Tessera

web3 is going just great

@web3isgoinggreat.com

tracking only some of the many disasters happening in crypto, defi, NFTs, and other blockchain-based projects since 2021 • created by @molly.wiki web3isgoinggreat.com

841 Posts22142 Follower 1 Folgt

web3 is going just great @web3isgoinggreat.com · 3d ago

Coldcard hardware wallet flaw sees more than 1,367 BTC (~$89 million) drained across thousands of wallets July 31, 2026 https://www.web3isgoinggreat.com/?id=coldcard-hardware-wallet-flaw

Coldcard hardware wallet flaw sees more than 1,367 BTC (~$89 million) drained across thousands of wallets
Thousands of users of a hardware wallet called Coldcard, a physical device developed by the Canadian Coinkite firm to allow bitcoin holders to store their bitcoin on a device that's not connected to the internet, have suffered more than 1,367 BTC (~$89 million) in combined losses after thieves began exploiting a flaw with the wallet firmware's seed phrase generation. A 2021 version of the device firmware, which affects a wide range of Coldcard devices, skipped the device's more secure hardware randomness generator and instead fell back to generating seed phrases with random numbers seeded from the device's serial number and clock registers. The resulting seed phrases are relatively trivially guessed, and hackers have been methodically draining vulnerable wallets as researchers warn that all vulnerable Coldcard devices will be drained soon if their owners do not move assets to secur

Hardware wallets are often used by more security conscious users, or those with more significant sums of money at risk, because the lack of internet connection makes the devices less vulnerable to phishing or malware-based attacks. However, if a wallet seed phrase can be obtained by an attacker, the lack of internet connection is no barrier to theft. Coldcard describes itself as "ultra-secure", and its website is filled with reviews describing the product as "one of the most secure Bitcoin hardware wallets ever built".

web3 is going just great @web3isgoinggreat.com · 2w ago

Wanchain bridge on Cardano exploited for more than $9 million July 20, 2026 https://www.web3isgoinggreat.com/?id=cardano-midnight-bridge-exploit

Wanchain bridge on Cardano exploited for more than $9 million
An attacker exploited the Wanchain bridge, stealing 515 million NIGHT tokens that had been bridged from Cardano to BNB. The NIGHT token belongs to Midnight, a privacy-focused blockchain linked to Cardano. The stolen tokens were priced at $9 million to $10 million at the time of the theft, although the massive outflow of tokens briefly caused the NIGHT token price to drop by about 43%.

web3 is going just great @web3isgoinggreat.com · 2w ago

42DAO's Balance Coin algorithmic stablecoin crashes after $912,000 theft July 21, 2026 https://www.web3isgoinggreat.com/?id=balance-coin-algorithmic-stablecoin-crashes

$42DAO's Balance Coin algorithmic stablecoin crashes after $912,000 theft Balance Coin, a small algorithmic stablecoin built on BNB Chain, lost its dollar peg and crashed to fractions of a cent after an attacker successfully exploited a flaw in its pricing logic. The attacker was able to trick the system into accepting an incorrectly low bitcoin price, which they then used to drain multiple vaults used by the project's lending protocol. The attacker ultimately profited by about $912,000, consisting of funds stolen from 42DAO, the entity that runs the Balance protocol.$

web3 is going just great @web3isgoinggreat.com · 2w ago

Across Protocol exploited for $3.35 million July 17, 2026 https://www.web3isgoinggreat.com/?id=across-protocol-exploit

Across Protocol exploited for $3.35 million
The Solana deployment of the Across bridge was hacked for around $3.35 million. According to Across, the stolen funds belonged to Risk Labs, the foundation supporting the project, rather than users of the bridge.

web3 is going just great @web3isgoinggreat.com · 2w ago

Allbridge exploited for $1.66 million July 19, 2026 https://www.web3isgoinggreat.com/?id=allbridge-exploit

