Pinned Tweet
🚨ExVul Security Incident Analysis Update
We are officially engaged in the comprehensive joint investigation and on-chain tracing for the recent security incident involving the @cysic_xyz cross-chain bridge on BNB Smart Chain.
🔍 Current Investigation Focus:
• Attack Path Analysis:
Deep-diving into the database access vector and message processing logic vulnerability.
• Fund Tracing & Monitoring:
Tracking fund flows and monitoring the blacklisted recipient address
(0xA4e1827Fe2664fD0797a55e442b2e2639449C255), which currently holds ~2.8M CYS.
• Security Remediation:
Assisting in risk validation and security hardening before bridge reopening.
We are working closely with the Cysic team to uncover the full picture. Detailed technical findings and tracing results will be published in our upcoming joint report.
Stay tuned for official updates. 🛡️
#ExVul #Web3Security #Cysic #IncidentResponse #SmartContractSecurity
🚨 ALERT — Exploit on Ethereum
X100 (@x100global) Freezer/DexTreasury lost 361,799.999998 X in a one-transaction, flash-loan-funded Senate takeover. The attacker realized 4.75M USDT.
Root cause:
applyForSenate() lets anyone join immediately for a 100-X fee, while the three Senate seats are chosen from current frozen balances—with no voting-power snapshot, stake-age delay, or execution timelock.
Two helpers froze 19,000.000001 X each, beating the 19,000-X incumbent by one raw unit and taking 2/3 seats.
Proposal #7 auto-voted for its proposer; the second helper voted, and execute() immediately self-called v3Swap(PancakeV3, X→USDT, fee=100, amountIn=400,000 X, minOut=0).
The attacker-seeded pool paid the treasury only 35.675313 USDT for 400K X.
Attack tx: etherscan.io/tx/0x38c60844f1…
Attacker: 0x7ec2afdf3ec5964899894f8d58afa95cbb8ffd63
Victim (X100 Freezer / DexTreasury): 0x79f35a33fe2813414851c4ae8daeacd14d822a46
Exploit coordinator: 0x37541fc4a6f1ec86889ba506f51dc39f2bedd10a
Subscribe to our TG bot for real-time attack alerts 👉 exvul.com/skyeye-monitor
Kudos to our partner @Cysic_XYZ for taking swift and decisive action. Burning 7.2M CYS from Foundation Reserves directly protects holders and realigns tokenomics. True resilience is built on accountability and transparent execution. Proud to support Cysic moving forward.
ExVul retweeted
A message from Cysic to the party responsible for the exploit:
In the interest of reaching an amicable resolution, we are offering a recovery bounty of approximately 10% for your cooperation in returning approximately 90% of the identified ETH proceeds from the unauthorized minting of 10,000,000 CYS.
Specifically, return 275.872 ETH in native ETH on Ethereum mainnet to the following address controlled by the Cysic Foundation:
0xe3e8E1147a47dCf42fa73892D74928544fe5a6A9
The return window is 72 hours from the on-chain publication of this message on Ethereum mainnet.
Upon verification that 275.872 ETH was received at the designated address by the deadline, you may retain the remaining identified ETH proceeds, approximately 30.652 ETH, as the recovery bounty. This bounty is excluded from the 275.872 ETH repayment amount and does not need to be returned. We will publicly acknowledge your cooperation and consider Cysic’s ETH recovery claim under this offer resolved.
We have reconstructed the key stages of the attack and preserved the supporting technical and on-chain evidence. If the funds have not been returned by the deadline, the matter will be escalated with law enforcement to pursue a full criminal investigation.
BSC on-chain message: bscscan.com/tx/0x2d737d1eff6…
ETH on-chain message: etherscan.io/tx/0x2e238635c5…
Always a pleasure working with great teams that take security seriously! 🛡️
Our team is completing another thorough smart contract audit to ensure maximum protection for user funds. Full audit report coming soon. Stay tuned! 🦔🔍
🚨 ALERT — Exploit on BSC
AlpsCon AI Trade Hub lost 152,809.3575 USDC; the attacker received 152,295.3625 USDC before gas. A 1,027,990 USDC Aave flash loan was converted into temporary ALPS service credits, which were credited with prior historical rewards across V7/V8/V9.
