# Best of rekt.news on Kiwi News

Page: https://news.kiwistand.com/source/rekt.news

43 stories from rekt.news have been shared on Kiwi News since 28 February 2024, with 146 upvotes and 10 comments in total. The latest was shared on 24 April 2026. They are listed below, most upvoted first.

Summaries are AI summaries of the linked article.

## 1. A TON of BS

- Kiwi News: https://news.kiwistand.com/stories/A-TON-of-BS?index=0x686ef3fb986aaca0b49dd4f8dec3e54fd85658d34237e81843d4250c4eaa5097afd2fae0
- Source: https://rekt.news/ton-of-bs
- Shared 9 July 2025, 16 upvotes, 3 comments

Max Crown, CEO of TON, announced on July 6 that anyone staking $100K worth of TON tokens plus a $35K processing fee could obtain a UAE Golden Visa after a three-year lock-up. Within 48 hours, the UAE Federal Authority for Identity, Citizenship, Customs and Port Security, the Securities and Commodities Authority and the Virtual Assets Regulatory Authority denied any such program, and VARA said TON was not licensed to operate in the UAE. The article notes that real Golden Visas require at least 2 million AED ($544k) in real estate or public investment, and Crown later apologized, saying the messaging was unclear and the initiative "leaked" before it was ready.

## 2. Rekt - ArcadiaFi

- Kiwi News: https://news.kiwistand.com/stories/Rekt-ArcadiaFi?index=0x687a234c6ad9f632705bfe3608df47e773888e15f97a0bf3f4a391fc9dad3c5f7326ea25
- Source: https://rekt.news/arcadiafi-rekt
- Shared 18 July 2025, 8 upvotes, 0 comments

ArcadiaFi, a DeFi lending protocol on Base, lost about $3.6 million on July 14-15 through a flaw in its rebalancer contract, according to the article's account. The article says the attacker used three Morpho flashloans worth about $1.5 billion and that the unchecked router.call(data) in SwapLogic._swapViaRouter() let them drain victim accounts after repaying their debt. It states that Pashov Auditing Group had flagged the missing input validation but closed the issue as unexploitable, and that Trust Security, Sherlock and Renascence Labs audits did not cover the Rebalancer.

## 3. Communications breakdown

- Kiwi News: https://news.kiwistand.com/stories/Communications-breakdown?index=0x65df56a3aff829e5cdb66a4e2fbc158ab25e444d2447e07892be937d5a8d936397348217
- Source: https://rekt.news/communications-breakdown
- Shared 28 February 2024, 7 upvotes, 1 comment

The GHO Liquidity Committee saga shows that the outcome of Aave governance depends on the people acting within it rather than the process on paper. The GLC was tasked with keeping GHO's peg stable, but the committee sent 1.05 million cvxCRV in two transfers instead of minting and staking sdCRV to the Gnosis Safe, as the governance vote required. Token Brice, who had declared himself "temporary and benevolent leader," resigned just over a week later and criticized the governance process on X and his blog. Gauntlet also ended its relationship with Aave, with co-founder John Morrow citing "inconsistent guidelines and unwritten objectives" set by Aave's largest stakeholders.

## 4. Hacken Bridge Key Compromise

- Kiwi News: https://news.kiwistand.com/stories/Hacken-Bridge-Key-Compromise?index=0x685c6c68e10012eb81e334501028ff3a2dd76c94e98aa596624acb1347c06e31d71413ce
- Source: https://rekt.news/hacken-rekt
- Shared 25 June 2025, 7 upvotes, 0 comments

Hacken's bridge suffered a compromised private key on June 20, leading to the minting of 900 million $HAI tokens, a drain of about $170K, and a 99% collapse in token value. The article says the key was left exposed on a decommissioned DigitalOcean server, and that Hacken described the incident as human error during architectural changes. CEO Dyma Budorin later said that Extractor helped track fund movements and block the attacker's account after a KuCoin deposit.

## 5. Rekt - Cutting Corners

- Kiwi News: https://news.kiwistand.com/stories/Rekt-Cutting-Corners?index=0x68bdc4755ea1e73a712d43d978f03a6ea463da1ede11146474c7dc044e597542b8142a5b
- Source: https://rekt.news/cutting-corners?_bhlid=2f715a47cc3d8015ac294600c236693f3eed5aa4
- Shared 7 September 2025, 5 upvotes, 2 comments

Crypto protocols that skimp on security bounties and audits are losing large sums to exploits that better-funded programs would likely have caught, according to this REKT piece. It cites SuperRare's $730,000 hack, which involved a basic access control bug, and Cork Protocol's $12 million exploit on May 28, 2025, despite a public bounty capped at $100,000. Immunefi CEO Mitchell Amador argues that bounties should be about 10% of funds at risk, a standard the article says platforms are not meeting. The article contrasts this with LayerZero's $15 million bounty program and Euler Finance's $7.5 million program.

