Someone found a bug in Initia's Move VM on Friday and gave themselves balances nothing ever minted. Then they bridged them to Ethereum. The lockboxes paid out $2.7M in real AUSD, ETH and USDC, most of it within 7 minutes. The chain halted 42 minutes after the mint.

Someone bought a DAO majority with a flash loan Saturday and had the treasury sell 400,000 tokens for $35. X100's Senate had three seats, ranked by what was staked right then. The three day vote window was only a deadline. A majority could execute at once. About $4.85M gone.

Someone printed about 39.8M ARRR on Pirate Chain last week. Supply up about 20%. A refactor last year made blocks skip the burn proof on coin imports. Send the same tx normally and it's rejected. Put it inside a block and it mints. Then it all went into the shielded pool.

BiFi's USDT market on Ethereum sat untouched for 36 days. When it woke up, the code charged all 36 days of interest at whatever rate the market showed in that moment. Inside one transaction you get to set that rate yourself. $165K out, in a single block.

On Friday a rescue bot paid the Cetus hacker about $392K. Eight Sui Bridge withdrawals from the May 2025 exploit sat signed and unclaimed for 17 months. The bot claimed them all, paid the gas, then asked the hacker for a tip. The 109k USDT still isn't frozen.

UNCX's vesting contract lost ~$1.49M on four chains. Claiming tokens took your shares off the pool total. Cancelling could take the same shares off again. Get the order right and your next claim gets paid from other projects' vested tokens. Copycats did the rest.

Someone took about $1.28M from Papertrade, a new 1000x perps venue on Hyperliquid, within eight hours of launch. It prices every trade at Hyperliquid's live mid. So they bought ~6,000 ETH to push it $3, closed, flipped short, sold it back. 296 wins out of 305.

A drain tied to Ledgers sold by one reseller in Southeast Asia took about $102M on Friday. Ledger now says a board hidden inside read the 24 words off the screen at setup and sent them out over LTE. The genuine check still passes. It only checks the secure chip.

An old MakerDAO auction bot won 200 ETH for a zero bid on Black Thursday in March 2020 and never collected it. One function on the bot had no auth check and handed the caller its whole Maker account. Six and a half years later, someone noticed and took all of it.

A Fomo user lost about $48K to a fake "human check". Find the four-legged animal, drag it to the bookmarks bar, click it 3 times. The bookmark was JavaScript. Clicked on the logged-in Fomo tab, it grabbed the login tokens. No wallet connect, no signature. No 2FA either.