BlockThreat - Week 27, 2025

Future Protocol | Neemo | Rant | Bitcoin | EthCC

Peter Kacherginsky

13 Jul 2025 • 5 min read

Greetings!

Over $5.5 million was stolen this week across three protocols, using familiar attack vectors like price oracle manipulation and private key theft. But it was the controversy surrounding the massive 80,000 BTC transfer that truly stole the spotlight.

A mysterious on-chain campaign was spotted targeting dormant 2011-era Bitcoin wallets. It uses OP_RETURN transactions to send legal notices along with links to an online form that collects sensitive wallet data. One of the recipients moved 80,000 BTC ($8.6B) which triggered a wave of speculative frenzy. Theories emerged, ranging from a hack or ECDSA nonce reuse exploit to a coordinated legal seizure. A questionable legal entity calling itself Salomon Brothers shared a statement that their client “seeks to mitigate global security issues presented by the abandoned wallets.” Despite all the noise, there is still no concrete evidence of what would have been the largest hack in Bitcoin’s history.

Oak Security has operated in Web3 Security since 2017, providing security services throughout a project's lifecycle. This includes audits, penetration testing, operational security training, and advisory services. Our signature blinded process emphasises redundancy: Every line of code is reviewed by multiple auditors with a multi-disciplinary background in parallel.

Link: https://www.oaksecurity.io/

Let’s dive into the news!

News

CVE-2025-32462 , CVE-2025-32463 Sudo chroot, host Option Elevation of Privilege Vulnerabilities by Rich Mirch (Stratascale). A 12 year old vulnerabilities found in the most audited security utility. Leaving this here in case you feel like all of the bugs have already been found ;-)
AT&T now lets you lock down your account to prevent SIM swapping attacks.
How a Hacker Spent Only $2.7K to Steal $140 Million From Brazilian Banks.
The state of The Red Guild #17.
OpenZeppelin is sunsetting Defender security dashboard.
2025 Q2 MistTrack Stolen Funds Analysis by Lisa (SlowMist).
2025 Mid-year Blockchain Security and AML Report by SlowMist.
Hack3d: The Web3 Security Quarterly Report - Q2 + H1 2025 by CertiK.

Crime

Media

Research

Pwning Solana for Fun and Profit - Exploiting a Subtle Rust Bug for Validator RCE and Money-Printing by Anatomist.
Rekt - After the Post-Mortem. The story with the Cork Protocol hack continues.
LISA Achieves 90% Detection on OWASP Smart Contract Top 10.
Access Control Flaw in Hyperlane's Rate-Limited ISM and Hook by Sujith Somraaj.
Supply Chain Attacks in The Solana Ecosystem by Catalin Neagu (Adevar Labs).
Bug Hunt: Zero-Knowledge, Full-Paranoia, and the AI That Stares Back by ZKSecurity.
Using Claude To Evolve Specialist AI Smart Contract Auditors by Dacian.
Inside the Nobitex Breach: What the Leaked Source Code Reveals About Iran’s Crypto Infrastructure by TRM.
Magic Animal Carousel: Full Exploit and Vulnerabilities by Cyphertux.
The Need for Robust Web3 Pentesting and Supply Chain Security by Chirag Agrawal (Guardrail).
Rational Censorship Attack: Breaking Blockchain with a Blackboard.
Blockchain Address Poisoning.

Tools

LISA - An LLM-powered Intelligent Security Analyzer.
Quimera - feedback-driven exploit generation for Ethereum smart contracts using LLMs.
AI Auditor Primers by Dacian. This repository contains open-source Primer documents to be ingested by AI prior to conducting smart contract audits.
Audit Contests Rewards Calculator by valuevalk.
deployment_validation - Simplified Deployment Validation of EVM-Based Smart Contracts by ChainSecurity.