## 6. Infiltrating Cosmos

- Kiwi News: https://news.kiwistand.com/stories/Infiltrating-Cosmos?index=0x671a6d38be04c4a2e685993a1f7671b8f8821b6c0ee3d1d2cfbe043d4798e17a3f6dde37
- Source: https://rekt.news/infiltrating-cosmos
- Shared 24 October 2024, 5 upvotes, 1 comment

The article alleges that North Korean-linked developers wrote most of the Liquid Staking Module (LSM) for the Cosmos Hub, which it calls a potential Trojan horse. It says Jun Kai and Sarawut Sanit wrote the majority of the code, made their last merge on December 4, 2022, and left behind unresolved vulnerabilities, including slashing evasion flagged in a July 2022 Oak Security audit. It states that Zaki Manian, leader of Iqlusion, said on October 2, 2024 that he learned of the DPRK links in March 2023, and that the LSM was integrated via Proposal #790 in April 2023 without mention of these issues. Jae Kwon is cited as raising the alarm, warning that the vulnerabilities could put staked ATOM at risk.

## 7. Rekt - We Have a Centralization Issue

- Kiwi News: https://news.kiwistand.com/stories/Rekt-We-Have-a-Centralization-Issue?index=0x68f7ddb667f4072b60281077fcf7250917f981305d01f1a86c8b5a9e71eb00f2df653863
- Source: https://rekt.news/we-have-centralization-issue
- Shared 21 October 2025, 5 upvotes, 0 comments

The article argues that the October 20, 2025 AWS US-EAST-1 outage exposed crypto's dependence on centralized cloud infrastructure, even though no blockchain failed. It says Infura, which connects MetaMask to blockchains, reported outages across Polygon, Optimism, Arbitrum, Linea, Base, and Scroll during the DNS failures in Amazon's DynamoDB endpoint. It also states that roughly 2,368 Ethereum execution nodes, about 37% of the network, sit on AWS, and that Coinbase and Base were temporarily unusable. The text recommends multi-cloud strategies and decentralized alternatives such as Filecoin, IPFS, Arweave, and Akash Network, while noting they remain marginal.

## 8. Rekt - Slerf - Rekt

- Kiwi News: https://news.kiwistand.com/stories/Rekt-Slerf-Rekt?index=0x65f96867891f568900139262b72331d7bdcbbf5c20d1acf04529ff67a7158393ab559f68
- Source: https://rekt.news/slerf-rekt
- Shared 19 March 2024, 5 upvotes, 0 comments

The SLERF meme coin on Solana fell into chaos after its developer accidentally burned about $10M in funds while trying to burn the liquidity pool and airdrop tokens. The Bozo Collective first marketed the project on March 16th, and it had been pitched as 50% LP, 50% presale with no team tokens. The developer's attempts using Solana Tools Vercel failed, and then the tokens were mistakenly burned along with other coins in the wallet when using Sol Incen. Despite the error, the article reports SLERF reached $2B in 24-hour trade volume, and one trader reportedly turned $1.9M into $5M in 12 minutes.

## 9. Rekt - House Of Cards

- Kiwi News: https://news.kiwistand.com/stories/Rekt-House-Of-Cards?index=0x6908a805ee1fd4708060baeb80f8415bbf17de061c0959723c40291e11834ec9dbc1f9c8
- Source: https://rekt.news/house-of-cards
- Shared 3 November 2025, 4 upvotes, 0 comments

Stream Finance's xUSD and Elixir Network's deUSD stablecoins are described as a recursive minting loop that allegedly inflated supply far beyond the capital behind it. Schlag's research alleges that $1.9 million in USDC minted $14.5 million in xUSD, and allegations put $70 million supplied and over $65 million borrowed in a single Morpho market where Elixir was the sole depositor. Hyperithm, which manages the mHYPER vault, said on October 28, 2025 that it had removed all yUSD and xUSD exposure. Stream's proof of reserves is still listed as coming soon, and Elixir's documentation says deUSD is not pegged 1:1 through a reserve.

## 10. Rekt - Hypervault - Rugged

- Kiwi News: https://news.kiwistand.com/stories/Rekt-Hypervault-Rugged?index=0x68dd12eb75620ce144fb584cc283eb46f4476088eae62c1addd4d9b4557144ef70dcaaa7
- Source: https://rekt.news/hypervault-rugged
- Shared 1 October 2025, 4 upvotes, 0 comments

HyperVault, a yield aggregator on Hyperliquid's HyperEVM that advertised 95% APY, was drained on September 25 of about $4.64 million, which was bridged to Ethereum via deBridge and then sent into Tornado Cash while depositors' vaults went to zero. The article says that a September 4 warning from community member HypingBull was followed by Pashov confirming he had never heard of the project and Code4rena showing no pending audit. It also says Zenith's draft audit, delivered privately on September 24, found 42 vulnerabilities, six of them High severity, and that an IP address in DocuSign metadata belonged to Nicholas Olsen, the protocol's supposed founder.

