{ "schemaVersion": "1.0.0", "publisher": "DT.gl Digital Trust & Threat Lab", "canonicalUrl": "https://dt.gl/incidents/dataset.json", "license": "CC-BY-4.0", "lastUpdated": "2026-11-11", "totalLedgerEvents": 16, "fullPostMortemCount": 4, "postMortems": [ { "incidentId": "DT-INC-2025-001", "slug": "bybit-safe-multisig-2025", "url": "https://dt.gl/incidents/bybit-safe-multisig-2025", "title": "Bybit $1.46B Safe Multisig UI Supply-Chain & Slot-0 Delegatecall Post-Mortem", "incidentDateUtc": "2025-02-21T14:13:00Z", "lossUsdAtExploit": 1460000000, "recoveredUsd": 42000000, "category": "multisig-ui-blind-signing", "rootCauseCwe": "CWE-494", "attribution": "Lazarus Group (DPRK TraderTraitor)", "affectedChains": [ "Ethereum" ], "onchainArtifacts": { "attackTxHashes": [ "0x46deef0f52e3a983b67abf4714448a41dd7ffd6d32d32da69d62081c68ad7882" ], "attackerAddresses": [ "0x47666Fab8bd0Ac7003bce3f5C3585383F09486E2", "0x96221423681A6d52E184D440a8eFCEbB105C7242", "0xbDd077f651EBe7f7b3cE16fe5F2b025BE2969516" ], "mutatedStorageSlots": [ "0x0000000000000000000000000000000000000000000000000000000000000000" ] }, "answerCapsule": "On February 21, 2025, DPRK Lazarus Group operators drained 1.46 billion USD in ETH and liquid-staked derivatives from Bybit's Ethereum cold multisig without exploiting any smart contract bug. Compromising a Safe developer workstation allowed attackers to inject targeted AWS S3 frontend JavaScript that tricked three hardware-wallet signers into blind-signing an operation=1 DELEGATECALL overwriting proxy storage slot zero." }, { "incidentId": "DT-INC-2025-002", "slug": "eip-7702-sweeper-delegations-2025", "url": "https://dt.gl/incidents/eip-7702-sweeper-delegations-2025", "title": "Ethereum Pectra EIP-7702 EOA Sweeper Delegations & Chain-ID Zero Replay Analysis", "incidentDateUtc": "2025-05-07T00:00:00Z", "lossUsdAtExploit": 85000000, "recoveredUsd": 0, "category": "eip-7702-delegation", "rootCauseCwe": "CWE-347", "attribution": "Inferno and Crime-as-a-Service Drainer Syndicates", "affectedChains": [ "Ethereum", "BNB Smart Chain", "Base", "Arbitrum" ], "onchainArtifacts": { "attackTxHashes": [ "0x04f8770280843b9aca008506fc23ac0083030d4094" ], "attackerAddresses": [ "0x0000000097592B97983295922296228546950000" ], "mutatedStorageSlots": [ "EOA Code Designator Prefix: 0xef0100 || sweeper_contract_address" ] }, "answerCapsule": "Following Ethereum's May 7, 2025 Pectra hard fork, commercial drainer syndicates shifted over 80 percent of malicious delegations to EIP-7702 Type-0x04 SET_CODE authorization tuples. A single off-chain signature over MAGIC byte 0x05 binds an externally owned account's code pointer to 0xef0100 plus a sweeper contract, draining native ETH and multiple ERC-20 tokens atomically and across all EVM chains when chain_id equals zero." }, { "incidentId": "DT-INC-2023-009", "slug": "ledger-connect-kit-supply-chain", "url": "https://dt.gl/incidents/ledger-connect-kit-supply-chain", "title": "Ledger Connect Kit NPM & jsDelivr CDN Supply-Chain Injection Post-Mortem", "incidentDateUtc": "2023-12-14T11:39:00Z", "lossUsdAtExploit": 610000, "recoveredUsd": 150000, "category": "supply-chain-npm-cdn", "rootCauseCwe": "CWE-494", "attribution": "Angel Drainer Phishing Affiliate", "affectedChains": [ "Ethereum", "Arbitrum", "Optimism", "Polygon", "BNB Smart Chain" ], "onchainArtifacts": { "attackTxHashes": [ "0x6bc2c01f0dc4972bc5c95e2f8a1e7aa805fd90fd27aa7911ef907bc50a8b8e9a" ], "attackerAddresses": [ "0x658729879fCa881D9526480B82aE00EFc54B5c2D" ], "mutatedStorageSlots": [] }, "answerCapsule": "On December 14, 2023, an attacker