BlockThreat - Week 10, 2025

Peter Kacherginsky

10 Mar 2025 • 4 min read

Greetings!

No billion-dollar exploits this week, but a couple of unusual DeFi compromises offered a break from the usual private key smash-and-grabs.

One particularly interesting case was the compromise of 1inch and a few market makers, resulting in around $5M in losses. Unlike traditional smart contract exploits, this attack resembled a memory corruption vulnerability with a carefully crafted transaction payload. You’ll find detailed write-ups, along with the rapid race to recover funds, in the premium hacks section below. Fortunately, the attacker agreed to a $450K “bug bounty,” allowing 1inch and the affected AMM to recover most of their losses. The key takeaway? Overoptimized Solidity/Yul contracts are notoriously difficult to audit and secure.

To gain access to comprehensive vulnerability write-ups, post-mortems, exploit proof of concepts (PoCs), attacker addresses, and additional data regarding this week’s compromises, please subscribe to the premium plan below.

Things got even more intriguing with a whitehat hack by shouccc and tonykebot targeting Time.fun’s backend. A clever exploit of the backend infrastructure—one that eagerly signed transactions on Solana—allowed them to drain all funds controlled by the internal wallet. Fortunately, all funds were returned.

On a more personal front, I will be working on the newsletter full time now. Please consider becoming a premium member to help support its future development.

Let’s dive into the news!

News

Scams

Plant a red flag by Rekt. A report on the disappearance of the Xeggex exchange and its links to past rugs like Cryptsy and Altilly.
Andrew Tate struggles to pump memecoin amid Florida criminal inquiry.

Malware

New PyPI Malware ‘set-utils’ Exfiltrates Ethereum Private Keys Through Blockchain Transactions by Socket.
Infostealer Campaign against ISPs by Splunk. A malware campaign by an Eastern European threat actor to spread cryptomining and infostealer malware.
Threat Actors Leverage YouTubers to Attack Windows Systems Via SilentCryptoMiner.

Contests

HTB CTF - Solidity Shenanigans: Hacking StarGazer by Fuzzing Labs.
Secureum Race Runner by KupiaSec. A browser extension that helps security researchers simulate Secureum races in a realistic environment. Secureum hosts excellent smart contract security challenges at https://ventral.digital/posts/, but their live races fill up quickly. This tool lets you practice these challenges as if you were in a real race.

Media

Research

Sepolia Pectra fork incident recap by Marius Van Der Wijden.
Across V3: Cross Chain Action Vulnerability Disclosure by zachobront.
First depositor attack on Hipo Finance on TON network by Saksham (Zokyo).
Solana Attack Vectors by ImmuneBytes. Account reloading attack.
Astrill VPN: Silent Push Publicly Releases New IPs on VPN Service Heavily Used by North Korean Threat Actors.
Safeguarding Blockchain Ecosystem: Understanding and Detecting Attack Transactions on Cross-chain Bridges.
Protecting DeFi Platforms against Non-Price Flash Loan Attacks.
BitVM: Unlocking Arbitrary Computation on Bitcoin Through Circuit Abstractions by Katat Choi (ZKSecurity).
ERC-20 Tokens: Innovation or Exploitation? What We Learned at ETHDenver by GoPlus Security.
How to Recover Your Browser Wallet Extension from a Sudden Failure? by Lisa & Aro (SlowMist).
Subverting Web2 Authentication in Web3 Bruno Halltari and Caue Obici (OtterSec)
Decode Sui Coin Standard by Senn.

Tools

Safe Watcher - a bot that monitors one or more Safe addresses for critical activities throughout the entire transaction lifecycle.
EVM Debugger by Rumblefish. Detailed opcode, stack, memory debugging. Also includes function stack trace and source navigation.
Cryo-MCP - an MPC server enabling your LLMs to query blockchain data using Cryo by z80.
Solana Program Account Scanner by Crytic. Visualize account relationships.
Echidna Coverage Reporter by Simon Busch. A TypeScript tool to parse and analyze Echidna code coverage reports for Solidity smart contracts.