Every Zipp story tagged #DeFiExploit, newest first.
Behind the drained reserves sit more than 960,000 daily UBI claimants, and the parallel XDC leg of the loss remains unexplained even though Superfluid pins the flaw to Celo alone.
One shared Move-language implementation turned one suspected compromise into parallel freezes across four chains, with Switchboard yet to publish a root cause or affected-integrations list.
The network halt is the headline. The signal is the attack shape: a thin-liquidity governance token pumped 100x in 20 minutes, then used as collateral. Same mechanic as the 2022 Mango Markets exploit.
The attacker's $1.36M haul was the smaller beat. A false CACAO balance collapsed the token 88.7%, and that's what drove the $11M in pool damage. Recovery terms remain undefined.
The attacker used Ostium's own Gelato-run price automation against it, forging future-dated oracle reads to extract an $18M USDC payout. It is the second major oracle hit in a week.
The attacker slipped a fake price past Supra oracle verification, borrowing $10M against 250 worthless SAUCE tokens. Nearly all of Hedera's DeFi value walked out the door in 24 hours.
The exploit rode a passed proposal through BonkDAO's own voting mechanism, a structural hit that turns governance itself into the attack surface.
CryptoSlate
TheBlock
CoinDesk