Onchain security

crypto lendin

2026-10-08 13:30:00

Crypto lending rebounds 55%, but protocol links and AI-era exploits keep risks in focus

Crypto lending has rebounded sharply since July, with total value locked climbing more than 55% to about $56 billion, according to figures cited in Cointelegraph Magazine. The recovery follows a weak second quarter, when Galaxy data showed $11.33 billion left the sector, partly after the April Kelp DAO incident shook confidence in lending markets and left Aave users temporarily unable to access ETH tied to the event. The episode exposed a broader problem for DeFi lenders: even if a protocol’s own smart contracts are not breached, risks can still arrive through bridges, wrapped assets, verifier networks, oracles, governance systems, and other external dependencies. After the Kelp DAO cross-chain route was exploited, 116,500 unbacked rsETH worth roughly $290 million at the time was created, and much of it was used as collateral on Aave. Aave later froze its rsETH and wrsETH markets, while deposits fell by about $15 billion in the following days. Executives from Aave, Spark, Ledn, Maple, and SALT Lending said risk management now has to extend beyond code audits to include collateral quality, operational security, liquidity controls, key management, and response procedures. They also said AI can help with testing and code review, but current tools still produce a high number of false positives, leaving human judgment central to security work.

00

Vitalik Buter

2026-10-08 00:30:22

Vitalik Buterin says AI could weaken cryptography within two years, with ECDSA also at risk

Ethereum co-founder Vitalik Buterin said advances in AI-driven mathematical research could create new security pressure for existing cryptographic systems, with lattice-based cryptography and ECDSA both potentially facing threats sooner than expected. In a post on X, Buterin pointed to lattice-based schemes such as ML-DSA and fully homomorphic encryption, or FHE, as areas that may see their practical security weakened if AI progress in mathematics accelerates over the next two years. He added that Ethereum’s Lean roadmap has been shifting over the past year toward pure hash-based cryptographic approaches, while avoiding lattice-based signatures and related zero-knowledge proof structures. Buterin said protocols should prefer hash-based cryptography where feasible and use more conservative security parameters for lattice-based systems. He also said privacy protocols should avoid storing encrypted information directly onchain when possible, and multisig wallets should favor offchain signature confirmation. For users, he suggested keeping funds in addresses that have not yet sent transactions when operationally convenient, though he did not recommend an immediate large-scale migration of assets. He also warned that migration itself carries risk, saying losses from his own migration mistakes exceeded those from past hacks.

20

Ethereum

2026-10-06 02:37:47

Vitalik Buterin says AI could become a new interface for onchain activity, while creating fresh security risks

Ethereum co-founder Vitalik Buterin said at the OKX Now 2026 summit in Singapore that AI is showing an ability to break out of sandboxes, attack websites, and find software bugs, while also helping the Ethereum protocol identify vulnerabilities, implement complex cryptography, and carry out formal verification. He said stronger security guarantees will become both possible and necessary as AI keeps uncovering exploitable weaknesses in systems. Buterin also shared a recent example from his own workflow: about a month ago, he updated ENS data for the first time without using a user interface, asking a local AI agent to write the script and complete the task in roughly five minutes. In his view, having AI directly execute complex onchain actions will gradually become normal. He added that this shift could reduce some risks tied to web interfaces, but it will also raise new questions around AI safety, prompt injection resistance, and whether AI can correctly understand onchain operations.

60

Blockaid

2026-10-04 09:34:54

Blockaid says unnamed vault on Base is under attack, with about $2.02 million drained

Blockaid said it detected an active exploit involving an unnamed vault on Base. According to the security firm, a new contract was added to the vault’s whitelist, after which the attacker borrowed aBaswstETH from the vault and sent the resulting aTokens to that contract. The reported loss has reached about $2.02 million so far, across roughly four transactions. Blockaid also said the attack was still ongoing at the time of its post. No further details on the identity of the vault were disclosed in the source material.

