# Exploit Related Articles

HTX News Center provides the latest articles and in-depth analysis on "Exploit", covering market trends, project updates, tech developments, and regulatory policies in the crypto industry.

SecondFi Outlines Recovery Plan After $2.4 Million Cardano Wallet Exploit

SecondFi, a project on the Cardano blockchain, has completed a forensic investigation and outlined a recovery plan following an exploit that drained approximately $2.4 million in ADA from user wallets. The company has taken a snapshot of user balances and aims to return the assets within two weeks. The incident is characterized as a wallet-level vulnerability, not a failure of the Cardano protocol itself. The report cautions against blaming the underlying blockchain without direct technical evidence. This event is highlighted as a specific data point for traders to monitor amidst broader market uncertainty, emphasizing the importance of verifying official security updates and on-chain transaction records over speculative narratives.

bitcoinist06/28 19:20

SecondFi Outlines Recovery Plan After $2.4 Million Cardano Wallet Exploit

bitcoinist06/28 19:20

Humanity Protocol, Kelp DAO stolen funds commingle – Same attacker?

Investigations into the 2026 exploits of Kelp DAO and Humanity Protocol have revealed that stolen funds from both attacks were recently commingled, suggesting a connection between the attackers. Blockchain analyst ZachXBT identified the activity, where 15,403 ETH ($23.6 million) from the Humanity Protocol hack was moved to a new Ethereum address and then to the Bitcoin network, merging with proceeds from the Kelp DAO exploit. Over $8 million of these funds has been laundered using methods associated with groups like the Lazarus Group. The Kelp DAO attack drained about $292 million in April 2026, while Humanity Protocol lost around $32 million in June due to a compromised developer device. This commingling points to a shared external threat actor and highlights ongoing security risks in DeFi.

ambcrypto06/28 11:17

Humanity Protocol, Kelp DAO stolen funds commingle – Same attacker?

ambcrypto06/28 11:17

Cardano Wallets Hit By SecondFi Exploit As Private Key Flaw Sparks Security Warning

SecondFi, previously linked to the Yoroi wallet, has halted services following a critical security flaw in its proprietary web-based wallet generation software. The vulnerability reportedly exposed private keys, leading to a significant theft of ADA tokens. Initial reports estimate losses of 16 million ADA (~$2.4M) from 374 wallets, while security firm SlowMist warns the broader impact could exceed 129 million ADA (over $20M). Crucially, the incident was confined to SecondFi's software; the Cardano blockchain protocol itself was not compromised. The core issue involves insecure private key generation, allowing attackers access to affected wallets. A primary warning for users is to avoid restoring compromised seed phrases into other wallets, as this would not resolve the underlying key exposure. Users are also cautioned against unverified recovery links or third-party refund platforms. The situation underscores that blockchain security extends beyond the protocol layer to include wallet software and key management. The community awaits a full post-mortem and confirmation of the final impact.

bitcoinist06/27 03:01

Cardano Wallets Hit By SecondFi Exploit As Private Key Flaw Sparks Security Warning

bitcoinist06/27 03:01

Hackers Steal Nearly $17 Million in 40 Days as 'Zombie Contracts' Become Their ATMs

According to an analysis published by ZeroDrift on June 22, 2026, attackers have stolen approximately $16.9 million over 40 days from five deprecated but still operational smart contracts across various blockchains. The primary issue is not a specific vulnerability but the incomplete decommissioning of legacy contracts. These "zombie contracts" often retain economic value, operational permissions, and callable functions, making them prime targets long after teams cease active development. The most significant loss occurred at DxSale, where an old locker contract lost about $7.3 million due to a forgotten control path becoming accessible again. Other affected projects include TrustedVolumes (~$5.87M), Raydium's legacy AMM pool (~$1.34M), Aztec Connect (~$2.28M), and Huma Finance V1 pool (~$101k). These incidents involved diverse systems—RFQ settlement, credit pools, liquidity lockers, AMMs—demonstrating the widespread nature of the risk. The analysis highlights that automated tools are lowering the cost for attackers to systematically scan for these long-tail targets, which have public code and weaker monitoring. In contrast, defensive practices for contract retirement remain underdeveloped. While the DeFi industry has mature audit processes for new deployments, it lacks strict protocols for securely sunsetting old contracts, which only become truly "retired" after all funds, permissions, authorizations, and trust assumptions are removed.

marsbit06/26 09:13

Hackers Steal Nearly $17 Million in 40 Days as 'Zombie Contracts' Become Their ATMs

marsbit06/26 09:13

$3M Exploit Hits Polymarket: Users to Receive Full Refunds After Third-Party Breach

Polymarket will fully reimburse users affected by a front-end exploit that stole approximately $3 million in crypto assets. The company stated the incident was not a flaw in its core protocol but a supply chain attack. A compromised third-party vendor injected a malicious script into the platform's front-end for a limited number of users, allowing the attacker to drain funds from about 15 wallets while they interacted with the site. The stolen assets, primarily Polymarket's pUSD stablecoin, were bridged to Ethereum and converted to roughly 1,893 ETH. This marks the second security incident for Polymarket in under two months, following a separate $700,000 loss. The event highlights growing risks associated with third-party dependencies in the crypto industry.

