Back to Blog

Monthly Security Review: October 2024

November 1, 2024
2 min read

Security at a Glance 👀

Radiant: $58M

On October 16th, Radiant Capital suffered a security breach on Arbitrum and BSC, resulting in losses exceeding $50M. While the complete technical details of the exploit remain undisclosed, the protocol team confirmed the compromise of several developer wallets as the attack vector.

Read Radiant’s post-mortem report for more details

Unknown: $1.4M

On October 24th, an unknown Compound-fork protocol was exploited on Base, resulting in a loss of approximately $1.4m. While the affected contracts were unverified at the time of the incident, our analysis indicates that this attack was probably due to vulnerable price dependency on Uniswap spot price.

View the complete attack transaction list via Phalcon's Security Incidents

EGA: $554K

On October 5th, an unverified contract was exploited on BSC, causing a loss of $554k. The root cause was the lack of slippage protection in the function that buys EGA tokens from Pancake pairs, susceptible to price manipulation attacks.

Track the attack details using Phalcon Explorer

P719: $315K

On October 11th, P719 token was exploited on BSC, resulting in a loss of $315k. While the compromised contract was unverified, we suspect the root cause was a flawed token burn mechanism within the P719 trading functionality.

Get Started with Phalcon Security

Detect every threat, alert what matters, and block attacks.

Try now for free

BlockSec at Better Web3 Forum 2024 🔥

Watch the speech by BlockSec co-founder Yajin Zhou at the Better Web3 Forum 2024 to learn about the latest security trends, lessons from past incidents, why auditing alone is insufficient, and what project parties can do to ensure protocol security.

Sign up for the latest updates
~$9.4M Lost: Injective, Aquifer Exploits | BlockSec Weekly
Security Insights

~$9.4M Lost: Injective, Aquifer Exploits | BlockSec Weekly

During the past week (2026/08/31 - 2026/09/06), four security incidents caused approximately $9.4M in losses across Injective, Solana, Ethereum, and Flow EVM. The largest was the Injective exploit, where an insurance fund identifier collided with a binary options market identifier and the settlement path never compared their denominations, draining about $4.8M; Aquifer on Solana lost about $2.47M because its swap path invoked an unvalidated caller-supplied Token Program, and Notional Finance V1 on Ethereum lost about $1.73M to an unchecked `uint128` cast that valued a debt at zero. Ankr FLOW on Flow EVM closed out the week with about $410K drained through a staking entry point that skipped its pause guard and minted against a stale ratio.

From Incidents to Regulation: Why Crypto Institutions Need Blockchain Penetration Testing
Security Services

From Incidents to Regulation: Why Crypto Institutions Need Blockchain Penetration Testing

Exchanges, payment firms, custodians, and wallet providers now lose the most money beyond the smart contract—in signing, custody, keys, people, and supply chains. Code-level audit and transaction-level monitoring each leave a gap, and traditional penetration tests may miss crypto's signing and fund semantics. This article opens our blockchain penetration testing series with the two legs of the case for institutions in scope: where the risk actually comes from, and how NYDFS, DORA, VARA, SFC, and MAS treat adversarial testing across five jurisdictions.

What Is Blockchain Penetration Testing? Definitions and Boundaries
Security Services

What Is Blockchain Penetration Testing? Definitions and Boundaries

No widely accepted definition of blockchain penetration testing exists, and many proposed ones tangle it with audit, scanning, and bug bounty. This article sets out a working definition—an adversarial, hands-on assessment of a running system, under agreed scope and rules of engagement, that validates exploitable paths and control chains—and what web3 adds: a money-handling threat model whose defining composition gap is the off-chain-to-on-chain handoff. It then maps the five testable capabilities of that chain and routes nearby objectives to code audit, wallet security audit, web3 security testing, scanning, and bug bounty.