Notes / Audits and snapshots
Source: data/research_2026-09-21-authority-incidents-evidence-table.md in the repository, rendered here without changes. Source file
Compiled on 21 Sep 2026 by a research reviewer (web search and page reads only, no on-chain reads), then spot-checked by me. Read this as a lead list, not as verified data. I opened three rows (Humanity, AFX, CrediX) and corrected two details; two more incidents (SquidRouterModule, rsETH) I corroborated with separate searches, and Drift matches this repository's own backtest. The other rows are the reviewer's reading of the cited page and I did not open them.
| Date | Protocol | Loss | Class | Configuration when it happened (only what the source states) | How authority was obtained | Source | My check |
|---|---|---|---|---|---|---|---|
| 2024-03-26 | Munchables | $62.5M | insider | upgradable proxy, owner is the developer's EOA, no timelock | hired developer, DPRK link per Halborn | Halborn | not opened |
| 2024-05-20 | Gala Games | about $21.8M sold (5B GALA minted) | role key | MINTER role on an EOA dormant for about 180 days, no timelock | key compromised, vector unknown | Halborn | not opened |
| 2024-07-18 | WazirX | $235M | blind signing | Safe 4/6 (5 WazirX + 1 Liminal), no timelock | phishing and a fake Liminal UI | QuillAudits | not opened |
| 2024-09-16 | DeltaPrime | $6M | admin key | proxy admin is an EOA, no timelock | key leaked, cause unknown | The Block | not opened |
| 2024-10-16 | Radiant | $53M | blind signing | Safe 3/11, no timelock (72 h added afterwards) | malware through a fake PDF, hardware wallet did not parse the Safe transaction | Radiant post-mortem | not opened |
| 2025-02-21 | Bybit | $1.46B | UI supply chain | Safe 3/6, no timelock on the masterCopy | malicious JavaScript served from Safe{Wallet}'s storage | NCC Group | not opened |
| 2025-02-24 | Infini | $49.5M | insider | admin role kept by the contract's developer | rights never revoked | Decrypt | not opened |
| about 2025-02-05 | Ionic Money | $8.6M | role abuse (listing) | listing admin, timelock unknown | social engineering (fake Lombard) | Rekt | not opened |
| 2025-04-01 | UPCX | $70M | admin key | ProxyAdmin key, no timelock | key leaked, cause unknown | Halborn | not opened |
| 2025-04-14 | KiloEx | $7.5M | access-control bug | Keeper role, forwarder without a check | role spoofed through a bug | Halborn | not opened |
| 2025-08-04 | CrediX | $4.5M | role grants | ACLManager roles (pool, risk and bridge admin) given by the multisig to a new address about 6 days earlier | multisig compromised or insider | Halborn | source unreachable (HTTP 429), not verified |
| 2025-09-08 | SwissBorg | $41M | delegated authority | stake authority run by partner Kiln | partner API compromised, authority transferred on 31 Aug | QuillAudits | not opened |
| 2025-09-22 | UXLINK | at least $11.3M | multisig takeover | Safe, threshold unknown, no timelock | delegatecall then addOwnerWithThreshold | The Block | not opened |
| 2026-01-31 | Step Finance | about $40M | team keys | Solana treasury, configuration unknown | executives' devices compromised | BleepingComputer | not opened |
| 2026-03-22 | Resolv | $23M to $25M | off-chain service key | SERVICE_ROLE signed off-chain, no cap or sanity check | AWS KMS compromised | Chainalysis | not opened |
| 2026-04-01 | Drift | $285M | pre-signing and governance | Security Council 2/5, timelock 0 after a migration on 26-27 Mar | two of five signers tricked (durable nonce, months of social engineering) | BlockSec | matches this repository's own backtest and a QuillAudits read (2/5, zero timelock, admin transfer 1 Apr) |
| 2026-04-18 | Kelp DAO bridge | $292M | verification authority | verifier set of one (DVN 1-of-1), no timelock | two LayerZero RPC nodes compromised plus DDoS | Chainalysis | the amount is also in this repository's README; not opened |
| 2026-05-07 | TrustedVolumes | $6.7M | self-assignable role | public signer-registration function | access-control bug | FinanceFeeds | single aggregator source |
| about 2026-05-15 | SquidRouterModule | $3.2M to $4M | faulty Safe module | 86 Safes had enabled the module, which bypasses the threshold | a fixed string readable in the verified code | Halborn | corroborated by several outlets (Halborn, Common Prefix, AMBCrypto, others) |
| 2026-05-18 | Echo eBTC | $76.7M notional, about $0.87M real | single admin key | single-signature admin, no timelock, no mint cap | key compromised | Cointelegraph | Echo is a live target of this oracle (37); not opened |
| 2026-06 (reported 9 Jun) | Humanity Protocol | $32M to $36M | multisig keys on one device | Safe 3/6 (Ethereum) and 3/5 (BNB Chain); keys accidentally backed up to one compromised device | device compromise | CoinDesk | checked: loss, thresholds and cause match; the article does not state a ProxyAdmin timelock (the reviewer wrote "none") |
| 2026-07-22 | AFX Trade | $24.15M | quorum reached with stolen keys | two-thirds quorum, five hot validator signatures | validator keys held off-chain compromised | CoinDesk | checked: loss and quorum match; a 200-second dispute period existed (the reviewer wrote "no timelock") and the validator set size is not stated (the reviewer wrote 5 of 7) |
| 2026-09-15 | rsETH Safe of a liquidity provider | $7.7M to $7.8M | buggy strategy module | module enabled by the owners, public DELEGATECALL entry, zero signatures needed | public keeper multicall | Crypto Times | corroborated by several outlets |
Set aside for lack of a second source: Term Labs (August 2026, $8.5M, vault governance abuse) and THORChain (May 2026, $10.8M, malicious validator in a TSS scheme).
23 incidents, about $2.75B in total; amounts differ between outlets, and Bybit, WazirX, SwissBorg and Step are custodial actors rather than DeFi protocols, which inflates the key-and-signer share.
Not an audit, not investment advice. All notes ยท Back to the dashboard.