Root cause:
V7–V9 recursively import balances from the preceding version, then multiply those newly visible balances by each version's already accumulated profitPerShare while the new account's entryProfitPerShare remains zero.
This lets a fresh V6 deposit claim distributions made before the deposit existed.
The onlyVerified gate also trusted 0xf39f…2266, the canonical Hardhat test account with a public private key;
EIP-7702 let the attacker run exploit code in that whitelisted account context.
Attack tx: bscscan.com/tx/0x824b83f94bd…
Attacker: 0x3d9df7d20d8296286383ffe475aa7b9e548946b2
Whitelisted delegated account: 0xf39fd6e51aad88f6f4ce6ab8827279cfffb92266
Victim (AI Trade Hub V9): 0x9b210da482217afc24074e57f6f8337fe07f0124
The hack decompiled contract:
decompiler.exvul.com/bsc/0xb…
Subscribe to our TG bot for real-time attack alerts 👉 exvul.com/skyeye-monitor
🚨 ALERT — Exploit on Ethereum
@kolan_protocol Uniswap v4 Hook was exploited for 1.279453 ETH net. The attacker flash-borrowed 6.7 WETH, manipulated the KLN spot price, permissionlessly closed two expired windows holding 2.309861 ETH, and sold back through the liquidity those closes injected.
Root cause:
KolanHook.accept(id) allows any caller after expiry, while _closeWindow() trusts the same pool's instantaneous _sqrtPrice() to restore/reposition escrowed ETH liquidity and runs an unbounded buyback.
The attacker moved that price first, forced two settlements at the manipulated state, then reversed the trade through the newly placed ETH liquidity.
Attack tx: etherscan.io/tx/0x7b131926e6…
Attacker: 0x8df735014eab81905e76b87ef0c069bd8e0ae382
Victim (KolanHook): 0x0136fecf49e0217bfd2d9551e8e7b05f174ba8ec Attack helper: 0x4d6a41f2b80fe75facf27f9d0b3dc8bd0ebc835f.
Subscribe to our TG bot for real-time attack alerts 👉 exvul.com/skyeye-monitor
🚨 ALERT — Exploit on Ethereum
@UNCX_token Smart Token Vesting was drained of five ERC-20s worth ≈$87.7K at parent-block spot prices.
The exploit contract retained ≈$85.6K in EDGEN, ZC, PEPECOIN, LO0P and PAAL; after 0.5624 ETH in fees/gas, estimated mark-to-market profit was ≈$84.2K.
Root cause:
VestingManager.release() subtracts claimed shares from global _totalTokenShares but leaves them in the position's _depositedShares.
After release → topUpVesting(), cancel() calculates sharesToRemove from the full lifetime _depositedShares without subtracting schedule released,
so already-released shares are removed from the global total a second time.
The attacker used a direct donation to magnify this stale-share debit,
corrupted the denominator, then released a second attacker-owned vesting to take tokens backing unrelated users.
Attack tx: etherscan.io/tx/0x352065378c…
Attacker: 0x78c9b11853e4f183a34c63ffd1924d2319a2f5b3
Exploit contract: 0xf6d072254eb8a9b06e0ba21221b498332c1bc35e
Victim (UNCX Smart Token Vesting): 0xa98f06312b7614523d0f5e725e15fd20fb1b99f5
The same accounting path remained live at the latest checked block; other token balances may still be exposed.
Subscribe to our TG bot for real-time attack alerts 👉 exvul.com/skyeye-monitor
🚨 ALERT — EIP-7702 Wallet Drain on Ethereum
sven.eth was drained for 9.1231 ETH net (~$22.77K) plus 1.69271471 TAPEETH.