used a phished former Ledger employee's unrevoked NPM automation token to publish malicious versions 1.1.5 through 1.1.7 of @ledgerhq/connect-kit containing Angel Drainer. Because Ledger's loader package dynamically fetched unpinned latest JavaScript from jsDelivr CDN without Subresource Integrity hashes, dozens of innocent DeFi frontends served wallet-draining modals simultaneously for nearly five hours." }, { "incidentId": "DT-INC-2025-003", "slug": "tornado-cash-van-loon-sanctions", "url": "https://dt.gl/incidents/tornado-cash-van-loon-sanctions", "title": "Tornado Cash OFAC Sanctions, Fifth Circuit Van Loon Reversal & Immutable ZK Law", "incidentDateUtc": "2025-03-21T15:00:00Z", "lossUsdAtExploit": 0, "recoveredUsd": 0, "category": "regulatory-sanctions", "rootCauseCwe": "CWE-285", "attribution": "OFAC SDN Designation and Fifth Circuit Judicial Reversal", "affectedChains": [ "Ethereum", "BNB Smart Chain", "Polygon", "Arbitrum", "Optimism", "Avalanche" ], "onchainArtifacts": { "attackTxHashes": [], "attackerAddresses": [], "mutatedStorageSlots": [ "Immutable Pool Contracts: owner == 0x0000000000000000000000000000000000000000 (Zero Admin Mutability)" ] }, "answerCapsule": "On November 26, 2024, the U.S. Court of Appeals for the Fifth Circuit ruled unanimously in Van Loon v. Department of the Treasury that Tornado Cash's immutable Groth16 zero-knowledge pool smart contracts cannot be owned, controlled, or altered by any person and therefore exceed Treasury's statutory property-sanctioning authority under IEEPA, prompting OFAC's formal SDN delisting on March 21, 2025." } ], "ledger": [ { "incidentId": "DT-INC-2025-001", "date": "2025-02-21", "target": "Bybit Cold Multisig (Safe{Wallet} UI Compromise)", "lossUsd": 1460000000, "chain": "Ethereum", "category": "multisig-ui-blind-signing", "cwe": "CWE-494", "attribution": "Lazarus Group (DPRK TraderTraitor)", "vectorSummary": "Compromised Safe{Wallet} developer workstation injected malicious JS into AWS S3 bundle, tricking 3 Ledger signers into blind-signing operation=1 DELEGATECALL overwriting slot 0 singleton.", "detailRoute": "/incidents/bybit-safe-multisig-2025", "canonicalDetailUrl": "https://dt.gl/incidents/bybit-safe-multisig-2025" }, { "incidentId": "DT-INC-2025-002", "date": "2025-05-18", "target": "Ethereum Pectra EIP-7702 Sweeper Delegation Wave", "lossUsd": 14800000, "chain": "Ethereum / Base / Arbitrum / BSC", "category": "eip-7702-delegation", "cwe": "CWE-345", "attribution": "Inferno & Pink Drainer Affiliates", "vectorSummary": "Phishing dApps & leaked keys signed 0x04 SET_CODE tuples (often chain_id=0 cross-chain) delegating EOAs to automated sweeper contracts draining incoming deposits instantly.", "detailRoute": "/incidents/eip-7702-sweeper-delegations-2025", "canonicalDetailUrl": "https://dt.gl/incidents/eip-7702-sweeper-delegations-2025" }, { "incidentId": "DT-INC-2025-003", "date": "2025-03-21", "target": "Tornado Cash Immutable Pool Sanctions & Van Loon Reversal", "lossUsd": 0, "chain": "Ethereum", "category": "regulatory-sanctions", "cwe": "CWE-284", "attribution": "OFAC SDN / U.S. Fifth Circuit Court of Appeals", "vectorSummary": "Fifth Circuit ruled immutable smart contracts without admin keys are not 'property' under IEEPA, leading to March 2025 OFAC delisting while developer criminal litigation continued.", "detailRoute": "/incidents/tornado-cash-van-loon-sanctions", "canonicalDetailUrl": "https://dt.gl/incidents/tornado-cash-van-loon-sanctions" }, { "incidentId": "DT-INC-2024-008", "date": "2024-10-16", "target": "Radiant Capital Multisig