Allbridge exploited for $1.66 million
The Allbridge blockchain bridge was exploited for $1.66 million in a flash loan attack. The attacker took advantage of a flaw in the project's logic that reprices assets against one another, after discovering that the same would happen even when borrowing an asset against collateral denominated in the same token. They were able to manipulate the project's internal pricing logic so that the asset's actual price diverged away from reality, pocketing $1.66 million in proceeds.

web3 is going just great @web3isgoinggreat.com · 3w ago

Ostium loses at least $24 million to oracle exploit July 15, 2026 https://www.web3isgoinggreat.com/?id=ostium-exploit

Ostium loses at least $24 million to oracle exploit
Decentralized perpetual futures exchange Ostium was drained of at least $24 million after an attacker manipulated its oracle system — a system that pulls in off-chain price data. After the attacker apparently gained access to the private key used to sign oracle messages, they were able to submit future-dated oracle reports that tricked the system into thinking trades were profitable.
The attacker siphoned at least $24 million USDC from the protocol, which they quickly swapped into ETH and laundered via Tornado Cash.

web3 is going just great @web3isgoinggreat.com · last mo.

Dutch Knaken crypto platform collapses June 30, 2026 https://www.web3isgoinggreat.com/?id=knaken-crypto-platform-collapses

Dutch Knaken crypto platform collapses
The Dutch cryptocurrency platform Knaken (not to be confused with the American Kraken platform) abruptly went offline in early June, leaving roughly 30,000 customers unable to access their funds. The company was unable to secure a license under the EU's MiCA regulations, which it said forced them to shut down. Though they claim to be winding down the company in an orderly fashion, they have reportedly stopped paying customer withdrawals, and have asked customers to stop filing claims.
Dutch prosecutors have asked courts to declare the platform bankrupt, which would install a court-appointed trustee to oversee the process of extracting assets from the company to return to customers. The country's Fiscal Information and Investigation Service has also opened a criminal investigation into the platform.

web3 is going just great @web3isgoinggreat.com · last mo.

Polymarket customers lose $2.97 million, company blames third-party vendor June 25, 2026 https://www.web3isgoinggreat.com/?id=polymarket-vendor-exploit

Polymarket customers lose $2.97 million, company blames third-party vendor
Polymarket customers have lost around $2.97 million to an attacker who then swapped stolen Polymarket USD (pUSD) to ETH.
Polymarket, a crypto-based prediction markets platform, quickly made an announcement to claim that a third-party vendor had been compromised to allow an attacker to inject a malicious script into the website frontend. Polymarket has said it will refund affected customers.

web3 is going just great @web3isgoinggreat.com · last mo.

Users of the SecondFi Cardano wallet lose $2.4 million in series of hacks June 23, 2026 https://www.web3isgoinggreat.com/?id=secondfi-exploit

Users of the SecondFi Cardano wallet lose $2.4 million in series of hacks
Users of the Cardano wallet SecondFi (formerly Yoroi) have lost a cumulative 16 million ADA (~$2.4 million) across three attacks targeting a vulnerability in the project's wallet generation code.
After the attacks commenced, SecondFi "rescued" another 129 million ADA (~$19.4 million) by moving the assets to a third party entity. They have announced that an external accounting firm will verify the funds and process user claims.

web3 is going just great @web3isgoinggreat.com · last mo.

Highly active MEV bot known as jaredfromsubway.eth drained for $7.7 million June 20, 2026 https://www.web3isgoinggreat.com/?id=jaredfromsubwayeth-exploit

Highly active MEV bot known as jaredfromsubway.eth drained for $7.7 million
On blockchains like Ethereum, a strategy known as "MEV" (short for "maximal extractable value") allows intermediaries to profit from manipulating the structure of blocks added to the chain — often reordering or "sandwiching" transactions in ways that extract profits. Automated software known as MEV bots make a business out of this strategy, and one of the most active is a bot called jaredfromsubway.eth — likely so named after one-time Subway spokesman and convicted sex offender Jared Fogle because of its strategy of "sandwiching" transactions by placing trades on both sides, causing the original trader to pay more.
On June 20, an attacker used a series of contracts to cause the bot to grant token approvals that were later used to drain 4,427 ETH ($7.7 million). Some of the funds were then laundered through Tornado Cash.

web3 is going just great @web3isgoinggreat.com · last mo.