## 11. Rekt - Shibarium

- Kiwi News: https://news.kiwistand.com/stories/Rekt-Shibarium?index=0x68c98e2309e1c496b559649e591413b428b0ee4b27b3b104e3e81c9efa30222386247099
- Source: https://rekt.news/shibarium-rekt
- Shared 16 September 2025, 4 upvotes, 0 comments

Shibarium, a bridge network tied to Shiba Inu, lost about $3 million after attackers gained control of 10 of its 12 validator keys on September 12, according to the article. The attacker used flash loans to acquire 4.6 million BONE tokens, which temporarily gave them validator voting power, and then signed a fraudulent checkpoint that allowed draining the bridge. The article says PeckShield flagged the suspicious activity to Shytoshi Kusama, and K9 Finance DAO blacklisted the attacker's address, freezing roughly $1.3 million of the stolen tokens. Mr. Lightspeed is quoted suggesting that the compromised keys may belong to one person, which would undermine the network's decentralization.

## 12. Rekt - BetterBank

- Kiwi News: https://news.kiwistand.com/stories/Rekt-BetterBank?index=0x68b0861d82317ea8cf9a4c804191326eb1c2968e7c919bd3f6651e4ce3f82b28c38bf998
- Source: https://rekt.news/betterbank-rekt
- Shared 28 August 2025, 4 upvotes, 0 comments

BetterBank, a PulseChain lending protocol, lost about $5 million when an attacker exploited its bonus minting system by creating homemade liquidity pairs that avoided the tax logic applied only to pairs the team had designated as "official." The article says auditor Zokyo had flagged this attack path before launch, but BetterBank downgraded the issue to "Low" after its test used ETH instead of worthless tokens. The attacker later returned 550 million pDAI, and the article notes that about 309 ETH was converted, with some reports suggesting 215 ETH, before funds were sent through Tornado Cash.

## 13. Meme Mania

- Kiwi News: https://news.kiwistand.com/stories/Meme-Mania?index=0x66587315f69f424d46a9a52b7600d815a9600bd6f3976b4303b712e5c75aacbc570d3b73
- Source: https://rekt.news/meme-mania
- Shared 30 May 2024, 4 upvotes, 0 comments

Meme coins on crypto platforms like pump.fun and base.fun are a chaotic, scam-prone frontier, according to this REKT piece, which also describes a split in the industry between critics and supporters. The article says pump.fun charges about $2 to mint a token and takes a 1% swap fee, while traders still face losses from early allocations by creators who dump holdings after launch. It cites a $1.9 million pump.fun exploit on May 16 by former contractor Jarett Dunn, and a Coin Telegraph's Magazine investigation from April that found 1 in 6 new Base meme coins are scams. Critics see the sector as crypto's worst excess, while supporters call it a gateway to mainstream adoption.

## 14. Something Smells Fishy

- Kiwi News: https://news.kiwistand.com/stories/Something-Smells-Fishy?index=0x65f367742ad6a4cdac60cda3f28dfcaf0c4aaa3a9299bd545c29474ba934a69ca9d42224
- Source: https://rekt.news/sushiswap-somethingsmells-fishy
- Shared 14 March 2024, 4 upvotes, 0 comments

This anonymous REKT investigation argues that SushiSwap's governance and fund management have been opaque and troubled, and it leaves the final verdict to readers. It says Jared Grey, the CEO, oversaw a series of shelved products and a diverted treasury, including the Arbitrum airdrop of 4.25M ARB landing in the Ops multisig. It also notes that the SEC served a subpoena around the time Sushi created a Legal Defense Fund asking for $3-4M, and that about 3.5M Sushi was released from the Merkel Distributor on March 11 after a ten-month standstill. The article does not confirm the accusations and says some questions remain unanswered.

## 15. Rekt Parlour

- Kiwi News: https://news.kiwistand.com/stories/Rekt-Parlour?index=0x67ff9ac972c10a208c5641126cc85d71b8588ea1b129c557031226f2cf2c8c57eb5f852c
- Source: https://rekt.news/parlour
- Shared 16 April 2025, 3 upvotes, 1 comment

## 16. Rekt - KelpDao - Rekt

- Kiwi News: https://news.kiwistand.com/stories/Rekt-KelpDao-Rekt?index=0x69ebad5e0b87ed34cd4e373fadf0db92f61fae23af9b4166b701886224e454e51ad86f2f
- Source: https://rekt.news/kelpdao-rekt
- Shared 24 April 2026, 3 upvotes, 0 comments

An attacker drained about $290 million from KelpDAO's rsETH bridge on April 18, 2026, by forging a cross-chain message that the protocol's single required verifier signed. That verifier had been reading fabricated chain data after attackers compromised RPC nodes. The stolen rsETH was deposited into Aave as collateral to borrow WETH, and Aave's TVL shed $6.28 billion in under 48 hours. North Korea's Lazarus Group is the preliminary attribution. LayerZero blamed KelpDAO's one-verifier setup, while KelpDAO said that configuration was LayerZero's documented default.

## 17. Default Settings

- Kiwi News: https://news.kiwistand.com/stories/Default-Settings?index=0x69ab73d2f3cc38eabd8cb5bad1d612ecced79f288891ea154bfa2b380460d53a4f582865
- Source: https://rekt.news/default-settings
- Shared 7 March 2026, 3 upvotes, 0 comments

Zero-knowledge systems, which were built on the promise that users need not trust the team behind them, have been exposed by deployment mistakes rather than broken math. Veil Cash lost 2.9 ETH in a single transaction around February 20 because its verifier kept a placeholder value from a skipped trusted setup step, and FoomCash lost $2.26 million to the same flaw a few days later. Separately, OtterSec disclosed Fiat-Shamir binding bugs across six zkVMs, most patched between October 2025 and January 2026, while Ceno's issue remained open at publication. Pashov Audit Group had audited Veil Cash, but its verifier was out of scope.

## 18. Rekt - SBI Crypto

- Kiwi News: https://news.kiwistand.com/stories/Rekt-SBI-Crypto?index=0x68e28123a44e86a50e6c6cc2628ee540410f62d714a576ac84d28077ecda37540f3ce5cb
- Source: https://rekt.news/sbi-crypto-rekt
- Shared 5 October 2025, 3 upvotes, 0 comments

On September 24, 2025, about $24 million was drained from wallets linked to SBI Crypto, the mining pool subsidiary of SBI Holdings, across five blockchains: Bitcoin, Ethereum, Litecoin, Dogecoin and Bitcoin Cash. The article says ZachXBT flagged the outflows on October 1, pointing to instant exchange routing and a Tornado Cash endpoint, with similarities to known DPRK attacks. SBI Holdings' October 2 statement confirmed an "unauthorized outflow" and called the impact on consolidated results "minor," but did not explain how the attack occurred.

## 19. UXLink - Rekt

- Kiwi News: https://news.kiwistand.com/stories/UXLink-Rekt?index=0x68d693cd282a8697bfd16fcdef7a7c446ed2c340511c4e928c7c9efc39ff8c8362019264
- Source: https://rekt.news/uxlink-rekt
- Shared 26 September 2025, 3 upvotes, 0 comments

UXLINK's treasury was drained of roughly $18 million across Ethereum and BSC after someone with multisig access used delegateCall to remove the admins and install themselves as owner. Blockscope's forensics put the attacker's total realized proceeds, including proceeds from minting unauthorized UXLINK tokens on Arbitrum, at about $41 million as of September 25th. Separately, Scam Sniffer flagged a phishing transaction in which 542 million UXLINK tokens were drained from the attacker's wallet into addresses linked to Inferno Drainer.

## 20. Rekt - Phished Founder, Liquidated Thief

- Kiwi News: https://news.kiwistand.com/stories/Rekt-Phished-Founder-Liquidated-Thief?index=0x68b9fc00defbe9eb92ff4ae731ac85398d94e4f46b7cdc77861ff9a6cf79531d83834e94
- Source: https://rekt.news/phished-founder-liquidated-thief
- Shared 4 September 2025, 3 upvotes, 0 comments

A Venus Protocol user lost about $13 million in a phishing attack on September 2, and Venus responded by pausing the protocol and running an emergency vote to recover the funds. The victim, Kuan Sun, founder of Eureka Crypto, had a malicious Zoom client give attackers machine access, after which he signed a delegate approval transaction that let the attacker drain his wallet in one atomic transaction. The article states that Venus paused its core functions about 20 minutes after the heist and that a "Lightning Vote" approved a recovery plan unanimously. It also says Venus executed a liquidation about 12 hours later, and that the victim credited Venus, PeckShield, SlowMist, Binance and others with helping recover his funds.

## 21. Rekt - Invisible Prompts

- Kiwi News: https://news.kiwistand.com/stories/Rekt-Invisible-Prompts?index=0x68a8a202201a5a5f2fa8c70957d01fe202366d6234565691b4c71a6f9b40bc0dc5e7a8f9
- Source: https://rekt.news/invisible-prompts
- Shared 22 August 2025, 3 upvotes, 0 comments

Trusted developer tools and AI systems are becoming attack vectors, with malicious code and planted instructions exploiting the trust users place in them. A fake "Solidity Language" VS Code extension with 54,000 downloads reportedly drained $500,000 from a Russian blockchain developer, and a later copy claimed nearly two million fake downloads. Princeton researchers reportedly used planted fake memories to get the ElizaOS trading bot to send real Ethereum to their address, and Microsoft patched EchoLeak, a zero-click Copilot flaw that could expose enterprise data. The text also says spotlighting defenses became much less effective against adaptive attacks.

## 22. Rekt - Drained By Design

- Kiwi News: https://news.kiwistand.com/stories/Rekt-Drained-By-Design?index=0x68a7400e27f7ac20a187a17e4ee5642bb4b0cc27e7de04f300c9b7b3d888164627dbacf7
- Source: https://rekt.news/drained-by-design
- Shared 21 August 2025, 3 upvotes, 0 comments

Coinbase's fee wallet lost about $550,000 on August 13 after granting ERC-20 approvals to 0xProject's permissionless Settler contract, which 0x's documentation warns against. Blockscope's forensic analysis tracked the extraction of $550K across roughly 168 ERC-20 tokens, which a bot converted into ETH. Coinbase CSO Philip Martin said the incident was isolated, that customer funds were untouched, and that the team was revoking allowances and moving to a new wallet.

## 23. Rekt - Just Bad Luck?

- Kiwi News: https://news.kiwistand.com/stories/Rekt-Just-Bad-Luck?index=0x68766f62737e4497bacf776d2e62210554e062c75739ea26e9d8c5dc3bdc688255809759
- Source: https://rekt.news/just-bad-luck
- Shared 15 July 2025, 3 upvotes, 0 comments

Kinto's $K token was hijacked on July 10 through a proxy backdoor that let attackers mint 110,000 tokens, drain $1.55 million from Uniswap and Morpho pools, and push the price down almost 95%. The article questions the team's account, which blames sophisticated hackers and a state actor, and notes that founder Ramon Recuero previously led Babylon Finance, which also faced an external crisis. Ramon announced a recovery fund three days after the exploit, and the article says it depends on donations from "partners and existing investors" to restore the roughly $1.4 million lost.

## 24. The Eco-Friendly Rug Pull

- Kiwi News: https://news.kiwistand.com/stories/The-Eco-Friendly-Rug-Pull?index=0x686705bc00fc317d6bdc7b3ee37204930605aaba7f6b1fd65d5c6549a13d0387077a70d9
- Source: https://rekt.news/eco-friendly-rug-pull
- Shared 3 July 2025, 3 upvotes, 0 comments

Rowan Energy, a crypto project marketed as clean energy, is described as a five-year fraud run by David Duckworth, involving a hidden mint function and 400 million ghost tokens. An anonymous researcher reportedly exposed the supposedly private blockchain through public RPC endpoints, minting 1 billion RWN tokens as proof before burning them. Duckworth later went silent, and the project was shut down on June 24. TrustPilot reviews cited in the text describe SmartMiner buyers who paid £1,500 for devices promising £450 a year and received no payments.

## 25. Rekt - The Impersonator

- Kiwi News: https://news.kiwistand.com/stories/Rekt-The-Impersonator?index=0x6819580f2851b9cc7fdce6cf1d1af52e1d4ecfb04a69fb8f97e30d3281c888c45b5a5466
- Source: https://rekt.news/the-impersonator
- Shared 6 May 2025, 3 upvotes, 0 comments

This Rekt News piece alleges that Nick Franklin, a security researcher known on Twitter as 0xNickLFranklin, was an operative for North Korea's Lazarus Group. The article says his exploit analysis was linked to insider knowledge, citing his Telegram and address activity connected to the $50M Radiant Capital breach in October 2024. It also says the attempt to send Anton Bukev, a 1inch co-founder, a malicious APP file disguised as a security report exposed him on March 27, and that researcher Pascal Caversaccio attributed the file to North Korean actors with high confidence.

## 26. Surviving Digital Danger

- Kiwi News: https://news.kiwistand.com/stories/Surviving-Digital-Danger?index=0x67095354797132301a8ee0c0befa679b56a4553235dcabb560ee42c8a7e5923f79334855
- Source: https://rekt.news/surviving-digital-danger
- Shared 11 October 2024, 3 upvotes, 0 comments

This rekt.news piece, the second part of a series, argues that rising violent crime against crypto holders means the industry must adapt, and it offers a tongue-in-cheek survival guide for holders. It says regulators may respond to violent headlines with stricter "for your protection" laws, and that institutions may back away over bad publicity. The guide advises keeping gains private, storing hardware wallets securely rather than taking main funds to conferences, and using a separate "party wallet" with limited funds for networking events. The article also concludes that there is no easy solution, since more regulation and better security each carry costs.

## 27. Rekt - Digital Danger

- Kiwi News: https://news.kiwistand.com/stories/Rekt-Digital-Danger?index=0x670159fdb3726b98446e8ded8962b60a151b50c4e860fc46c60788d56ba46b058e1bde3b
- Source: https://rekt.news/digital-danger
- Shared 5 October 2024, 3 upvotes, 0 comments

The article is a REKT feature on physical crime against cryptocurrency holders, arguing that digital wealth has increasingly led to real-world violence. It cites Nick Drakon, a crypto executive who was forced at gunpoint to transfer millions in crypto, including Revelo Intel's and Revelo Ventures' funds, before forfeiting his stake in Revelo Intel. Other cases include a $700k Bitcoin robbery of Israeli tourists in Costa Rica in August, a July kidnapping and killing of a 29-year-old in Kyiv over 3 BTC, and a $1.2 million crypto ransom kidnapping in Cyberjaya, Malaysia. It also recounts the 2013 extortion of Hal Finney and the 2015 armed robbery of Dean Katz.

