Hacken.AI

$HAI powered security prediction market · Real DYOR is a skill. Learn it at Trust Army · DYOR Digest every Friday 👇

[Hacken.AI @hackenai]

They climbed the Empire State Building to raise a flag

Now it’s your turn to raise something of your own: your on-chain DYOR certificate by finishing Trust Army

Learn how to research crypto before risking your portfolio

Get DYOR certified➡️ https://t.co/hAVzh9hpM8

[Hacken.AI @hackenai]

xStocks are moving faster than retail research habits.

Learn DYOR at Trust Army before you chase the next hot wrapper yield: https://t.co/0gmjzZQMio

[Hacken.AI @hackenai]

Tokenized Google stock got used as a money printer at @edeldotfinance

The attacker inflated wGOOGLx collateral to ~78x, borrowed against the fake value, and left ~$403K in bad debt.

This is the xStocks risk retail skips: the wrapper price path.

Breakdown below 👇

[Hacken.AI @hackenai]

Edel paused V1 and says users won’t lose funds. The team plans to absorb the bad debt and restore balances 1:1.

In a hot, fast-moving space like xStocks, DYOR isn’t optional. It's the first thing you should do when interacting with such a hot narrative to keep yourself safe.

[Hacken.AI @hackenai]

Regulation is now part of DYOR

Learn DYOR at Trust Army so you’re ready to research the next headline before it hits.
➡️https://t.co/0gmjzZQMio

⚠️Not financial advice

[Hacken.AI @hackenai]

MiCA hits EU crypto on July 1.
If your CEX has no MiCA license, access can change fast: signups, deposits, trading, staking

Your coins aren’t confiscated, but your exchange can become harder to use overnight

Start your DYOR by checking if your exchange is licensed in the EU⬇️

[Hacken.AI @hackenai]

Bybit has launched an EU-facing platform as part of its effort to align with MiCA requirements, though users should verify its current licensing status in the official ESMA register.

If you use any CEX, check the boring stuff before the panic: license status, country rules, migration emails, withdrawal access.

[Hacken.AI @hackenai]

Polymarket says it removed the bad dependency and will refund affected users in full.

Good response. Still, the DYOR lesson hurts: check the URL, double-check what you’re approving, and treat sudden signing requests like a red card.

Learn DYOR at Trust Army today⬇️
https://t.co/hAVzh9hpM8

[Hacken.AI @hackenai]

Users at @Polymarket got hit through the part they touch first: the website.

A compromised 3rd-party vendor injected a malicious script for some users.
Result: ~$3M in PUSD drained from 11+ wallets.

What actually happened and @Polymarket's answer⬇️

[Hacken.AI @hackenai]

With World Cup markets live, users move fast: match odds, last-minute bets in a hurry where some details get lost in the process.

That is perfect weather for a frontend drain.

Attackers don’t need to break the market if they can get you to sign the wrong transaction.

[Hacken.AI @hackenai]

DYOR lesson: self-custody is only as strong as the wallet generating your keys.

The chain can be fine while the wallet fails.

Learn DYOR to dissect headlines yourself👇
https://t.co/0gmjzZQMio

[Hacken.AI @hackenai]

“Cardano hack”? That’s not what actually happened.

@secondfiapp, formerly @YoroiWallet, was hit through wallet infrastructure

The issue is tied to @Cardano_CF wallet generation software, not the blockchain itself

Read the full breakdown below before you miss what happened👇

[SecondFi @secondfiapp]

There has been conflicting advice from different community members in an attempt to be helpful.

⚠️ DO NOT RESTORE your recovery phrase into a new Cardano wallet.

As advised, do nothing until official steps come from SecondFi. The only thing you should do is submit a ticket at https://t.co/bKfl8SK9D2.

We will never DM you first or ask for your recovery phrase.

[Hacken.AI @hackenai]

The real risk now isn’t the exploit, it’s the chaos that follows

If you used @secondfiapp stick to verified updates

Ignore anyone sliding into your DMs promising refunds, there are no legit recovery forms, submit a ticket

And no real support will ever ask for your seed phrase

[Hacken.AI @hackenai]

DYOR is about knowing what to check before the market teaches you the expensive way.

Use a variety of risk tools, find the gaps, ask better questions. But first you have to learn the skill.

Start with Trust Army and get your on-chain SBT certificate👉 https://t.co/0gmjzZQMio

[Hacken.AI @hackenai]

Teams need to review old contracts, bridges, keys, vaults, and anything still carrying value
Users need better tools too

Trust your own DYOR scope, don’t ignore what you spotted

We’ve seen too many hacks, drains, and “legacy” surprises to treat research like a vibe check👇

[CORE3 @Core3io]

What’s the oldest live system your team still relies on?
“Deprecated” is not a security control

If the contract still holds funds or permissions, calling it "legacy" is just a nicer way of saying nobody is watching it

Review it before your project becomes an exploit headline🔽

[Hacken.AI @hackenai]

Taiko halted block production, paused the Bridge and ERC20Vault, and asked CEXs to suspend $TAIKO deposits.

If you use Taiko: don’t bridge, don’t trust refund DMs, and wait for official updates.

DYOR takeaway: bridges are only as strong as their proof system, keys, and emergency controls.

[Hacken.AI @hackenai]

Taiko just got hit for ~$1.7M through its bridge verification layer.

Attackers reportedly got forged L2 messages accepted on Ethereum L1, then pulled real assets from the L1 Bridge / ERC20Vault.

@taikoxyz: "incident is contained and the bridge is paused."

Breakdown below 👇

[Hacken.AI @hackenai]

What broke: Early analysis points to an exposed Raiko SGX signing key and forged attestations.

Simple version: the bridge trusted bad proof data.

That turned fake source-chain messages into real L1 withdrawals.