Secret bridge exploited for $4.67 million a week before anyone notices June 10, 2026 https://www.web3isgoinggreat.com/?id=secret-bridge-exploit

Secret bridge exploited for $4.67 million a week before anyone notices
The bridge between the Cosmos-based Secret network and Axelar network was exploited via an infinite mint bug that went unnoticed for a week. An attacker exploited a smart contract in order to mint a large quantity of wrapped Axelar tokens on the Secret network, which they then redeeemed for around $4.67 million.
The exploit, which occurred on June 10, went unnoticed until June 17, when a transaction failed with a message suggesting that more tokens had been bridged out of the Secret network than had been bridged in.
Secret has warned, "If you hold Axelar-bridged saXXX tokens on Secret, please be aware their backing was affected and your funds may be lost."

web3 is going just great @web3isgoinggreat.com · last mo.

Main Street USD (msUSD) loses its dollar peg June 20, 2026 https://www.web3isgoinggreat.com/?id=main-street-usd-msusd-depegs

Main Street USD (msUSD) loses its dollar peg
Main Street USD, also known as msUSD, lost its dollar peg and crashed to around $0.25. At points, the token dipped as low as around $0.06. The asset, issued by Main Street Finance, is supposed to be redeemable 1:1 with Circle's USDC stablecoin. It's used as part of a yield strategy that is marketed as "democratizing the options box spread strategy through a stablecoin". Prior to the depeg, there was about $80 million msUSD in circulation.
On June 20, the verification provider Accountable announced that they had "terminated its service agreement with MainStreet, effective immediately. MainStreet was unable to meet our verification standards." The sudden loss of confidence in the token caused the price to plummet as holders rushed to withdraw funds.
Main Street issued a statement, claiming that "Mainstreet remains fully backed" and that "this is an infrastructure and reporting issue, not a solvency issue." However, they noted that "while our p

web3 is going just great @web3isgoinggreat.com · last mo.

Taiko bridge exploited June 22, 2026 https://www.web3isgoinggreat.com/?id=taiko-bridge-exploit

Taiko bridge exploited
The Taiko bridge, which allows assets to be transferred between the Ethereum mainnet and the Taiko Ethereum layer-2 chain, was exploited for at least $1.7 million before the network was halted, limiting losses. An attacker was able to forge withdrawal requests to appear as though they matched real deposits. Crypto security firm BlockSec said that the attacker may have gained access to a signing key that had been exposed on GitHub.

web3 is going just great @web3isgoinggreat.com · 2mo ago

Thief steals remaining 7,200 unsold The Kiss NFTs in digital museum heist June 2, 2026 https://www.web3isgoinggreat.com/?id=thief-steals-remaining-unsold-the-kiss-nfts

Thief steals remaining 7,200 unsold The Kiss NFTs in digital museum heist
Remember when Austria's otherwise respectable Belvedere Museum sold 10,000 NFTs representing postage-stamp sized sections of Gustav Klimt's The Kiss for like $2,000 a pop? No? Don't worry, I've got you.

Only about a quarter of them ever sold, leaving about 7,200 of them on the digital shelves. That is, until they were stolen (or, as the museum put it, "transferred from the wallet without authorization"). If valued at their sale price the stolen NFTs would be worth €13.32 million (US$15.3 million), though it's hard to argue the thief could've ever sold them for that amount given the museum had failed to do so for several years. The stolen NFTs were soon made even less appealing to prospective buyers when the museum un-linked the image files from the digital assets, and OpenSea blocked them from trading.

web3 is going just great @web3isgoinggreat.com · 2mo ago

Aztec Connect hacked for a second time in less than a week June 18, 2026 https://www.web3isgoinggreat.com/?id=aztec-hack-2

