WAX Multi-Chain Bridge drained ~$90.5K after eth.token::withdraw allowed negative max_fee that zeroed the debit while still logging full withdrawals and releasing mapped USDC/USDT/DAI/WETH/WBTC on Solana and Ethereum. SlowMist and Blockaid first reports. Live loss ~$0.09M, 1 incident, 3 chains. Kimchi Solana KOL pump-dump and CoinDCX wallet movements noted as UPDATE.
NEM (Newmont) token on BNB Chain drained ~$820K from its PancakeSwap USDT/NEM LP after a tax-settlement flaw let the attacker inflate pendingLpSellRecycle without real sells, then burn existing reserves via flushLpSellRecycle + sync. Defimon, CertiK, SlowMist, Phalcon first reports. Live loss ~$0.82M, 1 incident, 1 chain. Cysic bounty and Fearless Wallet key-leak noted as UPDATE.
Slice FundsModule on Base drained for ~$41K after release function trusted caller-selected source contracts without verifying actual ETH or USDC receipt. Institutional addresses lost ~973K MORPHO (~$2.3M) via EIP-7702 delegations, funds to Tornado Cash. SlowMist and Defimon first reports on Slice; ZachXBT on MORPHO. Live loss ~$2.34M, 2 incidents, 2 chains. Drift fund movements noted as UPDATE.
Argent-style smart wallet system on Ethereum drained for ~$59.8K after unrestricted recovery-period setter caused deadline wrap to past timestamp and execution module allowed signed payload reuse, used against thin MARK/WETH pool. SlowMist first report. Live loss ~$60K, 1 incident, 1 chain. Drift and Aztec fund movements noted as UPDATE.
AlpsCon AI Trade Hub on BNB Chain drained for ~$152K after a Hardhat default account was left on the KYC whitelist and used via EIP-7702 to claim historical rewards on a fresh stake. DefimonAlerts first report. Live loss ~$152K, 1 incident, 1 chain. Qubic weak-seed drain and BiFi noted as UPDATE.
BiFi Lending USDT market on Ethereum drained for ~$165.4K via interest-calculation inflation after a 36-day idle period. DefimonAlerts first report. Live loss ~$165K, 1 incident, 1 chain. UNCX official verified ~$807.6K with white-hat returns noted as UPDATE.
Quiet America/Panama window: no first-report protocol exploits with fresh scored loss figures from required monitors. Live loss $0, 0 incidents, 0 chains. Updates on prior items including Kolan, UNCX, Pirate Chain, Bofur Capital, Ledger phishing, Defimon Sui Bridge claim, and Gamdom recovery.
Small scored incident: Kolan Uniswap V4 hook drained ~$3K via flash-loan price manipulation on permissionless accept() with no slippage guard on buyback. Live loss ~$3K, 1 incident, 1 chain (ETH). Prior items including UNCX and Bofur Capital noted as updates.
UNCX Network Vesting V2 shared pools exploited via share-accounting flaw in cancel() and release(). Blockaid reports ~$1.49M drained across Ethereum, BSC, Base and Robinhood Chain involving 10 tokens and copycats. Containment via high fees. One incident, four chains.
Quiet day for new protocol drains. Monitored accounts posted no first-report smart-contract exploits or user-wallet drains with fresh loss figures in the last 24 hours. Combined live loss on this card is ~$0. THEO Hyperlane mint remains on the 13 Oct brief. iOS Safari advisory noted with no confirmed crypto theft.
Autheo THEO token on Base suffered an unbacked mint of 19 million tokens via a Hyperlane warp-route TrustedRelayerIsm logic error. Attacker swapped for approximately 700.8 ETH (~$1.76M) and bridged to Ethereum. Token dropped ~92%. One incident, one chain.
Quiet day for new protocol drains. Monitored accounts posted no first-report smart-contract exploits with fresh loss figures in the last 24 hours. Ledger issued a follow-up limiting confirmed CryptoBilis implant cases to the Southeast Asian reseller. COLDCARD reported a phishing post on its official X account with no confirmed user losses. Card live loss is ~$0.
