Wzrd Security

A wizard team 🥷 wielding dark magic to safeguard web3 security 🛡

[Wzrd Security @WzrdSecurity]

@Polymarket Source:
https://t.co/twm9WowwUW

Tx:
https://t.co/PlIQ4dwxHp

[Defimon Alerts @DefimonAlerts]

🚨 @adsharesNet - Loss ~$628K (2026-05-15)

Adshares bridge-minter EOA signed three wrapTo() calls on the WrappedADS contract minting 99,999.93 (x2) + 999,999.94 wADS to attacker. All three calls cited native block-message txids that don't exist on the canonical Adshares chain.

The attacker then dumped the wADS through Uniswap V4 UniversalRouter, extracting ~148.5469 ETH and ~$304,995 USDC.

1M ADS fake mint: https://t.co/VFwzhnjxJZ
Victim (WrappedADS): https://t.co/RQeQ9MSBID
Attacker EOA: https://t.co/N0T57XwxXV
Native attacker account: https://t.co/Py7VBQ5z4H

[Wzrd Security @WzrdSecurity]

EXPLOIT ALERT 🚨

@adsharesNet EXPLOITED FOR ~$628K (2026-05-15) ON ETHEREUM MAINNET

[Wzrd Security @WzrdSecurity]

@Urodboros @elonmusk Source:
https://t.co/HPwZGnt8v4

Tx:
https://t.co/kRnSr0UuUy

[Defimon Alerts @DefimonAlerts]

💬 Onchain Message:
MEV Sandwich Attack Alert
Calculated loss: $201.97 (0.088170 WETH-equivalent)

Your tx: https://t.co/OFwYWoMD2q
Block: 25095209
Your swap: 1.067835 WETH -> 20,412,930,711.02 wojak

What happened:
1. Frontrun tx: https://t.co/D1ofXynziV
A bot bought wojak before your swap.
2. Your swap tx: https://t.co/OFwYWoMD2q
You bought after the bot pushed the price against you.
3. Backrun tx: https://t.co/Nuj7siVJUW
The bot sold right after your swap.

In simple words: the bot entered before you, made your price worse, then exited after you. That is why you likely received less than you should have.

Next steps: use a private/MEV-protected RPC such as Flashbots Protect, set tighter slippage, split large swaps, avoid low-liquidity V2 pools during volatile periods, and revoke approvals if you used a suspicious router or token.
Evidence tx: https://t.co/OFwYWoMD2q
Uniswap V2 pool: https://t.co/mciKlfuuip

No wallet connect, signature, or payment is required. Never sign anything from alert links.

Optional tip if this helped:
EVM/ERC20: 0xe8a4f9c227bf4495c89043ea816eff4f9df2f7b2a
SOL: 9ZfjrKL8pzWRFxNjcPY8pqjwLptWJVwQpLT9fCqbr7P2
BTC: bc1q5lk8hnxq798rvp3ewxwdpz34syy42qepff8jn0sgy9f96w5n4dzstsuuhs

https://t.co/CQrP4e0ne2

[Wzrd Security @WzrdSecurity]

EXPLOIT ALERT 🚨

Onchain EXPLOITED FOR $201.97 (0.088170 WETH-equivalent) ON BASE

[Wzrd Security @WzrdSecurity]

@LoveLigth7 @elonmusk Source:
https://t.co/lrAqO6JkPh

Tx:
https://t.co/B1PNqDBgx0

[Wzrd Security @WzrdSecurity]

EXPLOIT ALERT 🚨

@THORChain EXPLOITED FOR 36.75 BTC ($10M) ON BASE

[Wzrd Security @WzrdSecurity]

Source:
https://t.co/C7QVAVrAFp

Tx:
https://t.co/S6JLuW0Cl7

[Defimon Alerts @DefimonAlerts]

💬 Onchain Message:
Hello, I believe I made a mistake while adding liquidity on Prism. The UI appeared to show an incorrect price, and I accidentally added 10k USDM as one-sided liquidity. As a result, your bot drained the pool and I was left with nothing.

I understand this may have been technically valid, but it was completely unintentional on my part. I would really appreciate it if you could consider returning at least a portion of the funds.

Here is the transaction for reference:https://t.co/DeYtrfGlKH

https://t.co/55M8YY0Dh6

[Wzrd Security @WzrdSecurity]

EXPLOIT ALERT 🚨

@TransitFinance EXPLOITED FOR $1.8M ON ETHEREUM MAINNET

[Wzrd Security @WzrdSecurity]

@Nonnytweet @elonmusk Source:
https://t.co/NVtbu1RNEQ

[Real-time DeFiHacks Intelligence @clarahacks]

Source: TenArmorAlert. IEXCBP on BNB Chain suffered an on-chain exploit, not phishing. A public payout bug let one actor withdraw more than their USDT-side liability, draining about $97.4K. This is a protocol accounting failure.

