BlockThreat - Week 39, 2025
UXLINK | Griffin AI | Hyperdrive | Linea | Seedify | Ideal Protocol | dTrinity | Cool
Greetings!
This week felt like a bucket of cold water after last week’s relative calm. More than $51M was stolen across 10 incidents, many of them entirely preventable had projects paid closer attention to the well known attack vectors that threat actors continue to exploit time and time again.
The most severe incident this week was the multisig hijacking of UXLINK, where attackers stole a massive $44.4M after taking control of the project’s contracts across multiple chains. The multisig had been configured with a 2/x threshold but lacked basic safeguards such as guardians, timelocks, or any kind of governance review process. On September 22, the attackers exploited this weak setup to reassign themselves as owners with a threshold of 1 and proceeded to pillage the protocol.
In an ironic twist, the attackers themselves later fell victim to an Inferno Drainer attack, losing 542M freshly stolen UXLINK. No honor among thieves, indeed.
Some critical lessons from the compromise:
- Avoid weak thresholds. A 2/x setup is far too low. For anything beyond a few hundred thousand dollars, raise the threshold to at least 5/x.
- Add timelocks. There’s no reason to allow immediate upgrades or parameter changes on multisigs. A multi-day timelock provides a critical buffer to detect and stop malicious activity.
- Use guardians. Guardians serve as the last line of defense, even if all core developers are compromised and a malicious transaction is about to be executed.
Speaking of preventable hacks, Griffin AI fell victim to yet another LayerZero OFT hijack. If that sounds familiar, it’s because just two weeks ago Yala suffered the exact same fate where a temporary bridge deployment was configured with a malicious token.
Just because you aren’t paying attention to active attack vectors doesn’t mean attackers aren’t. They absolutely are and they will reuse the same techniques until projects finally close the door. So pretty please with a sugar on top, lock down your OFTs and don’t give attackers the keys to print money.
The premium portion of the newsletter contains detailed write ups and indicators for the remainder of 10 hacks this week including UXLINK, Griffin AI, Hyperdrive, Linea, Seedify, Ideal Protocol, dTrinity, Cool, and others.
Amid all these stories of hacks, it’s worth highlighting the unsung heroes and sponsors of this week’s edition - ChainPatrol. The good folks at ChainPatrol are doing simply amazing work protecting protocols’ brands, fighting the barrage of X phishing attacks, and quickly taking down scammers before they can do real damage.
Let’s dive into the news!
News
Crime
- Thai Police Bust $15M Crypto Scam Ring Targeting Hundreds of Koreans - Decrypt.
- Eurojust coordinates action to halt cryptocurrency fraud of over 100 million euros across Europe.
- $8M in Crypto Stolen in Armed Kidnapping; Suspects Arrested in Texas.
Policy
Phishing
- The UXLINK exploiter address appears to have signed a malicious `increaseAllowance` approval to a phishing contract by Scam Sniffer.
- X/Twitter seems to have been compromised at some point in the last 24 hours by Dark Web Informer.
- Report of a phishing campaign stealing X accounts through fake a16z DMs and Google Calendar spoofing by Zak.eth.
- DeceptiveDevelopment: From primitive crypto theft to sophisticated AI-based deception by Eset. One of the more interesting revelation is a close collaboration between fake recruiters and DPRK IT workers who share intelligence gathered through the interviews of legitimate developers.
- GitHub notifications abused to impersonate Y Combinator for crypto theft.
- New advanced X account takeover attack targets crypto community.
Scams
- Parabolic Mirage by Rekt. Sybil and market manipulation of MYX Finance.
- DeFi protocol Hypervault vanishes after $3.6 million suspected rugpull.
Malware
- Two Malicious Rust Crates Impersonate Popular Logger to Steal Wallet Keys by Kirill Boychenko (Socket). Mass supply chain attacks continue. Did you pin your dependencies yet?
Media
- DSS Webinar - Trillion Dollar Security with Rajeev, Uri, Fredrik and Mehdi.
- Web3 Security Podcast - Validator sniping: How to harvest IP addresses to redirect MEV | Sebastian Bürgel (Gnosis).
- Scamurai - Ep. #5 Social engineering, AI and security in crypto with Stefan Beyer.
