Coinstats leaked keys to 1,510 wallets, costing users $2M. Velocore lost $6.8M to an unchecked feeMultiplier in its AMM math. Normie’s premarket whitelist logic let an attacker mint 650B tokens and dump them. Security assumptions shattered, again.
On June 22nd, the Coinstats exploit on the BNB chain resulted in a $2M loss. The root cause of the exploit was the compromise of private keys for 1,510 wallets. The exploiter drained funds from wallets that were created directly within Coinstats. The Coinstats team acknowledged the incident and confirmed no impact on externally connected wallets. Transactions were temporarily suspended for four days.
Exploit Contract (on BNB Chain): 0x53F7f5Ebc015ed0adE403b1392F1CBBa7D928c34
Transaction Hash: 0xc207f11df3dc69b0c3de97685c4698153c8e536fde398b7629c91596ed1a7a5d
On June 1st, the Velocore exploit on zkSync and Linea resulted in a $6.8M loss. The root cause was a logic bug in the ConstantProductPool contract, which lacked verification for the feeMultiplier parameter. This allowed anyone to manipulate the parameter, leading to incorrect fee calculations. The Velocore team acknowledged the incident and proposed a white-hat bounty reward to the exploiter. Linea briefly halted block production to mitigate further damage.
Exploit Contract (on Linea): 0x1d0188c4b276a09366d05d6be06af61a73bc7535
Transaction Hash: 0xed11d5b013bf3296b1507da38b7bcb97845dd037d33d3d1b0c5e763889cdbed1
On May 26th, the NORMIE exploit on the Base network resulted in a $882K loss. The root cause was the unauthorized minting of tokens. The attacker used flash loans to swap ETH for NORMIE tokens to equal the balance of the deployer address, thereby getting added to the _premarket_user list. Gaining permission as a premarket user allowed the exploiter to mint 650 billion NORMIE tokens. The Normie team acknowledged the exploit and offered a white hat bounty.
Exploit Contract (on Base): 0x7f12d13b34f5f4f0a9449c16bcd42f0da47af200
Transaction Hash: 0xa618933a0e0ffd0b9f4f0835cc94e523d0941032821692c01aa96cd6f80fc3fd