Musesec
4 Posts
Musesec
Web3 一体化安全服务 | 攻防 · 建设 · 运营 · 兜底｜守护交易所、DeFi 协议与 Web3 项目方｜DM 预约免费安全诊断
Open Trade
1.1 Years
0 Following
0 Followers
0 Liked
Posts
Portfolio
The exchange wasn’t hacked, but your coins are just gone.
Gate users lost $1.7 million. Face, SMS, email, and Google Authenticator were all verified successfully, yet the platform says there’s no vulnerability. The attacker doesn’t need to break into the platform—he only needs to prove, “He is you.”
For large assets, keep them in a cold wallet.
#Web3安全 #Exchange security
Gate users lost $1.7 million. Face, SMS, email, and Google Authenticator were all verified successfully, yet the platform says there’s no vulnerability. The attacker doesn’t need to break into the platform—he only needs to prove, “He is you.”
For large assets, keep them in a cold wallet.
#Web3安全 #Exchange security
$23.76 million, in 15 minutes using a single key to completely empty it out.
The Oracle signing key of Ostium was leaked. The attacker submitted forged prices with legitimate signatures. Ten transactions cycled opening and closing positions, and the treasury was emptied. It’s not a contract vulnerability—everything passed verification; the trust source itself was compromised.
#Web3安全 #Ostium #DEFİ #Arbitrum
The Oracle signing key of Ostium was leaked. The attacker submitted forged prices with legitimate signatures. Ten transactions cycled opening and closing positions, and the treasury was emptied. It’s not a contract vulnerability—everything passed verification; the trust source itself was compromised.
#Web3安全 #Ostium #DEFİ #Arbitrum
$292 million, and that one transaction is gone.
North Korea’s Lazarus changed two of Kelp DAO’s validator nodes. It DDoS’d the rest, so the system could only trust the controlled “insider” — forged messages went straight through, and 116,500 rsETH was unlocked and transferred out.
Not a code vulnerability, not a key leak. The issue came from a “convenience” configuration choice: 1/1 DVN single-node validation. LayerZero suggested switching to multi-node, but nobody listened.
#Web3安全 #LayerZero #跨链桥安全 #Lazarus #DeFi security
North Korea’s Lazarus changed two of Kelp DAO’s validator nodes. It DDoS’d the rest, so the system could only trust the controlled “insider” — forged messages went straight through, and 116,500 rsETH was unlocked and transferred out.
Not a code vulnerability, not a key leak. The issue came from a “convenience” configuration choice: 1/1 DVN single-node validation. LayerZero suggested switching to multi-node, but nobody listened.
#Web3安全 #LayerZero #跨链桥安全 #Lazarus #DeFi security
Your core developer gave notice and resigned.
He has all contract code, deployment privileges, multi-sig keys, and server root access.
Three months later, an identical competing product appears on-chain.
How did the code get transferred? Can you prevent it?
👇 4 images that explain the code theft prevention in a resignation scenario—after you swipe through, you’ll want to immediately check your company’s access permissions.
DM me for a free resignation scenario security assessment.
#Web3安全 #区块链安全 #智能合约 #网络安全 #digital-asset security
He has all contract code, deployment privileges, multi-sig keys, and server root access.
Three months later, an identical competing product appears on-chain.
How did the code get transferred? Can you prevent it?
👇 4 images that explain the code theft prevention in a resignation scenario—after you swipe through, you’ll want to immediately check your company’s access permissions.
DM me for a free resignation scenario security assessment.
#Web3安全 #区块链安全 #智能合约 #网络安全 #digital-asset security
Log in to explore more content