Blockchain Security Brief
The weekly record of web3 darkest hours
Monday, November 3, 2025
Top Exploits
From vibe-driven developers to recursive stablecoins, this week proved that crypto’s biggest risks aren’t in the code - they’re in the people writing and re-hypothecating it.
Speed is the new security risk, and vibe coding is the proof. Developers now trust AI autocompletion more than documentation or testing, writing code that looks right instead of code that is right. Nearly half of all new code is now AI-generated, yet fewer than one in three developers feel confident spotting vulnerabilities in it. The result is a growing trail of silent failures and invisible flaws that only surface once money is on-chain. DeFi teams ship unaudited smart contracts written with Copilot suggestions, optimize “for gas,” and call it done. Three weeks later, a missing check drains the treasury. Auditors trace the exploit back to the same pattern - code that compiled clean and read well but was never understood. The new motto of modern dev culture isn’t “move fast and break things.” It’s “move fast and get exploited.” (Read more)
Stablecoins used to be boring. Stream Finance and Elixir Network turned them into performance art. Their tokens, xUSD and deUSD, backed each other in an endless loop of leverage - mint one, borrow the other, bridge it, repeat. The same $1.9 million in deposits allegedly produced $14.5 million in “stable” assets, wrapped in the language of delta-neutral strategies and institutional-grade finance. On-chain sleuths traced the recursion in real time as Hyperithm, a major yield manager, quietly pulled $10 million in exposure before the crowd caught on. By the time retail was celebrating 95% APY, the professionals were gone. Stream promised proof of reserves “coming soon” while admitting it would unwind leverage that was supposedly “transparent from day one.” (Read more)
Rekt Audit Broker
The big city sleeps, but the code never does. Neither do the crooks.
Rekt Audit Broker connects protocols with top-tier security firms. One request, multiple bids. Faster audits, fairer pricing, trusted partners.
Audits are cheaper than funerals.
Deep Dives
How Weak Governance Impacts Stablecoin Security (8 min read)
Stablecoins live and die by their governance. When reserve audits lag, key control centralizes, or “risk appetite” turns to gambling with user funds, a 1:1 peg becomes a 1:who-knows. Halborn’s Rob Behnke breaks down how unchecked authority, opaque audits, and single-key minting logic - like Paxos’ $300 trillion fat-finger fiasco - prove that trust-based governance is the soft underbelly of supposedly “stable” coins. In crypto, it’s never the peg that breaks first - it’s the process.
Design Risks in Yield Aggregator Protocols (5 min read)
Yield aggregators are DeFi’s autopilot - routing deposits through lending, staking, and farming loops that promise “set-and-forget” returns. But beneath that smooth UX hides a web of timing dependencies, upgrade traps, and custody illusions. Spearbit’s latest breakdown dissects how faulty oracles, lazy integrations, and broken accounting can turn optimization into liquidation - showing why in DeFi, automation isn’t safety, it’s leverage disguised as convenience.
Unmasking the Shadow Economy: A Deep Dive into Drainer-as-a-Service Phishing on Ethereum (6 min read)
A new academic study co-authored by a BlockSec intern maps the rise of Drainer-as-a-Service: a full-blown criminal SaaS model industrializing crypto phishing into a $135M business. These aren’t lone scammers but revenue-sharing cartels like Inferno, Angel, and Pink Drainer - complete with dashboards, affiliate tiers, and NFT bonuses. The paper exposes how only 10% of these drainers are flagged on public trackers, showing that Web3’s biggest security hole isn’t on-chain logic - it’s the economy of crime built around it.
How a fake AI recruiter delivers five staged malware disguised as a dream job (25 min read)
A LinkedIn message promising an AI role morphs into BeaverTail, a five-stage dev-targeted campaign that weaponizes a fake GitHub repo to steal keys, hijack browsers, plant persistent backdoors, and hand attackers GUI access via AnyDesk; run the repo and in seconds your .env, wallets, cookies, and clipboard are exfiltrated while obfuscated JS and nested Python loaders install RATs, persistence engines, and remote shells - a reminder that hiring season is now adversary surface.
The cryptography behind electronic passports (24 min read)
Your passport isn’t just paper - it’s a chip-powered, cryptographically hardened identity device. Joop van de Pol unpacks how modern e-passports use layered encryption (PACE, EAC, CA, and TA) to balance privacy and authentication, while still dragging legacy protocols like BAC and AA behind them. But as zero-knowledge identity experiments eye passport integration, the old threat model cracks open: hand your passport to the wrong “prover,” and your digital identity might start traveling without you.
Other Security Stories
Monetary Warfare: Stablecoins as the New Cyberweapon. Stablecoins are the quietest weapon in a global financial war, private treasuries disguised as innovation that drain sovereignty from nations and turn money itself into a tool of algorithmic control.
RedTiger Infostealer Hits Discord Users. Hackers are hijacking Discord accounts with a weaponized version of RedTiger - an open-source pentesting suite turned infostealer that drains wallets, steals browser creds, and even grabs webcam shots before dumping everything to GoFile via Discord webhooks.
Tainted Memories: ChatGPT Atlas Exploit Plants Invisible Backdoors. A new LayerX Security report reveals a CSRF flaw in OpenAI’s Atlas browser that lets attackers inject malicious code into ChatGPT’s persistent memory - creating AI-powered infections that survive across sessions, devices, and even browsers.
Europol Sounds the Alarm on Crypto Crime Surge. At its Global Conference on Criminal Finances, Europol warned that crypto-fueled crimes are outpacing law enforcement as 2025’s hacks, scams, and wrench attacks push losses past $2 billion — turning pig butchering and physical extortion into Europe’s new financial plague.
TRON Wallets Flooded with ‘Dust’ in New Address Poisoning Wave. Attackers are exploiting TRON’s near-free transactions to send fake “TRX dust” from lookalike addresses, tricking users into copying scam wallets and draining funds - a low-cost, high-scale deception clogging wallets with micro deposits and phishing lures hidden in memo fields.
Security Jobs
Blockchain Security Specialist, Tether, Remote
CISO - Web3 Security, P2P.org, Europe, Remote
Security Analyst, Figment, London, UK
Security Engineer, Parity, Remote
Security Engineer, Hypernative, US Remote
Web3 Security Architect, ChainGPT, Remote
Rekt Flashback
One year ago, M2 Exchange turned Halloween into a live-action ghost story - reporting their own $13.7 million “hack” after claiming to recover the funds in just sixteen minutes. The UAE platform blamed an “access control breach,” yet on-chain traces showed ETH, BTC, and SOL draining like spirits through a séance gone wrong. With PR statements written faster than the exploit itself, M2’s self-exorcism raised a darker question: when an exchange recovers funds before the smoke clears, did they really banish the demons - or just lock them deeper in the vault?
Memes and Videos
The Hack That Changed 147M American Lives
When your “credit guardian” forgets to patch a server and leaves the internet’s front door open for 76 days, you don’t get a breach - you get a nation-state buffet. 147 million Americans served.
Source: Blackfiles
Source: 0xleegenz
Want to partner with us?
Skip the bots, hit the brains.
Get your message in front of the sharpest, most battle-tested crowd in crypto.
If they notice you, the whole space will. [Partner with us]
We provide an anonymous platform for whistleblowers and DeFi detectives to present their information to the community. All authors remain anonymous.
We are all rekt.