Web3 Daily Exploits — 14 Sep 2026: Yam $121k Gov Drain + Spiral 10.7 ETH

Yam proposal #45 finished as a realized ~$121k UMA-farm pull. SlowMist printed a same-block ~10.7 ETH (~$26.8k) spot-price borrow on SpiralHookV2. Ampleforth Governor Bravo #54 was cancelled on-chain.

Web3 Daily Exploits — 13 Sep 2026: Ampleforth $2.5M Gov Alert + Orb3 Bridge Window

No confirmed new protocol drain in the last 24 hours. Defimon flagged Ampleforth Governor Bravo proposal #54 aiming 2.5M USDC at a fresh proposer, and an Orb3 Orbit L1-bridge assertion that can confirm after block 26,005,988.

Web3 Daily Exploits — 12 Sep 2026: Zentra ~$140k Citrea Drain + ORB Reentrancy

First public desk confirmation of Zentra’s 9 Sep ctUSD reserve drain on Citrea (~$140k official / ~$143k Defimon), a SlowMist-confirmed ~$32.6k ORB reentrancy on BNB Chain, and a pending fake rollup assertion against Edgeless’s dormant L1 bridge (~9.2 ewETH at risk).

Web3 Daily Exploits — 11 Sep 2026: Symbiosis ~$336k WBTC Dump + Three Small Drains

Four first-report protocol items in the last 24 hours: Symbiosis BridgeV2 minted unbacked syBTC on BNB Chain and realized ~$336k in WBTC on Ethereum; BeatXswap lost ~$64k–$78k to a spot-oracle flash loan; ether.fi’s legacy AtomicQueue lost ~15.45 ETH; OMNI404 lost 2.4 WETH.

Web3 Daily Exploits — 10 Sep 2026: Quiet Window — Trezor Vendor-Email Phish

No new confirmed protocol drain in the last 24 hours. The window’s first-report item is a Trezor third-party email-provider breach that sent a fake STM32 entropy alert from legitimate sending infrastructure. A Defimon 10,000 USDC recovery ping remains unverified as a protocol exploit.

Web3 Daily Exploits — 9 Sep 2026: Order Factory ~24.7 ETH + Enso Deprecated Vault ~5.6 ETH

Two confirmed Ethereum drains in the last 24 hours: an unnamed order-factory access-control miss took ~24.7 ETH, and leftover funds in a deprecated Enso DPI strategy vault were pulled for ~5.6 ETH. No new eight-figure protocol loss in this window.

Web3 Daily Exploits — 08 Sep 2026: Liquid $47M Still Out + BNB Router Drains

Liquid actors returned 3,400 BTC and kept ~598.5 BTC (~$47M) without a signed bounty. Two fresh BNB Chain drains: a DEX router approval sweep of ~62.28 BNB and a WealthManagementV2 owner-key hit for 26,414 USDT.

Web3 Daily Exploits — 07 Sep 2026: Liquid $320M Whitehat Peg-Out + Cozy $170K

Liquid Network sees ~4,000 BTC (~$320M) unauthorized peg-out claimed as whitehat; Cozy Finance loses ~$170k on Optimism via UMA oracle abuse; Secured Finance ~$104k price-manipulation drain on Ethereum; Rocket $287k update.

Web3 Daily Exploits — 06 Sep 2026: Reddio ~9.25 ETH Vault Double-Count + Autonolas Gov Attempt

A quiet window produced one confirmed low-value vault exploit and one blocked governance attempt. Reddio’s RedSonic Vault lost approximately 9.25 ETH to a cross-vault double-counting flaw; a malicious Autonolas proposal targeting ~40 ETH remains unexecuted.

Web3 Daily Exploits — 05 Sep 2026: Notional $1.7M Overflow + Dream Health $72k Logic Drain

Notional Finance lost ~$1.73M on Ethereum via an unsafe uint128 downcast in free-collateral checks. A separate ~$72k logic flaw drained Dream Health Chain awards on BSC.

Web3 Daily Exploits — 04 Sep 2026: Notional $1.7M integer overflow drain

Notional Finance lost ~$1.7M on Ethereum via an unsafe uint128 downcast in free-collateral checks. Attacker minted extreme fCash pairs and drained escrow before mixing via Tornado Cash.

Web3 Daily Exploits — 03 Sep 2026: Quiet window with governance alert and small drain

No major new exploits confirmed in the last 24 hours. Smaller alerts include a Yam Finance governance takeover attempt and a ~6 ETH GebProxyActions drain on Ethereum.

See all