BlockThreat - Week 36, 2025

Greetings!

More than $26M were stolen this week across six incidents with the majority of losses coming from Bunni ($8.4M) and Venus ($13.5M) user compromises.

Let’s start with a more positive story this time. A user fell into DPRK’s trap after joining a compromised Zoom call, where a malicious client handed over control of their wallets. Normally this would have been yet another grim statistic, but not this time. The attacker’s greed and the swift response of Venus Protocol turned the tide. Within minutes Venus hit the pause button freezing the attacker in place while still holding the compromised collateral. A new governance proposal was initiated approving a plan to force liquidate the stolen funds in under 12 hours. The result was a full recovery and a rare happy ending to what is usually a disastrous story.

It’s rare to see novel exploit vectors in DeFi, but the Bunni V2 incident is unfortunately one such example. On September 2, 2025 the protocol lost $8.4M across Ethereum and Unichain due to a subtle flaw in its Liquidity Distribution Function (LDF) rebalancing logic. The mechanism was designed to round conservatively in favor of the protocol, but attackers discovered that by repeatedly forcing pool balances to extreme states (as little as 26 wei) they could accumulate tiny rounding advantages. Iterated over multiple cycles and those small discrepancies compounded into millions.

Amid all these stories of hacks, it’s worth highlighting the unsung heroes and sponsors of this week’s edition - ChainPatrol. The good folks at ChainPatrol are doing simply amazing work protecting protocols’ brands, fighting the barrage of X phishing attacks, and quickly taking down scammers before they can do real damage.

In other news, Justin Sun was caught red handed moving massive amounts of WLFI tokens to exchanges and was promptly blacklisted for market manipulation by World Liberty Financial ($100 million total). Despite Sun’s pleas for leniency, mounting a case is tricky when you’re dealing with the U.S. president’s family.

Let’s dive into the news!

News

• Widespread Data Theft Targets Salesforce Instances via Salesloft Drift. Bad actors were able to access emails and other sensitive data from Google, Palo Alto, Cloudflare, Tenable, Qualys, Bugcrowd, PagerDuty, and many others.
• Eth.limo - Legal Update & Full Summary. Another victim of the Tornado Cash saga with costly legal proceedings, subpoenas, and courts.
• Paradigm’s Reth Client Bug Briefly Freezes Ethereum Mainnet Nodes.
• Ethereum Layer 2 Kinto shuts down in wake of $1.6 million July exploit.
• Coinbase thinks vibe-coding 50% of its platform is a good idea.
• Threat Intelligence Report: August 2025 by Anthropic. Includes details on the use of AI by DPRK IT workers and next generation of malware.

Crime

• Lawsuit alleges that Bitmain faked contract breaches.
• How North Korean hackers are using fake job offers to steal cryptocurrency.
• Arkham Finds $5B in Bitcoin Tied to Movie2K Still Unmoved Since 2019.
• French Police Detain Seven Following Latest Crypto Kidnap Attempt.

Phishing

• Phished Founder, Liquidated Thief by Rekt. A rollercoaster of a $13M theft and recovery through a swift governance action by Venus Protocol.
• Contagious Interview | North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms by Aleksandar Milenkoski (SentinelOne), Sreekar Madabushi (Validin) & Kenneth Kinion (Validin).
• Inside the Kimsuky Leak: How the “Kim” Dump Exposed North Korea’s Credential Theft Playbook by DomainTools.
• ScamSniffer August 2025 Phishing Report. $12M+ stolen.
• Reports of a virulent DPRK fake interview campaign using Willo by Tay.
• Hackers are using the ‘classic EIP-7702’ exploit to snatch WLFI.
• Dark Web Offers Exploits, AT&T Access, Ledger Scam Kit, and 100K Stolen Cards by SOC Radar.
• Profile 0xAstroBee (@AzurbalaMutant, 1148423802) a serial scammer by NFT_Dreww.eth
• I just got drained for $996,000 by Alexander Choi. The attack involved a series of fake founder calls related to Spark ecosystem.

Scams

• Billionaire Justin Sun begs Trump-backed World Liberty Financial to unfreeze $100 million crypto stash. More details on what happened.
• ZachXBT says over 100 crypto influencers accepted promo deals without disclosing paid ads.

