October 2023 saw more déjà vu in Web3 security. A Fantom employee’s hot wallets were drained across chains for $7M. BlackHole and pSeudoEth repeated the burn-to-pump playbook. And uniclyNFT fell to another stale-reward reentrancy bug. These weren’t new attack types — they were unresolved patterns. Each one signals the same thing: most exploits are replays, not revelations.
On October 17th, the Fantom Foundation exploit on multiple chains resulted in a $7 million loss due to the compromise of private keys. The attacker created two malicious contracts and drained wallets 1, 16, 19, and 20 belonging to a Fantom employee on the Ethereum Mainnet, Fantom, and BNB chains. The Fantom Foundation has acknowledged the $7,078,184 hack and clarified that these wallets did not belong to the organization but to a Fantom employee.
Exploit Contract (Hot Wallet): 0x596288a9090c9eedf87bb5f2da5d8e1bbc7bb935
Transaction Hash: 0x799e6300bdef5733650f13a81513793654f7be4ea0408983c1cbec38ed6246f9
On October 11th, the BlackHole exploit on the BNB chain resulted in a $1.3 loss due to a price manipulation vulnerability. The root cause of the exploit was that the attacker was able to burn the BH tokens, reducing the total supply and artificially increasing the token price. The attacker first borrowed 773,800 USDT through flash loans and swapped the funds for BH tokens. The attacker then executed the burn() function and reduced the total BH token supply. The attacker then sold the BH tokens at an artificially inflated price and made a profit.
Exploit Contract (on BNB Chain): 0x55d398326f99059fF775485246999027B3197955
Transaction Hash: 0xc11e4020c0830bcf84bfa197696d7bfad9ff503166337cb92ea3fade04007662
On October 8th, the pSeudoEth exploit on the Ethereum Mainnet resulted in a $2.3K loss due to a price manipulation vulnerability. The exploit involved initially borrowing 51,970 WETH from Balancer’s Vault and then using these to swap for pEth tokens. The attacker then invoked pSeudoEth’s contract’s 0x387e() function, which included a tax amount that resulted in the burning of pEth tokens. This action reduced the pEth supply, subsequently driving up the token’s price, which the attacker then capitalized on by selling for a profit.
Exploit Contract: 0x62aBdd605E710Cc80a52062a8cC7c5d659dDDbE7
Transaction Hash: 0x4ab68b21799828a57ea99c1288036889b39bf85785240576e697ebff524b3930
On September 14th, the uniclyNFT exploit on the Ethereum Mainnet resulted in a $2K loss due to a reentrancy attack. The attacker began by depositing 3,528 uJENNY tokens into uniclyNFT’s PointFarm contract to accumulate rewards. Two days later, the attacker exploited the deposit() function, repeatedly minting rewards without settling their debt, as the user.rewardDebt amount was updated only after an external call. The attacker then used the rewards obtained to purchase a LootRealms NFT and subsequently listed it for sale.
Exploit Contract: 0xd3C41c85bE295607E8EA5c58487eC5894300ee67
Transaction Hash: 0xc42fe1ce2516e125a386d198703b2422aa0190b25ef6a7b0a1d3c6f5d199ffad