Back to Blog

Phalcon | 2023年Web3安全概览

January 15, 2024
4 min read

2023年:

Web3领域发生了一起重大的黑客攻击事件,Euler Finance遭到入侵,导致近2亿美元的资产损失——这是当年记录到的最大金融损失。

最常见的攻击向量源于业务逻辑漏洞,共发生了15起此类事件,每起事件的损失都超过8万美元,其中包括对Euler Finance和Platypus的重大黑客攻击。

精度损失(Precision loss)成为一种新兴的被利用漏洞类型,KyberSwap事件由于在刻度计算过程中的精度损失,导致约4600万美元的损失。

随着Web3生态系统的持续快速扩张,巨额利润的诱惑导致黑客攻击事件增加。为了应对这一情况,Phalcon推出了一款“安全事件”仪表板,允许用户系统地跟踪最新的安全事件。

您可以点击此处访问仪表板,或访问我们网站的首页,然后选择“探索交易”以找到该仪表板。

深入了解2023年的黑客攻击及其利用方式

您可能在想:Mixin Network事件不是2023年最大的黑客攻击吗?

确实,该事件影响重大,但我们的列表侧重于由漏洞利用造成的黑客攻击。由于拉地毯(rug pulls)、私钥管理不善和其他因素造成的损失未包含在我们的统计数据中。

在Phalcon的“安全事件”仪表板中,我们汇总了2023年近70起由漏洞利用造成的黑客攻击事件,每起事件的损失都超过10万美元。

以Exactly Protocol事件为例:

您可以了解被盗资产、攻击发生的区块链以及攻击发生时间等基本信息。

我们还显示了每起事件被利用的漏洞类型,并提供点击链接的选项以进行深入的根本原因分析。这些分析由我们敬业的安全专家提供,他们始终在场,一旦发生安全事件,就会及时为社区提供关键见解。

此外,本部分还包括由我们的合作伙伴DeFiHackLabs编译的PoC(概念验证)代码。

您可以使用Phalcon Fork调试安全事件的PoC(概念验证)代码,并与社区分享PoC代码和交易。

点击协议名称旁边的➕展开以查看每笔具体的攻击交易。 简单点击交易哈希,您就可以通过Phalcon Explorer检查交易的资金流、余额变化和调用流程。

信息 ➔ 洞察

📌 想了解与特定协议相关的攻击事件?

👉 在搜索框中输入**[协议名称]**即可立即获得结果。

📌 对2023年最关键的攻击事件感到好奇?

👉 选择**[损失 - 降序]**可快速识别损失最重大的安全事件。

📌 对2023年攻击事件的趋势感兴趣?

👉 选择**[日期 - 升序]**可跟踪全年中攻击频率和方法的演变。

📌 寻找由特定类型漏洞引起的攻击事件?

👉 使用过滤器选择**[漏洞类型]**可快速定位相关事件。

📌 如果您想比较和分析多个攻击事件

👉 点击⭐️ 将事件添加到书签,以便日后轻松参考。

立即开始探索

Phalcon的“安全事件”仪表板不仅为普通用户提供Web3安全信息,还为安全研究人员和开发人员提供了一个学习和审查的平台。通过分析实际的攻击技术和理解黑客如何利用漏洞,他们可以更好地识别和加固其系统中的潜在薄弱环节。

我们将保持数据更新,确保您能够获取最新的黑客攻击事件信息和见解。

立即探索Phalcon的“安全事件”仪表板,并与我们一起构建一个更安全的Web3世界。

Sign up for the latest updates
The Decentralization Dilemma: Cascading Risk and Emergency Power in the KelpDAO Crisis
Security Insights

The Decentralization Dilemma: Cascading Risk and Emergency Power in the KelpDAO Crisis

This BlockSec deep-dive analyzes the KelpDAO $290M rsETH cross-chain bridge exploit (April 18, 2026), attributed to the Lazarus Group, tracing a causal chain across three layers: how a single-point DVN dependency enabled the attack, how DeFi composability cascaded the damage through Aave V3 lending markets to freeze WETH liquidity exceeding $6.7B across Ethereum, Arbitrum, Base, Mantle, and Linea, and how the crisis forced decentralized governance to exercise centralized emergency powers. The article examines three parameters that shaped the cascade's severity (LTV, pool depth, and cross-chain deployment count) and provides an exclusive technical breakdown of Arbitrum Security Council's forced state transition, an atomic contract upgrade that moved 30,766 ETH without the holder's signature.

Weekly Web3 Security Incident Roundup | Apr 13 – Apr 19, 2026
Security Insights

Weekly Web3 Security Incident Roundup | Apr 13 – Apr 19, 2026

This BlockSec weekly security report covers four attack incidents detected between April 13 and April 19, 2026, across multiple chains such as Ethereum, Unichain, Arbitrum, and NEAR, with total estimated losses of approximately $310M. The highlighted incident is the $290M KelpDAO rsETH bridge exploit, where an attacker poisoned the RPC infrastructure of the sole LayerZero DVN to fabricate a cross-chain message, triggering a cascading WETH freeze across five chains and an Arbitrum Security Council forced state transition that raises questions about the actual trust boundaries of decentralized systems. Other incidents include a $242K MMR proof forgery on Hyperbridge, a $1.5M signed integer abuse on Dango, and an $18.4M circular swap path exploit on Rhea Finance's Burrowland protocol.

Weekly Web3 Security Incident Roundup | Apr 6 – Apr 12, 2026
Security Insights

Weekly Web3 Security Incident Roundup | Apr 6 – Apr 12, 2026

This BlockSec weekly security report covers four DeFi attack incidents detected between April 6 and April 12, 2026, across Linea, BNB Chain, Arbitrum, Optimism, Avalanche, and Base, with total estimated losses of approximately $928.6K. Notable incidents include a $517K approval-related exploit where a user mistakenly approved a permissionless SquidMulticall contract enabling arbitrary external calls, a $193K business logic flaw in the HB token's reward-settlement logic that allowed direct AMM reserve manipulation, a $165.6K exploit in Denaria's perpetual DEX caused by a rounding asymmetry compounded with an unsafe cast, and a $53K access control issue in XBITVault caused by an initialization-dependent check that failed open. The report provides detailed vulnerability analysis and attack transaction breakdowns for each incident.