Exploit post-mortems, DeFi hacks, on-chain forensics, and protocol security.
Crypto Security is where we cover the exploits, hacks, and on-chain forensics behind the money. We publish original post-mortems of DeFi and bridge exploits, trace stolen funds across chains, and break down the vulnerability classes — reentrancy, reserve manipulation, deprecated contracts, oracle abuse — that keep draining protocols. Every incident is checked against block-explorer data and primary post-mortems before we publish, and we correct the record when the viral number is wrong.
A DOJ-led public-private operation disabled more than 1.4 million Southeast Asian scam accounts and made 63 arrests — yet froze under $4 million in crypto. The viral '$3 billion frozen' figure is wrong, and the real gap between accounts taken down and money recovered is the actual lesson.
The US seized 127,271 bitcoin — about 0.64% of all the bitcoin ever mined — from Cambodia's Prince Group, the largest forfeiture in DOJ history. The coins sat untouched since 2020, yet were fully traced. Now the fight is over where $15 billion goes: a federal reserve, or the scam's victims.
DeFi project DIP Protocol was drained of roughly $111,000 on BNB Chain through a token-transfer bug that let an attacker double-count pool reserves. Here is the class of flaw involved and why it keeps reappearing.
An attacker exploited a settlement-boundary flaw in Aztec Connect's abandoned RollupProcessorV3 contract on June 14, 2026, draining roughly $2.19M in ETH and stablecoins. The privacy bridge was sunset in March 2023 and Aztec Labs holds no keys to pause it. The case is a reminder that "deprecated" is not "safe."