Compromise", "lossUsd": 53000000, "chain": "Arbitrum / BSC", "category": "multisig-ui-blind-signing", "cwe": "CWE-345", "attribution": "UNC4736 (DPRK)", "vectorSummary": "Trojanized Telegram ZIP infected 3-of-11 developers on macOS, intercepting Safe web requests to display benign calldata while hardware wallets blind-signed transferOwnership.", "detailRoute": "/crypto-security/major-incidents", "canonicalDetailUrl": "https://dt.gl/crypto-security/major-incidents" }, { "incidentId": "DT-INC-2024-006", "date": "2024-07-18", "target": "WazirX Liminal Multisig Exploit", "lossUsd": 234900000, "chain": "Ethereum", "category": "multisig-ui-blind-signing", "cwe": "CWE-345", "attribution": "Lazarus Group (DPRK)", "vectorSummary": "UI payload mismatch between frontend coordinator display and raw Safe multisig hash tricked 4 signers into upgrading proxy implementation to attacker drainer.", "detailRoute": "/crypto-security/major-incidents", "canonicalDetailUrl": "https://dt.gl/crypto-security/major-incidents" }, { "incidentId": "DT-INC-2024-004", "date": "2024-05-31", "target": "DMM Bitcoin Private Key Compromise", "lossUsd": 305000000, "chain": "Bitcoin", "category": "key-compromise-dprk", "cwe": "CWE-522", "attribution": "TraderTraitor (DPRK)", "vectorSummary": "Fake LinkedIn coding test compromised Ginco wallet infrastructure engineer, allowing unauthorized co-signing of 4,502.9 BTC.", "detailRoute": "/crypto-security/major-incidents", "canonicalDetailUrl": "https://dt.gl/crypto-security/major-incidents" }, { "incidentId": "DT-INC-2024-003", "date": "2024-05-03", "target": "WBTC Vanity Address Poisoning Heist", "lossUsd": 68000000, "chain": "Ethereum", "category": "address-poisoning-permit", "cwe": "CWE-451", "attribution": "On-Chain Vanity Poisoning Syndicate", "vectorSummary": "Zero-value dust transfer from vanity address matching victim prefix/suffix tricked victim into copying poisoned destination from truncated transaction history.", "detailRoute": "/tools/wallet-tracking-exposure-auditor", "canonicalDetailUrl": "https://dt.gl/tools/wallet-tracking-exposure-auditor" }, { "incidentId": "DT-INC-2023-009", "date": "2023-12-14", "target": "Ledger Connect Kit NPM / CDN Supply Chain Attack", "lossUsd": 610000, "chain": "EVM Multi-Chain", "category": "supply-chain-npm-cdn", "cwe": "CWE-829", "attribution": "Angel Drainer Affiliate", "vectorSummary": "Unrevoked NPM publish token of former employee allowed push of @ledgerhq/connect-kit v1.1.5-1.1.7, served immediately via unpinned jsDelivr CDN to hundreds of dApps.", "detailRoute": "/incidents/ledger-connect-kit-supply-chain", "canonicalDetailUrl": "https://dt.gl/incidents/ledger-connect-kit-supply-chain" }, { "incidentId": "DT-INC-2023-007", "date": "2023-07-06", "target": "Multichain MPC Custody Single-Point Collapse", "lossUsd": 126000000, "chain": "Fantom / Ethereum", "category": "bridge-verification", "cwe": "CWE-269", "attribution": "Insider / Single-Custodian Cloud Key Concentration", "vectorSummary": "Alleged distributed SMPC shards were all controlled under a single cloud account held by CEO, proving unverified MPC claims equal custodial risk.", "detailRoute": "/crypto-security/major-incidents", "canonicalDetailUrl": "https://dt.gl/crypto-security/major-incidents" }, { "incidentId": "DT-INC-2023-005", "date": "2023-06-03", "target": "Atomic Wallet Closed-Source Telemetry / Key Drain", "lossUsd": 100000000, "chain": "Multi-Chain", "category": "key-compromise-dprk", "cwe": "CWE-312", "attribution": "Lazarus Group (DPRK)", "vectorSummary": "Mass asynchronous drain across thousands of