Defimon Alerts

Real-time security alerts for DeFi

⚠️ Alerts:
💎 Signals:

[Defimon Alerts @DefimonAlerts]

Onchain monitoring and incident response is crucial for DeFi

Since 2022 we have been working on https://t.co/X9cKWDVOJz to detect DeFi exploits by analyzing transactions in real-time.

There is a constant stream of DeFi exploits that are barely noticed. You can get access to these instant alerts by subscribing to the exploits feed for just 50$/mo. For protocol teams we offer a Websocket subscription to act on the alerts automatically.

Native Telegram subscription: https://t.co/70vuWap7y0
Tribute mini-app: https://t.co/DP5gYe0hkk
Contact: https://t.co/iM6Ro8PnBv

[Defimon Alerts @DefimonAlerts]

💬 Onchain Message:
Hi - 32.3 ETH claimable from Euler post-exploit redistribution. Call claim() from this wallet. Verify https://t.co/7yB91NUdBN. -researcher

https://t.co/11Sx9HjJzK

[Defimon Alerts @DefimonAlerts]

💬 Onchain Message:
Hi - 324 ETH redeemable via Opyn v2 Controller (0x4ccc2339f87f6c59c6893e1a678c2266ca58dc72). You hold oWETHUSDC/WETH-22JUL22-1400C oTokens. Call operate(Redeem,...) - URGENT, pool only has ~379 ETH and others draining. Verify https://t.co/QCPf7ePWkU. -researcher

https://t.co/Tm3Yk8WQCN

[Decurity @DecurityHQ]

We warned about @dxsale rug pull risk 3 years ago: https://t.co/NJFzx6Pqao

[Defimon Alerts @DefimonAlerts]

💬 Onchain Message:
CRITICAL ALERT: THESIS TOKEN (THESIS) - VULNERABILITY ID #THESIS-PERMIT2-REENTRANCY. PERMIT_2 infinite allowance override allows total liquidity drain via reentrancy in _update() hook. PoC compiled - 11th vulnerable DERC20 template deployment confirmed - identical vulnerability across all deployments (DEAL, HALO, SHH, BRAIN, ZER0, BASEMATE, HERMES SYNTH, MEMORIDE, PROTEAN, SIGNAAGENT, THESIS). Send 58.00 XMR to 82subHXjv8pK2SStUkoyc9iEodJMAh12yMQiEnap6JmQYA1C5TFXM5rhFgbARgThJEdHpV9oqh2PJaTezy5xjSTcKYfgGyh or mass exploit execution across all eleven pools + public disclosure of all vulnerable contracts. Contact Session: 05351c54f3a444ab0f0f938f9291dce60b51086d077498efb5f8b79e6e714c3010

https://t.co/vSa9sgIp2s

[Defimon Alerts @DefimonAlerts]

💬 Onchain Message:
This message is directed at the individual responsible for the recent vsdCRV exploit. Law enforcement and on-chain tracking firms are involved in this matter, and significant identification data have been gathered. Stake DAO Association offers you the opportunity to return 35.021 ETH to 0x5DA07af8913A4EAf09E5F569c20138b658906c17 on Ethereum, and keep the remainder as a 20% white-hat bounty. At reception of the funds, Stake DAO Association will drop civil charges and pursuits. This offer is valid for 72 hours (until June 4th 2026, 5:00:00 PM UTC). Should you want to reach out, you can do it via Blockscan Chat to this address, which natively verifies wallet ownership.

https://t.co/55FtPjOEXk

[Defimon Alerts @DefimonAlerts]

💬 Onchain Message:
Hi,
Could we discuss the return of funds and the associated bounty through Blockscan Chat?
Alternatively, you can contact us at [email protected], and we'll be happy to continue the conversation there.

https://t.co/Ek7FeBlbwM

[Defimon Alerts @DefimonAlerts]

💬 Onchain Message:
To the individual responsible for the Alephium bridge exploit:

We are prepared to treat this incident as a white hat disclosure under the following terms:

1. Return 90% of the drained assets to:

0x238640C0F74A95485e986Fa26D434fF7B216D058

within 72 hours of this message.

2. You may retain 10% of the returned assets as a white hat bounty.

Upon receipt of the 90%, Alephium will consider the matter resolved and will publicly acknowledge your cooperation.

Contact [email protected] with a message signed by one of the addresses involved in the exploit for further communication.

We would prefer to resolve this matter quickly and cooperatively for the benefit of affected users.

