July 2026
Guru.fund $96K Vault Approval Exploit
Guru.fund, a delegated fund-management protocol on Ethereum, lost about $96K across seven transactions when a whitelisted deposit adapter let attackers make each vault approve and drain itself.
Read the full analysis →Verus Bridge $7.54M Forged Import Exploit
The Verus-Ethereum bridge was drained of $7.54M via a forged cross-chain import on July 23, 2026, two weeks after it refilled reserves recovered from May's $11.58M hack of the same import path.
Read the full analysis →DeFi Security Monitoring Tools Compared (2026)
How real-time DeFi security monitoring tools compare in 2026: enterprise platforms (Hypernative, Hexagate), inline firewalls (Forta Firewall, BlockSec), and self-serve machine-readable feeds (Defimon), by approach, coverage, integration, and pricing.
Read the full analysis →Automating DeFi Incident Response with a WebSocket Exploit Feed
A production integration guide for the Defimon WebSocket feed: raw vs confirmed streams, reconnect handling, filtering alerts against your contracts and exposure, and what to automate versus page a human for.
Read the full analysis →Ostium $23.75M Oracle Manipulation Exploit
Ostium, a perpetuals DEX on Arbitrum, lost $23.75M when an attacker with price-submission authority opened BTC longs at $5,000 and closed them near $60,000, draining the vault that backs every trade.
Read the full analysis →Bridge Exploits Explained: Why Cross-Chain Is DeFi's Weakest Link
How cross-chain bridges get drained: validator key compromise, message verification bugs, false deposit events and custody failure, from Ronin and Wormhole to Shibarium and KelpDAO.
Read the full analysis →Oracle Manipulation Attacks in DeFi: How Price Oracles Get Exploited
How DeFi price oracles get manipulated: spot-reserve pricing, missing update authorization, stale feeds and donation attacks, with real incidents and the on-chain patterns that expose them in real time.
Read the full analysis →Flash Loan Attacks Explained: How They Work and How to Detect Them
What flash loan attacks are, why the loan itself is never the vulnerability, and how exploits that borrow nine figures with zero collateral are detected on-chain within a second.
Read the full analysis →November 2025
Yearn yETH $9M Numerical Solver Exploit
Yearn's yETH weighted stableswap pool exploited through numerical instability in fixed-point iteration solver. Attacker collapsed product term to zero, switching pool to constant-sum invariant, then triggered arithmetic underflow to mint 2.35×10⁵⁶ LP tokens.
Read the full analysis →Balancer V2 $128M Rounding Exploit
Balancer V2 Composable Stable Pools exploited across multiple chains through rounding direction inconsistency in rate scaling logic. Attacker manipulated pool invariant to deflate BPT prices.
Read the full analysis →October 2025
Typus Finance $3.44M Oracle Manipulation Attack
Typus Finance lost $3.44M through oracle manipulation exploiting missing authorization check in custom oracle module. Attacker manipulated prices to drain TLP pool via arbitrage.
Read the full analysis →Abracadabra Money $1.8M Exploit - Logic Flaw Bypasses Solvency
Abracadabra Money's third exploit in two years. Logic flaw in CauldronV4 contracts allowed $1.8M unbacked MIM borrowing via status flag reset.
Read the full analysis →September 2025
NewGold Protocol $2M Flash Loan Attack - Triple Vulnerability Exploit
NewGold Protocol lost $2M through flash loan manipulation exploiting broken price oracle, faulty fee logic, and whitelisted dead address bypass.
Read the full analysis →Shibarium $3M Validator Compromise and Flash Loan Bridge Exploit
Shibarium bridge drained for $3M through validator key compromise and flash loan manipulation. Attacker controlled 10/12 validators to authorize fraudulent checkpoints.
Read the full analysis →Put the feed in your stack
Connect in minutes. Every attack across major chains, as JSON, in under a second.
@DefimonAlerts