retail non-custodial desktop/mobile installs lacking reproducible builds or hardware isolation.", "detailRoute": "/crypto-wallets/self-custody-privacy", "canonicalDetailUrl": "https://dt.gl/crypto-wallets/self-custody-privacy" }, { "incidentId": "DT-INC-2023-002", "date": "2023-03-13", "target": "Euler Finance donateToReserves Flash-Loan Exploit", "lossUsd": 197000000, "chain": "Ethereum", "category": "oracle-flashloan", "cwe": "CWE-682", "attribution": "Independent Exploiter (Funds Returned)", "vectorSummary": "Missing liquidity solvency check inside donateToReserves allowed leveraged flash-loan self-liquidation bad debt creation.", "detailRoute": "/crypto-security/major-incidents", "canonicalDetailUrl": "https://dt.gl/crypto-security/major-incidents" }, { "incidentId": "DT-INC-2022-009", "date": "2022-11-11", "target": "FTX Custodial Commingling & Unauthorized Hot-Wallet Drain", "lossUsd": 8000000000, "chain": "Multi-Chain", "category": "key-compromise-dprk", "cwe": "CWE-284", "attribution": "Alameda / FTX Executive Backdoor + SIM-Swap Drainer", "vectorSummary": "Omnibus custodial commingling plus single-server AWS root keys resulted in $8B balance-sheet hole and $477M bankruptcy-night hot-wallet theft.", "detailRoute": "/crypto-security/major-incidents", "canonicalDetailUrl": "https://dt.gl/crypto-security/major-incidents" }, { "incidentId": "DT-INC-2022-006", "date": "2022-08-02", "target": "Slope Mobile Wallet Sentry Plaintext Seed Leak", "lossUsd": 4100000, "chain": "Solana", "category": "privacy-telemetry-breach", "cwe": "CWE-532", "attribution": "Telemetry Logging Misconfiguration", "vectorSummary": "Mobile wallet crash-reporting SDK transmitted raw BIP-39 seed phrases in plaintext HTTPS POST payloads to centralized Sentry logging server, draining 9,231 wallets.", "detailRoute": "/crypto-wallets/self-custody-privacy", "canonicalDetailUrl": "https://dt.gl/crypto-wallets/self-custody-privacy" }, { "incidentId": "DT-INC-2022-003", "date": "2022-03-23", "target": "Ronin Bridge 5-of-9 Validator Key Compromise", "lossUsd": 624000000, "chain": "Ethereum / Ronin", "category": "bridge-verification", "cwe": "CWE-287", "attribution": "Lazarus Group (DPRK)", "vectorSummary": "Social-engineered PDF job offer compromised Sky Mavis validator nodes plus an unrevoked temporary Axie DAO allowlist signature.", "detailRoute": "/crypto-security/major-incidents", "canonicalDetailUrl": "https://dt.gl/crypto-security/major-incidents" }, { "incidentId": "DT-INC-2022-001", "date": "2022-02-02", "target": "Wormhole Solana SignatureSet Spoofing", "lossUsd": 326000000, "chain": "Solana / Ethereum", "category": "bridge-verification", "cwe": "CWE-347", "attribution": "Smart Contract Exploiter", "vectorSummary": "Deprecated load_instruction_at_unverified sysvar call allowed spoofed Guardian signature verification minting 120,000 unbacked wETH.", "detailRoute": "/crypto-security/major-incidents", "canonicalDetailUrl": "https://dt.gl/crypto-security/major-incidents" }, { "incidentId": "DT-INC-2020-004", "date": "2020-06-29", "target": "Ledger Shopify E-Commerce PII Database Breach", "lossUsd": 0, "chain": "Off-Chain Physical OPSEC", "category": "privacy-telemetry-breach", "cwe": "CWE-200", "attribution": "E-Commerce API Key Leak", "vectorSummary": "272,853 physical home addresses, phone numbers, and full names of hardware wallet buyers leaked online, fueling multi-year SIM-swap and home-invasion wrench attacks.", "detailRoute": "/anti-tracking/data-brokers-telemetry", "canonicalDetailUrl": "https://dt.gl/anti-tracking/data-brokers-telemetry" } ] }