Alephium Team

https://t.co/neFjYBp0uQ

[Defimon Alerts @DefimonAlerts]

🚨 LegendaryMoneyMon (MON) - Loss ~$85.5K (2026-05-28)

Token: $MON (Moneymon) — swapped out to USDT
MC: micro-cap (500K MON total supply, illiquid PancakeV3 pool)

Type: Broken Signature Verification / Uninitialized Admin

LegendaryMoneyMonNft.cliamRewred() relies on verify() which checks recoverSigner(...) == admin. The contract's admin is set to address(0), so ecrecover returning 0 on any malformed signature passes the check. Attacker called cliamRewred with a junk signature (v=27, r=s=0), drained 24,306 MON from the NFT reward contract, and swapped them via PancakeV3 SwapRouter for ~85,519 USDT.

TX: https://t.co/4Td2ps5d06
Victim: https://t.co/TkOFMrVf9U
Token: https://t.co/N99BCh5mMU

[Defimon Alerts @DefimonAlerts]

💬 Onchain Message:
We have detected movement of funds from your Bitcoin wallet. Contact us at telegram @trustedvolumes, email [email protected] and return the rest of the funds to 0xb6F28eD0f919A12822fE78F6d610e5e09A6Fe450

https://t.co/fM5yjtoBxY

[Defimon Alerts @DefimonAlerts]

💬 Onchain Message:
Security researcher here. Your MEV bot (proxy 0x8A1Ba3d) extracted 0.297 WETH from my swap on 2026-05-27 (tx 0x5fbe7638). I have fully decompiled your implementation (23K bytes, Solidity 0.8.34) and analyzed all 5 helper contracts. Your V3 callbacks lack CREATE2 validation but the tload(0) guard saves you. Requesting good-faith return of funds to 0x4056ebdCdD0D8b9Fe04F9ef918A948369f154a37. Happy to discuss a bounty arrangement for the vulnerability report. Contact: send 0-value tx back to my address with your preferred comm channel.

https://t.co/O8tBwbSJRX

[Defimon Alerts @DefimonAlerts]

🚨 @StakeDAOHQ deployer private key compromised on Arbitrum.

Attacker minted 5,446,744,073,709 vsdCRV and now is swapping to ETH via Metamask Router.

Attacker: https://t.co/6OR2kozDbb
Mint TX: https://t.co/e6BUSHGek6
LZ setPeer TX: https://t.co/tfrrWymcvk

[Defimon Alerts @DefimonAlerts]

💬 Onchain Message:
Days ago my bot frontran some transactions targeting the SEA token. Please contact me for a refund via on-chain message; portion as a bounty, it would be appreciated, it’s up to you.

https://t.co/OGd2Sydwf2

[Defimon Alerts @DefimonAlerts]

🚨 https://t.co/IitN3zoSqn (CEO @frank_hep) - Loss ~$3M (2026-05-25)

Type: Access Control / Authorization Bypass

New Market Trading gives each user a non-custodial ERC-4337 Safe smart account with a suite of DeFi modules (Aave, Yearn, Morpho, Beefy, SquidRouter, etc) that an off-chain delegate executes via a shared PermissionsManager/DelegateBundler.

The SquidRouterModule inherits Axelar's permissionless expressExecuteWithToken(), which does no gateway validation at express time. Its _executeWithToken only checks that a caller-supplied sourceAddress string equals Squid's router, then _processPayload blindly trusts the delegate address encoded in the attacker's payload.

By passing a real permissioned delegate with malicious swap/approve actions, anyone could impersonate that delegate and make any user Safe approve + swap its full balance.

We contacted @squidrouter as soon as the first attack was detected by our monitoring system. Squid is not vulnerable - it's the flaw is in New Market Trading's module wrapping the Axelar express pattern.

Sample TX: https://t.co/TbVrVQdxwv
Vulnerable module: https://t.co/y8ViX54PMx

[Defimon Alerts @DefimonAlerts]

💬 Onchain Message:
We represent the New Market Trading team that you exploited. Can we talk over blockscan chat?

https://t.co/DWCw33QvOg

[Defimon Alerts @DefimonAlerts]

💬 Onchain Message:
We represent the New Market Trading team that you exploited. Can we talk over blockscan chat?

https://t.co/DWCw33QvOg

[Defimon Alerts @DefimonAlerts]

🚨 Fractal Protocol - Loss ~$13.7K (2026-05-22)

Token: $USDF (receipt token, no liquid market)
TVL: $97.27K (pre-hack)

