๐ข New from Extractor: Firewall
A tool for smart contract teams who want to stop exploits โ not just study them after the fact.
It lets you set enforceable rules that block high-risk behavior before damage is done.
Hereโs how it works ๐งต
For teams serious about minimizing exploit risk, Firewall isnโt optional.
Itโs the missing layer between passive detection and real enforcement.
๐ Read the full breakdown: https://t.co/ycCYbNmWv2
๐ Looks like user lost 4,556 ETH (worth of $12.3M) in address poisoning attack 1 hour ago.
Transfer txn: https://t.co/wmwtLEWfMz
The "right" address seems to be 0x6D90CC (https://t.co/QwIy9V4KRE), but instead, ETH was mistakenly sent to 0x6d9052 (https://t.co/TMqZOLGJSo)
Two exploits tonight across two different projects โ SwapNet and @ApertureFinance.
Both caused by unrestricted malicious arbitrary external calls, allowing anyone to drain wallets that had previously approved tokens to the Router.
Total losses: ~$17.2M
Recap & analysis ๐๐งต
Uniswap V4 Liquidity Providers were beneficiaries and the Yield team has messaged to one of the LPs on-chain:
โYou retain 10% as a bug bounty, return the rest.โ
But no official statement has been posted on @yieldโs socials yet.
On-chain msg: https://t.co/61LPyEuyl4
๐จAlert: @yield has lost ~$3.73M due to a slippage in Vault operation of swapping stkGHO to USDC.
3.84M GHO was swapped to only 112K USDC โ a net loss of โ$3.73M.
Swap Tx: https://t.co/OnQu0c41K2
More insights to follow ๐งต
After the attack, most of the funds were distributed to two several wallets where stolen ETH is held at the moment.
Initial theft wallet: https://t.co/sdJCGLGg43
Laundering wallet 1: https://t.co/LrWVRSkKdO
Laundering wallet 2:
https://t.co/AnXZL4PfEl
Laundering wallet 3: https://t.co/LZZqbtKeey
๐จ Alert ๐จ @Truebitprotocol was exploited for 8,535 ETH ($26.5M) due to vulnerability in smart contract Truebit Protocol: Purchase (https://t.co/TrKpRJlxVr)
Details in the thread below๐
@Truebitprotocol Attack transaction: https://t.co/ut8YUKmXIo
Malicious contract was deployed right before the attack (in the same block) via private mempool with attack contract deployment at block position 3 and attack transaction at block position 4: