Open in app

Sign in

Write

Sign in

Week 72 — SEC Backs Down, TON’s Hype, LayerZero’s $ZRO Airdrop & CertiK-Kraken $3M Controversy

QuillAudits - Web3 Security 🛡️
7 min read1 day ago

--

Week 72 — SEC Backs Down, TON’s Hype, LayerZero’s $ZRO Airdrop & CertiK-Kraken $3M Controversy

​

GM! Buidlers

In this latest HashingBits issue, we’re diving deep into Ethereum’s Core Developers meetings, covering all the major updates in the Ethereum ecosystem. But that’s not all, we will dive into what’s happening in TON, LayerZero, Polygon, Solana & Near ecosystems, along with recent advancements in the AI & Web3 space. For developers, we’re highlighting new updates in tools designed to assist Smart contract developers and auditors. And, of course, we’re also digging into the headlines about CertiK’s controversial $3M white-hat hack on Kraken & Hologram’s $14.4M breach by a former contractor.

EtherScope: Core Developments 👨‍💻

Layer1 & Layer2

ERCs

EIPs

EcoExpansions: Beyond Ethereum 🚀

TON

LayerZero

Polygon

Solana

NEAR Protocol

DevToolkit: Essentials & Innovations 🛠️

Hackathons, Workshops & Events

Explore the Depths of Knowledge: Research Papers, Blogs and Tweets🔖

Twitter

Articles

Research Papers

Github

Watch 🎥

​

Web3 Security Watch 🛡️

Articles

Research Papers

Twitter

Hacks and Scams 🚨

Certik/Kraken Exploit (Loss ~ $3M)

  • Kraken accused security researchers of extortion following a $3 million bug bounty exploit.
  • CertiK, the cybersecurity firm, discovered and reported a critical vulnerability in Kraken’s system.
  • Kraken allegedly responded by threatening CertiK employees and making unreasonable demands, as claimed by CertiK.
  • The dispute escalated publicly, with both sides accusing each other of unethical behavior.
  • Kraken fixed the reported bug within an hour and 47 minutes, but CertiK found additional severe vulnerabilities.
  • CertiK claims Kraken demanded repayment of crypto without providing wallet addresses.
  • CertiK went public to protect users, asserting they followed responsible disclosure practices.
  • The exploit allowed over $3 million to be withdrawn from Kraken’s wallets over five days.
  • CertiK claims the funds were for testing purposes, and no real user assets were involved.
  • Kraken requested the return of funds, but researchers demanded a speculative ransom.
  • Three transactions from the testing address were deposited to Tornado Cash, raising legal concerns.

Holograph (Loss ~$14.4M)

  • The Omnichain NFT protocol Holograph was exploited by a former contractor, resulting in a loss of approximately $14.4 million.
  • The contractor exploited an infinite mint vulnerability in their smart contract, minting an additional 1 billion HLG tokens, which were then dumped on the market.
  • This malicious actor had funded the operator contract roughly 26 days before the attack and deployed an unverified contract on Mantle.
  • The unverified contract was used to mint the additional tokens through a function that exploited the protocol’s verification method.
  • The 1 billion HLG tokens were then bridged to Ethereum and sold on various exchanges.
  • In response, Holograph has temporarily locked down the protocol and is working with security experts to prevent similar exploits in the future.
  • The malicious actor’s exchange accounts have been frozen on Bybit, Gate, KuCoin, Bitget, and Backpack.
  • At least 200 million of the additional HLG tokens have been frozen.
  • As a precaution, these exchanges have also temporarily suspended all HLG deposits and withdrawals.
  • Moving forward, a third-party audit of the protocol will be conducted.

Community Spotlight

Hashingbits
Web3 Security
Ai Agents Army
Quillaudits
Ton

--

--

QuillAudits - Web3 Security 🛡️

Written by QuillAudits - Web3 Security 🛡️

950 Followers

Building the QuillAI Network: AI Agents Safeguarding Web3. Leading Smart Contract Audit Firm with $30B+ secured. Join our security squad builders 🛡️

Help

Status

About

Careers

Press

Blog

Privacy

Terms

Text to speech

Teams