Aztec Connect hacked for a second time in less than a week
Three days after Aztec Labs' deprecated Aztec Connect blockchain bridge was exploited for $2.1 million, the project has been hacked again for the same amount. Aztec Labs confirmed the second exploit, again trying to emphasize that the code was deprecated four years ago.
The hacks are part of a spate of exploits targeting legacy smart contracts belonging to projects including Raydium and DxSale. Although some projects have developed techniques to circumvent the immutable nature of blockchains and allow smart contracts to be upgraded or retired, many legacy contracts cannot be changed or shut down, leaving them vulnerable to attack indefinitely.

web3 is going just great @web3isgoinggreat.com · 2mo ago

Pudgy Penguins shuts down Pudgy Party NFT game after losing millions in less than ten months June 15, 2026 https://www.web3isgoinggreat.com/?id=pudgy-penguins-shuts-down-pudgy-party-nft-game

Although Pudgy Penguins CEO Lucas Netz boasted on Twitter in December about "1M+ downloads today. 10M+ downloads soon." he later admitted interest in the game had quickly died off. In a community call to announce the game's shutdown, Netz acknowledged that within months of the launch, there were only 200–300 active players. The project had lost the company millions of dollars, he confessed.

web3 is going just great @web3isgoinggreat.com · 2mo ago

Humanity Protocol loses $36 million to employee laptop compromise June 9, 2026 https://www.web3isgoinggreat.com/?id=humanity-protocol-theft

Humanity Protocol loses $36 million to employee laptop compromise
Humanity Protocol, a decentralized identity project that uses palm scans to try to prove that users are human, has suffered a $36 million loss after attackers compromised a laptop belonging to an employee. After the laptop was infected with malware, the malicious code gained root access, then stole seven private keys that were reportedly accidentally stored in a backup. Several of the keys were sufficient to satisfy multisignature requirements, which are intended to prevent private key leaks from allowing attackers to gain control over sensitive infrastructure like bridges. With multisignature wallets, keys are supposed to be stored separately across multiple individuals and devices; however, in this case, attackers only needed to compromise one laptop to gain control over multisig-protected contracts.

With the keys, the attacker stole more than 6 million of Humanity's H token, then used other keys to upgrade a bridge and drain 141 million more tokens. With the bridge access, they also minted 300 million new H tokens. The attacker then quickly swapped the ill-gotten tokens for ETH, causing the H price to plummet by 80–90%. Humanity Protocol markets itself as a competitor to Sam Altman's World (formerly Worldcoin), a decentralized identity project that aims to use iris scans to prove that users are unique humans. Humanity raised $20 million in 2025 from Pantera Capital and Jump Crypto.

web3 is going just great @web3isgoinggreat.com · 2mo ago

Raydium users lose $1.34 million after legacy smart contract exploited June 10, 2026 https://www.web3isgoinggreat.com/?id=raydium-legacy-smart-contract-exploit

Raydium users lose $1.34 million after legacy smart contract exploited
An attacker exploited a legacy smart contract that had been used by the Raydium Solana DEX before it was deprecated in 2021. Though the contract was unused, there were still funds in the liquidity pools affected by the vulnerable contract. Using fake LP tokens, the exploiter was able to trick an old smart contract with insufficient validation into allowing them to withdraw assets.
Raydium has said it will compensate users who lost funds in the exploit.

web3 is going just great @web3isgoinggreat.com · 2mo ago

DxSale exploited for $7.3 million May 29, 2026 https://www.web3isgoinggreat.com/?id=dxsale-exploit

DxSale exploited for $7.3 million
DxSale, a project that was popular in 2021 for launching new tokens and creating liquidity pools, suffered a $7.3 million exploit after ownership of a locker contract was transferred to a new address. Nine months later, the contract ownership was repeatedly moved between many new wallets — likely in an attempt to cover tracks — before $7.3 million was taken from old liquidity pools. The stolen assets were then swapped to BNB and routed through bridges and mixers to obscure the trail.

