BlockThreat - Week 1, 2025
Fx Protocol | Sora | PumpTokenFactory | Tangem | 98 | StakeOM | BNPL
Happy New Year!
At the start of the year, there were only a few minor incidents, all resulting in losses under $300K. Fx protocol made a costly mistake when calculating rewards for the ever increasing wstETH asset that cost them $125K. However, the most notable case involved the PumpTokenFactory, which deployed flawed token template code. This vulnerability led to a series of price oracle exploits affecting Laura, Luke, and other tokens. The incident bears similarities to the GemPad compromise from a few weeks ago, where $2M was stolen through reentrancy attacks targeting multiple factory tokens.
It’s concerning to see these patterns emerge. Hopefully, the crypto ecosystem can avoid the kind of mass exploitation events that plague the Web2 world—such as the persistent vulnerabilities in platforms like WordPress, Drupal, and other low-code/no-code solutions.
To gain access to comprehensive vulnerability write-ups, post-mortems, exploit proof of concepts (PoCs), attacker addresses, and additional data regarding this week’s compromises, please subscribe to the premium plan below.
Let’s dive into the news!
Events
Remedy CTF 2025. January 24th, 2025.
News
2024 Web3 Security Report by CyVers.
Hack3d: The Web3 Security Report 2024 by CertiK.
2024 Q4 MistTrack Stolen Funds Analysis by Slowmist.
Scam Sniffer 2024: Web3 Phishing Attacks – Wallet Drainers Drain $494 Million
2024 Blockchain Security and Anti-Money Laundering Annual Report by Slowmist.
Man Dies by Suicide After Being Convicted of ‘Rug Pull,’ Family Says. A tragic end to the Undead Apes saga.
Crime
Tether, Tron and TRM Labs Help Freeze $126 Million in USDT Linked to Crime.
South African Authorities Arrest Man Accused of Using Bitcoin to Fund Terrorist Activities.
Policy
Thread on unredacted OCP 2.0 letters from FDIC by Paul Grewal.
Scams
Trapped Between Protocols by Rekt.
39 Ways You Could Lose Money in Crypto: How to Keep Your Money Safe by Sage D. Young (Unchained).
Malware
North Korea-nexus Golang Backdoor/Stealer from Contagious Interview campaign by dmpdump.
Malicious Obfuscated NPM Package Disguised as an Ethereum Tool Deploys Quasar RAT.
Research
A Tale of Two Calls: How a Reentrancy Attack Can Take Over Maker's CDPs by Adriro.
Collaborative Approaches to Enhancing Smart Vehicle Cybersecurity by AI-Driven Threat Detection.
How Concentrated Liquidity in Uniswap V3 Works by RareSkills.
Concentrated Liquidity - Sticky Tick Boundaries by Joran Honig.
Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.