- SEC-T 0x11: Simon Gerst - Attacking and defending GitHub Actions.
- Thinker - Hunting the $477,000,000 FTX Hacker.
- Decrypt - Catching Criminals On-chain with Elliptic’s Matt Price.
- Network Chuck - You need to learn MCP Right Now! A detailed walkthrough on teaching LLMs to interface with security tools using custom MCP servers.
Research
Blockchain Forensics series by SomaXBT:
Inside Ethereum’s Engine: How the Execution Layer Actually Works by Ezequiel Perez (OpenZeppelin).
SP1 and zkVMs: A Security Auditor’s Guide by Kirk Baird (Sigma Prime).
Supply Chain Attacks: Prepare for Next Week by Franco Riccobaldi (Coinspect).
Supply-Chain Guardrails for npm, pnpm, and Yarn by Franco Riccobaldi (Coinspect).
Supply chain attacks are targeting Web3: What the September npm hack reveals by Chirag Agrawal (Guardrail).
Supply chain attacks are exploiting our assumptions by Brad Swain (Trail of Bits).
Device hardening & factory reset guides by OpSek.
How to Setup an Ethereum Node Part 1 and Part 2 by Trash Pirate.
How we trained LLM to find reentrancy vulnerabilities in smart contracts by seth (Unvariant).
MCP Security: TOP 25 MCP Vulnerabilities by Adversa AI.
First Malicious MCP in the Wild: The Postmark Backdoor That’s Stealing Your Emails by Idan Dardikman (Koi Security).
Moving from EVM to Move Part 1 by VulSight.
Commit-Reveal2: Securing Randomness Beacons with Randomized Reveal Order in Smart Contracts.
When Priority Fails: Revert-Based MEV on Fast-Finality Rollups.
Unaligned Incentives: Pricing Attacks Against Blockchain Rollups.
Decoding TRON: A Comprehensive Framework for Large-Scale Blockchain Data Extraction and Exploration.
Generic Adversarial Smart Contract Detection with Semantics and Uncertainty-Aware LLM.
Tools
- Introducing V12 by Zellic. An autonomous Solidity auditor designed to find critical bugs consistently and automatically.
Hacks
UXLINK
Date: September 22, 2025
Attack Vector: Multisig Hijacking
Impact: $44,400,000
Chain: Arbitrum, Ethereum, BSC
https://rekt.news/uxlink-rekt
Unkn_16c10E
Date: September 22, 2025
Attack Vector: Function Parameter Validation
Impact: $4,000
Chain: BSC
https://x.com/TikkalaResearch/status/1969974137662640189
Unkn_506a8a
Date: September 22, 2025
Attack Vector:
Impact: $22,000
Chain: Base
https://x.com/TenArmorAlert/status/1970015815979171983
Seedify Bridge
Date: September 23, 2025
Attack Vector: Key/Signer Compromise
Impact: $1,700,000
Chain: Base, Polygon, Arbitrum, BSC
https://x.com/Phalcon_xyz/status/1970510108506591289
Linea Bridge
Date: September 24, 2025
Attack Vector: Forgotten approval
Impact: $220,000
Chain: Ethereum, Linea
https://x.com/push0ebp/status/1972284761751388641
Griffin AI
Date: September 24, 2025
Attack Vector: Misconfiguration
Impact: $3,000,000
Chain: BSC, Ethereum
https://rekt.news/griffinai-rekt
Ideal Protocol
Date: September 24, 2025
Attack Vector: Uninitialized Contract
Impact: $1,000,000
Chain: BSC
https://x.com/blockaid_/status/1970900879055155560
Hyperdrive
Date: September 27, 2025
Attack Vector: Arbitrary External Calls
Impact: $782,000
Chain: Hyperliquid
https://x.com/CertiKAlert/status/1972117426893738341
Cool
Date: September 27, 2025
Attack Vector: Insufficient Function Access Control
Impact: $100,500
Chain: Ethereum
https://x.com/TenArmorAlert/status/1972123648111558978
dTrinity
Date: September 27, 2025
Attack Vector: Function Parameter Validation
Impact: $56,000
Chain: Sonic, Fraxtal