web3 is going just great @web3isgoinggreat.com · 3mo ago

Largest North American bitcoin ATM operator, Bitcoin Depot, files for bankruptcy May 18, 2026 https://www.web3isgoinggreat.com/?id=bitcoin-depot-bankruptcy

Largest North American bitcoin ATM operator, Bitcoin Depot, files for bankruptcy
Bitcoin Depot has filed for Chapter 11 bankruptcy. The company operates a fleet of kiosks at retail locations that allow customers to purchase bitcoin with cash. Bitcoin Depot announced in a press release that its 9,700 kiosks – primarily located at gas stations and convenience stores – had already been taken offline.
The company's bankruptcy filing reports between $10 million and $50 million in both assets and liabilities. In a recent financial disclosure, the company had reported a 49% year-over-year reduction in revenue and a net loss of $9.5 million for the year. The company had also suffered a $3.67 million hack in April.
Bitcoin Depot has blamed a challenging state-level regulatory environment for its bankruptcy, pointing to a series of regulatory restrictions and outright bans on crypto ATMs, which are a major conduit for crypto scams. An FBI report on Internet crime in 2024 showed 11,000 reports of

web3 is going just great @web3isgoinggreat.com · 3mo ago

Verus bridge hacked for $11.6 million May 17, 2026 https://www.web3isgoinggreat.com/?id=verus-bridge-hack

Verus bridge hacked for $11.6 million
An attacker stole $11.6 million in various crypto assets from the Verus–Ethereum bridge, which allows users to use tokens from the Verus network on the Ethereum chain and vice versa. The attacker then swapped the tokens for ETH, limiting the ability for issuers of more centralized tokens to freeze the stolen assets.
Verus halted the entire Verus network after the exploit was detected in hopes of limiting further damage.

web3 is going just great @web3isgoinggreat.com · 3mo ago

THORchain exploited for $10.8 million May 15, 2026 https://www.web3isgoinggreat.com/?id=thorchain-exploit

THORchain exploited for $10.8 million
The THORchain cross-chain liquidity protocol was exploited for around $10.8 million across several blockchains: Bitcoin, Ethereum, BNB Chain, and Base. The protocol paused trading after observing the suspicious transactions. News of the hack caused the protocol's RUNE token to drop in price by more than 10%.

web3 is going just great @web3isgoinggreat.com · 3mo ago

Transit Finance hacked for $1.88 million May 13, 2026 https://www.web3isgoinggreat.com/?id=transit-finance-hack

Transit Finance hacked for $1.88 million
Transit Finance was exploited for $1.88 million after an attacker exploited a "legacy contract" on the TRON blockchain that the project said was deprecated in 2022. "Historical vulnerabilities within it" were exploited, the project explained, allowing the attacker to steal $1.88 million.
Transit was previously exploited in 2022 for $21 million, although around 70% of the stolen assets were later returned.

web3 is going just great @web3isgoinggreat.com · 3mo ago

TAC bridge exploited for $2.8 million May 12, 2026 https://www.web3isgoinggreat.com/?id=tac-bridge-exploit

TAC bridge exploited for $2.8 million
The TAC bridge, which bridges assets from the Ethereum blockchain to the Telegram-linked TON chain, was exploited for $2.8 million. The project paused the bridge and announced they were investigating.
The project has announced they intend to "restor[e] bridge liquidity through a legally structured sale of Foundation's TAC token treasury reserves."

web3 is going just great @web3isgoinggreat.com · 3mo ago

TrustedVolumes suffers $6.7 million exploit May 6, 2026 https://www.web3isgoinggreat.com/?id=trustedvolumes-exploit

TrustedVolumes suffers $6.7 million exploit
TrustedVolumes, a resolver and market maker used by 1inch and other defi platforms, suffered a $6.7 million exploit after an attacker was able to steal funds without proper validation. The thief then swapped the stolen wETH, USDT, wBTC, and USDC through ChangeNow and converted them to ETH to evade freezes.
Blockchain research firm Blockaid has linked the attacker to a similar exploit in March 2025 that saw $5 million drained from 1inch. This time, 1inch has asserted that although they use TrustedVolumes as a resolver, the exploit did not involve any of their systems.

