# Exploit Related Articles

HTX News Center provides the latest articles and in-depth analysis on "Exploit", covering market trends, project updates, tech developments, and regulatory policies in the crypto industry.

Hackers Steal Nearly $17 Million in 40 Days as 'Zombie Contracts' Become Their ATMs

According to an analysis published by ZeroDrift on June 22, 2026, attackers have stolen approximately $16.9 million over 40 days from five deprecated but still operational smart contracts across various blockchains. The primary issue is not a specific vulnerability but the incomplete decommissioning of legacy contracts. These "zombie contracts" often retain economic value, operational permissions, and callable functions, making them prime targets long after teams cease active development. The most significant loss occurred at DxSale, where an old locker contract lost about $7.3 million due to a forgotten control path becoming accessible again. Other affected projects include TrustedVolumes (~$5.87M), Raydium's legacy AMM pool (~$1.34M), Aztec Connect (~$2.28M), and Huma Finance V1 pool (~$101k). These incidents involved diverse systems—RFQ settlement, credit pools, liquidity lockers, AMMs—demonstrating the widespread nature of the risk. The analysis highlights that automated tools are lowering the cost for attackers to systematically scan for these long-tail targets, which have public code and weaker monitoring. In contrast, defensive practices for contract retirement remain underdeveloped. While the DeFi industry has mature audit processes for new deployments, it lacks strict protocols for securely sunsetting old contracts, which only become truly "retired" after all funds, permissions, authorizations, and trust assumptions are removed.

marsbit06/26 09:13

Hackers Steal Nearly $17 Million in 40 Days as 'Zombie Contracts' Become Their ATMs

marsbit06/26 09:13

$3M Exploit Hits Polymarket: Users to Receive Full Refunds After Third-Party Breach

Polymarket will fully reimburse users affected by a front-end exploit that stole approximately $3 million in crypto assets. The company stated the incident was not a flaw in its core protocol but a supply chain attack. A compromised third-party vendor injected a malicious script into the platform's front-end for a limited number of users, allowing the attacker to drain funds from about 15 wallets while they interacted with the site. The stolen assets, primarily Polymarket's pUSD stablecoin, were bridged to Ethereum and converted to roughly 1,893 ETH. This marks the second security incident for Polymarket in under two months, following a separate $700,000 loss. The event highlights growing risks associated with third-party dependencies in the crypto industry.

TheNewsCrypto06/26 07:12

$3M Exploit Hits Polymarket: Users to Receive Full Refunds After Third-Party Breach

TheNewsCrypto06/26 07:12

Tornado Cash Suffers Another Governance Attack: A Fake Proposal Targets $23 Million Community Treasury

On June 25, 2026, a deceptive governance proposal (#67) appeared in the Tornado Cash DAO, masquerading as an upgrade to implement fee adjustments and token burns. Security researchers, including Sergey Shemyakov and Pascal Caversaccio, quickly identified it as malicious. The proposal's unverified code contained a hidden function designed to stealthily replace the protocol's legitimate governance address (0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce) with an attacker-controlled address (0x5efda50f22d34f272c7077689d6abc42f15e285f). If passed, this would have granted the attacker control over the DAO's treasury, containing approximately $23 million in TORN tokens, and the ability to drain all relayers. The attacker's wallet (0xd4eca8c9242b9f9faa3cf19a78defc21dc97a925) was funded via the privacy protocol Railgun four days prior, obscuring the source. The community response was swift, with the proposal receiving 27,163 TORN votes against (100%) and 0 for, far below the 100,000 TORN quorum required for validity. It is set to expire on June 30. This incident marks the second major governance attack on Tornado Cash, following a May 2023 exploit that stole $2.17 million. It highlights persistent vulnerabilities in DAO structures where power derives from token ownership. The article advises users to follow security researchers, vote against unverified proposals, and delegate voting power. For developers, implementing timelocks—a delay between proposal approval and execution—is presented as a critical security measure to allow for community review and intervention.