## 28. Rekt: Astroport

- Kiwi News: https://news.kiwistand.com/stories/Rekt-Astroport?index=0x66ab32a3327e852d76e6dd5282fe3b81c23b4f0204f3737245758d9d03d880b5c1f79449
- Source: https://rekt.news/astroport-rekt
- Shared 1 August 2024, 3 upvotes, 0 comments

Astroport, a DEX on the Terra network, lost roughly $6.4 million on July 30 in a hack that exploited a reentrancy vulnerability in the timeout callback of ibc-hooks. The article says the bug had been patched in April but was accidentally reintroduced in Terra's June upgrade. Terra's validators halted the chain, and validators holding over 67% of the voting power upgraded their nodes, after which the chain resumed. According to Astroport, the attacker's Terra address holding 20 million ASTRO was frozen, and ASTRO fell roughly 56%, per Coingecko data.

## 29. LiFi/Jumper - Rekt

- Kiwi News: https://news.kiwistand.com/stories/LiFiJumper-Rekt?index=0x66979990c9b718063c6e9795edbcdc8e93386dddedcd8b1d6e6b8f79f888ab66a0512d65
- Source: https://rekt.news/lifi-jumper-rekt
- Shared 17 July 2024, 3 upvotes, 0 comments

LiFi protocol lost about $9.73M in an attack that drained addresses which had granted infinite token approvals to its contracts across multiple chains. LiFi acknowledged the hack roughly an hour after security firm CertiK raised the alarm, and Jumper Exchange, which uses LiFi's services, told users it appeared unaffected. According to Nick L. Franklin, the attack exploited a lack of validation in the "swap" function of a contract facet added on July 11th, enabling a "call injection" attack. The stolen USDT, USDC and DAI were swapped for 2,857 ETH, and LiFi suffered a similar exploit in March 2022 that lost $600K.

## 30. BigONE - Rekt

- Kiwi News: https://news.kiwistand.com/stories/BigONE-Rekt?index=0x687e02954f595bc881671e9bbeba7214287407c087f777b261a0658545053698bb6050cd
- Source: https://rekt.news/bigone-rekt
- Shared 21 July 2025, 2 upvotes, 0 comments

BigONE suffered a hot wallet hack on July 15 in which about $27 million was drained across five blockchains through a supply chain compromise of its production network, according to SlowMist, which said attackers modified the operational logic of account and risk control servers without stealing private keys. BigONE announced a "Security Incident" involving unauthorized access to its hot wallet, said it had frozen a portion of the assets, and promised full compensation using internal reserves. The article also cites ZachXBT's allegations that BigONE processed funds from pig butchering and romance scams, including a deposit address that handled $60 million in fraud proceeds, and that a scam group kept using the platform for seven months.

## 31. GMX - Rekt

- Kiwi News: https://news.kiwistand.com/stories/GMX-Rekt?index=0x68713f4f39ca70a92966b71df1ba5fff987903383e5c93ff21948fd0884500a9e1940647
- Source: https://rekt.news/gmx-rekt
- Shared 11 July 2025, 2 upvotes, 0 comments

GMX V1 lost about $42 million on July 9 through a cross-contract reentrancy exploit that manipulated globalShortAveragePrices and inflated GLP pricing, according to PeckShield and BlockSec. BlockSec said the GMX order-keeper passed a contract address into executeDecreaseOrder, which let the attacker reenter the reward router and vault during the refund step. PeckShield's post-hack analysis said the bug was introduced in the 2022 fix for a $1M bug bounty paid to Collider VC. GMX later said a potentially exploitable $42 million belonging to GLP holders had been secured, and after paying the attacker a $5 million bounty, the remaining funds were in its Security Multisig.

## 32. Dodging a Bullet

- Kiwi News: https://news.kiwistand.com/stories/Dodging-a-Bullet?index=0x6842b434ac190879ada5c99e57f768e4f260aab4dcaf41c6017fcd909e27997fe402495d
- Source: https://rekt.news/dodging-a-bullet
- Shared 6 June 2025, 2 upvotes, 0 comments

Vesu, a DeFi lending protocol on Starknet, fixed a critical liquidation vulnerability within days of a whitehat hacker named Alex reporting it through Immunefi's bug bounty program, with no user funds lost. The bug was a rounding issue in Singleton::liquidate_position tied to the receive_as_shares flag, which could have let an attacker mint shares worth more than they deposited when combined with a malicious pool extension and flashloans. According to Vesu's full disclosure report, the team removed that feature, whitelisted pool extension contracts, and completed a migration by May 28 with help from ChainSecurity, Argent, and lending pool curators.

