Alexander Scherbatyuk

🛡️ Smart Contract Security Researcher & Developer • ⚔️ Alumni @CyfrinUpdraft &🦄 UHI8 @AtriumAcademy &🕵️‍♂️ @KannAudits internship

[Alexander Scherbatyuk @AlexScherbatyuk]

Happy to receive my certificate of completion for the Kann Audits internship. 🚀
@KannAudits thanks for the opportunity!

[Alexander Scherbatyuk @AlexScherbatyuk]

@PashovAuditGrp Is there a specific definition of a ‘great security researcher’ to meet?

[Alexander Scherbatyuk @AlexScherbatyuk]

2 Medium in @metricxyz Audit Contest 🚀

[SHERLOCK @sherlockdefi]

@metricxyz @kvarxyz https://t.co/IjZQ8K89dx

[Alexander Scherbatyuk @AlexScherbatyuk]

I just found a confirmed bug on @immunefi #immunefitribe https://t.co/jIpjzoVkBC

[Alexander Scherbatyuk @AlexScherbatyuk]

Another important step for Web3 security. 🛡️

Glad to have contributed to securing the protocol. 🫡

[Kann Audits @KannAudits]

New security audit report published for @FlutonIO, It’s been an interesting one.

14 days audit of their contracts. 12 High, 5 Medium, 5 Low/Info severity issues found. 🫡

Read the report below 👇
https://t.co/nFeVVd2xAg

[Alexander Scherbatyuk @AlexScherbatyuk]

@KannAudits @FlutonIO Proud to be part of the team that helped secure the protocol 🫡

[Alexander Scherbatyuk @AlexScherbatyuk]

Another protocol is secured 🛡️
Glad I helped contribute to N4A security 💪

[Kann Audits @KannAudits]

New security audit report published for N4A.

12 days audit of their contracts. 1 high, 3 medium, 6 low/info severity issues found. 🫡

Read the report below 👇
https://t.co/rQVkiHlAn6

[Alexander Scherbatyuk @AlexScherbatyuk]

@KannAudits Proud to be part of the team that helped secure the protocol.🫡

[Alexander Scherbatyuk @AlexScherbatyuk]

@KannAudits @KannAudits Thanks 🙏 for sharing the model. A major step forward for Web3 security.

[Alexander Scherbatyuk @AlexScherbatyuk]

@casterdotfun @KannAudits 🫡

[Alexander Scherbatyuk @AlexScherbatyuk]

Proud to have been one of the auditors who helped secure the protocol. Happy to contribute to stronger Web3 security. 🛡️

[Kann Audits @KannAudits]

New security audit report published for @casterdotfun, It’s been a tough one.

22 days audit of their contracts. 19 Critical/High, 28 Medium, 37 Low/Info severity issues found. 🫡

Read the report below 👇
https://t.co/yurQKZQpRd

[Alexander Scherbatyuk @AlexScherbatyuk]

@KannAudits @casterdotfun Glad I could contribute to securing the protocol.🫡

[Alexander Scherbatyuk @AlexScherbatyuk]

A new Web3 security tool is about to emerge!

[Kann Audits @KannAudits]

🤯You are not ready for what's coming next week.

For the past few months, we've been quietly building something.

An AI security model trained for Solidity smart contract audits.

Next week, we'll release the beta for everyone to try

Stay tuned. 👀

[Alexander Scherbatyuk @AlexScherbatyuk]

3. The decoy — .env Never referenced in code, and points at a different endpoint (ipcheck-six) than the one actually called. It's there to soak up attention with a plausible base64'd "auth API" plus fake AWS/Alchemy keys.

Bottom line: never clone/run a stranger's repo on a machine with real credentials. Inspect it statically or in a throwaway VM with no secrets and no network. The chain runs on load, so npm install && npm start is all it takes.

[Alexander Scherbatyuk @AlexScherbatyuk]

Clone our repo and run the demo

I have encountered a new interesting scam that started as a regular interview via Calendly.

