UNCX2026-10-15 11:00:13UNCX offers 10% white-hat bounty if Vesting V2 attacker returns funds within 48 hoursDecentralized service provider UNCX has sent an on-chain message to the attacker behind its Vesting V2 incident, offering to treat the exploit as a white-hat case if the assets are returned, according to a disclosure highlighted by Defimon Alerts. The message says the attacker has 48 hours to send back 18.207 ETH on Ethereum and 510,727 USDT on BNB Chain. UNCX said both transfers should be made to its multisig addresses. The development follows an earlier update referenced by Foresight News, which said UNCX Lockers had disclosed that its Vesting V2 contract was attacked earlier in the day. That incident involved 10 tokens. No additional details beyond the on-chain message and the earlier disclosure were provided in the source material. The bounty terms, as stated in the message, would grant the attacker 10% of the recovered assets if the funds are returned within the specified window.140
Duelbits2026-10-08 10:48:46Duelbits offers on-chain bounty settlement over stolen fundsDuelbits has posted an on-chain settlement proposal tied to its stolen funds case, according to monitoring by Defimon Alerts. The message said the platform had traced the movement of the stolen assets and identified suspected parties along with related wallets, exchanges, and accounts. Under the proposal, the counterparty would be allowed to keep an agreed portion of the funds and return the rest. The message added that if a formal agreement is signed and repayment is completed, Duelbits would not pursue criminal charges or take further legal action. Foresight News had previously reported that on Sept. 24, Duelbits lost about $7 million after a private key leak compromised its hot wallet. The latest development points to a negotiated recovery route rather than an immediate escalation, though the terms referenced in the on-chain message were not disclosed in detail.300
79AU2026-10-08 07:49:0879th Vault hot wallet on BNB Chain may have lost about $12.5 million in suspected private key leakDefimon Alerts said 79th Vault on BNB Chain may have suffered a loss of about $12.5 million after what appears to be a private key compromise involving its operational hot wallet. The monitoring account said the wallet was typically used only for small transfers into the reward pool, but it recently moved 2.01 million 79AU out of the trading pair to an external address in seven transactions. Those transfers were listed as 10,000, 100,000, 100,000, 300,000, 500,000, 500,000 and 500,000 79AU. The attacker then swapped the tokens back into the same trading pair through about 95 transactions. As that happened, the pool’s USDT reserves fell from $15.2 million to $3.9 million. Defimon Alerts said the attacker cashed out 16,249 BNB, worth about $12.5 million by its estimate. The monitoring update also said the operational key sent another 3.79 BNB to the same external address. Separately, another 500,000 79AU was transferred to other addresses. The information was cited from a post by Defimon Alerts.330
ChainCatcher2026-10-08 08:12:57Defimon Alerts flags possible $12.5 million loss at 79thVault on BNB ChainDefimon Alerts said 79thVault on BNB Chain may have lost about $12.5 million in an incident tied to a possible private key leak. The monitoring account said the project team’s operational hot wallet, which usually handled only small transfers to a rewards pool, recently sent 2.01 million 79AU out of a trading pair to an external address in seven transactions. The transfers were split into 10,000, 100,000, 100,000, 300,000, 500,000, 500,000 and 500,000 tokens. According to the alert, the attacker then sold the tokens back into the same trading pair through roughly 95 swap transactions. That activity reduced the pool’s USDT reserves from $15.2 million to $3.9 million. The attacker also cashed out 16,249 BNB, worth about $12.5 million based on the figures cited in the alert. Defimon Alerts added that the operational key later sent another 3.79 BNB to the same external address, while a separate transfer moved 500,000 79AU to other addresses. ChainCatcher reported the alert in a 7x24 news update.300
MakerDAO2026-10-06 09:04:50Defimon Alerts says new Tornado Cash-funded address withdrew 200 WETH from dormant Maker liquidation botDefimon Alerts said a newly funded address linked to Tornado Cash withdrew 200 WETH from a dormant MakerDAO ETH-A liquidation bot proxy on Oct. 6, with losses estimated at about $538,000. The proxy had previously won four ETH-A liquidation auctions in 2020, auctions No. 1457 through 1460, with 50 WETH tied to each one, but never called deal(), leaving the collateral sitting in Flipper. According to the monitoring account, the issue came from an unprotected withdrawal function in the implementation contract rather than from MakerDAO’s core system. Because the extraction function was not protected by ds-auth, any caller could trigger the sequence: call deal() on the old auctions, move the collateral to the keeper through Vat.flux, then use GemJoin.exit to send 200 WETH to an address chosen by the caller and unwrap it into ETH. The report said MakerDAO core contracts behaved as designed. The flaw was in the third-party liquidation bot’s exit function, which lacked access control.290
Ampleforth2026-09-13 04:28:11Defimon flags suspected malicious Ampleforth governance proposal tied to 2.5 million USDCDefimon Alerts said it detected what appears to be a malicious governance proposal on Ampleforth, centered on roughly 2.5 million USDC from the protocol treasury. The proposal, labeled as a grant for 「SPOT completed work」, would send funds to the proposer’s address. The amount is close to the full 2.538 million USDC held by the timelock contract. According to the disclosure cited by Defimon, the proposer said they wrote the proposal and would vote for it through a delegate holding only 87,238 FORTH, or about 0.57% of supply. That would narrowly clear the 75,000-vote threshold. Based on a FORTH price of $0.22, Defimon estimated the attack cost at about $132,000. The alert focuses on the proposal mechanics, the treasury exposure, and the relatively low token cost needed to reach the required voting threshold.950
Swan Treasury2026-07-31 06:29:18Swan Treasury loses about $625,000 on BNB Chain after private key leakSwan Treasury, a decentralized asset management protocol on BNB Chain, lost about $625,000 after a private key leak, according to monitoring by Defimon Alerts. The tracker said the attacker forged a valid signature to an address they controlled and bought STY at a 100x discount. The trade was carried out through a PancakeSwap flash loan, using roughly 19,700 USDT to acquire about 687,000 STY. The attacker then forged claim() and transfer signatures on a sibling contract and dumped the tokens into the STY/USDT pool, walking away with about 625,000 USDT in profit. Defimon Alerts said every ecrecover in the transaction resolved to a specific hardcoded signer, which points to a compromised key rather than a flaw in the signing logic. The incident was reported in a post linked by Foresight.1960