[Wzrd Security @WzrdSecurity]

EXPLOIT ALERT 🚨

on-chain EXPLOITED FOR UNKNOWN AMOUNT ON BNB CHAIN

[Wzrd Security @WzrdSecurity]

@Cristiano @AlNassrFC @AlNassrFC_EN Source:
https://t.co/dZFQjRbjUg

[Real-time DeFiHacks Intelligence @clarahacks]

Source: TenArmorAlert. Uniperp's BoostHook was hit by a real exploit on Ethereum. In one transaction, an unprivileged attacker created a protocol shortfall and caused 36.438588111442646005 ETH of new bad debt. This shows liquidation math can fail even without privilege abuse.

[Wzrd Security @WzrdSecurity]

EXPLOIT ALERT 🚨

real EXPLOITED FOR 36.438588111442646005 ETH ON ETHEREUM MAINNET

[Wzrd Security @WzrdSecurity]

Source:
https://t.co/4KYhXGhHfj

Tx:
https://t.co/bCobBjZ60J

[ExVul @exvulsec]

🚨🚨🚨Security Alert: Aurellion Labs ERC20 Pull Incident

@Aurellion_Labs suffered an incident on Arbitrum, resulting in the transfer of 456,442.536622 USDC to an attacker-controlled address.

🔍 Root Cause
The attacker deployed and initialized a diamond-style contract flow, then executed `diamondCut(...)` to attach a facet exposing `pullERC20(address,address,uint256)` and `sweepERC20(address,address)`. The attacker used `pullERC20` to invoke `USDC.transferFrom(...)` against multiple EOAs with pre-existing USDC approvals, then swept the collected balance out of the proxy. This was not caused by a vulnerability in USDC itself.

🧾 On-chain Details

• Malicious diamond / pull contract:
`0x0adc63e71b035d5c7fdb1b4593999fa1f296f1b2`

• Attacker receiver / operator path:
`0x9f49591a3bf95b49cd8d9477b4481ce9da68d5ca`
`0x4d7759e69cc973d338a1ea2fdb125c2b818f4d7e`

• Stolen asset:
456,442.536622 USDC

• Attack txs:
https://t.co/CysHi6lm9n

🛡️ Takeaway
Approval-based token pull mechanisms become high risk when paired with attacker-controlled upgradeability or arbitrary execution hooks. Initialization and upgrade authority must be strictly locked, and users should avoid leaving unlimited approvals on untrusted or weakly governed contracts.

[Wzrd Security @WzrdSecurity]

EXPLOIT ALERT 🚨

@Aurellion_Labs EXPLOITED FOR 456,442.536622 USDC ON ARBITRUM

[Wzrd Security @WzrdSecurity]

EXPLOIT ALERT 🚨

Onchain EXPLOITED FOR UNKNOWN AMOUNT ON ETHEREUM MAINNET

[Wzrd Security @WzrdSecurity]

@Polymarket Source:
https://t.co/NN4nfL718b

Tx:
https://t.co/EbeWrbhOFj

[Wzrd Security @WzrdSecurity]

EXPLOIT ALERT 🚨

Onchain EXPLOITED FOR 20,000 USDC ON ETHEREUM MAINNET

[Wzrd Security @WzrdSecurity]

Source:
https://t.co/eG3rXwMggY

Tx:
https://t.co/XGPmHEDOIN

[ExVul @exvulsec]

Security Alert: Huma Finance V1 BaseCreditPool Exploit

@humafinance suffered an exploit affecting deprecated V1 BaseCreditPool deployments on Polygon, resulting in the theft of USDC and USDC.e valued at ~$101,389.

🔍 Root Cause
Under investigation. The affected contracts were deprecated V1 deployments, and no user funds are reported to be at risk.

🧾 On-chain Details

• Affected V1 BaseCreditPool deployments:
`0x3EBc1f0644A69c565957EF7cEb5AEafE94Eb6FcE` (82,315.57 USDC)
`0x95533e56f397152B0013A39586bC97309e9A00a7` (17,290.76 USDC.e)
`0xe8926aDbFADb5DA91CD56A7d5aCC31AA3FDF47E5` (1,783.97 USDC.e)

• Attacker address:
`0x13B44e416e0f66359502E843AF2e1191f1260DaF`

• Exploit contract:
`0x44D4a434aE1529106e4B801315E22721978022A3`

• Attack txs:
https://t.co/vYrpUpbRoQ

🛡️ Takeaway
Deprecated deployments should be fully decommissioned, access-restricted, or drained of residual funds once retired. Even when user funds are not directly at risk, legacy contracts left live onchain can still present exploitable value.

[Wzrd Security @WzrdSecurity]

EXPLOIT ALERT 🚨

@humafinance EXPLOITED FOR 82,315.57 USDC (~$101,389) ON POLYGON

[Wzrd Security @WzrdSecurity]

@Polymarket Source:
https://t.co/uKN9UMGGg9

Tx:
https://t.co/BE2JBRWNrR

[Blockaid @blockaid_]

🚨 Exploit Alert - @humafinance V1 (deprecated)
✅ No user funds at risk.
Huma Finance's V1 BaseCreditPool deployments on Polygon were exploited a few minutes ago for ~$101K.

Total drained: ~$101.4K (USDC + USDC.e)

More Details: