https://dt.gl/incidents Forensic exploit post-mortems, multisig UI spoofing analyses, and CWE incident classifications. en-us https://dt.gl/incidents/bybit-safe-multisig-2025 DT-INC-2025-001: Bybit $1.46B Safe Multisig UI Supply-Chain & Slot-0 Delegatecall Post-Mortem Wed, 11 Nov 2026 00:00:00 GMT On February 21, 2025, DPRK Lazarus Group operators drained 1.46 billion USD in ETH and liquid-staked derivatives from Bybit's Ethereum cold multisig without exploiting any smart contract bug. Compromising a Safe developer workstation allowed attackers to inject targeted AWS S3 frontend JavaScript that tricked three hardware-wallet signers into blind-signing an operation=1 DELEGATECALL overwriting proxy storage slot zero. https://dt.gl/incidents/eip-7702-sweeper-delegations-2025 DT-INC-2025-002: Ethereum Pectra EIP-7702 EOA Sweeper Delegations & Chain-ID Zero Replay Analysis Wed, 11 Nov 2026 00:00:00 GMT Following Ethereum's May 7, 2025 Pectra hard fork, commercial drainer syndicates shifted over 80 percent of malicious delegations to EIP-7702 Type-0x04 SET_CODE authorization tuples. A single off-chain signature over MAGIC byte 0x05 binds an externally owned account's code pointer to 0xef0100 plus a sweeper contract, draining native ETH and multiple ERC-20 tokens atomically and across all EVM chains when chain_id equals zero. https://dt.gl/incidents/ledger-connect-kit-supply-chain DT-INC-2023-009: Ledger Connect Kit NPM & jsDelivr CDN Supply-Chain Injection Post-Mortem Wed, 11 Nov 2026 00:00:00 GMT On December 14, 2023, an attacker used a phished former Ledger employee's unrevoked NPM automation token to publish malicious versions 1.1.5 through 1.1.7 of @ledgerhq/connect-kit containing Angel Drainer. Because Ledger's loader package dynamically fetched unpinned latest JavaScript from jsDelivr CDN without Subresource Integrity hashes, dozens of innocent DeFi frontends served wallet-draining modals simultaneously for nearly five hours. https://dt.gl/incidents/tornado-cash-van-loon-sanctions DT-INC-2025-003: Tornado Cash OFAC Sanctions, Fifth Circuit Van Loon Reversal & Immutable ZK Law Wed, 11 Nov 2026 00:00:00 GMT On November 26, 2024, the U.S. Court of Appeals for the Fifth Circuit ruled unanimously in Van Loon v. Department of the Treasury that Tornado Cash's immutable Groth16 zero-knowledge pool smart contracts cannot be owned, controlled, or altered by any person and therefore exceed Treasury's statutory property-sanctioning authority under IEEPA, prompting OFAC's formal SDN delisting on March 21, 2025. https://dt.gl/crypto-security/major-incidents DT-INC-2024-008: Radiant Capital Multisig Compromise (CWE-345) Wed, 16 Oct 2024 00:00:00 GMT Trojanized Telegram ZIP infected 3-of-11 developers on macOS, intercepting Safe web requests to display benign calldata while hardware wallets blind-signed transferOwnership. https://dt.gl/crypto-security/major-incidents DT-INC-2024-006: WazirX Liminal Multisig Exploit (CWE-345) Thu, 18 Jul 2024 00:00:00 GMT UI payload mismatch between frontend coordinator display and raw Safe multisig hash tricked 4 signers into upgrading proxy implementation to attacker drainer. https://dt.gl/crypto-security/major-incidents DT-INC-2024-004: DMM Bitcoin Private Key Compromise (CWE-522) Fri, 31 May 2024 00:00:00 GMT Fake LinkedIn coding test compromised Ginco wallet infrastructure engineer, allowing unauthorized co-signing of 4,502.9 BTC. https://dt.gl/tools/wallet-tracking-exposure-auditor DT-INC-2024-003: WBTC Vanity Address Poisoning Heist (CWE-451) Fri, 03 May 2024 00:00:00 GMT Zero-value dust transfer from vanity address matching victim prefix/suffix tricked victim into copying poisoned destination from truncated transaction history. https://dt.gl/crypto-security/major-incidents DT-INC-2023-007: Multichain MPC Custody Single-Point Collapse (CWE-269) Thu, 06 Jul 2023 00:00:00 GMT Alleged distributed SMPC shards were all controlled under a single cloud account held by CEO, proving unverified MPC claims equal custodial risk. https://dt.gl/crypto-wallets/self-custody-privacy DT-INC-2023-005: Atomic Wallet Closed-Source Telemetry / Key Drain (CWE-312) Sat, 03 Jun 2023 00:00:00 GMT Mass asynchronous drain across thousands of retail non-custodial desktop/mobile installs lacking reproducible builds or hardware isolation. https://dt.gl/crypto-security/major-incidents DT-INC-2023-002: Euler Finance donateToReserves Flash-Loan Exploit (CWE-682) Mon, 13 Mar 2023 00:00:00 GMT Missing liquidity solvency check inside donateToReserves allowed leveraged flash-loan self-liquidation bad debt creation. https://dt.gl/crypto-security/major-incidents DT-INC-2022-009: FTX Custodial Commingling & Unauthorized Hot-Wallet Drain (CWE-284) Fri, 11 Nov 2022 00:00:00 GMT Omnibus custodial commingling plus single-server AWS root keys resulted in $8B balance-sheet hole and $477M bankruptcy-night hot-wallet theft. https://dt.gl/crypto-wallets/self-custody-privacy DT-INC-2022-006: Slope Mobile Wallet Sentry Plaintext Seed Leak (CWE-532) Tue, 02 Aug 2022 00:00:00 GMT Mobile wallet crash-reporting SDK transmitted raw BIP-39 seed phrases in plaintext HTTPS POST payloads to centralized Sentry logging server, draining 9,231 wallets. https://dt.gl/crypto-security/major-incidents DT-INC-2022-003: Ronin Bridge 5-of-9 Validator Key Compromise (CWE-287) Wed, 23 Mar 2022 00:00:00 GMT Social-engineered PDF job offer compromised Sky Mavis validator nodes plus an unrevoked temporary Axie DAO allowlist signature. https://dt.gl/crypto-security/major-incidents DT-INC-2022-001: Wormhole Solana SignatureSet Spoofing (CWE-347) Wed, 02 Feb 2022 00:00:00 GMT Deprecated load_instruction_at_unverified sysvar call allowed spoofed Guardian signature verification minting 120,000 unbacked wETH. https://dt.gl/anti-tracking/data-brokers-telemetry DT-INC-2020-004: Ledger Shopify E-Commerce PII Database Breach (CWE-200) Mon, 29 Jun 2020 00:00:00 GMT 272,853 physical home addresses, phone numbers, and full names of hardware wallet buyers leaked online, fueling multi-year SIM-swap and home-invasion wrench attacks.