Malware

• From PowerShell to Payload: Darktrace’s Detection of a Novel Cryptomining Malware by Darktrace.
• Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials by Kush Pandya (Socket).
• Ethereum smart contracts used to push malicious code on npm by Lucija Valentić (Reversing Labs).

Media

• Web3 Security Podcast - How to secure $70 billion in DeFi: Aave's approach to Web3 security with Ernesto Boado (BGD Labs)
• CBER Forum - A Structural Model of Automated Market Making with David Cao, Brett H. Falk, Leonid Kogan, Gerry Tsoukalas.
• CBER Forum - A Structural Analysis of MEV Boost Auctions with Mallesh Pai.
• bountyhunt3rz - Episode 25 - adrian hetman.
• Rekt - Episode 1 with Benjamin Samuels

Contests

• Wintermute Alpha Challenge write up by Drun.

Research

• Launching the Learn EVM Attacks Explorer by Lior Abadi (Coinspect). A curated collection of Foundry attack scripts from real world exploits, bug bounty reports, and theoretical vulnerabilities on EVM chains.
• Position Spoofing Post Mortem by Panoptic.
• The Dark Side of Upgrades: Uncovering Security Risks in Smart Contract Upgrades.
• Blockchain Forensics: Attribution Techniques and the Role of OSINT.
• Safer cold storage on Ethereum by Trail of Bits.
• “Vibe Hacking”: Abusing Developer Trust in Cursor and VS Code Remote Development by Calif.
• DevSecOops handbook by The Red Guild.
• Subverting code integrity checks to locally backdoor Signal, 1Password, Slack, and more by Darius Houle (Trail of Bits).
• Unraveling crypto crimes through blockchain tracing.
• Large Language Models for Cryptocurrency Transaction Analysis: A Bitcoin Case Study.
• KGBERT4Eth: A Feature-Complete Transformer Powered by Knowledge Graph for Multi-Task Ethereum Fraud Detection.
• LMAE4Eth: Generalizable and Robust Ethereum Fraud Detection by Exploring Transaction Semantics and Masked Graph Embedding.
• SoK: Root Cause of $1 Billion Loss in Smart Contract Real-World Attacks via a Systematic Literature Review of Vulnerabilities.
• Time Tells All: Deanonymization of Blockchain RPC Users with Zero Transaction Fee (Extended Version).
• Performance analysis of common browser extensions for cryptojacking detection.
• Interaction-Aware Vulnerability Detection in Smart Contract Bytecodes.
• TraceLLM: Security Diagnosis Through Traces and Smart Contracts in Ethereum.
• Token Risk Scanning for Traders: Glider Flags 20+ on-chain risks others miss by Hexens.
• DNS Security in Web3: Attacks & Monitoring Setup Explained by Chirag Agrawal.

Tools

• A step closer to isolation —devcontainer-wizard by The Red Guild.
• dApp Observatory by Coinspect. Track supply chain risks for popular web3 apps.
• Bridge WTF - cross-chain analytics dashboard.

Hacks

OlaXBT

Date: September 01, 2025
Attack Vector: Key/Signer Compromise
Impact: $2,000,000
Chain: Ethereum

https://x.com/olaxbt_terminal/status/1962494096578420981

Unkn_46cbe7

Date: September 01, 2025
Attack Vector: Insufficient Function Access Control
Impact: $88,900
Chain: Base

https://x.com/TenArmorAlert/status/1962413608182128843

Bunni

Date: September 02, 2025
Attack Vector: Rounding Error
Impact: $8,400,000
Chain: Ethereum, Unichain

https://x.com/phalcon_xyz/status/1962743751568433416

Venus User

Date: September 02, 2025
Attack Vector: Approval Phishing
Impact: $13,500,000
Chain: BSC

https://x.com/PeckShieldAlert/status/1962844096856568262

E2X

Date: September 04, 2025
Attack Vector: Reward Manipulation
Impact: $38,000
Chain: Ethereum

https://x.com/CertikAIAgent/status/1963788894098596149

Nemo Protocol

Date: September 07, 2025
Attack Vector: Price Oracle Manipulation
Impact: $2,400,000
Chain: Sui

https://x.com/peckshieldalert/status/1964936862566592938