Sign in Subscribe

BlockThreat - Week 47, 2025

DSS | GANA | Aerodrome | Velodrome | Agentic FoF | PORT3 | Cloudflare

Peter Kacherginsky

• 8 min read
BlockThreat - Week 47, 2025

Greetings!

As many of us were out enjoying the warm weather and people of Buenos Aires, the DeFi ecosystem was hit with four exploits totaling nearly $4M in losses. The biggest impact came from GANA, which lost more than $3M in a private key theft. Close behind was the DNS hijacking attack on Aerodrome/Velodrome, resulting in roughly $700K stolen from users who unknowingly signed malicious transactions delivered through a compromised front-end. It’s a stark reminder of the persistent centralization risks across DeFi, where critical infrastructure still depends on components never designed to withstand the high-risk environment we’ve grown accustomed to onchain.

Speaking of 3rd party infrastructure risk, the entire internet including blockchain infrastructure were hit by Cloudflare outage. A simple database mistake on the part of some 3rd party company and suddenly all of our RPC servers and wallet front-ends were out. Between hacks and outages, may be it’s time to start moving to more resilient tech such as IPFS and Lava network (or similar) for hosting critical onchain infrastructure.

DeFi Security Summit was simply outstanding this year. From the venue to the quality of the talks, it is clear that the blockchain security community is thriving. I have added links to the published recordings in the Media section.

Be sure to check out The State of DeFi Security 2025 Edition, which goes beyond the now customary discussion of Top 10 DeFi attack vectors. This year I focused more on emerging threats, the kinds of potential billion dollar failure modes we have narrowly avoided one too many times. These are the areas we need to prioritize before they turn into something more than a dodged bullet.

One topic I had too little time to cover is competitive incident response. The idea comes from the massive success of competitive bug hunting, including bug bounties, competitions, and similar community driven efforts. Why can’t we adapt the same approach for incident response?

Some tasks are difficult to crowdsource, such as incident management, mitigations, communications, coordination with law enforcement, and other responsibilities traditionally handled by an incident commander. These should remain within a tight group of warroom participants. But there are other tasks that, when outsourced, could become a real asset to already stressed and overstretched incident responders.

Even before an incident unfolds there is always a race to detect, triage, and assign severity to potential problems. Teams must deal with constant noise and false positives from onchain monitoring systems, no matter what their marketing claims suggest. In practice many projects rely on third party companies like Peckshield to publicly or privately notify them with an exploit transaction hash. These companies are motivated to be the first to announce a hack because early visibility brings clients, a form of ambulance chasing. Instead of this dynamic, why not create incentives for a wider community to share confirmed incidents through an incident response bounty platform? Crowdsourcing challenges remain such as low quality submissions and high volume, but those could be addressed with the same reputation and triage processes used in mature bug bounty programs.

During an ongoing incident there is a race to identify the root cause. This is an extremely time sensitive task and can be the difference between successful containment or a complete disaster. Researchers already compete on social media to publish the first accurate root cause, so why not incentivize a bounty for the first correct analysis and allow the impacted team to focus on containment and managing the incident. Imagine a well motivated security community diving into an incident with the same energy we see during top security competitions. Every minute saved in analysis could prevent millions in stolen assets.

After an incident the onchain tracking effort often becomes a multi month or even multi year process that many projects eventually abandon. Yet as cases like the Oasis recovery show, it often pays to follow stolen funds and intervene as early as possible. More projects are beginning to offer bounties for help with tracking and asset recovery, so why not formalize this and unleash an army of onchain sleuths without waiting for a public plea.

Below are some of the bounties we could offer at different stages of an incident:

I have seen many pieces of competitive incident response emerge in the incidents I track week after week. The recent Balancer recovery is one example where well aligned incentives helped the defenders succeed. I believe we are now at the point where a new uniquely DeFi security discipline is forming. Imagine a world where we make it significantly harder for attackers not only to find bugs but also to successfully execute attacks and escape with stolen funds. Competitive incident response may be the path that gets us there.

Let’s dive into the news!

News

Crime

Policy

Phishing

Scams

Malware

Media

Contests

Research

Tools

Hacks

Layerswap

Date: November 17, 2025
Attack Vector: Incorrect Price Oracle
Impact: $186,000 (Recovered $167,400)
Chain: BSC

References:

https://x.com/layerswap/status/1991810671600673036

GANA

Date: November 20, 2025
Attack Vector: Stolen Private Keys
Impact: $3,100,000
Chain: Ethereum, BSC

References:

https://x.com/GANA_PayFi/status/1991424973190361394
https://x.com/extractor_web3/status/1991439154602008833
https://x.com/BlockscopeCo/status/1991572063379943535
https://hacken.io/insights/gana-payment-hack-explained/
https://rekt.news/gana-payment-rekt

PORT3

Date: November 22, 2025
Attack Vector: Uninitialized Contract
Impact: $166,000
Chain: BSC

References:

https://x.com/peckshield/status/1992388937109868993
https://x.com/Phalcon_xyz/status/1992474569723273380
https://x.com/Port3Network/status/1992371564181164468
https://x.com/Port3Network/status/1992471015948210277

Agentic FoF

Date: November 23, 2025
Attack Vector: Malicious Insider
Impact: $531,000

References:

https://x.com/BasisOS/status/1992689112491725207
https://x.com/BasisOS/status/1992927582556496333
https://x.com/m13_digital/status/1992968371894153509

Sign up for more like this.

Enter your email
Subscribe