Pinned Tweet
As institutions move onchain, counterparty and transaction screening are essential to their security and compliance.
Forta Firewall delivers that, powered by the FORT token.
Learn more 👉 forta.org/fort
Railway’s security incident hit crypto too: private keys stored in env vars were drained, ~$370K across 19+ EVM chains, with $261K in USDT0 landing on Arbitrum.
Forta Firewall flagged the attacker.
An urgent notice from the Railway team
blog.railway.com/p/security-…
What happens to your portfolio if a stablecoin depegs?
Or an oracle fails? A protocol is exploited? Liquidity disappears?
Forta Risk lets teams model scenarios and quantify their potential impact.
forta.org/risk
It was a busy week for attackers, and for Forta Firewall.
Over the last six days, Firewall detected all six hacks, spanning different chains, exploit types and victims.
👇
AlpsCon on BNB Chain was exploited for $200K 🚨
A test wallet with a publicly known private key sat on its staking whitelist for 14 months.
The attacker used that key to run exploit code via EIP-7702 and drained the reward pool.
Forta Firewall flagged the attack.
Onchain risk analysis doesn’t always need another dashboard.
With the Forta Risk Graph MCP, you can explore dependencies, exposure and contagion directly through your AI assistant using natural language.
Ask a question. Query the live risk graph. Follow the exposure.
Get started
docs.forta.network/en/latest…
Financial markets are moving onchain.
As institutional capital moves onto blockchain rails, risk teams need visibility into the dependencies and exposures that come with it.
Onchain finance needs institutional-grade risk management.
Forta Risk
forta.org/risk
.@UNCX_token lost ~$86k to a share accounting bug in VestingManager 🚨
cancel() didn’t check that retained shares covered shares already released, letting the attacker over-reduce global shares and claim excess tokens from the shared pool.
Forta Firewall flagged it.
Private key compromise 🚨
A wallet dormant since Feb 2025 just sent its full $3.48M balance in USDT and ETH to a fresh address.
Forta Firewall flagged it.
Ask a simple question: “What happens if this asset fails?”
The Forta Risk Graph MCP can trace the dependencies, identify what’s exposed and quantify the potential impact in USD.
Live onchain risk intelligence, directly from your AI assistant.
docs.forta.network/en/latest…
~$3.55M in unclaimed bridge funds was claimed via EIP-7702 delegations from a Tornado Cash-funded address 🚨
Forta Firewall detected it.
Diversification can hide shared dependencies.
Assets that appear unrelated may rely on the same protocols, oracles, collateral or admins.
Forta Risk maps indirect exposures to reveal concentration risks that holdings alone miss.
forta.org/risk
Ask your AI assistant:
"If this stablecoin depegs, what gets hit and by how much?"
"Who can upgrade this contract?"
"What dependencies do my positions share?"
The Forta Risk Graph MCP brings live onchain risk data into your assistant.
docs.forta.network/en/latest…
What you hold is only part of what you’re exposed to.
Every onchain position depends on contracts, admins, oracles, collateral, bridges and other protocols, often several layers deep.
Forta Risk maps those dependencies, quantifies them in USD and monitors them in real time.
Explore Forta Risk
forta.org/risk
Seven addresses added to the OFAC list today, one per member of a Tren de Aragua crew that jackpotted US ATMs for ~$40M.
Their alleged ringleader is on the FBI's Ten Most Wanted list.
On chains running Firewall, those addresses can't transact.
ofac.treasury.gov/recent-act…
No flash loan, no oracle, no exploit primitive 🚨
MUSystem credited its welcome bonus in two places and let you withdraw without checking you were taking out less than you put in.
Sixteen fresh wallets just used the product as written, sixteen times.
Forta Firewall flagged it.
$351 million walked out of Bitget. Almost none of it was frozen by the asset issuers.
Our August piece on why issuers need to automate that decision is becoming increasingly relevant.
👇
forta.org/blog/should-rwa-is…
Bad look for Circle.
The Bitget hacker stole $350M today, and a part of these funds was in USDC.
Circle had the possibility to freeze these funds as USDC is centralized, but it chose to do nothing.
That says a lot about how much Circle cares about saving user funds.
$RWC drained for ~$109K on BSC 🚨
Attacks this size never make the headlines, which is exactly why they keep working. Nobody builds monitoring for the $100K case, and the $100K case runs every week.
Forta flagged it.
👇
Congratulations to the @OpenZeppelin team.
Over the past 11 years, OZ has played a fundamental role in making crypto safer, more resilient, and ready for adoption by the global financial system.
Excited to see what this talented team will do next, now with the scale and reach of S&P Global behind them.
👇
Today we are announcing that S&P Global has entered an agreement to acquire OpenZeppelin.
Onchain finance is growing from an emerging market into core financial infrastructure, and the standards and rails our team and community built are becoming the rails of global finance. OpenZeppelin smart contracts facilitated over $37 trillion in value transferred, with the vast majority of the largest DeFi protocols, blockchain networks, stablecoins and tokenized funds relying on them.
With S&P Global, we expect to accelerate the impact of onchain finance, backed by more than a century of trust in global markets, benchmarks, and risk frameworks.
To our clients and to all the users of OpenZeppelin open source tools:
• OpenZeppelin Contracts and all our open source applications and tools remain open source, free, and publicly maintained on GitHub. Building open source standards stays a core priority.
• Audits, engineering work, and ecosystem programs continue with the same team, brand, quality, and customer experience, with what will be the added benefit of S&P Global's research capacity, market data, and institutional reach.
For the last decade, OpenZeppelin has set the security standard for onchain finance. Today begins a new chapter for that mission, together with one of the most trusted names in global markets.
Read the full announcement: openzeppelin.com/news/spglob…
💸 ~$346K taken from @flamincome 🚨
The vault counted tokens anyone could send it as its own, then priced them with Curve's virtual price, which assumes a balanced pool. It wasn't. Share price inflated, redeemed against real aUSDT.
Forta flagged it.
👇
~65 people lost ~$47K yesterday to an approval they forgot they'd granted 🚨
The BonfireSwap router let anyone move tokens out of any address that had approved it. $BONFIRE, BNB Chain.
Approvals don't expire. Forta flagged it. Go revoke what you're not using.
👇






















