Web3 Daily Exploits — 7 Nov 2026: Quiet Window, No New Scored Losses

The 7 Nov America/Panama window records no first-reported protocol or smart-contract incidents with confirmed scored user losses. Monitored accounts (DefimonAlerts, CertiKAlert, Phalcon_xyz, GoPlusSecurity, SlowMist_Team, PeckShieldAlert, BlockSecTeam, Lookonchain, ZachXBT, CyversAlerts, Immunefi, rekt.news) produced no new material first-reports of drains with fresh loss figures in the last 24 hours. Prior items remain UPDATEs: Loopscale’s Solana pricing and NAV paths were contained with vaults made whole and no user deposits lost; FLOKI’s Telegram trading bot exploit has no disclosed loss size; TENDRIL’s BNB Chain sell-hook drain stands at the previously scored ~$555K; the Binance multi-chain hot-wallet signing compromise and Mercado Bitcoin multi-chain signing incident have no material new scored loss. Combined live scored loss on this card is ~$0.

Also noted

• Loopscale Solana contained attempts (UPDATE, not re-scored): Incident first reported 5–6 November. Sustained API probing led to pause; two paths identified (~$412K undercollateralized loan from SOL Genesis Vault via pricing mismatch; ~$521K NAV-inflated redemption from USDC Genesis Vault halted within 30 seconds). Vaults made whole, no user deposits lost. Partial functionality restored; vault withdrawals restricted. No material new loss figures. Prior coverage: https://www.rektradar.xyz/web3-daily-exploits-06-nov-2026-loopscale-floki-bot-pause/.
• FLOKI Telegram trading bot (UPDATE, not re-scored): Announced early 5 November. Bot taken offline after exploit; affected users being migrated; loss size undisclosed at cutoff. No quantified drain from primary sources. Prior coverage in the 6 Nov brief.
• TENDRIL sell-hook (UPDATE, not re-scored): First reported 4–5 November. ~$555K USDT drained from PancakeSwap V2 pair on BNB Chain via premature burn/sync. No material new loss figures. Prior coverage: https://www.rektradar.xyz/web3-daily-exploits-05-nov-2026-tendril-555k-sell-hook/.
• Binance hot-wallet signing-access compromise (UPDATE, not re-scored): The ~$6.3 billion multi-chain drain from 29 October remains on prior briefs. New reporting (Bloomberg) details use of EIP-7702 delegation to move roughly $2.5 billion in a single transaction at a cost of ~$15 in gas; total remains in the previously reported range. No material new scored loss figures in the last 24 hours. Prior coverage: https://www.rektradar.xyz/web3-daily-exploits-30-oct-2026-binance-63b-eip7702-polymarket-debugbear/.
• Mercado Bitcoin multi-chain signing drain (UPDATE, not re-scored): Incident first reported 2 November. Bitquery and CoinDesk reporting notes continued activity for hours after the exchange’s containment statement and links to other exchange wallets; exchange previously stated affected assets and coverage plans. No material new loss figures used for scoring today. Prior coverage: https://www.rektradar.xyz/web3-daily-exploits-03-nov-2026-mercado-46m-signing-drain/.
• CoreVault / BNIX / OSK InsurancePool (UPDATE, not re-scored): Prior BNB Chain oracle flash-loan (~$112K net). No material new figures. Prior coverage: https://www.rektradar.xyz/web3-daily-exploits-04-nov-2026-corevault-112k-oracle-flash/.
• DarkSword iOS exploit kit (device-level, not a protocol incident): CertiKAlert posted a thread on 6 November warning of a newer P7 variant targeting crypto wallets on unpatched iPhones (iOS 18.4–18.7 range). Opening a malicious Safari page can suffice; no wallet connection or signature required. Targets include MetaMask, Trust Wallet, Phantom, Exodus, Coinbase; also keychain passwords, Photos, Notes. Researchers have linked related campaign activity to movement of ~$5.57M USDT across shared wallets (tracing, not a single scored protocol loss). Users advised to update iOS and move funds to a fresh seed on a clean device. Not scored as a live protocol incident.
• Other notes: Scattered user reports of individual seed drains remain unverified and unattributed to any protocol. Immunefi published broader 2026 lending-hack statistics; no new first-report drains. DefiLlama hacks page shows no additions beyond the prior TENDRIL and Loopscale entries for the recent window.
• Monitored accounts: DefimonAlerts, CertiKAlert, Phalcon_xyz, GoPlusSecurity, SlowMist_Team, PeckShieldAlert, BlockSecTeam, Lookonchain, ZachXBT, CyversAlerts, Immunefi and rekt.news. No additional first-report protocol drains with fresh confirmed user-loss figures.

Sources and references

• 6 Nov brief (Loopscale / FLOKI): https://www.rektradar.xyz/web3-daily-exploits-06-nov-2026-loopscale-floki-bot-pause/
• 5 Nov brief (TENDRIL): https://www.rektradar.xyz/web3-daily-exploits-05-nov-2026-tendril-555k-sell-hook/
• Bloomberg on Binance single-transaction detail: https://www.bloomberg.com/news/articles/2026-11-06/hackers-paid-15-to-drain-2-5-billion-from-binance-in-one-hit
• CoinDesk Mercado Bitcoin continued activity: https://www.coindesk.com/business/2026/11/05/mercado-bitcoin-hack-continued-hours-after-exchange-said-attack-was-contained-report-finds
• CertiKAlert DarkSword thread: https://x.com/CertiKAlert/status/2118701951751692552
• The Hacker News on P7 DarkSword: https://thehackernews.com/2026/10/p7-darksword-ios-exploit-kit-adds.html
• DefiLlama hacks: https://defillama.com/hacks
• Monitored accounts checked: DefimonAlerts, CertiKAlert, Phalcon_xyz, GoPlusSecurity, SlowMist_Team, PeckShieldAlert, BlockSecTeam, Lookonchain, ZachXBT, CyversAlerts, Immunefi, rekt.news. No additional first-report protocol exploits with fresh scored user-loss figures in the last 24 hours.

Editor’s note: the scored live loss on this card is ~$0. No newly reported items with confirmed user losses. Loopscale, FLOKI bot, TENDRIL, Binance, Mercado Bitcoin and CoreVault are UPDATEs. DarkSword is a device-level kit, not scored as a protocol incident. No how-to or exploit reproduction steps. Stay tuned or stay rekt.