Sign in Subscribe

BlockThreat - Week 4, 2026

Makina | HypuurFi | SwapNet | Aperture | Cosmos | SagaEVM | USMS

Peter Kacherginsky

• 8 min read
BlockThreat - Week 4, 2026

Greetings!

More than $28M was stolen this week across eight incidents. From arbitrary call vulnerabilities to infinite mint bugs, it was a particularly rough week. Let’s break down a few of the most notable hacks.

HypuurFi, SwapNet, and Aperture Finance were hit by arbitrary external call exploits, draining users of roughly $17 million in a single day. Notably, the last two had no source code and were exploited shortly after deployment. We’ve long observed that attackers are becoming increasingly sophisticated with onchain vulnerability scanners. Now, we see they not only can detect bugs in raw EVM code but also wait patiently for the most opportune moment to strike exactly as I discussed in my recent DSS talk on watering hole contracts.

If you are not familiar with this attack vector, below is a snippet from the vulnerable HypuurFi contract:

function swapAndDeposit(
    address swapRouter,      // arbitrary call address
    bytes calldata swapData, // malicious input
    address vault,
    address tokenIn,
    uint256 amountIn,
    address tokenOut,
    address receiver
) public payable {
    // Execute swap (tokens come to gateway)
    if (!_isNativeToken(tokenIn)) {
        IERC20(tokenIn).safeTransferFrom(msg.sender, address(this), amountIn);
        IERC20(tokenIn).safeIncreaseAllowance(swapRouter, amountIn);
    }

    // VULNERABILITY:      v----- Tainted user input  ----v
    (bool success,) = swapRouter.call{value: msg.value}(swapData);
    require(success, "Swap failed");

    // Deposit swapped tokens
    uint256 balance = IERC20(tokenOut).balanceOf(address(this));
    _deposit(vault, tokenOut, balance, receiver);
}

The easiest way for developers to catch this bug class is to consider all user input malicious and never pass it along without any constraints to call() or equivalent.

It’s hard to blame users for this hack as they were using DeFi protocols exactly as we encourage them including infinite allowances without any mechanism to revoke them. Perhaps it should be up to wallets to step up and help users clean up these long-lasting approvals just like our password managers frequently remind us to change compromised or weak passwords. In the meantime, bookmark http://revoke.cash and try to visit it on a quarterly/monthly basis.

There’s some hope that the attackers behind these incidents will eventually slip up and face swift justice. It happens to all of them sooner or later. In the meantime, check out this week’s sponsor and the good guys behind Anchain.ai, who are working hard to track down bad actors and help make our ecosystem a bit safer for us all.

SPONSORED
CTA Image

AI-native Crypto Intelligence Data

AnChain.AI Data delivers institution grade cryptocurrency data API and MCP for AML, fraud compliance, growth analytics and beyond.

$200 Promo Code (By 2/28): AINATIVECRYPTODATA

https://www.anchain.ai/data

Learn more

Cosmos ecosystem is know for some of the nastiest blockchain-level bugs including infinite minting, reentrancy, and others. This week, SagaEVM became the victim to one such critical vulnerability. Attackers exploited an infinite-mint bug to generate assets out of thin air, stealing over $7M. Although the chain was halted, the attackers had already bridged out the available liquidity.

In other news, son of a company owner tasked with managing US Marshal Service’s seized crypto assets (including from Bitfinex hack) managed to steal $40M. ZachXBT was able to pin down the perp after he leaked his wallets on Telegram.

Let’s dive into the news!

News

Crime

Policy

Phishing

Malware

Media

Research

Tools

Hacks

SynapLogic Compromise

Date: January 19, 2026
Attack Vector: Function Parameter Validation
Impact: $186,000
Chain: Base

References:

Exploit:

Paradex Mithril Trading Bot Compromise

Date: January 20, 2026
Attack Vector: Stolen Private Keys
Chain: Ethereum

References:

Makina Gmak Compromise

Date: January 20, 2026
Attack Vector: Price Oracle Manipulation
Impact: $4,130,000
Chain: Ethereum

References:

Analysis:

Recovery:

Exploit:

SagaEVM Compromise

Date: January 21, 2026
Attack Vector: Infinite Minting
Impact: $7,000,000
Chain: Saga

References:

Analysis:

Response:

Exploit:

AiPay Compromise

Date: January 23, 2026
Attack Vector: Price Oracle Manipulation
Impact: $30,100
Chain: BSC

References:

Exploit:

HypuurFi Compromise

Date: January 25, 2026
Attack Vector: Arbitrary External Calls
Impact: $84,000
Chain: HyperEVM

References:

Exploit:

Matcha Meta SwapNet Compromise

Date: January 25, 2026
Attack Vector: Arbitrary External Calls
Impact: $13,300,000
Chain: Base

Part of a series of attacks targeting whales with approvals to vulnerable contracts.

References:

Exploit:

Aperture Finance Compromise

Date: January 25, 2026
Attack Vector: Arbitrary External Calls
Impact: $3,530,000
Chain: Base,Ethereum,Arbitrum,BSC

Part of a series of attacks targeting whales with approvals to vulnerable contracts.

References:

Exploit:

Sign up for more like this.

Enter your email
Subscribe