Type: Logic Error / Price Manipulation

Attacker (0xe2acec13) used an Aave V3 USDC.e flash loan, looped through a chain of Balancer V2 batchSwap callbacks, and recursively hit Fractal's Vault deposit (0xb6b55f25) / withdraw on 0x80e1a981 (impl 0x038c8535) and the USDF receipt token 0xae48b7c8 (impl 0xf8a13864). Each callback minted USDF at the configured tokenPrice and burned it back, extracting ~$13.7K of USDC.e from the vault by exploiting the deposit/withdraw accounting (tokenPrice/share-rounding) inside the recursive Balancer→Vault flow. Vault uses a fixed daily-accrued tokenPrice (~1.27 USDC/USDF) with only a 30-day catch-up in _compute(), and no proper invariant check between depositAmount and withdrawalAmount across re-entered swap callbacks.

TX: https://t.co/pCRvQDEOJ1
Victim Vault: https://t.co/mx01V2SGNh
USDF Token: https://t.co/cfhgYLH6vn

[Defimon Alerts @DefimonAlerts]

Learn about new DeFi hacks before anyone posts on Twitter: https://t.co/HJC9rh581N

[Defimon Alerts @DefimonAlerts]

🚨 @Mureapp - Loss ~$11.7K (2026-05-21)

Type: Access Control / Unvalidated Signer Source

MureDistribution trusts the user-supplied input to provide the authorized signer. Attacker passed an attacker-controlled contract as source, making themselves the "signer" - SignatureChecker then calls the attacker contract which returns true.

Attacker then drained any address that had pre-approved the MureDistribution proxy, pulling 4.85M QUEST via transferFrom and dumping to ~5.45 ETH on Uniswap.

TX: https://t.co/YVjKUoW2vq
Victim: https://t.co/MAcxkTfqjN (MureDistribution proxy)

[Defimon Alerts @DefimonAlerts]

💬 Onchain Message:
To the Verus<->Ethereum Bridge Exploiter:
Members of the Verus community and its developers have discussed a set of terms, detailing the size of the bounty, obligations from your side and ours, and how the funds can be returned.

1. We have agreed that the bounty amount will be 1350 ETH. If you adhere to these terms, we will consider these 1350 ETH a reward for your exposing of a vulnerability, and we would publicly request to all interested parties that the 1350 ETH be considered your legitimate bounty.

2. If the funds are returned to the address 0xF9AB28cB7b72B518e6a351FbdaBe69362cBC1A74, minus 1350 ETH, meaning a total return of 4052.4 ETH within 24 hours after this post, Verus community members and developers, and everyone we currently know to be involved in investigating the event, will halt any existing investigations into you to the best of our ability, and we will not press charges or pursue extralegal consequences. We will consider the address that holds 1350, either as change or if still in the source as the bounty address.

If you return a total of 4052.4 ETH to the address 0xF9AB28cB7b72B518e6a351FbdaBe69362cBC1A74 within the 24 hours specified above, we will understand that as your agreement to these terms, and we will uphold our stated agreement to cease further investigation into you, not initiate new investigation of you, not press charges, and not seek additional consequences. We will also post a public acknowledgement, referencing the 1350 ETH and publicly state that we consider those funds to be your bounty. If further communication is required to come to an agreement, please refer to the following contact points, as mentioned in previous messages:

email: [email protected]
z-address on Verus (for encrypted memo communication): zs1wl6e6qe8z8n8t8jp4qxek5ey53t9xajzwxc75gj72wrcwuq6ha4mdg0v8p6z8wpkz2fhxrqlayc

To verify the authenticity of this offer, you can also see the same message posted on the Verus discord in the announcements channel, and on the Verus community's X account at https://t.co/VIFHskjOzO.

https://t.co/hGjZ4JK7m5

[Defimon Alerts @DefimonAlerts]

Learn about new DeFi hacks before anyone posts on Twitter: https://t.co/HJC9rh581N

[Defimon Alerts @DefimonAlerts]

🚨 @ElevateFiOG ($EFI) - Loss ~$16K (2026-05-19)

Type: Oracle Manipulation (UniswapV2 spot-price)

Staking vault prices EFI via raw pricePair.getReserves(). Attacker used a flash-loan funded buy of EFI from the EFI/DAI pair to inflate spot EFI price during staking, paid less EFI for a large packageUsd credit, then waited for epochs to accrue and called rebase() + claim() at normal price, extracting 6,256.5 EFI (2x the EFI they put in) from the vault.

StakeEFI TX: https://t.co/cMyBPFsVgT
Claim TX: https://t.co/tfoRbTaVeZ
Victim: https://t.co/beyqrVq0SQ