非法资金流动案例研究：55M 网络钓鱼

非法资金流动案例研究：55M 网络钓鱼

案件背景

2024 年 8 月 20 日，一笔钓鱼交易牟利超过 5400 万稳定代币 DAI。被引流的地址是一个由 Gemini 资助的 vault ，相关的"Maker Vault Owner "地址是 0xf2b8。 网络钓鱼者诱使受害者（金库的原所有者）签署交易，将金库所有者更改为网络钓鱼者控制的地址，然后执行交易，将金库的资金抽走。

资金流分析

2024 年 8 月 20 日，受害者保险库的原所有者受骗签署了一份交易，将保险库所有者变更为钓鱼者控制的地址。大约五小时后，钓鱼者又发送了一笔交易，进一步将所有者更改为新的地址。在新地址完全控制金库 20 分钟后，它签署了一份交易，从金库中抽走了 5,500 万 DAI。

然后，在两个小时内，所有非法获得的 DAI 代币都被转移到了由钓鱼者控制的下游地址，而最初的地址则没有留下任何东西，金库的资金被抽干。共有六个下游地址直接连接到地址 0x5D4b（即与初始地址相隔一跳）。大部分 DAI 代币（4400 万个）直接转移到下游地址，1000 万个代币被交换为原生代币（3880 个）ETH，然后转移到地址 0x8cc5。交换使用的 DEX 是CoW 协议：GPv2Settlement。交换交易：0x7c63.

从原始地址 0x5D4b 到 1 跳下游地址的虹吸 DAI 资金流图。

将非法资金转移到 1 跳下游地址后，攻击者开始进一步将资金分批转移到更深的地址。在转移过程中，钓鱼者逐渐将下游地址持有的 DAI 换成 ETH。在距离初始地址 4 跳的下游地址，所有被盗 DAI 都已被换成了 ETH。这些以 ETH 形式存在的非法资产随后流入集中式交易所（eXch、KuCoin、ChangeNOW）和跨链桥接器（THORChain、Hop Protocol）。(点击名称查看这些套现地址。）向 eXch 存入非法所得的交易实例：0x2e42, 0xa982, 0x1e1e, 0xb7a9.Examples of transactions moving illicit gains to THORChain: 0x5c06, 0xf824, 0x391e.

部分资金从第 2 层地址（距离初始地址 2 跳）流向第 5 层地址：

在非法所得向深下游地址的转移中，最长的转移路径达到 12 跳，约 8 万美元被转移到交易所KuCoin 17。如下资金流图所示，在 2024 年 8 月 21 日至 8 月 22 日期间，攻击者通过 12 跳的路径向中心化交易所逐步转移了 38 个 ETH。

为了避免大额转账引起过多关注，犯罪者倾向于将大额资金拆分到多个地址，并利用小额转账将资产转移到更深的地址。将 165 万 DAI 拆分成 36 小块，由 1 跳地址 0x860c 处理的示例：

一些相关地址和交易

| 地址 交易 非法资金流动 | :----------------------------------------:| :----------------------------------------------------------:| :----------------------:| | 0x860cf33bdc076f42edbc66c6fec30aa9ee99f073 | 0xa11e, 0x9ef1 | 1,650,000 DAI | | 0xdd6397104d57533e507bd571ac88c4b24852bce9 | 0x7af2, 0x1d45| 36,733,858 dai | 0x8cc568, 0x1d45 | 0x8cc568f3565a7ed44b3b0af8765a7ef67b8bc2dc | 0x7e10, 0x5d08| 3879 eth + 1,825,000 dai | 3879 eth + 1,825,000 dai | 0xca6061c6e5a7c3657297f9cc45ce110dc4d14470 | 0xee0d| 875 ETH | 0x77b9f7e33e42b1f64b915bb27e9a9bca199da83e | 0xf97a, 0xbc5c | 2164 ETH |

资金流概览：

Explore details in MetaSleuth: https://metasleuth.io/result/eth/0x5d4b2a02c59197eb2cae95a6df9fe27af60459d4?source=c81289c1-2bd9-49af-a397-e4cc71990595.

Sign up for the latest updates
Weekly Web3 Security Incident Roundup | Feb 9 – Feb 15, 2026

Weekly Web3 Security Incident Roundup | Feb 9 – Feb 15, 2026

During the week of February 9 to February 15, 2026, three blockchain security incidents were reported with total losses of ~$657K. All incidents occurred on the BNB Smart Chain and involved flawed business logic in DeFi token contracts. The primary causes included an unchecked balance withdrawal from an intermediary contract that allowed donation-based inflation of a liquidity addition targeted by a sandwich attack, a post-swap deflationary clawback that returned sold tokens to the caller while draining pool reserves to create a repeatable price-manipulation primitive, and a token transfer override that burned tokens directly from a Uniswap V2 pair's balance and force-synced reserves within the same transaction to artificially inflate the token price.

Top 10 "Awesome" Security Incidents in 2025

Top 10 "Awesome" Security Incidents in 2025

To help the community learn from what happened, BlockSec selected ten incidents that stood out most this year. These cases were chosen not only for the scale of loss, but also for the distinct techniques involved, the unexpected twists in execution, and the new or underexplored attack surfaces they revealed.

#10 Panoptic Incident: XOR Linearity Breaks the Position Fingerprint Scheme

#10 Panoptic Incident: XOR Linearity Breaks the Position Fingerprint Scheme

On August 29, 2025, Panoptic disclosed a Cantina bounty finding and confirmed that, with support from Cantina and Seal911, it executed a rescue operation on August 25 to secure roughly $400K in funds. The issue stemmed from a flaw in Panoptic’s position fingerprint calculation algorithm, which could have enabled incorrect position identification and downstream fund risk.