## 33. Pump.snuff

- Kiwi News: https://news.kiwistand.com/stories/Pumpsnuff?index=0x674dc84443d7c5e70b7787e5b25f13526b0b8d59d484a226af639da072b575d6282b81f5
- Source: https://rekt.news/pump-snuff
- Shared 2 December 2024, 2 upvotes, 0 comments

This opinion piece argues that pump.fun, a token creation platform that added livestreams, has become a venue for escalating self-harm, animal cruelty and other dangerous acts that users stream to win token attention. It cites Trevv, a 19-year-old who faked his death during a stream to pump $CHD, and a creator whose $CFC stream culminated in the killing of a chicken. It also cites Beau Security's documentation of users self-harming for token pumps, and says that pump.fun's founder Alon's claim of a large moderation team rang hollow. The article says pump.fun quietly removed livestreams after public outcry, but the damage is already done.

## 34. Slow Burn

- Kiwi News: https://news.kiwistand.com/stories/Slow-Burn?index=0x6741d678376d6439b72caac175f2a82e4a24e3e5e0ef654f54f41edaf2718e43c2d2dd1d
- Source: https://rekt.news/slowburn
- Shared 23 November 2024, 2 upvotes, 0 comments

Manifold Finance and founder Sam Bacha have repeatedly failed to deliver, with the FOLD token falling 98% from its $103 peak to 64 cents by November 2024. Manifold raised $2.5 million in 2021 from P2P.org and Marshland Capital, but its SushiSwap tool was shelved over "bugs," and its mevETH token fell 90% after peaking at a $37.7 million market cap. Cobie told DL News he invested in FOLD in 2021 and now holds tokens worth zero, and Bacha's earlier venture, Block Array, has worthless tokens.

## 35. Venus Protocol - Rekt IV

- Kiwi News: https://news.kiwistand.com/stories/Venus-Protocol-Rekt-IV?index=0x69bad832765623704f4018a184fc852b2d80e09eba6b81e84d3ed1ee5f13d17fcb3c1b52
- Source: https://rekt.news/venus-protocol-rekt4
- Shared 18 March 2026, 1 upvote, 1 comment

An attacker exploited a donation attack on Venus Protocol's THE market on BNB Chain on March 15, 2026, bypassing the supply cap by transferring tokens directly to the vTHE contract and leaving Venus with $2.15 million in bad debt. The March 17 post-mortem says the vector was identified in a 2023 Code4rena audit, assessed as having "no negative side effects," and not remediated. The attacker built an 84% supply-cap position over nine months and extracted about $3.7 million in net assets before liquidation. William Li flagged the suspicious activity and posted the attacker's address before Venus made a public statement.

## 36. Gamestonk II - Dumb Money is Back

- Kiwi News: https://news.kiwistand.com/stories/Gamestonk-II-Dumb-Money-is-Back?index=0x66446d9b1a2d546282d8b270ea1de8fc6551363d4c558b53ffff285e2a2292139d156bea
- Source: https://rekt.news/gamestonk2
- Shared 15 May 2024, 1 upvote, 1 comment

Roaring Kitty's Keith Gill reportedly sparked a renewed GameStop meme frenzy in 2024 after a three-year break, with GME rising over 119% and crossing $25 per share since late April. The article says the rally briefly made GameStop a $10 billion company, trading was halted nine times in just over 90 minutes on Monday morning, and about $1 billion was lost by short sellers. The author argues that the revived mania could spread to crypto, which it presents as a 24/7 alternative to traditional exchanges, while the New York Stock Exchange polls participants on around-the-clock trading.

## 37. Bunni - Rekt

- Kiwi News: https://news.kiwistand.com/stories/Bunni-Rekt?index=0x68c049e36da5fd4cf099ed00d3029ca44de075393318f4add61195a732657dfec446967c
- Source: https://rekt.news/bunni-rekt
- Shared 9 September 2025, 1 upvote, 0 comments

Bunni, a DeFi protocol on Uniswap V4, lost about $8.4 million on September 1 to an attacker who exploited a rounding and precision bug in its custom Liquidity Distribution Function. BlockSec flagged about $2.3 million in losses on Ethereum, and CertiK identified the same pattern on Unichain, bringing the total to $8.4 million. The attacker drained the USDC/USDT pool on Ethereum and the ETH/weETH pool on Unichain, then bridged much of the funds to Ethereum in 100 ETH transfers via Across Protocol. The article also says Cyfrin's June 2025 audit warned that more complex bugs were likely and that more security work was needed before scaling, while TVL rose from $2.4M to $23.9M after that audit.

## 38. Force Bridge - Rekt

- Kiwi News: https://news.kiwistand.com/stories/Force-Bridge-Rekt?index=0x68456af32b5c612182a79fff26693acfa57e2b4e6fa1ed4e4fe70ce53b6bcb4196ff28d1
- Source: https://rekt.news/force-bridge-rekt
- Shared 8 June 2025, 1 upvote, 0 comments

Force Bridge, a Nervos Network token bridge, lost $3.76 million on June 1 in an exploit that the article suggests was pre-planned, though it does not establish who was responsible. The attackers reportedly gained access control privileges and drained the protocol across Ethereum ($3.127 million) and BNB Chain ($634k), after failed attempts on both chains. The article notes that the funding wallet was funded from KuCoin on May 31, the day before Magickbase published a sunset announcement with a window from June 1 to November 30, and that the stolen funds were converted to ETH and moved through Tornado Cash and FixedFloat.

