Two confirmed Ethereum drains in the last 24 hours: an unnamed order-factory access-control miss took ~24.7 ETH, and leftover funds in a deprecated Enso DPI strategy vault were pulled for ~5.6 ETH. No new eight-figure protocol loss in this window.
Liquid actors returned 3,400 BTC and kept ~598.5 BTC (~$47M) without a signed bounty. Two fresh BNB Chain drains: a DEX router approval sweep of ~62.28 BNB and a WealthManagementV2 owner-key hit for 26,414 USDT.
Liquid Network sees ~4,000 BTC (~$320M) unauthorized peg-out claimed as whitehat; Cozy Finance loses ~$170k on Optimism via UMA oracle abuse; Secured Finance ~$104k price-manipulation drain on Ethereum; Rocket $287k update.
A quiet window produced one confirmed low-value vault exploit and one blocked governance attempt. Reddio’s RedSonic Vault lost approximately 9.25 ETH to a cross-vault double-counting flaw; a malicious Autonolas proposal targeting ~40 ETH remains unexecuted.
Notional Finance lost ~$1.73M on Ethereum via an unsafe uint128 downcast in free-collateral checks. A separate ~$72k logic flaw drained Dream Health Chain awards on BSC.
Notional Finance lost ~$1.7M on Ethereum via an unsafe uint128 downcast in free-collateral checks. Attacker minted extreme fCash pairs and drained escrow before mixing via Tornado Cash.
No major new exploits confirmed in the last 24 hours. Smaller alerts include a Yam Finance governance takeover attempt and a ~6 ETH GebProxyActions drain on Ethereum.
Yam Finance faces an active Timelock takeover vote with about $337K still at risk. SlowMist confirmed a GebProxyActions drain of ~5.94 ETH; no new eight-figure protocol hacks landed in-window.
Injective halted nearly four hours after a likely binary-options settlement bug; bridged proceeds near $4.9 million in ETH have not moved. Aquifer on Solana was emptied for about $2.47 million, and Cronos finished rolling back the August 30 Tectonic attack.
Cronos remains halted after Tectonic's TONIC manipulation attack. Firms cite about $75M; a reconstruction puts the hole nearer $119M, with smaller drains at More Markets, Balancer V1, and Float.
Fogo paused its SVM Layer-1 after a foundation compromise moved 400 million FOGO, worth about $3 million. On Ethereum, Ajna confirmed a ~$775,000 liquidation-accounting exploit, while Rain said Avici and Tria cardholders have been repaid after Friday’s Solana card-contract drain.
Rain’s legacy Solana card contract was abused across Avici and Tria prepaid balances, while Ajna v2 lost about $775K to liquidation accounting manipulation on Ethereum.
Moonwell on Base is still the window’s largest confirmed loss after an illiquid-collateral price attack; a separate CashCowCoin drain on BNB Chain took about $117K.
Moonwell Base Core markets were drained via manipulated MAMO collateral; about $8.7M DAI now sits on Ethereum while protocol-side bad debt is tracking near $9.15M.
Realio webapp key compromise swept 124M+ RIO across five chains; Enjin Crypto Items proxy takeover minted a manager and melted ~5.24M ENJ; Comet AMM on Stellar was drained ~$750K; a Pendle TWAP nudge forced ~$36M in Morpho PT-reUSD liquidations.
Comet AMM $750K Stellar drain via same-asset swap accounting bug; Enjin $142K via malicious ERC-1155 transfer adapter; warp.green $93K bridge hit. White-hat offers active.