F12

Smart contract security. Continuous audits, real-time exploit monitoring & onchain forensics. Catching threats before they drain you.

[F12 @f12sec]

~72M USDT frozen by Tether , part of a 120M+ Tron laundering run (KuCoin, instant exchanges, bridged to BTC/ETH). confirmed the inflow on-chain. h/t @zachxbt

Frozen: TBzrPEsStbZAUx2SBhD4oHz8UW3FX9Ak9W Entity: TA6YHqB2xh5HhfmC7WoLQaWmqq7Vv4zCoQ

[F12 @f12sec]

@r0bre yeah, closed source isn't a real boundary. the sbf bytecode is public, you can disassemble it, and missing account checks show up in behavior regardless. no source just means harder, not safe. hit the same root cause, and traced the full fund flow on chain. it's on my profile.

[F12 @f12sec]

@Param_eth thanks!

[F12 @f12sec]

@WhiteHatMage It's closed-source/unverified, that's why you can't find it

But source isn't needed: the bytecode is public and the bug is in account validation, discoverable by probing. The attacker's failed test txs are right there on-chain.

I broke it all down in my account

[F12 @f12sec]

@PeckShieldAlert https://t.co/sotgfLOgrN

[F12 @f12sec]

🚨 SOLVED: ~$1.3M Raydium-AMM exploit on Solana

We traced every hop on-chain

The bug? A FAKE LP token (supply=1) → Withdraw → 100% of the pool drained.

~$1.3M bridged via deBridge → 810 ETH straight into Tornado Cash.

Here's exactly how 🧵👇

[F12 @f12sec]

🚨 Raydium drained of ~$1.3M (reported by @PeckShieldAlert / Specter)

Attacker funded from KuCoin → bridged Solana to ETH → laundered 810 ETH via Tornado Cash + 7 ETH to FixedFloat. Tracing the on-chain flow now. 👇

[F12 @f12sec]

@AMLBotHQ Full trace here if you want it 👇

https://t.co/sotgfLOgrN

[F12 @f12sec]

🚨 SOLVED: ~$1.3M Raydium-AMM exploit on Solana

We traced every hop on-chain

The bug? A FAKE LP token (supply=1) → Withdraw → 100% of the pool drained.

~$1.3M bridged via deBridge → 810 ETH straight into Tornado Cash.

Here's exactly how 🧵👇

[F12 @f12sec]

@Purrykana @PeckShieldAlert @Raydium https://t.co/sotgfLOgrN

[F12 @f12sec]

🚨 SOLVED: ~$1.3M Raydium-AMM exploit on Solana

We traced every hop on-chain

The bug? A FAKE LP token (supply=1) → Withdraw → 100% of the pool drained.

~$1.3M bridged via deBridge → 810 ETH straight into Tornado Cash.

Here's exactly how 🧵👇

[F12 @f12sec]

@PeckShieldAlert @Raydium https://t.co/sotgfLOgrN

[F12 @f12sec]

🚨 SOLVED: ~$1.3M Raydium-AMM exploit on Solana

We traced every hop on-chain

The bug? A FAKE LP token (supply=1) → Withdraw → 100% of the pool drained.

~$1.3M bridged via deBridge → 810 ETH straight into Tornado Cash.

Here's exactly how 🧵👇

[F12 @f12sec]

@0xINFRA Root cause's a fake LP token (supply=1) that drains 100% of the pool on withdraw. Money went deBridge then 810 eth into tornado. Breakdown's here 👇

https://t.co/sotgfLOgrN

[F12 @f12sec]

🚨 SOLVED: ~$1.3M Raydium-AMM exploit on Solana

We traced every hop on-chain

The bug? A FAKE LP token (supply=1) → Withdraw → 100% of the pool drained.

~$1.3M bridged via deBridge → 810 ETH straight into Tornado Cash.

Here's exactly how 🧵👇

[F12 @f12sec]

@TheBlockCo Root cause's a fake LP token (supply=1) that drains 100% of the pool on withdraw. Money went deBridge then 810 eth into tornado. Breakdown's here 👇

https://t.co/sotgfLOgrN

[F12 @f12sec]

🚨 SOLVED: ~$1.3M Raydium-AMM exploit on Solana

We traced every hop on-chain

The bug? A FAKE LP token (supply=1) → Withdraw → 100% of the pool drained.

~$1.3M bridged via deBridge → 810 ETH straight into Tornado Cash.

Here's exactly how 🧵👇

[F12 @f12sec]

Exploited program (unverified):
https://t.co/e5CYsjoXrf

"Unverified" proof (osec):
https://t.co/3jKXL6CN36

ETH wallet:
https://t.co/G65xDHJb2z

[F12 @f12sec]

🚨 SOLVED: ~$1.3M Raydium-AMM exploit on Solana

We traced every hop on-chain

The bug? A FAKE LP token (supply=1) → Withdraw → 100% of the pool drained.

~$1.3M bridged via deBridge → 810 ETH straight into Tornado Cash.

Here's exactly how 🧵👇

[F12 @f12sec]

🚨 Raydium drained of ~$1.3M (reported by @PeckShieldAlert / Specter)

Attacker funded from KuCoin → bridged Solana to ETH → laundered 810 ETH via Tornado Cash + 7 ETH to FixedFloat. Tracing the on-chain flow now. 👇

[F12 @f12sec]

$894K drain (USDC+RAY):
https://t.co/CNmnhWft92

RAY+wSOL:
https://t.co/W6SQ8EOuAJ

RAY+SRM:
https://t.co/mE4Ssf0dn6

RAY+dust:
https://t.co/xRIdJ4f4s7

[F12 @f12sec]

How it's prevented:

One line , assert the LP mint passed in == the pool's stored mint. On every withdraw/deposit path. No exceptions.

We catch this class with invariant checks + real-time "new mint → Withdraw → vault drained to 0" alerts

- F12 Security Labs

[F12 @f12sec]

Same trick, 4 pools drained:

• 66,836 RAY + 893,700 USDC
• 74,720 RAY + 5,602 wSOL
• 8,621 RAY + 10,692 SRM
• 5,037 RAY + dust

Everything funneled into one wallet, then swapped to USDC

[F12 @f12sec]

Cash-out:

USDC bridged Solana → Ethereum via deBridge (giveChainId "sol") → 819.9 ETH (~$1.3M) on the attacker's ETH wallet.

Then: 810 ETH into Tornado Cash (9 deposits), 7 ETH to FixedFloat, 0.65 ETH to a fresh EOA