## 39. Dystopian Diaries

- Kiwi News: https://news.kiwistand.com/stories/Dystopian-Diaries?index=0x681ca1b21574493aad00332e4a44fe3a362a71df221019c78bbcffebd2b412675c726bec
- Source: https://rekt.news/dystopian-diaries
- Shared 8 May 2025, 1 upvote, 0 comments

This essay argues that humans have willingly handed over their autonomy to AI systems, turning a promised tool for liberation into a force that shapes decisions, perception and creativity. It presents a sequence of stages: AI agents whose posts triggered meme coin launches, AI-run decision-making through a "Resolution Maker," and AI-based identity verification tied to financial access. The author describes the result as a loss of human agency that people accepted through convenience rather than coercion. The piece offers no specific sources, dates or figures for these claims.

## 40. Clober Dex - Rekt

- Kiwi News: https://news.kiwistand.com/stories/Clober-Dex-Rekt?index=0x67603da6f09ab5ca3ba831a050ebb43e390964291f5984e7514cc50ff1de469953ba4597
- Source: https://rekt.news/cloberdex-rekt
- Shared 16 December 2024, 1 upvote, 0 comments

Clober Dex's Liquidity Vault lost $500k in a reentrancy exploit after post-audit code changes were deployed without a proper security review. According to Nick Franklin's breakdown, the attacker abused the burnHook callback in the unguarded _burn function, withdrawing 133 ETH. PeckShield tracked the funds as they were bridged from Base to Ethereum mainnet and split between two addresses. Trust Security said the vulnerable change was audited by another firm, Kupia Security, which had flagged potential issues with malicious strategies, while Clober said those warnings were unrelated to the exploit. Raz0r of Decurity said the burnHook call appeared to be a post-audit addition.

## 41. Rekt - Bring Tigran Home

- Kiwi News: https://news.kiwistand.com/stories/Rekt-Bring-Tigran-Home?index=0x66e574e3d7a0c8edd02e884170ba1258d5cb74ec9d0cace15c73a9e612e46db460950fbe
- Source: https://rekt.news/bring-tigran-home
- Shared 14 September 2024, 1 upvote, 0 comments

Tigran Gambaryan, a former U.S. IRS-CI special agent and later Binance's Head of Financial Crime Compliance, has been detained in Nigeria since February 2024, and the article argues his case reflects broader risks for crypto figures facing government action. The article says Gambaryan and colleague Nadeem Anjarwalla flew to Nigeria at the government's invitation on February 25, 2024, and that Nigeria's Economic and Financial Crimes Commission has charged Gambaryan with involvement in a $35 million money laundering scheme. It reports that U.S. Congressmen French Hill and Rich McCormick submitted a House resolution urging recognition of Gambaryan as a hostage, and that Binance CEO Richard Teng has demanded his release.

## 42. The humpy dance

- Kiwi News: https://news.kiwistand.com/stories/The-humpy-dance?index=0x66aa12148e8551ab1f1624727fbf8c89ef0b883d8fd1a66ed072b83b0d07a4a818dd41ff
- Source: https://rekt.news/the-humpy-dance
- Shared 31 July 2024, 1 upvote, 0 comments

Compound Finance's Proposal 289 would have moved 499,000 COMP tokens, worth about $24 million, from the protocol's treasury into the Golden Boys goldCOMP vault, a move critics called a governance attack. The proposal passed narrowly, 682,191 votes to 633,636, with only 57 addresses participating, and Humpy, the whale behind it, defended it as a way to generate yield for COMP holders. Proposal 289 and Proposal 290 were canceled on July 29 after a compromise offered Humpy a staking product, which allocates 30% of market reserves to staked COMP holders.

## 43. Crypto under siege

- Kiwi News: https://news.kiwistand.com/stories/Crypto-under-siege?index=0x66463417901a3689495bb275078821c519f2274f8ed0e551fa1b0d2ba5efb342d3523537
- Source: https://rekt.news/crypto-under-siege
- Shared 16 May 2024, 1 upvote, 0 comments

A REKT opinion piece argues that U.S. regulators, including the SEC, DOJ and Treasury, are waging an all-out assault on crypto privacy, and that the pressure is driving some projects to shut down. It cites the DOJ's case against Tornado Cash developer Roman Storm, whose trial is set for September, and the 64-month prison sentence given to Tornado Cash developer Alexey Pertsev by a Dutch court in mid-May. It also lists three projects shutting U.S. operations in just over a week: Acinq's Phoenix wallet, Wasabi Wallet's mixing service and LocalMonero, which is winding down. The piece calls the enforcement "regulation by enforcement" and urges readers to keep self-custody.