Foresight News06/26 06:01

Tornado Cash Suffers Another Governance Attack: A Fake Proposal Targets $23 Million Community Treasury

Foresight News06/26 06:01

Cardano wallet exploit: SecondFi traces attack to private key flaw, warns users not to restore seed phrases

SecondFi has identified the root cause of the recent Cardano wallet exploit, which drained approximately 16 million ADA ($2.4 million) from 374 wallets. The attack stemmed from a deterministic nonce derivation flaw in its software signer, allowing attackers to mathematically reconstruct private keys from public blockchain data after transactions were signed. The company warns affected users not to restore their compromised recovery phrases into another wallet, as the vulnerability exists at the private key level, meaning addresses remain exposed. Users are advised against moving funds or withdrawing staking rewards and should instead await SecondFi's official recovery process. Emergency containment has secured around 129 million ADA pending recovery. SecondFi has launched a restoration fund, engaged external security auditors, and identified two attacker groups responsible for the automated draining campaigns between June 21 and 23. The platform remains in maintenance mode during ongoing security reviews.

ambcrypto06/25 16:17

Cardano wallet exploit: SecondFi traces attack to private key flaw, warns users not to restore seed phrases

ambcrypto06/25 16:17

Legacy Polygon Royalties Contract Exploit Drains $261K Through Reward Logic Flaw

A hacker exploited a legacy Polygon royalties contract, stealing approximately $261,200 in cryptocurrency. Security firm TenArmorAlert identified the attack on June 23. The exploit was made possible by a flaw in the contract's reward calculation logic within the Royal1155LD.beforeLdaTransfer() function. By executing several zero-value transactions, the attacker manipulated reward accounting and token ownership data, artificially inflating balances to enable excessive withdrawals. The attacker also utilized a flash loan to amplify the exploit's profit after repayment. This incident highlights ongoing security risks associated with older, inactive smart contracts that still hold funds, following similar recent exploits. Developers are urged to audit, update, or decommission such legacy deployments to prevent future attacks. The Polygon blockchain's core infrastructure was not compromised.

TheNewsCrypto06/24 12:59

Legacy Polygon Royalties Contract Exploit Drains $261K Through Reward Logic Flaw

TheNewsCrypto06/24 12:59

Infamous MEV Bot JaredFromSubway Drained For $7.5 Million

The notorious Ethereum MEV bot "JaredFromSubway" has been drained of approximately $7.5 million after attackers tricked its automated system. Security firm Blockaid reported that the bot was deceived into approving malicious trading routes by attacker-controlled contracts. These approvals were then used to siphon WETH, USDC, and USDT from the bot's contract. The incident is ironic as MEV bots are designed to exploit minute market advantages, but in this case, its own automation became the vulnerability. The attack specifically targeted the bot's trading logic, not the Ethereum protocol or a broader DeFi application. It underscores a critical risk in automated trading: the pursuit of speed can create fragility, making systems susceptible to carefully crafted traps. While the financial loss is significant, the broader impact is reputational for MEV infrastructure. It serves as a warning that automated systems granting token approvals require stringent safeguards, simulation, and route verification. The event is considered a targeted exploit on a trading bot, not a network-wide security issue.

bitcoinist06/22 15:31

Infamous MEV Bot JaredFromSubway Drained For $7.5 Million

bitcoinist06/22 15:31

Hunter Becomes the Hunted: The Most Profitable MEV Bot Gets Hacked

The prominent Ethereum MEV bot address Jaredfromsubway.eth suffered a targeted on-chain attack, losing over $7.5 million. The incident was identified as a "counter-MEV honeypot attack," where the attacker deployed numerous fake token contracts and liquidity pools over several weeks, mimicking mainstream assets like WETH and USDC to create seemingly profitable arbitrage opportunities. The MEV bot, designed to automatically detect and execute such trades, interacted with the malicious setup. During the process, it granted approvals to attacker-controlled contracts, which were not promptly revoked. The attacker later exploited these persistent permissions in a single transaction, draining the bot's holdings of ETH, USDC, and USDT. Jaredfromsubway.eth is known as one of Ethereum's most active and profitable MEV bots, primarily executing "sandwich attacks" to extract value from user transactions. Its operations have been linked to a majority of such attacks on the network. This event highlights the evolving security threats in crypto, demonstrating that even sophisticated, rule-exploiting systems can become targets of carefully designed behavioral traps. Following the theft, an impersonator account on X falsely claimed to offer a bounty for the return of the funds, prompting warnings from developers.

Odaily星球日报06/21 09:15

Hunter Becomes the Hunted: The Most Profitable MEV Bot Gets Hacked

Odaily星球日报06/21 09:15

Four Questions on the Zcash Orchard Vulnerability: Was It Exploited? Can Funds Be Recovered? Is the Supply Verifiable? And Are There Others?