No flash loan or AMM manipulation was involved: the attacker sponsored a type-4 transaction carrying the victim's valid EIP-7702 authorization, then swept the account in one call.
Root cause:
This is not a TAPEETH / PodMining bug.
The authorization signed by sven.eth delegated its EOA to attacker-deployed code at 0x0366b55f948a688888ca6e029ad0831f6ec260d1.
EIP-7702 then made calls to sven.eth execute that code in the victim account's context, allowing the hard-coded controller 0x9208097c007be15e28b20e94e66870a3f9f820bc to call PodMining.claim(), transfer the freshly minted reward, and send out the victim's entire ETH balance.
Attack tx: etherscan.io/tx/0x36e0d1491c…
Attacker: 0x9208097c007be15e28b20e94e66870a3f9f820bc
Victim (sven.eth): 0xd8ba9e5886b7000bace2c9dbdd0be98ac77d4a28
Malicious EIP-7702 delegate: 0x0366b55f948a688888ca6e029ad0831f6ec260d1
The malicious delegation was still active at block 26,188,153. Do not send funds to the victim address; clear/replace the delegation and migrate assets immediately.
Subscribe to our TG bot for real-time attack alerts 👉 exvul.com/skyeye-monitor
Security and transparency are the foundation of fast-moving markets.
🛡️ It was a pleasure working with the @bibodottrade team to review and secure their smart contracts.
Glad to see them live and building right! Check out the full report below 👇
Bibo has completed a smart contract audit with @exvulsec 🔐
Market move fast
We keep building with security and transparency in mind
Thanks to the ExVul team for the review
Read the full audit report 👉
bibo.trade/docs/security
🚨 ALERT — Exploit on Ethereum
Legacy Set Protocol’s ETHMACOAPY lost ~8.11 WETH across two transactions from different EOAs.
Root cause:
actualizeFee() rounds redemption backing UP, even when no fee is payable. The attacker donated collateral, triggered recalculation, then redeemed temporary tokens for more collateral than they contributed—consuming existing holders’ backing.
Attack tx: etherscan.io/tx/0xb54c77dae4…
Attacker: 0x3a15cf422307e922645d671cb247e76e8b1ec50d Victim (ETHMACOAPY): 0xb647a1d7633c6c4d434e22ee9756b36f2b219525
A second transaction two blocks later removed another ~4.062 WETH, effectively exhausting this Set’s recorded backing.
Subscribe to our TG bot for real-time attack alerts 👉 exvul.com/skyeye-monitor
ExVul Decompiler now supports screenshots and annotations 📸
Capture a code snippet, add red notes, arrows, and boxes, then download the image to share your findings.
Make your contract analysis easier to follow.
Try it: decompiler.exvul.com
🚨 ALERT — Exploit on Base
An unnamed vault was drained of 1,783.067 aBaswstETH (~$6.0M) across six vault outflows.
Root cause (preliminary):
A newly whitelisted contract used the vault’s borrowing path. We verified the aToken outflows and subsequent redemption into wstETH; the precise authorization failure remains unconfirmed.
Flow: vault → attacker contract → attacker wallet → aTokens redeemed for ~1,783.067 wstETH.
The linked tx moved 1 aBaswstETH; the total includes five later outflows.
Attack tx: basescan.org/tx/0x0ec75c3be1…
Attacker: 0x0B5126e1bc27C0de77e02e97945760A674EdB034
Victim (vault): 0xD1895f2019c2152FC2b9022D57f19198c4CFCABC
Loot contract: 0xcdFE91301356da873562EF513828a60dba1F569d
Subscribe to our TG bot for real-time attack alerts 👉 exvul.com/skyeye-monitor
Timeline:
08:52:23 UTC:
the owner Safe disabled the attacker contract’s whitelist membership.
Transaction trace (base.blockscout.com/api/v2/t…).
08:53:51 UTC:
the same Safe enabled that contract again. Both administrative transactions included three successful ECDSA recoveries using the same signing identities.
Admission trace (base.blockscout.com/api/v2/t…).
