Every Zipp story tagged #DeFiExploit, newest first.
The attacker's $1.36M haul was the smaller beat. A false CACAO balance collapsed the token 88.7%, and that's what drove the $11M in pool damage. Recovery terms remain undefined.
The attacker used Ostium's own Gelato-run price automation against it, forging future-dated oracle reads to extract an $18M USDC payout. It is the second major oracle hit in a week.
The attacker slipped a fake price past Supra oracle verification, borrowing $10M against 250 worthless SAUCE tokens. Nearly all of Hedera's DeFi value walked out the door in 24 hours.
The exploit rode a passed proposal through BonkDAO's own voting mechanism, a structural hit that turns governance itself into the attack surface.
CryptoSlate
CoinDesk
TheBlock