Subscribe
Sign in
Home
Notes
Archive
About
Latest
Top
Discussions
A $13 Million Bridge Forgery, a Repeated Flash-Loan Exploit, and a Critical WordPress Vulnerability | Burn Notice #10
Wanchain's bridge had operated for more than eight years and Allbridge had already patched its attack class once, yet both were compromised through…
Jul 23
•
Adrian ⛩️ Hetman
1
Ostium Loses $18M, Bonzo Lend $9M, and BlueMove Drains Its Own Pools | Burn Notice #9
Two Oracle Failures and an Alleged Insider Backdoor, Plus a Security Vendor's npm Package Turned Infostealer.
Jul 22
•
Adrian ⛩️ Hetman
1
Bonk's $20M Governance Buyout, Summer.fi's $6M Vault Drain, and Aptos's $70B Move VM Bug | Burn Notice #8
Every loss that mattered this week came through machinery each team had stopped watching.
Jul 9
•
Adrian ⛩️ Hetman
1
Burn Notice #7 | SecondFi's Deterministic Nonce Flaw, Edel Finance's 78x Oracle Manipulation, and THORChain's 39-Day Reopening
One of the three entities that founded Cardano ships a wallet, and this week a flaw in its own signing software handed attackers the private keys to 374…
Jul 3
•
Adrian ⛩️ Hetman
1
1
June 2026
Jared’s $7.5M Approval Sweep, 144 Poisoned npm Packages, and Aztec Drained Twice in a Week | Burn Notice #6
A counter-MEV bot tricked into authorising its own drain, a North Korean crew republishing a million-download package scope, and a four-year-dead bridge…
Jun 24
•
Adrian ⛩️ Hetman
1
Will AI Take the Security Researcher's Job?
Your Security Career in the Age of AI
Jun 23
•
Adrian ⛩️ Hetman
2
2
A Bug Bounty Costs Less Than Getting Hacked
Don't Kill Your Bug Bounty Program Over AI Slop
Jun 21
•
Adrian ⛩️ Hetman
2
2
Burn Notice #5
Aztec Connect’s $2.19M Unpausable Drain, Verus’s $11.6M Replay of a 2022 Bridge Bug, and Two Bounty Programs Going Dark
Jun 17
•
Adrian ⛩️ Hetman
1
The Operational Security Gap Behind 2026's Web3 Losses
Roughly ~200 hack and exploit incidents in the first half of 2026, and about $900M stolen in total. Operational and infrastructure compromises took…
Jun 12
•
Adrian ⛩️ Hetman
1
Burn Notice #4
A Laptop That Cleared Two Multisigs, Opus 4.8’s Four-Year Zcash Bug, and a One-Vote DAO Takeover
Jun 10
•
Adrian ⛩️ Hetman
1
1
The Expensive Failures Live Above the Code
Web3’s most expensive failures come from the opsec and infrastructure layer. The audits are still pointed at the contracts.
Jun 5
•
Adrian ⛩️ Hetman
1
Burn Notice #3
Gnosis Pay's Delay-Module Signature, StakeDAO's setPeer Mint, and a Bridge Down to Its Signing Key
Jun 3
•
Adrian ⛩️ Hetman
2
1
This site requires JavaScript to run correctly. Please
turn on JavaScript
or unblock scripts
