BlockThreat - Week 51, 2025

Peter Kacherginsky

30 Dec 2025 • 5 min read

Greetings!

Roughly $3.7M was stolen this week across eight incidents. The winter holidays remain one of the most dangerous periods for defenders, as attackers intensify their activity while relying on reduced staffing and slower response times.

The most severe incident this week stemmed from a user falling victim to an address poisoning attack, resulting in a $50M loss. While this does not surpass last year’s record $71M WBTC address poisoning hack, successful compromises of this kind continue to incentivize attackers to flood the blockchain with malicious transactions. What’s frustrating is that this class of attack is largely solvable. Wallets and blockchain explorers could defeat most address poisoning attacks with stronger heuristics. What are the odds that a user legitimately interacts with multiple addresses that share similar prefixes and suffixes? We can do better!

The troubling trend of attacks against older contracts also persists. Yearn was compromised yet again, losing $300K due to a misconfiguration exploit, while Rari’s multisig was taken over, allowing attackers to drain approximately $2M.

Let’s dive into the news!

Events

DarkMode Conference by SEAL. Call for Papers is now open.

News

Crime

Policy

Media

Don’t Get Rekt - Ep04. Pablo Sabbatella and Officer_secrets share great intel on opsec failures and attack patterns. Takeaways.

Research

The Ultimate Guide to the Top for Security Researchers: Setting Sail by Shealtielanz (SigmaPrime).
You’re writing require statements wrong by Brock Elmore (Nascent). A new pattern for DeFi Smart Contract Security.
Decentralized Perpetual Contracts Security Audit Guide by SlowMist.
Solaris: Stateful, Structure-Aware, sBPF Bytecode Coverage-Guided Fuzzing by Inversive Labs.
Institutional-Grade Security. Chapter 1: Guardrails and Role Separation by 0xmikko.eth.
Institutional-Grade Security. Chapter 2: Onchain Github for bytecode by 0xmikko.eth.
Test Proxy Contracts Safely in Wake by Ackee.
You are thinking about rounding errors wrong by Jorgect.eth.
Rebroadcast of my Devcon 7 presentation on Passkeys at 39c3 / CDC by Nicolas Bacca. Remember to keep your most precious passkeys non synchronized on dedicated secure hardware.
Harvesting MEV Bots by Exploiting Vulnerabilities in Flashbots Relay by BlockSec.
Don’t underestimate TON: how incorrect gas estimations lead to critical issues by ChainSecurity.
EIP-712 Encoding in Wake Without Guesswork by Ackee.
A Developer’s Guide to FHEVM Security by OpenZeppelin.
Can chatbots craft correct code? by Evan Sultanik (Trail of Bits).
Belobog: Move Language Fuzzing Framework For Real-World Smart Contracts.
EIP-7702 Phishing Attack.
Mage: Cracking Elliptic Curve Cryptography with Cross-Axis Transformers.
No More Hidden Pitfalls? Exposing Smart Contract Bad Practices with LLM-Powered Hybrid Analysis.
ScamSweeper: Detecting Illegal Accounts in Web3 Scams via Transactions Analysis.
Sandwiched and Silent: Behavioral Adaptation and Private Channel Exploitation in Ethereum MEV.
Detection and Analysis of Sensitive and Illegal Content on the Ethereum Blockchain Using Machine Learning Techniques.
Clean Up the Mess: Addressing Data Pollution in Cryptocurrency Abuse Reporting Services.
BugMagnifier: TON Transaction Simulator for Revealing Smart Contract Vulnerabilities.
Love, Lies, and Language Models: Investigating AI’s Role in Romance-Baiting Scams.
Vision-Based Learning for Cyberattack Detection in Blockchain Smart Contracts and Transactions.
BugSweeper: Function-Level Detection of Smart Contract Vulnerabilities Using Graph Neural Networks.

Tools

CTFBench is a benchmark for evaluating AI smart contract auditors. Repo.
DeployGuard by 0xstormblessed. A CLI tool for auditing Foundry deployment scripts for security vulnerabilities, best practice violations, and missing test coverage. It focuses on detecting CPIMP (Clandestine Proxy In the Middle of Proxy) vulnerabilities and other security anti-patterns.
Introducing Hacken’s Open-Source Uniswap v4 Hook Testing Framework.
Crypto Skills for Python Devs by @fubuloubu. Skills for Claude and other LLMs/Agents to help users build projects in Python for blockchain networks.

Hacks

NX Finance

Date: December 15, 2025
Attack Vector: Price Oracle Manipulation
Impact: $400,000
Chain: Solana

References:

https://x.com/NX_Finance/status/2000896087360725427
https://x.com/NX_Finance/status/2001976173086306787
https://docs.google.com/spreadsheets/d/1S5Pkp9lvv4rWvHyTEXwUQaW2xXlUZr9SOf_taIqI2C4/edit?gid=0#gid=0

Biswap

Date: December 15, 2025
Attack Vector: JavaScript Injection
Impact: Assets Stolen

References:

https://x.com/certikalert/status/2000695821281485089
https://x.com/CertiKAlert/status/1996750360070049876

RelayAdapt

Date: December 15, 2025
Attack Vector: Misconfiguration
Impact: $108,700
Chain: Ethereum

References:

https://x.com/TenArmorAlert/status/2000753419233931741
https://x.com/Zyy_0530/status/2000823739068678555

Exploit:

https://etherscan.io/tx/0xd86313645241f1bf080d8609ac11442e641a0decc3d2052b69b3431f87c84215
https://etherscan.io/tx/0x8b3c8f0e756705f2b299a75ea6044681a68692b4b693a792e3e420c502b620ed
https://etherscan.io/tx/0x4a87b3a99e60b75b1bf0e7f90c626bda7734997d07e4905cdb7491f89fd05762

Unkn_a59209

Date: December 16, 2025
Attack Vector: Arbitrary External Calls
Impact: Assets Stolen
Chain: BSC

References:

https://x.com/DefimonAlerts/status/2001152276300439729

Exploit:

https://bscscan.com/tx/0x2ac64049ef86b54457e4f99cca9f8c5ef7abd1b1b4c7d9eedc480e93983ad375

Futureswap

Date: December 16, 2025
Attack Vector: Governance
Impact: $830,000
Chain: Ethereum

References:

https://x.com/TenArmorAlert/status/2001116475424133536
https://x.com/hklst4r/status/2001129275739484627
https://x.com/lzhou1110/status/2001148759720272104?s=20
https://x.com/lzhou1110/status/2001157492814839874
https://x.com/blockful_io/status/2001443082307285427

Exploit:

https://etherscan.io/tx/0x39e584cdb52adf6b2ed5bb44bfda0e1b254cb0a3925911cc33d842feaf0a8b95
https://github.com/DK27ss/FutureSwap-270k-PoC