product can wrap around and the check can pass even when the real reserve product drops sharply. The attacker registered a self-controlled contract as an authorized router and ran two crafted swaps to drain WETH and VISTA, with a loss of about $18,600.

An attacker exploited an accounting bug in X7Pioneer’s claimRewards(). The function adds address(this).balance - lastETHBalance to totalRewards on every call, but updates lastETHBalance only when claimable > 0. An empty array leaves claimable at 0, so the same unaccounted balance is added repeatedly and inflates per-token rewards. The attacker donated ETH to widen the delta, then drained about 6.78 ETH.

An operator hot-wallet private key of 79th Vault was compromised. Using an OPERATOR_ROLE function, the attacker moved 2.01 million 79AU out of the PancakeSwap 79AU/USDT pair in seven transfers, sold them back in about 95 swaps, cut the pool’s USDT reserves from about $15,200,000 to about $3,900,000, and cashed out 16,249 BNB (about $12,500,000). Forty-one seconds later the same operator key sent 3.79 BNB to the attacker address.

A Tornado Cash-funded address called an unprotected drain function on a dormant MakerDAO ETH-A liquidation keeper. The upgradeable proxy had won auctions #1457–1460 in 2020 (200 WETH total) but never called deal(), leaving the collateral in the Flipper. The attacker called deal(), moved the collateral to the keeper via Vat.flux, then used GemJoin.exit() to withdraw 200 WETH to an attacker-chosen address and unwrap it to ETH. The flaw was in the third-party keeper, not MakerDAO core.

The attacker abused Set Protocol’s actualizeFee(). Even though no fee was minted, the function rounded unitShares upward from 4,927 to 4,928. The attacker issued shares before the update and redeemed the same quantity afterward, extracting extra collateral from the rounding-induced unit increase. Uniswap v4 flash accounting supplied temporary liquidity to scale the exploit.

Web3 financial platform Based discovered that an unauthorized third party had accessed an internal dashboard used to manage the Based Visa Card program and contained the incident shortly after detection. KYC data collected by the card issuer for some cardholders (including name, ID/passport number, date of birth, and address) may have been obtained. Card numbers, CVV, PIN, ID photos, liveness records, the Based Wallet, and card funds were not affected, and cards continue to work normally. Affected users were notified by email, authorities were informed, and users were warned about phishing and social-engineering risks.

An attacker exploited a logic flaw in MALT’s swap function. With negligible input they triggered an external rebalanceHook that pulled DAI from the protocol’s Capital Source into the same pool. The swap then checked its invariant against the post-hook balances and treated the treasury-funded DAI as caller-supplied funds, allowing a disproportionate MALT withdrawal and a loss of about $ 72,000.

On Base, an attacker exploited GoldPesa’s GPXHooks. The hook rebalanced through a shared, flash-accounted PositionManager without checking that the GPX/USDC currency deltas were zero. The attacker opened an unlock, minted an unsettled WETH/USDC position (about 115,000 USDC of phantom debt), then swapped on the GPX pool to trigger the hourly reBalance. The hook’s burn credit was netted against that debt, and the attacker burned its own position and withdrew about 114,900 USDC from the PoolManager.

Microsoft’s official X account was accessed without authorization for about 30 minutes. Attackers changed the profile picture to Clippy, followed and reposted an impersonator account, and promoted an unauthorized Clippy meme coin to roughly 13 million followers; a later “apology” post was also unauthorized and deleted. Microsoft told The Verge and others that the account was secured, the posts removed, and that it never authorized any token tied to Clippy or $MSFT.