BlockThreat - Week 23, 2025
Alex Lab | Bitopro | Lazarus | Libra | Crocodilus
Greetings!
Over $17M was stolen this week across four separate incidents, with the majority of losses stemming from the compromise of Alex Lab on the Stacks blockchain. This exploit once again highlights how chain- or contract-specific quirks can quietly erode trust assumptions. In Alex Lab’s case, the protocol allowed users to create their own markets—but due to insufficient verification logic, attackers were able to rapidly drain funds. It’s a particularly unfortunate event, as Alex Lab also suffered a $4.3M private key theft by Lazarus just over a year ago.
One of blockchain’s defining features is its radical transparency: hacks are often immediately visible. Detailed technical post-mortems appear within hours before the affected team has even responded. This level of openness is one of the ecosystem’s core strengths.
But what happens when theft occurs beyond the reach of on-chain sleuths or on chains few are watching? This week offered two stark reminders. Bitopro, a centralized exchange, disclosed an $11.5M breach that occurred a month ago after suspicious mixing activity was flagged by ZachXBT. Meanwhile, Marinade Finance suffered a $5M market manipulation scheme that went undetected for months.
How many other attacks remain unseen—either due to the opacity of centralized entities or simply because no one is paying attention? Most blockchain monitoring firms ignore incidents under a few hundred thousand dollars. Yet time and again, we see mass campaigns siphoning small amounts over time, flying just below the radar.
Speaking of transparency, check out the excellent work by our sponsor, Coinspect. From in-depth wallet security reviews to uncovering the latest wallet-draining techniques, the team at Coinspect is focused on protecting one of the most important and vulnerable parts of the ecosystem: the users.
Coinspect’s Wallet Security Ranking is an objective, transparent, and regularly updated evaluation of leading cryptocurrency wallets. It focuses on critical security features like anti-phishing defenses, transaction clarity, and protection against blind signing, helping users choose wallets that prioritize their safety.
Link: https://www.coinspect.com/wallets/
Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.
Let’s dive into the news!
News
Bitopro Confirms $11M Hack, Taiwan Crypto Exchange Says it Has Replenished Lost Funds. The notification came shortly after ZachXBT exposed the hack about a month after the event.
New Chrome Zero-Day Actively Exploited; Google Issues Emergency Out-of-Band Patch.
Crime
Alleged mastermind behind French crypto kidnapping spree arrested in Morocco.
DOJ Seeks $7.7 Million Forfeiture in Crypto From North Korean Hackers Masquerading as IT Workers.
Hacker arrested for breaching 5,000 hosting accounts to mine crypto.
Policy
Argentina anti-corruption office clears Javier Milei in Libra crypto promotion scandal.
Crypto groups push to add a bill that aims to protect software developers in overarching legislation.
No, California didn’t pass a law to seize your idle bitcoin.
Phishing
EF Security Checklist. Step by step guide to personal digital security and privacy including securing of your messaging, mobile devices, personal computers, smart home, email, physical security, and others.
The Crypto Threat Landscape: Threats and Exploits Targeting Crypto Users by SomaXBT.
Evolution of Web3 Phishing – From Email Scams to AI-Driven Hacks - Part 1 by Three Sigma.
Automated Wallet Drainers & Smart-Contract Phishing Kits by Three Sigma.
FBI warns of NFT airdrop scams targeting Hedera Hashgraph wallets.
Understanding EIP-7702 Phishing Attacks: A Comprehensive Guide to Protection Strategies for Wallets by GoPlus Security.
Crypto complacency: The hidden security threats at industry conferences by Kraken.
Beyond the Pond Phish: Unraveling Lazarus Group's Evolving Tactics by BitMEX.
Behind the Mask: SlowMist Reveals How a Fake Security Expert Tricked Crypto Users by Liz & Reborn (SlowMist).
Malware
Cryptojacking Campaign Exploits DevOps APIs Using Off-the-Shelf Tools from GitHub.
Android Trojan Crocodilus Now Active in 8 Countries, Targeting Banks and Crypto Wallets.
Media
OpenSense - From Clueless to Confident: Sammy’s Web3 Security Journey.
bountyhunt3rz - Episode 16 - 0xflint.
Think Like an Attacker: Finding the Attack Vectors Before They Do by Riley Holterhus (Cantina).
Building an Institutional-Grade Security Practice featuring Ryan (Gauntlet), Gal (Hypernative), Fives (SEAL), Tal, Julia, and Ziggy (ZeroShadow).
0xProfiles - Juno by Offbeat.
Contests
Pectra Educational CTFs by Rotciv. EIP-7702 and other Petra related educational challenges.
Research
Defining a new methodology for modeling and tracking compartmentalized threats by Talos. A great guide on threat modeling approaches, kill chains, and attribution.
The Notorious Bug Digest #3 by Frank Lei & Ionut-Viorel Gingu (OpenZepp
Dodging a Bullet by Rekt. A case study for a successful bug bounty report in Vesu protocols on Starknet.
Stablecoin Security: Economic Attack Vectors & Black Swan Failures by ImmuneBytes. A relevant read considering recent Chainlink $500K meltdown.
EulerSwap auditing thought process thread with Daniel Von Fange.
Rescuing funds with EIP-7702 by pcaversaccio.
Rescuing a 100 ETH wallet on Base. The story of whitehats at Protofire who frontran a weakness for older Safe wallets.
Standardizing wallet information so humans can actually know what they are signing by Patrick Collins. Watch this video and the Wise Signer tool for some context.
Decimal Dangers: Exploits from Math Mishaps in Web3 by Three Sigma.
Institutional Wallet Security by ZeroShadow.
Incident Post Mortem: op-geth<>op-reth Gas Refund Mismatch by Optimism.
Pandora’s Box: How Unrestricted LLMs Threaten Crypto Security by SlowMist.
A Security Engineer's Guide to Reviewing Core Blockchain Nodes by Kirk Baird (Sigma Prime).
AI-Driven Threat Modeling – LLMs for Automated STRIDE Analysis by Fuzzing Labs.
elin).
Why Web3 security is broken (2025 edition) by Charles Wang.
Talking Transactions: Decentralized Communication through Ethereum Input Data Messages (IDMs).
Transaction Proximity: A Graph-Based Approach to Blockchain Fraud Prevention.
Tools
eBurger - a static analysis tool that provides a way to quickly query and analyze solidity smart contracts by forefy. A great tool and action to include in your CI pipeline.
Radar - A static analysis tool for anchor rust programs by Auditware. Another great tool for the Solana/Rust CI pipeline.
Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.