Zcash Orchard Bug: Four Key Questions Answered A critical forgery vulnerability was discovered in Zcash's Orchard privacy pool, raising four major concerns for users. 1. **Was the Orchard bug exploited?** The likelihood is considered low. The bug was found proactively using advanced AI-assisted tools and was promptly patched, limiting any potential attack window. If exploitation had occurred, evidence would likely have surfaced by now. 2. **Can legitimate Orchard funds be recovered?** It is believed so, based on the assessment that the bug was not exploited. If forgery did happen, existing "turnstile" mechanisms could prevent full recovery of legitimate funds if forged coins were moved out first, though this scenario is deemed unlikely. Users can choose to move funds, but this carries risks like loss of privacy or new wallet/software issues. 3. **Can users verify Zcash's total supply?** Currently, no. The vulnerability's prior existence prevented independent verification of the shielded supply. The proposed "Ironwood" network upgrade will restore this ability by sealing the Orchard pool, allowing anyone running a node to verify that the circulating ZEC does not exceed the correct amount. 4. **Are there other forgery bugs?** Ongoing intensive audits by multiple teams, including AI-assisted analysis, have not found additional forgery vulnerabilities, increasing confidence that none remain. Further work and collaborations are planned to provide additional guarantees. In conclusion, while the team assesses that exploitation was unlikely and the supply is safe, the upcoming upgrade is critical to restore users' ability to independently verify Zcash's supply integrity, moving away from reliance on trust.

marsbit06/15 07:50

Four Questions on the Zcash Orchard Vulnerability: Was It Exploited? Can Funds Be Recovered? Is the Supply Verifiable? And Are There Others?

marsbit06/15 07:50

Four Questions on the Zcash Orchard Vulnerability: Was it Exploited? Can Funds Be Recovered? Is the Supply Verifiable? Are There Others?

**Summary: Zcash Orchard Vulnerability Analysis** A critical forgery vulnerability was recently discovered in Zcash's Orchard shielded pool, raising concerns about the coin's supply and user funds. The developers, led by Zcash Open Development Labs, acted swiftly to temporarily freeze the pool and deploy a fix. The article addresses four key questions: 1. **Was the vulnerability exploited?** While unknown, the developers believe it is unlikely for several reasons: the bug was difficult to find, using advanced AI tools; the fix was deployed quickly; and typical crypto exploits are fast, with no evidence of abnormal outflows. 2. **Can legitimate Orchard funds be recovered?** If the bug was not exploited, all funds are safe. If exploited, a mechanism limits total withdrawals from the pool to the amount legitimately entered, potentially blocking some legitimate funds. The developers deem this unlikely but advise cautious users to consider moving funds, noting the privacy and risk trade-offs of moving to transparent or Sapling pools. 3. **Can users verify Zcash's total supply?** Not currently. The vulnerability temporarily broke the ability for users to independently verify that no extra ZEC was created. 4. **Are there other forgery bugs?** Ongoing audits by multiple teams, including using advanced AI analysis, have so far found no others, increasing confidence. The proposed "Ironwood" network upgrade is the core solution. It will **seal** the Orchard pool, preventing new entries or internal circulation. This action, combined with the existing withdrawal mechanism, will restore the ability for any node operator to verify that Zcash's supply limit has not been violated, regardless of whether exploitation occurred in the past. The upgrade aims to restore the system's long-term credibility through user-verifiable supply integrity.

Odaily星球日报06/15 07:50

Four Questions on the Zcash Orchard Vulnerability: Was it Exploited? Can Funds Be Recovered? Is the Supply Verifiable? Are There Others?

Odaily星球日报06/15 07:50

Token Of Power Governance Exploit Drains $1.58 Million In WETH, TRM Says

Blockchain intelligence firm TRM Labs reports a governance exploit against the Token of Power protocol, resulting in a loss of approximately $1.58 million in WETH. The attacker exploited a missing timelock in the protocol's Aragon DAO setup, allowing them to propose, vote on, and execute a malicious action within a single block. The attacker funded the operation with 662 ETH from Tornado Cash, purchased enough TOP tokens to gain majority voting power, minted 10 billion new TOP tokens, and swapped them for WETH via a Balancer pool before moving funds back through Tornado Cash. The incident underscores that governance design is a critical security risk in DeFi, where parameters like timelocks provide essential reaction time. It also highlights how mixers and liquidity pools can be utilized in exploits without being directly compromised. Observers are now watching for any movement of the stolen funds and further remediation details from involved parties. This event is part of a broader shift in crypto, emphasizing the importance of underlying infrastructure, security, and governance alongside market movements.

bitcoinist06/14 21:32

Token Of Power Governance Exploit Drains $1.58 Million In WETH, TRM Says