Defendor — DeFi Security

🧪 Vault Fee Shares Priced Against the Wrong Supply A swap priced fee shares against the wrong supply, so the fee recipient received 21 shares when about 32 were due. The post covers the single fuzz property that caught it, the fix, and how the same harness sca…

🚨 Major Wave of Active Exploits and Supply Chain Compromises Critical PHP and Next.js RCEs are under attack, and LiteLLM v1.107.0 is backdoored to steal credentials. PingCAP's TiDB Cloud was breached, and BeyondTrust and Ivanti zero-days hit CISA's KEV catalog…

🚨 Institutional Entity Loses ~$2.3M in MORPHO via EIP-7702 Thefts The 973K MORPHO was taken from two addresses within hours and deposited into Tornado Cash. The same entity lost ~$3.5M on Oct 9, bridged to Zcash and shielded, and both thefts involved EIP-7702…

🚨 Slice Exploited for ~$41K on Base The funds module trusted release amounts reported by caller-chosen contracts without checking that any assets were actually received. The attacker supplied two contracts returning unbacked amounts, which were used to pay out…

🕵️ DPRK-Linked SquidSquad Launders $2.84M Stolen on BSC The attacker deposited 1,111.2 ETH into Tornado Cash, withdrew to three addresses, and bridged everything to Tron via USDT0. Within minutes the funds moved through intermediaries to Chinese OTCs, likely t…

🤝 IOC Support Now Helping Crypto Fraud Victims Victims of crypto-related fraud are already using the service, which is meant to help them avoid the follow-up scams that are rampant afterward. 🔗 Details

🕵️ FreedomXMR Laundering Service Found on Hyperliquid Core Over 87% of its inflows are tied to illicit activity, with $20M+ traced to ransomware, exploits, and malware, including the Axelar and Gamdom incidents. Its admin sources XMR liquidity from KuCoin. 🔗 D…

🔑 SlowMist: Qubic Wallet Keys Recoverable From 6 Observations The wallet used the same non-cryptographic random stream for account seeds and for values exposed in network packet headers, so six consecutive observations can recover the generator state. That let…