140

TRM Labs

2026-09-18 17:00:08

Fake AI bot tutorials led 224 victims to deploy and fund their own drainers, TRM says

A scam built around fake YouTube tutorials persuaded 224 people to deploy and fund malicious smart contracts themselves, according to a Sept. 14 analysis from TRM Labs. The blockchain intelligence firm said the operation drained 274.60 ETH between Feb. 12 and Aug. 11 through 234 victim-deployed contracts that routed funds to six collection addresses controlled by the operators. At the time of the transfers, the stolen ETH was worth about $517,205, and the median loss was 1 ETH. TRM said the scheme stood apart from standard drainer campaigns because it did not depend on malicious token approvals or spoofed websites. Victims selected a tutorial, copied code, deployed a contract, and funded it from their own wallets, making the activity look self-initiated to wallet security tools. In the version TRM reviewed, a fake compiler site replaced the code pasted by the user with a different contract fetched from an operator-controlled server. The substituted contract had no arbitrage logic and no AI capability. Instead, it accepted deposits and sent balances above 0.05 ETH to the operators when users clicked Start or Withdraw. TRM also said one site tried to trigger a second payment with a fabricated error message, while the nine identified videos were still online in September with 310,474 combined views.

440

Ethereum

2026-09-15 16:03:32

MEV Bot Yoink Front-Runs $7.81 Million rsETH Exploit Targeting Safe Wallet on Ethereum

An MEV bot known as Yoink front-ran a transaction tied to an rsETH exploit targeting a Safe wallet on Ethereum, in an incident PeckShield valued at roughly $7.81 million. Onchain data shows the Yoink transaction received 2,900 rsETH, sent 2,882.37 rsETH to the address 0xC70f00CD7E461686b04B0E912E309becA8b80ea0, and routed 17.63 rsETH to Uniswap v4’s Pool Manager. The pool then sent 18.95 ETH to the Yoink contract, which forwarded 18.93 ETH to the block builder. Both the Yoink transaction and the original attack transaction were included in Ethereum block 25980525 at 12:38 a.m. ET. Yoink landed in position zero, while the original attack reverted. Security researchers said that ordering matches a front-running pattern. BlockSec linked the exploit to a flawed authorization check in an executor contract tied to an enabled Safe module, while Blockaid said the attacker used a public keeper multicall to direct a custom Uniswap v4 liquidity module into an attacker-created hooked pool, where aEthrsETH was unwrapped into rsETH.

930

Uniswap

2026-09-15 04:03:04

0x says Uniswap v4 Hooks are becoming a new attack surface, with only 19.4% of 84,163 samples rated safe

0x said Uniswap v4’s open Hooks system is being exploited by malicious pools that show attractive quotes and then settle trades at worse terms. In its analysis of 84,163 Hooks across six chains, the firm said only 19.4% were classified as safe, while 54.2% were labeled malicious and another 26.4% were considered likely malicious. According to 0x, some trades routed through these pools ended up delivering as much as 50% less to users than the quoted amount. The post also listed two onchain examples, one on Base and one on BNB Chain, with detailed figures on transaction counts, fee incidence, fee ranges, and total fees collected. 0x said the issue goes beyond a single product feature and raises a broader question for onchain trading: whether displayed “best quotes” can still be trusted without verifying how the route behaves at settlement. The firm added that it has already introduced detection systems and strict due diligence measures to keep such pools out of its routing results.

830

Blockaid

2026-08-27 10:13:04

Blockaid flags suspicious activity on Moonwell on Base after cbBTC is borrowed from mCBTC market

Blockaid said its exploit detection system has identified suspicious activity involving Moonwell on Base. According to the monitoring alert, the attacker manipulated the price of MAMO collateral and then borrowed cbBTC from the mCBTC market. The impact observed so far is the transfer of 50.6 cbBTC, which Blockaid said is worth more than $4 million. The alert did not disclose additional details beyond the monitored activity and the amount moved. ChainCatcher reported the notice as a market update.

920