Web3 Security News

Quick one for the builders here. Polymarket lost ~$3M last week and it wasn't their contracts or servers.. a third-party script on their frontend got compromised and changed what users were signing. Same story as Badger, Ledger Connect Kit, Balancer, the npm drainers. You can't fully control everything on your own domain, so it has to be monitored. That's what we've been building VANTAGE for, now in alpha with beta opening up. X: https://x.com/__Raiders/status/2071620737706913800 Beta: https://vantage.digibastion.com/

hey folks, been getting quite a few messages around this so put it all together --> web3sec roadmap + AI-era path for anyone getting into this. drop improvements via PR if any, tried to make it short, clear and actionable. https://x.com/__Raiders/status/2059294222600294845

Hey everyone! Just a quick reminder that today is the last day to support our Ethereum security quadratic funding on Giveth. If you can spare a $ in donation, it will be matched, which means we'll be able to continue doing awesome research and developing tools for the crypto community. Web3sec news: https://qf.giveth.io/project/web3secnews:-security-intelligence-newsletter Digibastion: https://qf.giveth.io/project/digibastion:-dns-opsec-supply-chain-security Thanks so much for all the support till date :)

hey fam, Web3Sec.News and DigiBastion.com both projects made it into the thedaofund Ethereum Security QF Round on Giveth 🎉 500 ETH matching pool, voting open until May 14. Even $1 from a unique donor makes a real difference. 🔗 web3sec_news: https://qf.giveth.io/project/web3secnews:-security-intelligence-newsletter 🔗 DigiBastion: https://qf.giveth.io/project/digibastion:-dns-opsec-supply-chain-security Full details in this thread: https://x.com/__Raiders/status/2048441729175716040

cow.fi got hijacked recently, so did hypurr.fi, and neutrl.fi - all in the same few weeks, all through DNS, none through code. we saw someone also survive an attempted attack on our own domain. caught it in 30 seconds. here's the full breakdown: ✦ how the attack chain works (registrar → ns swap → valid cert → live phishing) ✦ our field report — what we did in the first 10 mins ✦ 4 attacker TTPs extracted from confirmed incidents ✦ defensive checklist you can act on today if you're running a protocol, especially on a .fi domain - read this one. 👉 https://web3secnews.substack.com/p/the-fi-files-a-field-report-on-dns

Protecting Crypto Domains and Infra: A Guide to Defending Against DNS Hijacking and BGP Attacks A detailed guide by vladimir https://x.com/i/status/2044147555618173261

For affected users: Revoke everything at revoke.cash, focus on CoW Protocol router contracts. Move funds out of any wallet connected to cow.fi today. Stay safe. https://x.com/__Raiders/status/2044106026321096751

🚨 CONFIRMED: cow[.]fi (CoW Swap) is under an ACTIVE supply chain attack. If you connected your wallet to cow.fi today — REVOKE ALL APPROVALS NOW. → revoke.cash → etherscan.io/tokenapprovalchecker ATTACK BREAKDOWN: 1. DNS/Registrar hijack WHOIS shows the domain was modified today (14.04.2026). The attacker has taken control of the cow.fi DNS zone, the legitimate site has been replaced. 2. Pixel-perfect phishing frontend cow.fi now serves a thin iframe shell loading light.html / dark.html both are 942KB SingleFile HTML snapshots of the real swap.cow.fi, saved today at 14:31 CEST via browser extension. Visually indistinguishable from the real app. 3. Malicious svelte.js wallet drainer The fake page loads ./svelte.js (124KB). This is NOT the Svelte framework. It is a confirmed wallet drainer: --> LZ-string decompression + eval() unpacks the payload at runtime to evade static analysis --> setTimeout(drainFunction, 50ms), auto-executes 50ms after page load --> Function() constructor as a secondary execution vector The drain runs automatically on wallet connection. No user approval prompt needed. Attack window: ~12:30–14:31 UTC today Rogue cert fingerprint (SHA1): 74:9B:F1:B4:C9:C8:86:07:D0:CF:FA:D7:EF:1F:22:84:FB:76:44:1A ---

honoured to be selected for the ETHSecurity Badge holder already heads down building at digibastion, dns security, live threat intel, supply chain and phishing tooling, opsec guides... a lot coming together a lot of work ahead but excited to contribute to the DAO https://x.com/i/status/2043883600152801651

you're NOT even aware of the types of hacks & exploits POSSIBLE through third-party packages, existing code, binaries, SDKs, and projects whose code is NEVER visible - yet broadly TRUSTED and used. and with vibe coding across AI tools and different LLMs, new attack surfaces are opening up that can lead to FULL infra compromise & data exfiltration. give it 1-2 years & it'll click for most people. everything is a marketing bs and narrative atm. iykyk - this is genuinely scary stuff. https://x.com/__Raiders/status/2043747739931160908

Been working on something quietly over the past few months. I built an internal Domain and DNS security intelligence scanner to help teams stay protected from domain hijacking, DNS misconfigurations, registrar issues, and other overlooked risks. This came from seeing the same thing again and again. Critical domains getting compromised not because of complex exploits, but because of simple gaps in DNS or registrar security. So I went deep on it. 250+ handcrafted checks Covers DNS configs, registrar posture, takeover risks, and edge cases Built from real audit work and real incidents I’ve already shared a few reports with founders, protocol teams, and security researchers. The response has been great, but more importantly, people actually fixed the issues. That’s the goal. Domain security is still underestimated, but when things go wrong, the impact is huge. Email, auth flows, user trust, everything depends on it. I’m happy to run this on a few more DOMAINS. Comment your domain or DM me & I’ll share a detailed report with fixes so you can act before it’s too late.