TheNewsCrypto06/26 07:12

$3M Exploit Hits Polymarket: Users to Receive Full Refunds After Third-Party Breach

TheNewsCrypto06/26 07:12

Tornado Cash Suffers Another Governance Attack: A Fake Proposal Targets $23 Million Community Treasury

On June 25, 2026, a deceptive governance proposal (#67) appeared in the Tornado Cash DAO, masquerading as an upgrade to implement fee adjustments and token burns. Security researchers, including Sergey Shemyakov and Pascal Caversaccio, quickly identified it as malicious. The proposal's unverified code contained a hidden function designed to stealthily replace the protocol's legitimate governance address (0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce) with an attacker-controlled address (0x5efda50f22d34f272c7077689d6abc42f15e285f). If passed, this would have granted the attacker control over the DAO's treasury, containing approximately $23 million in TORN tokens, and the ability to drain all relayers. The attacker's wallet (0xd4eca8c9242b9f9faa3cf19a78defc21dc97a925) was funded via the privacy protocol Railgun four days prior, obscuring the source. The community response was swift, with the proposal receiving 27,163 TORN votes against (100%) and 0 for, far below the 100,000 TORN quorum required for validity. It is set to expire on June 30. This incident marks the second major governance attack on Tornado Cash, following a May 2023 exploit that stole $2.17 million. It highlights persistent vulnerabilities in DAO structures where power derives from token ownership. The article advises users to follow security researchers, vote against unverified proposals, and delegate voting power. For developers, implementing timelocks—a delay between proposal approval and execution—is presented as a critical security measure to allow for community review and intervention.

Foresight News06/26 06:01

Tornado Cash Suffers Another Governance Attack: A Fake Proposal Targets $23 Million Community Treasury

Foresight News06/26 06:01

Cardano wallet exploit: SecondFi traces attack to private key flaw, warns users not to restore seed phrases

SecondFi has identified the root cause of the recent Cardano wallet exploit, which drained approximately 16 million ADA ($2.4 million) from 374 wallets. The attack stemmed from a deterministic nonce derivation flaw in its software signer, allowing attackers to mathematically reconstruct private keys from public blockchain data after transactions were signed. The company warns affected users not to restore their compromised recovery phrases into another wallet, as the vulnerability exists at the private key level, meaning addresses remain exposed. Users are advised against moving funds or withdrawing staking rewards and should instead await SecondFi's official recovery process. Emergency containment has secured around 129 million ADA pending recovery. SecondFi has launched a restoration fund, engaged external security auditors, and identified two attacker groups responsible for the automated draining campaigns between June 21 and 23. The platform remains in maintenance mode during ongoing security reviews.

ambcrypto06/25 16:17

Cardano wallet exploit: SecondFi traces attack to private key flaw, warns users not to restore seed phrases

ambcrypto06/25 16:17

Legacy Polygon Royalties Contract Exploit Drains $261K Through Reward Logic Flaw

A hacker exploited a legacy Polygon royalties contract, stealing approximately $261,200 in cryptocurrency. Security firm TenArmorAlert identified the attack on June 23. The exploit was made possible by a flaw in the contract's reward calculation logic within the Royal1155LD.beforeLdaTransfer() function. By executing several zero-value transactions, the attacker manipulated reward accounting and token ownership data, artificially inflating balances to enable excessive withdrawals. The attacker also utilized a flash loan to amplify the exploit's profit after repayment. This incident highlights ongoing security risks associated with older, inactive smart contracts that still hold funds, following similar recent exploits. Developers are urged to audit, update, or decommission such legacy deployments to prevent future attacks. The Polygon blockchain's core infrastructure was not compromised.

TheNewsCrypto06/24 12:59

Legacy Polygon Royalties Contract Exploit Drains $261K Through Reward Logic Flaw

TheNewsCrypto06/24 12:59

Infamous MEV Bot JaredFromSubway Drained For $7.5 Million

The notorious Ethereum MEV bot "JaredFromSubway" has been drained of approximately $7.5 million after attackers tricked its automated system. Security firm Blockaid reported that the bot was deceived into approving malicious trading routes by attacker-controlled contracts. These approvals were then used to siphon WETH, USDC, and USDT from the bot's contract. The incident is ironic as MEV bots are designed to exploit minute market advantages, but in this case, its own automation became the vulnerability. The attack specifically targeted the bot's trading logic, not the Ethereum protocol or a broader DeFi application. It underscores a critical risk in automated trading: the pursuit of speed can create fragility, making systems susceptible to carefully crafted traps. While the financial loss is significant, the broader impact is reputational for MEV infrastructure. It serves as a warning that automated systems granting token approvals require stringent safeguards, simulation, and route verification. The event is considered a targeted exploit on a trading bot, not a network-wide security issue.

bitcoinist06/22 15:31

Infamous MEV Bot JaredFromSubway Drained For $7.5 Million

bitcoinist06/22 15:31

Hunter Becomes the Hunted: The Most Profitable MEV Bot Gets Hacked

The prominent Ethereum MEV bot address Jaredfromsubway.eth suffered a targeted on-chain attack, losing over $7.5 million. The incident was identified as a "counter-MEV honeypot attack," where the attacker deployed numerous fake token contracts and liquidity pools over several weeks, mimicking mainstream assets like WETH and USDC to create seemingly profitable arbitrage opportunities. The MEV bot, designed to automatically detect and execute such trades, interacted with the malicious setup. During the process, it granted approvals to attacker-controlled contracts, which were not promptly revoked. The attacker later exploited these persistent permissions in a single transaction, draining the bot's holdings of ETH, USDC, and USDT. Jaredfromsubway.eth is known as one of Ethereum's most active and profitable MEV bots, primarily executing "sandwich attacks" to extract value from user transactions. Its operations have been linked to a majority of such attacks on the network. This event highlights the evolving security threats in crypto, demonstrating that even sophisticated, rule-exploiting systems can become targets of carefully designed behavioral traps. Following the theft, an impersonator account on X falsely claimed to offer a bounty for the return of the funds, prompting warnings from developers.

Odaily星球日报06/21 09:15

Hunter Becomes the Hunted: The Most Profitable MEV Bot Gets Hacked