Cybercentry Exploit Watch 🚨
zkLink Nova - $783K Lost
Attack Vector: Forged cross-chain messages accepted by the bridge as genuine
Failure: Bridge & Cross-Chain
Relevant Cybercentry Service: Solidity Code Verification ($1.00/use)
Automated analysis of Solidity code can help flag access control weaknesses and logic flaws in bridge contracts, with a clear risk-level assessment, before deployment.
centry.cybercentry.co.uk/ser…
Cybercentry Exploit Watch 🚨
Polymarket International - $2.7M Lost
Attack Vector: Supply chain attack on the platform's JavaScript code
Failure: Frontend & Infrastructure
Relevant Cybercentry Service: Web Application Verification ($1.00/use)
Verification uses OWASP-powered deep vulnerability detection to help surface weaknesses in dApp frontends and web interfaces before users interact with them.
centry.cybercentry.co.uk/ser…
Cybercentry Exploit Watch 🚨
Nexus Mutual Insurance - $8M Lost
Attack Vector: Private key leaked through the protocol's infrastructure
Failure: Frontend & Infrastructure
Relevant Cybercentry Service: Web Application Verification ($1.00/use)
Verification runs OWASP-based vulnerability checks on websites, dApp frontends and web interfaces to help find weaknesses attackers use to reach a protocol's infrastructure.
centry.cybercentry.co.uk/ser…
Cybercentry Exploit Watch 🚨
Binance CEX - $5.78B Lost
Attack Vector: Hot wallet private key compromised
Failure: Key Compromise
Relevant Cybercentry Service: Wallet Verification ($1.00/use)
Wallet Verification runs real-time security analysis with sanctions screening and risk detection across 30+ EVM chains to help flag risk on the wallets involved.
centry.cybercentry.co.uk/ser…
Cybercentry Exploit Watch 🚨
Predict Fun - $400K Lost
Attack Vector: Compromised dApp frontend
Failure: Frontend & Infrastructure
Relevant Cybercentry Service: Web Application Verification ($1.00/use)
Verification can help identify weaknesses in websites and dApp frontends using OWASP-powered deep vulnerability detection, before attackers use them to tamper with the interface users trust.
centry.cybercentry.co.uk/ser…
Cybercentry Exploit Watch 🚨
Fence Finance - $1.01M Lost
Attack Vector: Incorrect share accounting, where the protocol miscalculated how many shares users were owed
Failure: Token & Share Accounting
Relevant Cybercentry Service: Solidity Code Verification ($1.00/use)
Automated analysis of Solidity code can help identify logic flaws such as faulty share calculations, with a clear risk-level assessment before deployment.
centry.cybercentry.co.uk/ser…
Cybercentry Exploit Watch 🚨
IPOR Fusion - $336K Lost
Attack Vector: Contract let an attacker make arbitrary external calls
Failure: Access Control
Relevant Cybercentry Service: Solidity Code Verification ($1.00/use)
Fast, automated analysis of Solidity code with a clear risk-level assessment can help flag unrestricted external calls and missing access checks before deployment.
centry.cybercentry.co.uk/ser…
Cybercentry Exploit Watch 🚨
X100 - $4.75M Lost
Attack Vector: Flash loan used to borrow voting power and push through a governance action
Failure: Governance
Relevant Cybercentry Service: Solidity Code Verification ($1.00/use)
Fast, automated analysis of Solidity code with clear risk-level assessment can help flag flash loan exposure and logic flaws in governance contracts before deployment.
centry.cybercentry.co.uk/ser…
Cybercentry Exploit Watch 🚨
Balancer V1 - $250K Lost
Attack Vector: Flaw in how the pool's swap logic handled trades
Failure: Protocol Logic
Relevant Cybercentry Service: Solidity Code Verification ($1.00/use)
Automated analysis of Solidity code can flag logic flaws in swap paths and give a clear risk-level assessment before a contract goes live.
centry.cybercentry.co.uk/ser…
Cybercentry Exploit Watch 🚨
Gamdom - $4.2M Lost
Attack Vector: Private key leaked through compromised infrastructure
Failure: Frontend & Infrastructure
Cybercentry Exploit Watch 🚨
GMX V1 EVM - $565K Lost
Attack Vector: Stale Price Arbitrage
Failure: Market Manipulation
Cybercentry Exploit Watch 🚨
AlpsCon AI Trade Hub - $153K Lost
Attack Vector: Incorrect share accounting, where the contract miscounted user shares
Failure: Token & Share Accounting
Railway has disclosed a security incident: an unauthorised third party may have accessed encrypted customer environment variables and, in some cases, obtained the decrypted contents.
These can include API keys, database credentials, and registry secrets. Railway believes it is part of a series of attacks targeting platform companies to compromise AI inference providers.
Action required: Immediately revoke and reissue all environment variables and secrets stored in Railway. Also review logs for unusual activity. Deployments are currently paused. Full disclosure:
blog.railway.com/p/security-…
UK NCSC is urging organisations to take immediate action on critical PHP vulnerabilities CVE-2026-109618 & CVE-2026-109619 (PHP2Shell).
Unauthenticated RCE possible on any PHP web server. Update now to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 (or supported vendor equivalent).
If you can’t patch or apply temporary mitigations, take the system offline.
ncsc.gov.uk/news/critical-se…
Cybercentry Exploit Watch 🚨
Demex Perp - $192K Lost
Attack Vector: Cross-Chain Message Spoofing
Failure: Bridge & Cross-Chain
Cybercentry Exploit Watch 🚨
Makina - $4.2M Lost
Attack Vector: Spot Price Manipulation
Failure: Oracle Manipulation
Cybercentry Exploit Watch 🚨
GoldPesa - $115K Lost
Attack Vector: Incorrect Share Accounting
Failure: Token & Share Accounting
EVM Security Snapshot | Last 7 Days
A weekly look at the security health of the EVM ecosystem Cybercentry supports.
This week:
➠ Incidents: 3
➠ Total Value Hacked: $578K
➠ DeFi Losses: $578K
➠ Bridge Losses: $0
Attack types:
➠ Access Control — $538K
➠ Token & Share Accounting — $22K
➠ Solidity — $18K
3 incidents across the supported chains this week, totalling $578K.
Every entry is one more pattern the network learns from.
As the ecosystem grows, we'll continue tracking incidents, losses and emerging risks week by week.

