mono

Wrote up the on-chain timeline, from the delegation to the revocation: sigintzero.com/blog/binance-…

Binance lost about $6.4B on Oct 29. Biggest crypto theft on record. On Ethereum the attacker brought 50 presigned permissions for one hot wallet, one per possible nonce. One matched. The wallet ran their code for 3h49m after that. Six more pulls after the first sweep.

Aron put the on-chain timeline and the script teardown together here: sigintzero.com/blog/polymark…

Polymarket traders lost about $2.65M Thursday to a hacked page speed script. The vendor was DebugBear. Its script found your logged-in session, sold or moved your positions, and paid the attacker through Polymarket's own relayer. Second vendor script hit there since June.

I added up every Ethereum receipt and the timeline, including why the lockboxes had no way to say no: sigintzero.com/blog/initia-2…

Someone found a bug in Initia's Move VM on Friday and gave themselves balances nothing ever minted. Then they bridged them to Ethereum. The lockboxes paid out $2.7M in real AUSD, ETH and USDC, most of it within 7 minutes. The chain halted 42 minutes after the mint.

Alex went through the contract, all three attack waves, and the one limit that saved the other 12M tokens: sigintzero.com/blog/x100-4-8…

Someone bought a DAO majority with a flash loan Saturday and had the treasury sell 400,000 tokens for $35. X100's Senate had three seats, ranked by what was staked right then. The three day vote window was only a deadline. A majority could execute at once. About $4.85M gone.

Alex traced it through the fix commits, including why the turnstile never fired: sigintzero.com/blog/pirate-c…

Someone printed about 39.8M ARRR on Pirate Chain last week. Supply up about 20%. A refactor last year made blocks skip the burn proof on coin imports. Send the same tx normally and it's rejected. Put it inside a block and it mints. Then it all went into the shielded pool.

Whitehat bot c0ffeebabe ran the drain one block after the attacker deployed, then sent most of it back. Then address poisoners showed up 8 minutes after the refund. Full trace: sigintzero.com/blog/bifi-165…

BiFi's USDT market on Ethereum sat untouched for 36 days. When it woke up, the code charged all 36 days of interest at whatever rate the market showed in that moment. Inside one transaction you get to set that rate yourself. $165K out, in a single block.

Aron's write-up, with the whole 17-month timeline on-chain: sigintzero.com/blog/sui-brid…

On Friday a rescue bot paid the Cetus hacker about $392K. Eight Sui Bridge withdrawals from the May 2025 exploit sat signed and unclaimed for 17 months. The bot claimed them all, paid the gas, then asked the hacker for a tip. The 109k USDT still isn't frozen.

Alex's write-up, with the code and the on-chain timeline: sigintzero.com/blog/uncx-ves…

UNCX's vesting contract lost ~$1.49M on four chains. Claiming tokens took your shares off the pool total. Cancelling could take the same shares off again. Get the order right and your next claim gets paid from other projects' vested tokens. Copycats did the rest.

I wrote up the whole loop with the trade-by-trade numbers: sigintzero.com/blog/papertra…

Someone took about $1.28M from Papertrade, a new 1000x perps venue on Hyperliquid, within eight hours of launch. It prices every trade at Hyperliquid's live mid. So they bought ~6,000 ETH to push it $3, closed, flipped short, sold it back. 296 wins out of 305.

Alex's write-up, with the on-chain trail and why the genuine check can't see it: sigintzero.com/blog/ledger-c…

A drain tied to Ledgers sold by one reseller in Southeast Asia took about $102M on Friday. Ledger now says a board hidden inside read the 24 words off the screen at setup and sent them out over LTE. The genuine check still passes. It only checks the secure chip.