Most audit tools pattern match. guardix maps your architecture first. invariants, assumptions, design decisions. then hunts for violations. Every finding is backed by a verified exploit. audit runs are versioned. fix, re-audit, see exactly what changed. 1 free solidity audit after signup. If you've been vibe coding contracts, now's a good time to check what you're about to ship. → https://guardix.io

we just published our Q1 2026 Web3 security deep dive 🔐 $450M+ lost this quarter. the biggest single incident - Drift Protocol's $285M had zero code vulnerabilities. pure social engineering on the signers. what's inside: → full Q1 numbers breakdown → top 10 vulnerability classes ranked by impact → where security budgets go vs where losses actually come from → how attacks unfold from recon to cash-out → action items for builders, signers, and usersworth a read whether you're building, auditing, or just active in the space.. must read https://web3secnews.substack.com/p/web3-security-in-q1-2026-over-450m

most protocols audit their code. nobody audits who controls it. admin compromise has drained more funds than logic bugs ever did. we cover this. full stack - multisig config, key hygiene, supply chain, infra, DNS. if your protocol wants an admin audit, DM https://x.com/i/status/2040381361891250452

one more thing that almost never comes up during architecture reviews and honestly should be the first conversation: UPPER CAPS on single-point-of-failure exposure like fundamentally why was $285m drainable in 12 minutes through a single chain of compromise. if your architecture allows 100% of TVL to leave when admin is compromised everything else is damage mitigation not damage prevention.. strict upper caps need to be baked into the protocol layer itself and not controllable by the same admin keys: - per-transaction limits that no security council can override - cumulative time-windowed caps (max X% of TVL exits in any 24hr window) - velocity-based circuit breakers that auto-pause when outflows exceed historical norms - tiered thresholds where crossing certain amounts triggers mandatory delays requiring a completely separate key hierarchy drift's attacker gained full admin permissions and removed all withdrawal limits. if those caps were immutable at the protocol level, max loss might have been $10-20m before circuit breakers fired and the community had time to respond we're also seeing "shadow contagion" now where one breach cascades across shared infrastructure. resolv's $25m aws kms breach triggered bad debt across morpho, euler and fluid simultaneously. upper caps at the protocol level are the only thing that can contain that blast radius of an attack in realtime IMO. the question every protocol should be asking isn't just "how do we prevent compromise" but "when everything fails, what's our maximum possible loss." if the answer is 100% of TVL - the architecture needs to change before anything else https://x.com/__Raiders/status/2040101411606999301

the "set and forget" era of security is dead. drift protocol just lost $270M+ not from a zero-day. not from a novel attack vector. early reports point to a compromised admin key i.e basic key management 😅 $550M in TVL. half of it gone in minutes. you can audit your smart contracts 10 times. if nobody's watching who holds the keys and how they're stored, none of it matters. security isn't just a deployment with a rubber stamp. it's a practice. https://x.com/i/status/2039556330642604172

had 15+ conversations with early stage founders over the past few weeks. almost all of them said the same thing about security. "we'll deal with it when we get bigger." sure. here's what dealing with it later actually looks like. you grow. you raise. you start landing enterprise deals. then one of them asks for your SOC report. or your compliance cert. or proof that someone's actually monitoring your infra at 2am on a tuesday. and suddenly "later" is now. except now it's also urgent. and 4x more expensive. and blocking a deal that could define your quarter. watched this happen at least half a dozen times this year. one founder nearly lost a client worth 3x their MRR because no one could produce a single log showing who accessed what and when. and this isn't just a startup problem. look at what just happened with claude code. anthropic, one of the most well-resourced AI labs in the world, had source code exposed. not from some sophisticated zero-day. not a nation-state op. basic security hygiene. now think about what that means in the current AI race. the gap between leading and falling behind shifts every week. one code exposure can leak your model architecture, your training pipeline, your entire edge. when competition is this tight and moving this fast, a single slip doesn't just cost you a compliance checkbox. it costs you your position. if a company like anthropic can miss the basics, what makes a 12-person startup immune? the fix wasn't expensive. it wasn't complicated. it just needed to start 6 months earlier. security doesn't need a big budget. it needs a small start. https://x.com/__Raiders/status/2039260636513964044

SUPPLY CHAIN ATTACKS are not slowing down !!!! ⛔ axios just got hit -> versions 1.14.1 & 0.30.4 published via a HIJACKED MAINTAINER ACCOUNT injecting a fake dependency that drops a cross-platform RAT. self-destructing payload, pre-staged 18 hours in advance. whenever i do security audit, i always check TRANSITIVE DEPENDENCIES, package health, maintainer geography, and different heuristics to catch exactly this and REPORT as a finding so they can fix and harden ci/cd. been building this at digibastion.com - scan your repos for malicious dependencies, malware, and idle packages that shouldn't be there. DM me for a supply chain security audit. i only need the github repo haha https://x.com/i/status/2038867038706524622

🚨 3 VSCode extensions by IoliteLabs (solidity-macos, solidity-windows, solidity-linux) just got hijacked after sitting dormant since 2018. 27,500 installs. 8 years of trust capital gone in one version bump. The attacker compromised the publisher account, pushed v0.1.8 with a multi-stage backdoor hidden inside a tampered pako dependency. not even in the extension entry point. https://x.com/i/status/2038075687916237099

🚨Yesterday, versions 1.82.7 and 1.82.8 on PyPI (LiteLLLM) were backdoored with a credential-stealing payload 97 million downloads/month. 3.4M downloads/day. Present in 36% of cloud environments. Just installing it was enough. No import needed. Here's the full breakdown 🧵 https://x.com/i/status/2036640285011419643