Lei Wu

Co-founder of BlockSec (@BlockSecTeam) | Views are my own

[Lei Wu @realvisual]

Attackers have been pretty active these past few weeks... even during the holidays.

[BlockSec Phalcon @Phalcon_xyz]

🗓 BiWeekly Web3 Security Roundup | Sep 21 - Oct 04

🚨 Spotlight on 8 notable incidents | ~$418M lost these two weeks

Featuring a vulnerability breakdown and in-depth analysis of selected key cases👇
https://t.co/akBNJRV30O

[BlockSec @BlockSecTeam]

Bitget: $387.5M gone. No private key stolen, no contract exploited.

The attacker compromised internal credentials and told the wallet system to send the money. It did.

Bybit, now Bitget. The attack surface has moved off-chain.

Our breakdown, with a complete security review framework for exchanges and custodians: https://t.co/kmr9KUXxQ5

[BlockSec @BlockSecTeam]

Bitget: $387.5M stolen. Less than $1M frozen.

Full fund flow analysis: https://t.co/2qhvfmojds

$183M swapped into ETH within hours. Issuers froze $339K. NEAR Intents blocked $50M in attempts but caught $503K. THORChain let it all through.

Tracing worked. Freezing did not, because the window was hours and most of it closed before the first request landed.

[BlockSec @BlockSecTeam]

BlockSec's blockchain penetration testing is now live, written up as a series: What it covers, where its boundaries sit, how it is authorized, and which attack surfaces it has to reach.

First four parts are live, more to come 🔜
Part 1: Why institutions need it: https://t.co/hlVBGJ8vPQ
Part 2: What it is, and its boundaries: https://t.co/BJGXsTUk8k
Part 3: Authorization and production safety: https://t.co/oHGzpjzCWW
Part 4: The attack surfaces it covers: https://t.co/Q6XWzVnyoq

[BlockSec @BlockSecTeam]

Attackers rarely break the chain. They take over a channel you already trust — a real account, a real conversation, a real history.

BlockSec co-founder @yajinzhou and the Gate security team on how account takeovers, phishing and impersonation actually work, and what separation of identity, devices and permissions buys you.

[BlockSec Phalcon @Phalcon_xyz]

🗓 Weekly Web3 Security Roundup | Sep 14 - Sep 20

🚨 Spotlight on 2 notable incidents | ~$11.3M lost this week

Featuring a vulnerability breakdown and in-depth analysis of selected key cases👇
https://t.co/rVr7XMKsjC

[BlockSec Phalcon @Phalcon_xyz]

🗓 Weekly Web3 Security Roundup | Sep 07 - Sep 13

🚨 Spotlight on 2 notable incidents | ~$320M lost this week

Featuring a vulnerability breakdown and in-depth analysis of selected key cases👇
https://t.co/xvf9aoVb7G

[BlockSec Phalcon @Phalcon_xyz]

🗓 Weekly Web3 Security Roundup | Aug 24 - Aug 30

🚨 Spotlight on 5 notable incidents | ~$23M lost this week

Featuring a vulnerability breakdown and in-depth analysis of selected key cases👇
https://t.co/ceCWxWEnX8

[BlockSec Phalcon @Phalcon_xyz]

🗓 Weekly Web3 Security Roundup | Aug 17 - Aug 23

🚨 Spotlight on 2 notable incidents | ~$10.26M lost this week

Featuring a vulnerability breakdown and in-depth analysis of selected key cases👇
https://t.co/xxGcDabOrC

[BlockSec Phalcon @Phalcon_xyz]

🗓 Weekly Web3 Security Roundup | Aug 10 - Aug 16

🚨 Spotlight on 5 notable incidents | ~$47M lost this week

Featuring a vulnerability breakdown and in-depth analysis of selected key cases👇
https://t.co/bodPL6ykEL

[Yajin (Andy) Zhou @yajinzhou]

https://t.co/IV4fcqP5Sx

[BlockSec Phalcon @Phalcon_xyz]

🗓 Weekly Web3 Security Roundup | Aug 03 - Aug 09

🚨 Spotlight on 2 notable incidents | ~$1.6M lost this week

Featuring a vulnerability breakdown and in-depth analysis of selected key cases👇
https://t.co/wl8GCI2oFl

[BlockSec @BlockSecTeam]

https://t.co/OkyeN6JNtu

[BlockSec Phalcon @Phalcon_xyz]

🗓 Weekly Web3 Security Roundup | Jul 27 - Aug 02

🚨 Spotlight on 2 notable incidents | ~$88M lost this week

Featuring a vulnerability breakdown and in-depth analysis of selected key cases👇
https://t.co/P5FO2CoQPe

[BlockSec Phalcon @Phalcon_xyz]

🗓 Weekly Web3 Security Roundup | Jul 20 - Jul 26

🚨 Spotlight on 8 notable incidents | ~$39.5M lost this week

Featuring a vulnerability breakdown and in-depth analysis of selected key cases👇
https://t.co/ppzkDZvUtv

[BlockSec Phalcon @Phalcon_xyz]

🗓 Weekly Web3 Security Roundup | Jul 13 - Jul 19

🚨 Spotlight on 2 notable incidents | ~$1.35M lost this week

Featuring a vulnerability breakdown and in-depth analysis of selected key cases👇
https://t.co/B5xmGjvctr

[BlockSec Phalcon @Phalcon_xyz]

🗓 Weekly Web3 Security Roundup | Jul 6 - Jul 12

🚨 Spotlight on 3 notable incidents | ~$36M lost this week

Featuring a vulnerability breakdown and in-depth analysis of selected key cases👇
https://t.co/pJ01zrmfbU

[BlockSec Phalcon @Phalcon_xyz]

🗓️ Weekly Web3 Security Roundup | Jun 29 - Jul 5

🚨 This week's focus: @hinkal_protocol Double-Spend Attack
~$800K drained from a shielded pool — a legacy note format flaw likely allowed deriving multiple nullifiers from one deposit.

Breaking down how a circuit-level binding gap enabled repeated withdrawals👇
https://t.co/NZNIUxqLaN

[BlockSec Phalcon @Phalcon_xyz]

🗓 Weekly Web3 Security Roundup | Jun 22 - Jun 28

🚨 Spotlight on 2 notable incidents | ~$4.1M lost this week

Featuring a vulnerability breakdown and in-depth analysis of selected key cases👇 https://t.co/OfBn3ahd0q

[BlockSec Phalcon @Phalcon_xyz]

🗓 Weekly Web3 Security Roundup | Jun 15 - Jun 21

🚨 Spotlight on 3 notable incidents | ~$18.3M lost this week

Featuring a vulnerability breakdown and in-depth analysis of selected key cases👇
https://t.co/p76YlrASyi