SECURITY WITH SISI: November Hack Breakdown
November closed with $127M confirmed losses and closer to $240/250M when small/underreported incidents are included. It made one thing brutally clear
Web3 breaks at the seams where deFi, centralized infra, keys, governance and humans intersect.
Major Incidents
◈ Balancer V2 $113M Exploit
Vector: Composable pool invariant failure
A subtle rounding bug inside Balancer’s composable pool logic allowed attackers to distort pool balances and drain liquidity across multiple integrated protocols.
Because these pools were deeply wired into other protocols, the exploit cascaded across chains.
A tiny math error escalated into multiprotocol contagion.
Recovery: $45M frozen across cooperating protocols, remainder laundered via bridges/mixers.
◈ Stream Finance $93M Loss
Vector: Off-chain fund manager failure
Stream relied on an external asset manager controlling large off chain collateral. A massive loss hit the manager, wiping the backing of xUSD/xBTC/xETH.
Centralized fund management undermined decentralized guarantees
Recovery: Legal & forensic investigation; withdrawals still restricted.
◈ Upbit $30/36M Hot Wallet Compromise
Vector: Private key inference / infrastructure level key leak
Abnormal SOL outflows from Upbit’s wallets triggered an emergency freeze.
Investigators claim the attacker reconstructed the hot wallet key by exploiting a "private key inference vulnerability" in Upbit’s internal infrastructure meaning the flaw was likely inside the signing system, not user accounts.
Funds flowed exactly like a Lazarus op:
• SOL → USDC
• USDC → ETH
• ETH bridged + mixed
Same chain path as the 2019 Upbit hack.
What’s interesting is that the hack happened exactly during Upbit parent Dunamu’s $10B acquisition by Naver Corp. The exchange’s explanation is still unusually vague
Could be Lazarus or an insider disguising as Lazarus
Recovery: Remaining funds moved to cold storage; full reimbursement promised. Investigation ongoing.
◈ GANA Payment $3.1M Drained
Vector: Admin key compromise and delegator misuse
An hacker gained access to an admin key and abused an EIP-7702 style delegation contract to drain assets.
They bridged stolen ETH + BNB to Ethereum, then laundered through Tornado Cash.
Recovery: None. Team announced they will “relaunch.”
◈ Beets $3.8M Exploit
Vector: Smart contract vulnerability
A protocol level flaw in beets allowed hackers to manipulate pool logic and extract value.
Not a wallet drain, not phishing, classic contract failure.
Recovery: No confirmed freezes or clawbacks announced yet.
User side losses
Over $33M in November came from: Seed phrase theft, clipboard malware, wallet drainer approvals, “delegation” phishing, fake support staff, malicious extensions, old keys reused across wallets
Hackers increasingly target individuals because:
• One whale is 8/9 figure jackpot
• OPSEC is weak
• Hardware wallet usage is still not default
• New wallet drainers are 1 click silent approvals
User mistakes remain one of the largest attack vectors in Web3.
Hack Pattern Analysis: What changed this month?
◈ DeFi composability remains a multiplier for failure, one small bug → dozens of pools → multiple chains → 9 figure loss.
◈ Off chain operations are now a systemic onchain risk
◈ Stream finance proves that you can follow every smart contract rule and still lose everything if your centralized partner blows up, centralized infra is still the weakest keyholder
◈ Upbit’s private key leakage shows CEXes remain the #1 institutional attack surface.
◈ Admin/privilege misuse is still the fastest way to zero
GANA’s exploit required no clever math just an overpowered admin key.
◈ Wallet hygiene is still collapsing
Despite better tools, user losses remain massive and steady.
Security Tips
For users: Use hardware wallets, keep hot wallet risk minimal, assume all support DMs are scams, never reuse keys and never store seed phrases on devices.
For teams: Use timelocks & multisig/MPC, remove unnecessary emergency powers, audit both code and operations, rotate keys, isolate environments and expect attackers to target governance and key control.
For the ecosystem: Enforce transparent recovery/freeze reporting, build shared cross chain forensics and standardized admin privilege disclosures.
If you’re building in web3 secure the keys, secure the people, secure the processes before securing the code.
Gm frens
T-7 hours until the new security with sisi monthly hack breakdown drops followed by an investigative topic on the upbit hack.
Was it really the Lazarus Group , an insider… or do we have a very convincing copycat on our hands?
Here's a flower for making it through half for the week.
Gm web3
Another day reminding you to read some of security with sisi write ups. You might need the security tips more than you think.
November hack analysis drops tomorrow, not many hacks but there was still some major damage and lazarus team strikes again, even though something is still not adding up imo.
Have a good day 💜
Took alil break from giving updates on my buildings, but I'll back next week
@Me0wverse is ready
The phishing tool is almost done
The Warpcast app is ready for some testing
Which one are you exciting for ?