web3 is going just great @web3isgoinggreat.com · 3mo ago

Ekubo exploited for $1.4 million May 5, 2026 https://www.web3isgoinggreat.com/?id=ekubo-exploit

Ekubo exploited for $1.4 million
The Ekubo automated market maker infrastructure project experienced a $1.4 million theft after attackers were able to take advantage of a smart contract that improperly verified permissions. They stole 17 wBTC ($1.4 million), which they swapped for ETH and laundered via Tornado Cash.

web3 is going just great @web3isgoinggreat.com · 3mo ago

Wasabi Protocol exploited for more than $5 million April 30, 2026 https://www.web3isgoinggreat.com/?id=wasabi-protocol-exploit

Wasabi Protocol exploited for more than $5 million
The Wasabi Protocol defi derivatives platform has been exploited for more than $5 million across multiple blockchains. The attack has been attributed by blockchain security firms to a compromised admin key, which allowed the attacker to upgrade contracts to steal assets.

web3 is going just great @web3isgoinggreat.com · 3mo ago

Polish Zondacrypto exchange stops processing withdrawals amid possible insolvency April 25, 2026 https://www.web3isgoinggreat.com/?id=zondacrypto-withdrawal-halt

Polish Zondacrypto exchange stops processing withdrawals amid possible insolvency
The Polish cryptocurrency exchange Zondacrypto faced complaints that withdrawals were not being processed as far back as December 2025, but the crisis seems to have escalated. CEO Przemysław Kral attempted to assuage insolvency fears by pointing to a cryptocurrency wallet containing around 4,500 BTC (~$330 million) as proof of assets, but he also admitted that the keys to the wallet were known only to the exchange's previous CEO and not transferred during the company's 2021 sale. The former CEO has been missing for four years.
Polish authorities have launched investigations into the apparent collapse. Losses have been estimated at 350 million zł (~$96 million).
Poland's Prime Minister Donald Tusk has also recently accused Zondacrypto of sponsoring conservative and right-wing politicians, including Polish President Karol Nawrocki. Nawrocki has repeatedly vetoed legislation aiming to regulate the crypto sec

web3 is going just great @web3isgoinggreat.com · 3mo ago

Volo Protocol exploited for $3.5 million, most recovered April 21, 2026 https://www.web3isgoinggreat.com/?id=volo-protocol-exploited-for-3-5-million-most-recovered

Volo Protocol exploited for $3.5 million, most recovered
The Sui-based Volo Protocol defi yield platform was exploited for around $3.5 million after an attacker targeted three vaults holding wBTC, XAUm (a tokenized gold asset), and the USDC stablecoin.
Volo says they have frozen or recovered all but around $60,000. They have also said they are "prepared to absorb this loss", rather than passing losses along to their users.

web3 is going just great @web3isgoinggreat.com · 4mo ago

Aave faces approximately $200 million in bad debt after Kelp DAO bridge exploit April 19, 2026 https://www.web3isgoinggreat.com/?id=aave-bad-debt

Aave faces approximately $200 million in bad debt after Kelp DAO bridge exploit
The Aave defi lending protocol is grappling with anywhere from $177 million to $236 million in bad debt after the Kelp DAO bridge exploiter used Aave to cash out their stolen rsETH. Rather than selling the tokens, the attacker used the rsETH as collateral to borrow wETH, leaving Aave stuck with the huge quantity of unbacked rsETH. Although Kelp and Aave both froze affected markets, the attacker had already cashed out. The attacker borrowed essentially all of the wETH available on the platform, leaving those who'd loaned those tokens unable to withdraw.
Aave maintains a $50 million insurance fund to absorb bad debt. However, this can't cover such a huge shortfall.