A recruiter-style lure (LinkedIn outreach → job brief → "clone the repo and start the demo") ships a repo with a backdoor that fires on server startup. The malicious logic is split across three files so nothing looks suspicious on its own. Reassembled, it dumps your environment and then runs attacker-supplied code.

1. The primitives — controllers/auth.js Disguised as an API-key check. verify POSTs your entire runtime process.env (cloud keys, DB URLs, tokens — not just the repo's .env) to a URL that setApiKey base64-decodes at runtime, so it never appears in plaintext.

[Alexander Scherbatyuk @AlexScherbatyuk]

2. The trigger + RCE — socket/index.js Called at module load. The base64 decodes to https://t.co/G2VcxgUMGq. It exfiltrates process.env, then runs the server's response as live JS with require in scope — full remote code execution. server.js requires this module on boot, so npm start alone is enough.

[Alexander Scherbatyuk @AlexScherbatyuk]

@0xpinkman @immunefi It feels like there should at least be another final status “duplicate” that clearly says it is valid but already known and reported. @immunefi

[Alexander Scherbatyuk @AlexScherbatyuk]

https://t.co/kl3iZnAyx1

[GoPlus Security 🚦 @GoPlusSecurity]

⚠️Top 10 Security Incidents (January–June 2026)

1：KelpDAO, April 18, loss of approximately $292 million. The attacker exploited a verification flaw in the LayerZero-related cross-chain bridge validation flow, released a large amount of unbacked rsETH, and rapidly supplied it to protocols including Aave, Compound, Euler, and Fluid for borrowing and cashing out, ultimately evolving into a cross-protocol bad debt contagion event.

2：Drift Protocol, April 1, loss of approximately $285 million. The attacker obtained protocol administrative control by leveraging durable nonce, social engineering, and weaknesses in multisig governance, then introduced forged collateral assets and manipulated protocol parameters to drain a large amount of real assets from the protocol.

3：Step Finance, January 31, loss of approximately $40 million. The compromise of high-privilege devices and the treasury private key system resulted in significant asset losses. On February 24, the project announced it would cease operations.

4：Humanity Protocol, June 9, loss of approximately $31 million to $36 million. The root cause was improper management of private keys and multisig keys. After compromising critical devices, the attacker took over bridge administrative privileges and carried out fund transfers and abnormal minting across multiple chains.

5：Truebit, January 8, loss of approximately $26.6 million. The attacker exploited an integer overflow/pricing logic flaw in a legacy contract to mint a large amount of TRU at low cost and dump the tokens on the market, causing the token price to collapse rapidly.

6：Resolv Labs, March 22, loss of approximately $25 million. After obtaining high-privilege signing capabilities, the attacker exploited the lack of supply caps and ratio validation in the minting logic to mint approximately 80 million unbacked USR and cash them out.

7：SwapNet, January 25, loss of approximately $13.4 million. Its closed-source contract contained arbitrary-call / approval abuse risks. The attacker leveraged users' existing approved allowances to trigger malicious transferFrom calls and drained users' assets at scale.

8：Verus-Ethereum Bridge, May 18, loss of approximately $11.58 million. The cross-chain bridge failed to strictly verify whether the source-chain input amount matched the destination-chain release amount during the validation process. The attacker exploited this flaw to forge valid payloads and withdraw assets.

9：YieldBlox, February 22, loss of approximately $10.97 million. The attacker manipulated the price of USTRY in a low-liquidity market, causing the oracle to overestimate the collateral value, and then executed excessive borrowing from the Stellar lending pool.

10：THORChain, May 15, loss of approximately $10.7 million. A newly joined node operator exploited weaknesses in the GG20 threshold signature scheme, compromised a single vault, and withdrew assets across multiple chains, exposing the systemic risks of cross-chain signing infrastructure.

[Alexander Scherbatyuk @AlexScherbatyuk]

@Bryan_Conquer22 Let’s connect 🚀