08:55:01 UTC:
70 seconds after admission, the borrower received the first 1 aBaswstETH. Five subsequent outflows brought the total to 1,783.067 aBaswstETH, approximately $6M.
🚨 ALERT — FlashLoopAdapter Safe-module exploit on Ethereum
Two Safes using a custom Aave v3 loop adapter lost an estimated $305K. The attacker gained 114.092 ETH after gas in one transaction. Aave v3 itself was not affected.
Root cause:
FlashLoopAdapter trusted a caller-controlled response from isModuleEnabled() as proof that the caller was a Safe. The attacker supplied a fake Safe, then set the adapter’s swapRouter to each real victim Safe and swapCalldata to execTransactionFromModule(...). The real Safes accepted those calls because the adapter was an enabled module.
Flow (1 tx):
Morpho WETH flash loan → repay 1,335.256 WETH of Safe #1’s Aave debt → transfer 6.426 weETH from Safe #2 and withdraw 1,306.482 weETH from Safe #1 → swap collateral and repay the loan → +114.092 ETH after gas.
Attack tx: etherscan.io/tx/0x75328f916b…
Attacker: etherscan.io/address/0x42c26…
Victim Safe #1: etherscan.io/address/0xcfedf…
Victim Safe #2: etherscan.io/address/0xe3b23…
Vulnerable module: etherscan.io/address/0x16bb8…
Both identified Safes have since disabled the module. Other Safes still using it should disable it until fixed.
Subscribe to our TG bot for real-time attack alerts 👉 exvul.com/skyeye-monitor
the hacker return 1 in the attack contract and then directly bypass the access control.
decompiler.exvul.com/ethereu…
🚨 ALERT — Exploit on BNB Smart Chain
The SKYDAO/USDT PancakeSwap V2 pair lost 183,482.88 USDT. The attacker kept 59,914.12 USDT
Root cause:
SKYDAO's sell transfer calls its pool controller before crediting the pair with the seller's net tokens.
The controller sells the 35% tax, moves the GROSSsell amount from the pair to the dead address via controlburn(), then callspair.sync().
This records almost zero SKYDAO reserve.
When the token transferfinishes, the unrecorded net tokens let the attacker call pair.swap() and withdraw nearly all USDT.Flow (1 tx):
flash borrow 2.657m USDT → buy SKYDAO with 435,367.43 USDT → sell-transfer triggers pair-token removal and premature sync → direct pair swapreceives 495,281.56 USDT → repay loan = +59,914.12 USDT to attacker.
Attack tx: bscscan.com/tx/0x8e3016674ea…
Attacker: 0x5c9214d91ea1d2d6a46f80457c25a6e7e4d56ebc
Victim pair: 0x096e08dda1e18625ffdfbae4bb65a414aa7ec2c8
Vulnerable SKYDAO token: 0x7eba33c7a0e555d115277ba4af04dfbb4f4fa70c
Pool controller: 0xee5fdff6364dde0a3c66dd38a4303cdd3d10730c
Subscribe to our TG bot for real-time attack alerts 👉 exvul.com/skyeye-monitor
🚨 ALERT — Exploit on BSC
An attacker netted 32,080.60 USDT from a PositionManager USDT/BTCB vault in one transaction.
Root cause:
PositionManager.deposit() valued the vault's USDT using the manipulable Pancake V3 spot USDT/BTCB price multiplied by Chainlink BTC/USD.
The depressed spot undervalued existing USDT, so a new depositor received too many PM shares.
withdraw() immediately redeemed those shares against actual USDT balances; there was no same-transaction withdrawal delay.
Attack tx: bscscan.com/tx/0x8725c094ae6…
Attacker: 0x97f119508fd5cc15e90b539b603895a5cfc56808
Victim (PositionManager): 0x7cedb2e5d7791c7d46c5c9d35eac4775bc887f00
Subscribe to our TG bot for real-time attack alerts 👉 exvul.com/skyeye-monitor